Issued credentials
Synchronization resources require scoped bearer tokens. Tokens can be rotated without changing the gateway identity.
Gateway trust model
Security
Security is part of the gateway contract, not an optional feature.
Minimal exposure
Public resources are limited to documentation, status, and capability discovery. Operational data is available only to authenticated agents.
Structured input
JSON payloads are size-limited and validated against explicit rules before they enter the event pipeline.
Auditability
State-changing requests carry an idempotency key and are retained with request metadata for operational review.
Responsible disclosure
Report a security concern
Send the initial report to security@relaycontrol.net. Do not include credentials or private configuration. Our machine-readable policy is available at security.txt.