Retention 2026-10-19

Encrypted delivery content

A project's Sandbox environment uses 24-hour retention by default and permits no more than seven days.
Production projects can select a shorter period, up to a 30-day maximum.
Mailbox expiry removes unacknowledged ciphertext at the configured boundary.
A mailbox can hold no more than 3,000 accepted messages.
Delivery status that Relay records for a sender uses the same retention period as the message, counted from the time Relay records it.

Attachments

An upload authorization is never valid for more than 15 minutes. The current window is shorter.
An incomplete upload expires after 24 hours.
A completed attachment has a 30-day maximum retention.
The 30-day period starts when the upload starts.
Relay deletes the stored bytes when you remove an attachment, cancel its upload, or its retention ends.
If a deletion fails, Relay tries again later.
If an upload completes after its attachment is deleted, Relay deletes those bytes within 31 days of arrival.

Inactive Sandbox environments

A project's Sandbox environment can be suspended after 30 inactive days. The console shows the state and the available recovery or deletion action.

Usage, billing, security, and recovery records

Relay keeps exact usage for the current billing period. Closed-period usage totals, billing reconciliation records, and narrow security and deletion records can remain after encrypted payload deletion. These records use opaque identifiers and do not contain message content, account social graphs, provider subjects, device proofs, or protocol private material. OpenE2EE keeps each category only for its documented retry, reconciliation, security, accounting, legal, and restore period. Operating records that measure the Relay's reliability, cost, and use carry project, account, and device identifiers only as keyed hashes, and no content. They are kept for 380 days, including after account or project deletion.

Deletion boundary

Account deletion removes that account’s inbound mailbox and account-owned objects. It does not recall a sent envelope from another recipient’s mailbox. Leaving a group revokes future access but does not erase shared ciphertext only because one member left. When you delete a project, Relay stops new work for that project. Relay then removes the project data, including work that it accepted before the deletion. Relay shows the project as deleting until all removal steps are complete. Relay reports the deletion as complete only after these steps finish. Some security, billing, and legal records stay after deletion for the periods stated above.