STAGING — production claims do not apply here
Closed alpha intake is paused while the forwarding gate is completed.
SciRelay

Trust

Trust begins with saying exactly what happens.

SciRelay handles a sensitive thing: the route by which people reach you. This page separates product intent, technical facts, and limits without pretending they are the same.

The SciRelay Continuity Charter

  1. An activated alias is never reassigned to another person.
  2. A core forwarding route is not held hostage by a later paid upgrade.
  3. Users control and can change their verified destination.
  4. SciRelay does not sell personal data or correspondence data.
  5. Forwarded message bodies and attachments are not intentionally stored in the SciRelay application database.
  6. User profile and account data remain exportable in machine-readable form.
  7. Verification labels state only what was actually checked.
  8. Public profiles and search indexing require user choice.

What SciRelay stores

SciRelay stores the account identifier, alias, encrypted destination address, profile fields, affiliation records, consent history, and limited operational events. Operational events do not include the sender address, subject, message body, attachment, or full message identifier in the SciRelay application database.

What processes a forwarded message

Cloudflare Email Service receives the message for the SciRelay domain and passes it to a routing Worker. The Worker looks up and decrypts the verified destination, then asks Cloudflare to forward the message. The destination email provider receives and stores the message according to that provider’s terms and settings.

SciRelay does not intentionally parse or store the body or attachments of forwarded messages in its application database. This is not end-to-end encryption: Cloudflare and the destination provider process the message, and operational email logs may contain delivery and authentication metadata.

Encryption at rest

Destination, recovery and temporary verification email addresses are encrypted at rest with AES-256-GCM. A separate keyed blind index is used to detect duplicate addresses without querying by plaintext. Encryption keys are stored as Worker secrets, not in the database or source repository.

Retention and deletion

Forwarded message content
Not intentionally stored in the SciRelay application database or logs.
Destination history
Retained while the account exists so route changes and the seven-day rollback window can be operated safely.
Verification challenges
Expire after their short verification window; only keyed challenge hashes are stored for email codes. Public passkey challenges are short-lived.
Account security activity
Action names and times are retained for 90 days; aggregate security counts and pending security notices for 30 days. Account activity does not contain email message content, addresses, authentication codes or tokens.
Account deletion
Starts a 30-day recovery period. Finalization deletes linked personal account data while preserving the activated alias as an unassigned tombstone so it is never recycled.

Verification meanings

Independent account access
Account access uses a passkey with device verification. Recovery requires a verified recovery email and a saved one-time recovery code. This does not verify legal identity, qualifications, employment, or researcher status.
Destination verified
The account demonstrated control of the inbox currently used as its forwarding destination.
Email-domain verified affiliation
The user demonstrated control of an address on an accepted organization-associated domain at the recorded time. It does not prove position, title, employment dates, continuing employment, or endorsement by that organization.
Previously email-domain verified
The affiliation was email-domain verified on the displayed date and is no longer marked current.
Self-reported affiliation
The account holder entered this information and SciRelay did not verify it.
Independent researcher
The account holder chose not to list a current organization.

Service limitations

Email can be delayed, filtered, rejected, or placed in spam by sending and receiving providers. SciRelay cannot guarantee inbox placement or uninterrupted operation. Messages above 25 MiB, including attachments, are rejected. v0.1 does not let users send from their SciRelay address.

Security contact

Found a security issue? Contact security@staging.scirelay.com. Do not include sensitive message content unless necessary to explain the issue.

Independence

SciRelay is an independent service. ROR data is used to standardize organization selection; ROR does not verify SciRelay users.