Zero-Retention & Envelope-Encrypted by Design
Sentry Relay was architected from line one so autonomous agents can securely navigate authentication challenges without creating toxic data liabilities.
Google Cloud KMS Envelope Encryption
Every workspace has an isolated Data Encryption Key (DEK) wrapped by a regional Cloud Key Management Service (KMS) Key Encryption Key (KEK).
When a TOTP secret is vaulted, it is encrypted via AES-256-GCM context-bound to workspaceId:identityId:secretId as Additional Authenticated Data (AAD). If an attacker attempts to alter any parameter or swap identities, decryption fails cryptographically.
Zero Raw PII Storage & Auto-Purge
We never write inbound email bodies, SMS message bodies, or passwords to persistent disk or databases.
Inbound payloads are parsed entirely in memory and extracted codes are placed into Upstash Redis with a strict 60s Time-To-Live (configurable up to 600s). With Burn-After-Read enabled, tokens are atomically removed the microsecond your agent claims them.
Deterministic Non-LLM Hot Path
Zero third-party LLMs or external inference APIs are invoked during OTP extraction.
Your verification codes and magic links are extracted via a 5-stage deterministic engine in <8ms. This eliminates prompt injection risks, ensures 100% predictable parsing, and guarantees your data is never used to train machine learning models.
Carrier Compliance & Anti-Abuse
Sentry Relay provides dedicated US local virtual carrier numbers via Telnyx strictly for receiving inbound 2FA verification challenges.
Numbers are strictly inbound-only; outgoing spam or bulk marketing messages are prevented by design. Inbound voice calls are forwarded cleanly via TeXML <Dial> directly to verified human operator numbers.