Managed
We run it for you.
Spin up a fully managed PostgreSQL cluster — high availability, backups and monitoring included. More engines on the way.
PostgreSQLHigh availabilityBackups
Database control plane — private beta
The control plane for your data.
Provision, manage and monitor your databases — and govern who connects. Every developer gets access by identity, with sensitive data masked and every query on the audit trail.
scroll
What is Relay
A platform for your databases — and the people who connect.
Relay provisions, manages and monitors your databases. And when a developer, analyst or teammate needs to query one, Relay secures that access by identity — masking sensitive data per person and auditing every query. It governs the people who connect, not your apps.
Named users
developers · analysts · support
developerid
analystid
supportid
Relayplatform
Access
identity · masking · audit
Fleet
provision · monitor · backups
Your databases
provisioned · managed · monitored
pg-prodhealthy
mongo-euhealthy
Named users
People connect by name — not your apps. Every developer, analyst and teammate carries an identity Relay recognizes before a single query runs.
Relay
Relay sits in the middle. It authenticates each identity, masks sensitive columns per person, and audits every query that passes through.
Your databases
Postgres and Mongo that Relay provisions, manages and monitors — reached only through Relay, never connected to directly.
Three ways in
Get a database, your way.
However your data needs to live, Relay runs it.
Bring your own
Connect what you already run.
Register an existing database wherever it lives. Relay adds identity, masking and audit — without moving your data.
RegisterNo migrationYour infra
Your cloud
Your account, we operate.
Relay provisions into your own AWS or GCP account and runs day-2 for you. You keep ownership, we keep it healthy.
AWSGCPYou own it
AI-powered masking
Give access. Don’t give away your data.
When you hire your first analyst, support agent, or contractor, they need to query production. Relay’s AI automatically detects sensitive columns — PII, secrets, financials — and masks them per-column based on identity: your admin sees real values, your developers see masked ones, your auditor sees nothing.
select * from users
viewing as
| user | phone | card | ssn | |
|---|---|---|---|---|
| alice | alice@acme.io | +1 415 555 4821 | 4242 4242 4242 4242 | 078-05-1120 |
| marcus | marcus@acme.io | +1 312 555 7727 | 5500 0000 5555 5559 | 141-92-7731 |
| priya | priya@acme.io | +44 7700 900812 | 3782 822463 10005 | 205-31-6649 |
Same query — Relay masks per identity, at the wire protocol.hover a masked cell to peek the raw value
Go global when you need it
Multi-region, multi-cloud — when you choose it.
Clusters start in one region. When you need global reach, flip it on: pick regions across AWS, GCP and Azure and Relay places electable nodes, read replicas and failover for you.
orion-prodprovisioning cluster
3
clouds
6
regions
0
nodes
awsus-east-1electable
awssa-east-1read-only
gcpeurope-west1electable
gcpasia-northeast1read-only
azuresoutheastasiaelectable
azureaustraliaeastread-only
Single-region by default. Go global in a few clicks — Relay handles the topology.
Runs the fleet
Scales and heals on its own.
Relay watches every cluster and keeps it healthy — so you don't get paged.
Auto-scaling
Storage, compute and read replicas grow with load — no manual resize, no downtime.
storagecomputereplicas
Backups & PITR
Scheduled backups and point-in-time recovery, ready before you ever need them.
scheduledPITR
Monitoring & health
Live metrics, health checks and automatic failover — Relay reacts before you do.
metricshealthfailover
AI agent for DBAs
An AI agent that handles the database busywork.
Relay’s agent does the work a DBA would: it reads your schema, flags what’s sensitive, and drafts the masking and access policy. You review and approve from the CLI or dashboard — Relay applies it and keeps the audit trail.
Classify
Reads your schema and tags PII, secrets, and financial columns — no manual lists to maintain.
Draft
Proposes per-role masking and access grants from what it found — ready for you to review.
Approve
Nothing changes until you sign off, from the CLI or the dashboard.
Audit
Then logs every query against the identity that ran it — who saw what, and when.
relay agentpg-prod
you
Give the support team read access to users, but hide anything sensitive.
→classified 4 sensitive columns in users
emailphonecardssn
click a step — or watch it runauto
Preview — today you drive Relay from the CLI and dashboard.
What you get
One control plane. Three layers.
Connections, a wire-protocol security layer, and self-hosted agent pools — three facets of one product. They work together because they're built together, around a single proxy.
Connections
Your clusters, one control plane.
Provision a new PostgreSQL instance or register the MongoDB you already run — wherever it lives. Relay holds the credentials, your team gets a single endpoint that respects identity, role, and policy.
- Provision & manage PostgreSQL, or bring your own MongoDB
- Self-host the agent on any cloud or on-prem
- Identity-tied — Google OAuth becomes the database login
- Connection groups — scope by team and environment
Security layer
Your data protected, transparently.
The agent speaks the database wire protocol natively. AI flags the sensitive columns, they get masked before they leave the agent, queries get logged with the identity that ran them, and your app never sees a different driver.
- Wire-protocol level — standard clients and ORMs unchanged
- AI-classified columns, masked: redact, hash, partial, passthrough
- Per-team and per-role access grants
- Identity-tied audit trail (Google OAuth)
Agent pools
Run where your data lives.
Group lightweight agents into pools — one per region, one per VPC, one per environment. The agents sit next to your databases. Your data plane stays inside your network; only encrypted control traffic crosses the boundary.
- Self-host the agent — anywhere a container or process can run
- Pool by region, VPC, or environment — your call
- mTLS by default — credentials never leave the pool
- Client identity extracted from mTLS certificate
From zero to query
Three commands. Done.
There’s no setup ceremony. Provision, grant access, connect — that’s it. New teammate? They run one command and they’re in, with the right masking applied automatically.
Register
Provision or connect.
$relayconnections create
Provision a fresh PostgreSQL instance, or point Relay at the MongoDB cluster you already run. Credentials are stored in the vault and never exposed to end users.
Grant
Define who sees what.
$relaygrants create
AI flags the sensitive columns; you set per-column masking and per-role grants. Every query inherits the policy of the identity running it.
Connect
Use the client you already have.
$relayconnect pg-prod
A local port comes up. psql, mongosh, DBeaver, your ORM — all work unchanged.
Multi-engine, multi-cloud
No vendor lock-in. By design.
Relay speaks PostgreSQL at the wire protocol, so psql, your ORM and every client connect unchanged. More engines are on the way. Run the agent next to your databases — no SDKs, no driver swaps, no app changes.
Database engines
PostgreSQL today. More on the way.
PostgreSQLProvision & manage
Upcoming
MongoDBMySQLValkeyScyllaDBSQLiteCassandra
Native wire-protocol implementation — no database driver dependencies.
Run the agent
Run where you already run.
Amazon Web ServicesEC2 · ECS · EKS
Google CloudGCE · GKE
Microsoft AzureAKS · VMs
On-prem / bare metalDocker · systemd
One lightweight agent. Anywhere a container or process can start.
For platform & security teams
Built for the security review.
When your security team asks how database access actually works, you have answers — not a Slack channel of one-off scripts. Identity-tied audit, role-based access, and team-scoped grants come standard.
Audit log, by query.
The agent emits one event per connection and query — identity, source, columns touched, what got masked. Append-only JSONL you can ship anywhere downstream.
JSONLAppend-onlyIdentity-tied
Teams & roles, scoped.
Connection groups, team grants, environment scoping. Owner / Admin / Member / Viewer roles baked in. Sign in with Google.
Google OAuthRBACConnection groups
No security theater.
mTLS in flight. Masking enforced inside the agent — sensitive bytes never leave it unmasked. No app-side trust required, no SDK to import.
mTLSAI maskingNo app-side trust
Three ways in
Whoever you are, start where you are.
Whether you’re shipping your first MVP solo, growing a team past five, or running a platform with hundreds of databases — Relay scales with you. Same product, different defaults.
For indie hackers
Ship fast. Without shipping a leak.
The day you give your first contractor access to production, masking is already wired in. Define a grant, share the connection name — they connect with their own client and only see what their role allows.
Get early access →For growing teams
Grow the team. Not the blast radius.
Your support team needs queries. Your analysts need real numbers. Nobody needs raw PII. Per-column masking and per-query audit make that the default, not the exception.
Get early access →For platform engineers
Centralize the chaos. Keep the autonomy.
One control plane across PostgreSQL and MongoDB. Self-host the agent pools next to each environment. Drive everything from the CLI or the dashboard.
Get early access →Early access
Get early access.
Connections, agent pools, column-level masking, and per-query audit are live — provision PostgreSQL or connect your existing MongoDB, with more engines on the way. Drop your email and we’ll reach out as slots open up.