OpenE2EE Relay
Device lifecycle and recovery
Linking, unlinking, provider migration, total-loss recovery, and deletion boundaries.
One Relay account supports up to five active devices. Each device has its own registration, prekeys, sessions, mailbox generation, and push registration.
Link and unlink
The existing device authorizes a short-lived encrypted linking session. The new device receives account identity material, not existing sessions or message history. Relay allocates the device slot and binds it to the verified account. Clients cannot select another account's slot.
Unlinking revokes the device, advances the affected delivery authority, and prevents the old mailbox generation from receiving new work. It does not recall messages that another device already decrypted.
Total-loss recovery
Total-loss recovery creates a new recovery generation after the configured recovery proof succeeds. Old credentials, capabilities, mailbox tokens, certificates, and restored pre-recovery state fail closed. Recovery does not recreate missing message plaintext or device-local sessions.
Deletion
Project and account deletion first write the monotonic security-journal fence. Relay then removes the owning mailboxes, encrypted objects, group access, plan and spend authority, and provider registrations. A sent envelope in another recipient's mailbox is not recalled. Only the bounded records required for billing, disputes, and the deletion fence remain under their separate retention contracts.
Read limits, billing, and operations before production activation.