Groups and attachments
Shared encrypted group bodies, bounded fan-out, and private encrypted attachment lifecycle.
Relay treats group bodies and attachments as ciphertext. Devices create the encrypted content and retain the keys needed to open it.
Group fan-out
A group send stores one encrypted shared body for all destinations. Each destination mailbox receives a reference to that body and an encrypted recipient prefix. Delivery can complete after the send request returns. Delivery is at least once. Each retry keeps the same message identifier, so a device can discard a duplicate. A destination counts as delivered only when its mailbox accepts the reference.
The group body limit is 96 KiB. Each destination prefix is at most 512 bytes. One send supports up to 5,000 destination devices. Relay tries to deliver a send to 100 or fewer devices before the request returns. Relay delivers a larger send after the request returns. Relay records a delivery unit only for each destination mailbox that stores its reference.
Attachments
An attachment upload is one accepted upload authorization for one stable SDK request identifier. An exact retry does not count again. Attachment uploads are a hard plan cap and have no overage.
The upload capability authorizes one exact private object key, expected size, and digest. Its URL is valid for no more than 15 minutes. An incomplete upload expires after 24 hours. Completion succeeds only when exact size and digest metadata match.
A completed attachment has a 30-day maximum retention, counted from when its upload starts. The project can select a shorter value. Relay deletes the stored bytes when you remove the attachment, cancel its upload, or its retention ends. If a deletion fails, Relay tries again later. If an upload completes after its attachment was deleted, Relay deletes those bytes within 31 days of their arrival.
Storage accounting
Storage counts the live bytes of retained mailbox ciphertext, group ciphertext, and completed attachments. It also counts the expected bytes of some removed or canceled attachments. This applies when the upload started and its completion was not yet confirmed. Those bytes stay in the project storage for 31 days after the removal and then leave it. Relay's own metadata and accounting records do not count toward your storage. Paid storage usage integrates exact byte changes over time, including objects that cross a UTC month boundary.