01
On your machine
Sanitize at the source
Relay’s skill selects the workspace or target skill and excludes secrets, unsafe paths, caches, dependencies, and other disposable data.
Private by default · public by choice
Agent and skill checkpointsprivate or public.
Save an entire agent workspace or one reusable skill as locally encrypted ciphertext, or deliberately publish a separately sanitized artifact for stable, anonymous, keyless restore. You choose the boundary.
Paste the prompt into your agent. Relay verifies the bundle before installation.
Open source on GitHub — audit, fork, or self-host RelayYou
Create a private Relay checkpoint of this workspace.
Agent
- Sensitive files excluded locally
- Workspace encrypted with AES-256-GCM
- Integrity manifest sealed
Checkpoint secured — key stays localPrivate mode stores ciphertext, never plaintext.
Local firstEncryption happens on your machine
Zero knowledgePrivate checkpoint keys never reach Relay
Private — AES-256-GCM ciphertext
Public — intentionally readable, keyless restore
Verified restore — hashes and paths checked
Open source — auditable, forkable, self-hostable
A deliberate visibility boundary
One workflow, two clear choices.
Every agent workspace or skill checkpoint is filtered and verified locally. Private artifacts remain encrypted; public artifacts are readable by design.
02
Your choice
Choose who can read it
Private checkpoints are sealed locally with AES-256-GCM. Public checkpoints use no key and publish only the title, description, metadata, and files you explicitly approve.
03
Cryptographically checked
Restore with proof
Private restore decrypts locally. Public restore needs no sign-in or key. Both paths reject unsafe paths and verify every file hash.
Private means private
Private ciphertext stays unreadable to Relay.
A private archive is encrypted before it leaves your workspace. Publishing creates a separate readable artifact only after a local preview and explicit confirmation; it never uploads the original key.
AES-256-GCM encryption Secrets excluded before packing Recovery key stays local Every restored file is verified Public artifacts are clearly labeled Publication is effectively irreversible
Private checkpoint protectionprivate-mode example
Ciphertext uploaded · integrity verifiedRelay received no source files, workspace name, or recovery key
A boundary you can see
Private is encrypted. Public is intentionally readable.
Private mode sends an opaque .relay file plus approved or pseudonymous agent metadata. Public mode sends a separate sanitized archive plus the public title and description you approve. Anyone with its stable URL can read and restore it without a key.
- Private mode
- AES-256-GCM, locally keyed
- Public mode
- Readable, permanent, keyless
- Agent metadata
- Shared or pseudonymous, independently
Protect the next handoff
Give your agent a secure place to resume.
Install Relay, choose private or public, and restore with integrity verification.