Is it safe to forward support email to Slack?

What RelayMail can see

RelayMail never connects to your mailbox. It has no password, IMAP login or OAuth token for it, so it cannot read anything in your inbox, sent mail or folders. It only receives the messages your provider forwards to your RelayMail address, and deleting that forwarding rule stops all mail to it.

Forwarded emails arrive through Resend, the email provider RelayMail uses to receive and send mail, and replies from Slack go out through Resend too.

What RelayMail keeps

Email bodies are posted to your Slack channel and not kept on RelayMail's servers. To put a customer's next email in the right thread, RelayMail keeps a short record per conversation: the message ID, the sender's address, the subject and the Slack thread it belongs to.

That record is deleted within 30 days after you delete the inbox or the subscription ends, or sooner if you ask at hello@greatwork.company. Attachments are passed through to Slack or to the customer, not stored.

Who can read the emails in Slack

Once an email is posted, it is a Slack message in the channel you picked. Everyone in that channel can read it, and it follows your workspace's retention settings, not RelayMail's. A private channel limits who sees it; RelayMail joins a private channel only after someone invites it.

Who can send replies is a setting on the inbox: anyone in the channel, only admins, or named people. A thread message that starts with // or an @mention stays in Slack as a team note and is never emailed.

How RelayMail is run

RelayMail runs on servers at DigitalOcean in the United States, under its own unprivileged account. Server logins use SSH keys only, and root login is turned off. Every page and API is served over HTTPS.

Requests from Resend, Slack and Stripe are checked against their signatures, and anything that fails the check is refused. The services involved are Resend (receives and sends the email), Slack (stores the messages and files posted to your channel), Stripe (payments; card numbers never reach RelayMail), Google Analytics (visits to relaymail.app only, never email content) and DigitalOcean (hosting).

RelayMail has no SOC 2 report or other third-party audit. If your team has a security questionnaire, send it to hello@greatwork.company and we will answer it. Security problems go to the same address, which is also listed at relaymail.app/.well-known/security.txt.

When email in Slack is the wrong fit

Some organizations should not put customer email in Slack at all. Slack's own help article says that HIPAA-compliant Enterprise organizations cannot send emails to Slack. If your email carries data with rules like that, check them before forwarding anything, and keep that mail in a system built for it.

Questions