Frequently asked questions

What is Relayrix?

Self-hosted integration and automation software that moves critical data between systems — in real time as each file arrives, or on a schedule you control.

Do I need WinSCP, FileZilla or WS_FTP?

No. Relayrix connects to your servers by itself — SFTP, FTPS, FTP, WebDAV, HTTP(S), Amazon S3 and Windows file shares (SMB). If a partner runs a WS_FTP server, Relayrix connects to it like any other SFTP or FTP server, so there's no client tool to install or script around.

Can it replace Task Scheduler and our transfer scripts?

Yes. A typical setup leans on three separate pieces — Windows Task Scheduler, a .bat file and an SCP or WinSCP script — and if any one of them breaks, files stop moving, often without anyone noticing. Relayrix is one app that schedules, transfers, checks and alerts, so when something goes wrong you hear about it right away.

Can files move in real time, or only on a schedule?

Both, and it's a setting on the pipeline rather than a different product. Pick Watch folder as the trigger and Relayrix moves each file as it appears instead of waiting for the next scheduled run.

How fast depends on where the file lands. A folder on your own machine or network share is event-driven — the operating system tells Relayrix the file is there, so the transfer starts immediately. A partner's SFTP, FTPS, FTP, WebDAV, HTTP(S), S3 or SMB server has no way to announce a new file, so Relayrix holds the connection open and checks as often as every second; in practice a file moves within a few seconds of arriving. You choose the cadence, from one second to one minute.

Two things it deliberately does not do. It won't pick up a file that is still being written — it waits for the file to stop changing first, so you never send half a batch and record it as a success. And it won't fill your history with noise: a check that finds nothing writes no run at all, and a server outage raises one alert rather than one per check. If the app is restarted, anything that arrived while it was down is picked up as soon as it comes back.

The one exception is a source that runs a database or MongoDB query. There is no arriving file to watch for, so those run on a schedule.

Where do I set the folder a transfer reads and writes?

On the connection, once. A connection holds everything needed to reach a place — the server, the credentials, and the Default folder it works in — and a pipeline simply picks it. The pipeline builder does not ask you for a folder again; it shows you the one on the connection you chose, so what a transfer will do is visible before you save it.

A Browse button beside the field lists the folders that are really on the far side, so you can click through to the right one instead of typing a remote path from memory.

If the same server holds two feeds in two folders, make it two connections and name them for the job — Partner A (results) and Partner A (eligibility). Change the folder in one place and every pipeline using that connection follows, including anything already watching it in real time.

How is it licensed?

An annual subscription — or a 14-day free trial first, if you would rather try the full product before buying. Either way, each license runs on one computer, and having one is what opens up the installer download. When you install, the app shows that computer's Server ID — enter it in My Account → License & app and your signed key is issued on the spot.

Moving to a new server later is self-service, from the same page.

Is there a free trial?

Yes. Create a free account, then start a 14-day trial from My Account → License & app — no credit card. It runs as the full product: nothing is withheld and nothing is charged unless you decide to buy. One trial per account.

You will see a banner in the app three days before it ends, but no email — trials are never emailed about. If it lapses without a purchase, the app goes read-only the same way an expired subscription does (see below): you can still sign in and export your data, but transfers pause until you buy a license.

What do I need to run Relayrix?

Docker, and a machine with 2 CPU cores, 2 GB of RAM and 10 GB of free disk. That's it.

Your operating system doesn't matter. Linux, Windows, macOS, a VM on the host you already run, or any cloud. If your IT team can run Docker, they can run Relayrix.

On Windows Server there's a native build instead — a normal .exe that runs as a Windows service and stores its data in your own SQL Server, so your DBA's existing backups cover it. Windows Server 2019 or later.

How long does setup take?

Installing takes about an hour, on Windows Server or Docker. Each transfer job then takes about 15–30 minutes to set up and test, and most teams have their current jobs running within a day or two — well inside the 14-day trial.

Which build do I get, and can I change my mind?

Both. One license covers the Docker image and the Windows installer.

Your key is issued for one computer, though, so switching builds means activating the new install with its own Server ID — a self-service move from My Account. And your data doesn't move between them — each build keeps it in a different place and there's no import. Worth picking the one you intend to keep and starting there.

Is my data sent to Relayrix?

No — and there is nothing in the product that could send it. Relayrix runs on your own infrastructure, and it doesn't phone home: no usage reporting, no crash reporting, no analytics, no update check. Those aren't settings switched off by default; they were never built.

The only connections Relayrix opens are the ones you configure — your trading partners' servers, your own mail server for alerts, and a chat webhook if you set one up. Files go where your pipelines send them and nowhere else. Even the interface pulls nothing from the internet: no third-party fonts, scripts, or trackers. If you turn on the server mode add-on, your partners connect in to the port you choose — that still sends nothing to us.

Does Relayrix need internet access?

The app itself doesn't. You need internet to download the installer and to manage your subscription in a browser, but neither of those is the app reaching out — you do them from any machine you like, and paste the license key in.

Installing doesn't need it either. The download is the whole application, already built. You load it from the file and start it — nothing is fetched, downloaded or compiled on your network while it installs. So the server you install on can be cut off from the internet before the file even reaches it, and the Docker download carries both Intel/AMD and ARM so it doesn't matter which one you land on.

After that Relayrix will run in a segment firewalled off from everything except the partners you send files to — and, with server mode on, the partner addresses you allow in. Your license is verified right there on your own server with a signature check; there's no activation call, no re-check, and nothing that stops working when the internet does.

Is Relayrix HIPAA compliant?

Compliance belongs to your organization — no product can hold it for you, and no body certifies software as HIPAA compliant. What Relayrix gives you is the safeguards it depends on, switched on by default rather than options you have to find: everything encrypted at rest and in transit, named logins with role-based access, automatic session timeouts, a delivery receipt for every file, and a record of every access that nobody can quietly alter. Between them they cover all five technical safeguards in the HIPAA Security Rule.

It's also self-hosted, which removes the biggest exposure in most healthcare integrations: PHI never leaves your infrastructure and never reaches us.

Because it never reaches us, we aren't acting as a Business Associate. If your compliance process calls for a BAA anyway, tell us and we'll review it with you.

Is Relayrix HITRUST certified?

HITRUST certifies your organization, not the tools it uses, so Relayrix doesn't hold a HITRUST certification of its own. What it gives you are the controls to map: named logins with roles, encryption at rest and in transit, a tamper-evident audit log, delivery receipts and automatic session timeouts. We can send a security overview to help you map them to your HITRUST requirements and your risk assessment.

How is my data encrypted?

Everything, everywhere. In transit, each connection automatically negotiates the strongest encryption both sides support — you never have to pick a cipher. SFTP takes SSH keys as well as passwords.

At rest, the entire database — settings, credentials, run history and the audit log — is encrypted with AES-256, and the key stays on your server. We never hold it.

Does Relayrix support Ed25519 keys?

Yes. Point a connection at your key file and Relayrix works out the type on its own. There is nothing to set up.

What we support:

• Ed25519 SFTP keys, with a passphrase if the file has one.
• ECDSA and RSA SFTP keys, the same way.
• The server's own key, pinned and checked whatever type it is.
• PGP keypairs from a modern GnuPG, shown in Settings as EdDSA/Cv25519.

Two kinds of key we don't take, and what to do about each:

• PuTTY .ppk files. Open the key in PuTTYgen and use Conversions, then Export OpenSSH key. Point the connection at the exported file. If you do hand Relayrix a .ppk, it says so by name rather than leaving you guessing.
• DSA keys. OpenSSH removed DSA from its own releases, so a current SFTP server will not accept one either. Generate an Ed25519 key instead — it is what ssh-keygen makes by default.

Can Relayrix encrypt files with PGP?

Yes, in both directions, and it's part of the license rather than a separately priced module.

Add PGP encrypt to a pipeline and every file leaves encrypted to your partner's public key. Add PGP decrypt and what they send back is opened with your own keypair before anything else touches it. Both happen inside the transfer itself, so there is no separate command anyone has to remember — and the delivery receipt records the file the partner actually receives.

Keys are imported by hand, in Settings. Relayrix never contacts a key server or looks a key up online — the same as the rest of the product. Key material is never shown on screen or written to a log; you see the key's name and its fingerprint, and imports and deletions are recorded in the audit log.

If a partner forgets to encrypt one day, that file doesn't quietly slip through. You decide in advance whether it fails or is delivered unchanged with a note on the run.

To be clear about the edges: Relayrix encrypts and decrypts. It does not sign files or check signatures, and it can't know that a partner has revoked a key — if they do, delete it and import the replacement.

How do I prove a partner received a file?

You send them the receipt — or pull it up in the system and show them. Either works.

Relayrix records every file the moment it lands — the filename, where it was written, and the timestamp to the second — and keeps it searchable months later, in a record nobody can quietly alter. Look it up yourself, export it, or give an auditor their own read-only login and let them find it.

To be precise about what that proves: the file reached their server, whole. What their system did with it afterwards is on their side of the connection. But "we never got it" is a claim about the transfer, and that's exactly the claim the receipt answers.

How does the receipt show the file arrived unchanged?

Every receipt carries the file's fingerprint: a SHA-256 hash, the public standard used across banking and software downloads. Change a single character in a file and its fingerprint changes completely.

Relayrix only counts a file as delivered when the copy on their server matches what you sent. You don't have to take our word for it: run Get-FileHash (Windows) or shasum -a 256 (Mac) on the file and compare the result with the receipt.

How does Relayrix help with audits?

Every transfer is logged, and every file carries its own delivery receipt — what was sent, where it landed, and when it got there. Hand it to an auditor or use it to settle a dispute; it can't be quietly altered.

In a HIPAA audit that counts twice. A reviewer asks you to show a record of who did what, and then asks how you know the record itself hasn't been edited. Relayrix answers both: every sign-in, setting change, run and file moved is recorded, and the app re-checks on the spot that not one past entry has been altered or removed.

Filter it to the person and the quarter you were asked about, export it, and the reviewer can re-check it themselves.

A second copy of the log is written to a separate add-only file on your own server, so the record survives even if the database is lost. You decide how long entries are kept, to match your retention policy, and an auditor can have their own read-only login that shows only the history they need. Together this covers the HIPAA Security Rule's audit controls requirement (§164.312(b)) and supports the HITRUST logging and monitoring controls.

What happens when a transfer fails?

Nothing waits on someone noticing. The file is retried automatically — up to three attempts — and a failure that survives those raises an alert on the channel you chose: email, Slack, Teams or a webhook.

The file then stays in a Needs attention list at the top of the dashboard until it's delivered — by a re-send or by the next run bringing it through — or until someone marks it resolved, which is recorded with their name. An empty list means nothing is waiting on you.

If the far end is the problem rather than the file, every connection carries its own health from real traffic, so you can see which server is refusing transfers and how many pipelines depend on it. It clears itself on the next successful run.

What can Relayrix alert me about?

You can be alerted when:

• A transfer fails, or only some of its files are delivered.
• An expected file doesn't arrive within a set time, or by a deadline — for example, "no file by 9:00 AM on weekdays".
• Files are in the folder but don't match what the job is looking for.
• A file is empty, can't be decrypted, or doesn't arrive intact — every delivery is checked.
• A server can't be reached or rejects the login.
• A server's identity changes unexpectedly. Transfers to it are blocked until someone approves the change.
• A run is interrupted, for example by a server restart.
• A transfer succeeds, if you want success notices too.

Alerts go to as many people as you like by email, or to Slack, Teams or a webhook. The late-file alert can also go to its own list of people.

How are updates installed?

Run the new installer (or pull the new image) over the existing one — your settings and history are kept. Relayrix never connects back to us and needs no internet access to run, so there's no outside connection to monitor.

What reporting do I get?

A Statistics tab: headline numbers, a volume chart, run outcomes, and a day-by-day grid. Filter it to Test or Prod or a single pipeline — every view is a link you can send someone.

The same report can be emailed on a schedule, daily, weekly or monthly, to as many people as you like. Nobody has to log in to read it.

Files aren't the only unit. Every delivered file is counted by content where the type is recognized — HL7 messages, X12 transactions, FHIR bundle entries, delimited rows, plain-text lines — so a Records total appears beside the file count, on the page and in the email. Formats it can't read are left uncounted rather than guessed at.

Can I get a report for a calendar month rather than a rolling 30 days?

Yes. Alongside the rolling windows there are calendar ranges — yesterday, this or last week, this or last month. A report set to Last month always covers the whole previous month whatever day it goes out, so scheduling it for the 1st gives you a monthly summary that maintains itself.

Can I see whether this month is better than last month?

Yes, with nothing to switch on. Every range except All time is automatically compared against the period before it, and each headline number carries its change. The volume chart can overlay the two periods or show just the difference, day by day.

Why does the success-rate change say pts instead of percent?

Because a percentage change of a percentage is a different number, and quoting it would flatter you. Going from 50% to 60% is a rise of 10 percentage points — but also 20 percent. So the success-rate tile shows the subtraction and labels it pts; every other tile is a plain count, shown in %.

Why is there no comparison on All time?

Because there's no period before all time. The change indicators are absent rather than zero — printing 0% would be a claim about a period that doesn't exist.

What decides when a month starts?

One install-wide Time zone setting. Calendar ranges begin and end at midnight in that zone, and both the Statistics page and every emailed report print the zone they used. It's one setting for the whole install rather than a personal preference — which is what stops two people quoting different numbers for the same month.

Is there a year-over-year view?

There's no This year button, but a custom range gives you one: a custom window is compared against the equal-length stretch immediately before it, so 1 January to 31 December is measured against the year before. Custom ranges can't be scheduled, though — for a self-maintaining report, use Last month.

Can our partners log in to Relayrix and send us files?

Yes, with the server mode add-on — a flat $1,500 a year on top of your Professional license, with no limit on partner accounts. It's the same app and the same license key; you switch it on in the app and add your partners there.

• SFTP and FTPS. Partners log in with an SSH key by default, or a password if you allow it for that account. FTPS is explicit TLS 1.2 or newer; plain, unencrypted FTP is not offered.
• Each partner is locked to its own folder, with its own permissions and an optional quota. It can't see other partners' files or anything else on your server.
• An IP allowlist per partner, checked before sign-in: a connection from an address you haven't approved is dropped before it can even try a password. Repeated failed sign-ins lock the account and ban the address.
• Every upload is recorded as a run, so it gets the same history, alerts and delivery receipt as a file Relayrix fetched itself — including an alert when a partner stops sending. A pipeline can pick the file up from the partner's folder and move it on. Partner logins and files are written to the audit log.
• Off until you turn it on, and on its own port. Partners never reach your admin console, and their logins are separate from your staff's — a partner password can't open the app.
• Runs where Relayrix runs: on Windows Server it's a second service the installer already added; on Docker it's a second container, on a Linux host. (Docker Desktop on a Mac or Windows PC isn't supported for partner traffic, because it hides each partner's real address from the allowlist.)

To add it, email [email protected]. It's included in the 14-day free trial.

We already use AWS Transfer Family — why would we need Relayrix?

They do different jobs, and most teams that need both end up running both. Transfer Family is the inbound endpoint: partners log in, files land in S3 or EFS. Relayrix is what happens next — routing each file to wherever it actually has to go (including systems that are nowhere near AWS), checking the HL7 or X12 inside it, retrying the one that failed, and raising an alert when a partner who sends every weekday morning does not.

If what you need is somewhere for partners to log in, Relayrix can now be that too: the server mode add-on ($1,500/yr) hosts SFTP and FTPS accounts for your partners, and every upload is recorded with the same history, alerts and receipts, ready for a pipeline to move on. Transfer Family is still the right choice if you need a managed, multi-region endpoint under an AWS agreement.

Read the full comparison.

Who can access the system?

Everyone gets their own named login — no shared accounts — and roles control what each person can see and do. You can narrow a read-only user down to specific tabs, which is how you give an auditor or a trading partner a login that shows their transfer history and nothing else. Sessions time out automatically, and every login and action is logged.

Does Relayrix support two-factor authentication?

Yes, on your Relayrix account here on the website — free, optional, and set per person. Turn it on from My Account → Security, scan the code with any authenticator app (Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden or Apple Passwords), and every later sign-in asks for a 6-digit code after your password. If your phone is not to hand you can have a code emailed instead, and you get ten single-use recovery codes for the day both are gone.

Can I see the documentation before I buy?

Yes. Create a free account and the whole document center opens up — installation, connections, pipelines, processors, notifications, reporting and troubleshooting. No subscription needed to read it, and nothing to install.

Create a free account, or sign in if you already have one.

How do I get support?

Sign in and open the document center, or use the support link in your account. Don't have an account yet? Creating one is free.

Can I cancel anytime?

Yes. Manage or cancel your subscription from My Account → Billing at any time.

What happens to the app if my subscription ends?

Nothing is deleted. Relayrix moves to a read-only state — you can still sign in, read every pipeline and run, and export your audit log, but transfers stop until a valid key is installed. Your data stays exactly where it is, on your own infrastructure, and renewing restores full service immediately.

You'll also get a reminder in the app about 30 days before expiry, so a lapse should never be a surprise. (A free trial works the same way at the end, but with a 3-day reminder instead of 30 — see "Is there a free trial?" above.)