Relay disclosure

Version 2026-10-16. An organization admin accepts this before Relay can be used; the acceptance (who, when, which version) is recorded in the organization's audit log, and can be withdrawn at any time under Execution → Runner & Relay.

What Relay is

Sovereign pipelines run in your own Google Cloud project. When a Sovereign pipeline reads from or writes to a system outside BigQuery (for example MySQL, PostgreSQL, SFTP or an API), the data has to be moved. You can move it with:

• your Runner — a job that runs in your Google Cloud project. The data never leaves your cloud. This is the default and what we recommend for sensitive data.
• Relay — PipeKeel moves it for you, so you don't have to set up the Runner.

What happens to your data with Relay

• Relay runs in PipeKeel's infrastructure (Google Cloud), in your organization's home region, in a worker started for that one task and then discarded.
• It acts as your Sovereign execution service account, so it can only reach what you granted that account.
• Rows pass through the worker in memory only on their way between your source and your own BigQuery (or from your BigQuery to your target). Nothing is written to PipeKeel's storage, and no row data is logged.
• Credentials you keep in your own Secret Manager are read as your execution account, for the task only. Credentials stored with PipeKeel are read only by that task's worker.
• Runs that used Relay are labelled "via Relay" in run history.

Your choices

You can withdraw Relay at any time; pipelines that need it will then ask for the Runner. PipeKeel's processing of this data is covered by the Data Processing Agreement.