The release control plane for shipped software

Every device. Every version.
One control plane.

Relayer sits between git push and the thousands of machines running your desktop app, CLI or OS agent - staged rollouts, instant rollback and fleet visibility over one HTTP contract. No SDK. Any framework.

relayercli.com / prometheus-agent / releases
2.1.0stable25% rollout

312 of 1,482 stable devices on 2.1.0 (21%) · offered 389 times

1%10%25%50%100%Roll back

Checks · last 24h

Device check-in activity, last 24 hours

0devices reporting

If it can make an HTTP request, Relayer can update it

TauriElectronWailsSwiftGoRustPythonNode CLIsOS agents.NETTauriElectronWailsSwiftGoRustPythonNode CLIsOS agents.NET

Why a control plane

Shipping the update is the easy part. Surviving it isn't.

One bad push is an outage

One faulty update pushed to every machine at once took down 8.5 million devices and cost Fortune 500 companies an estimated $5.4 billion (Parametrix, 2024). The failure wasn't the bug. It was shipping to 100% with no staged rollout and no way back.

Updates are changes without change control

Configuration and change-management failures cause 62% of major IT and software outages (Uptime Institute). Your web deploys have change control. The updates you push to customer machines usually have none.

Home-grown update servers rot

The S3 bucket and latest.json work until you need to hold back a version, stage a ramp, or answer who shipped what. Then you're maintaining cohorting, version comparison, policy and audit logic forever, on infrastructure nobody owns.

Features

Updates are easy. Control is the product.

Staged rollouts

Serve a release to 1%, watch adoption, ramp to 100%. Devices are bucketed deterministically by hashing device and release, so nobody flaps in and out of a cohort.

Instant rollback

One click stops a bad version from being served: permanently, everywhere, on the next check. The fleet falls back to the last good release automatically.

Fleet visibility

Versions in the wild, platform split, check-in activity, stale devices. Not analytics theater. The actual answer to “can I retire 1.x yet?”

Framework-agnostic

One GET request is the whole integration. Tauri works with zero code, Electron via a feed URL, everything else with ten lines of anything.

Publish from anywhere

gh release create v2.1.0, and it's in Relayer: HMAC-verified webhooks, assets classified by platform, pre-releases routed to beta. Or publish via the API from any CI.

Audit-grade by default

Append-only audit log of every publish, rollout change and key use: actor, IP, timestamp. Keys hashed at rest, shown once. The change-management evidence your auditor asks for.

How it works

Three moving parts. You own one of them.

01

Publish like you already do

Keep your release flow. A GitHub webhook or one API call registers the version, notes and artifacts. Relayer stores decisions; your binaries stay wherever they live.

gh release create v2.1.0 ./dist/*
02

Decide who gets what

Channels (stable, beta, …), rollout percentages, minimum-version policies. Change your mind at 2am without rebuilding anything.

2.1.0 → stable · rollout 25% · min 1.1.0
03

Devices ask, Relayer answers

Each install asks one URL on its schedule and gets a manifest or a 204. That check is also the heartbeat that powers your fleet dashboard.

GET /u/APP/stable/darwin/aarch64/2.0.0

Integrate

Ten minutes, not ten sprints.

Any runtime
# The whole client contract - from any language:
curl https://www.relayercli.com/u/YOUR_APP/stable/linux/x86_64/1.4.2 \
  -H "X-Relayer-Device: $DEVICE_UUID"

# 200 -> {"version":"2.1.0","url":"...","sha512":"...","updateMode":"recommended"}
# 204 -> up to date (this device isn't in the rollout yet, or nothing newer)

Full guides for Tauri, Electron, custom agents, publishing and the API in the documentation.

Changelog included

Every channel is a public changelog.

Publish a release and your users can follow it anywhere. No extra setup, no separate changelog tool.

SlackSlackPaste one line into any channel and release notes deliver themselves to your team or your customers./feed subscribe …/rss.xml
RSSA standard feed for anyone who follows your releases in a reader./feed/<app>/stable/rss.xml
JSONJSON with versions, markdown notes and artifacts, built for "What's new" screens./feed/<app>/stable

Both sides of the table

Loved by the person integrating it. Defensible to the person approving it.

Developers get out of the way fast

  • One HTTP GET is the whole client. No SDK to embed, nothing to vendor.
  • Publish from CI in one line with the CLI, or keep your GitHub release flow.
  • Tauri and Electron adapters speak your updater's native contract.
  • Plain JSON everywhere. Read the raw OpenAPI spec, curl everything.

Your org gets control it can prove

  • Staged rollouts and permanent rollback: change control for shipped software.
  • An append-only audit log: who shipped what, to whom, when.
  • Roles and org scoping, so publishing isn't a shared password.
  • A small data surface: no binaries, no end-user PII, ever.

The full posture, including what we never hold, lives on the security page.

FAQ

Fair questions.

Do you host my binaries?+

No. Relayer serves decisions, not bytes: which version each device should run, with URLs and checksums pointing at your existing storage: GitHub releases, S3, R2, anywhere. Your download bandwidth bill doesn't change.

Which frameworks are supported?+

Anything that can make an HTTP GET. Tauri and Electron work natively (Tauri needs zero code; our endpoint speaks its updater contract). Wails, Swift, Go, Rust, Python, .NET or a bash script: the whole client is ~10 lines.

What do you know about my users' devices?+

Devices are identified by an anonymous, locally-generated UUID. No accounts, no PII. Rollout bucketing hashes that UUID so cohorts are deterministic and sticky.

How seriously do you take security?+

Every publish, rollout change, key mint and webhook delivery lands in an append-only audit log with actor, IP and timestamp. API keys are hashed at rest and shown once. Webhooks are HMAC-verified. Rate limiting on every public endpoint.

What does it cost?+

Relayer is free while in beta, with a generous free tier planned (real apps ship on it forever), paid plans priced on fleet size and team seats. Early users get grandfathered generosity.

What happens to my devices if Relayer goes down?+

Your fleet keeps running. Relayer serves decisions, not bytes: if an update check fails, devices simply stay on their current version and try again later. Nothing bricks, nothing blocks. There's a public status page linked in the footer.

Can I self-host it?+

Relayer is a hosted service today. If your environment needs self-hosting or a private instance, email us: it's on the roadmap and we'd rather design it with a real requirement in hand.

Your next release deserves a control plane.

Sign up, point one device at one URL, and watch your fleet appear. Free while in beta.

Start shipping free