Skip to content
Tao Systems

Relay

A CRM platform you run under your own brand.

Relay is the CRM behind products that carry someone else's name. It suits two kinds of buyer. Insurance broker networks, franchise groups, membership bodies and software vendors offer it to their members and customers as their own product. Other organisations run it as a fully branded CRM for their own teams, without building or maintaining one.

Talk to us See deployment options
  • SSO via SAML 2.0 and OIDC, SCIM provisioning, enforced MFA
  • Every read and every write in an immutable audit log
  • Runs in your AWS, Azure or GCP account, or on-premises. Never on ours.
Relay as one tenant sees it. The brand, the domain, the login and the apps belong to the customer; the record model, the workflow and the audit log underneath are Relay.

White-label

Your brand, end to end

White-labelling in Relay covers every surface a user, a member or an app store reviewer sees: the domain they type, the address a renewal reminder arrives from, the app they install, the login page they land on and the help article they read when something's unclear. Nothing says "powered by", the favicon is yours and the email headers carry your domain.

Resellers get all of this per tenant. A broker network can give each member agency its own logo and colour scheme on one shared platform, and a software vendor can ship CRM features under its own product name on its own domain. Branding is tenant configuration, so adding an agency doesn't mean a new deployment.

  • Logo and wordmark
  • Colours and typography
  • Custom domain, such as crm.yourbrand.com
  • Email sending domain, with SPF and DKIM on your domain
  • Login page
  • iOS and Android apps published under your name and icon
  • Documentation and in-app help carrying your brand
  • No "powered by" anywhere
  • Per-tenant branding for resellers

Platform

What sits underneath the brand

The objects, automation, APIs, identity and audit that your requirements list will ask about, named specifically so you can check them off.

  • Data model

    Contacts, organisations, deals and pipelines, activities, tickets and products come as standard. Add custom objects, custom fields, formula fields, lookups and many-to-many relationships, then work with them through views, saved filters and kanban pipelines.

  • Automation

    A workflow builder with triggers, conditions and actions. Scheduled jobs for the overnight work, approval flows for discounts and refunds, email sequences for onboarding and renewals, and SLA timers on tickets.

  • Integration

    REST and GraphQL APIs, webhooks and a Kafka-compatible event stream. Native connectors for Microsoft 365, Google Workspace, Twilio, Stripe, DocuSign and Xero. Importers for Salesforce, HubSpot and Dynamics 365.

  • Identity

    Single sign-on via SAML 2.0 and OIDC against the identity provider you already run. SCIM provisioning, so joiners and leavers are handled by HR rather than by a CRM admin. MFA is enforced for every user.

  • Permissions and tenant isolation

    Role-based permissions down to the field, so a claims handler sees the policy but never the bank details. Each tenant is strictly isolated with its own encryption key, so one reseller customer can never read another one's data.

  • Audit

    An immutable log of every read and every write: the user, the record, the fields touched and when. Exportable to Splunk, Microsoft Sentinel or any other SIEM.

Integration and API

Everything is reachable from code.

REST for records, GraphQL for the queries that would otherwise take six round trips, webhooks for the events you want pushed, and a Kafka-compatible stream for the events you want to replay into your own systems.

Native connectors cover Microsoft 365 and Google Workspace for mail and calendar, Twilio for SMS and calls, Stripe for payments, DocuSign for signatures and Xero for invoicing. Importers for Salesforce, HubSpot and Dynamics 365 bring across objects, custom fields, attachments and activity history, and report row counts and checksums so you can reconcile against the source before anyone cuts over.

Connectors
Microsoft 365Google WorkspaceTwilioStripeDocuSignXero
Importers
SalesforceHubSpotDynamics 365

Create a deal over REST

curl -X POST https://api.northgatebrokers.co.uk/v1/deals \
  -H "Authorization: Bearer $RELAY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Halden & Co fleet renewal 2026",
    "pipeline": "commercial-lines",
    "stage": "proposal",
    "contact_id": "con_8f3k2",
    "value": { "amount": 48500, "currency": "GBP" }
  }'

Webhook delivered on stage change

POST https://portal.northgatebrokers.co.uk/hooks/relay
Relay-Signature: sha256=9b2e4f1c...

{
  "id": "evt_01J9X4Q7",
  "type": "deal.stage_changed",
  "occurred_at": "2026-08-30T09:38:12Z",
  "tenant": "northgate",
  "actor": { "type": "workflow", "id": "wf_renewal_reminder" },
  "data": {
    "deal_id": "dl_4m2p7",
    "from": "qualified",
    "to": "proposal"
  }
}

Audit and compliance

Every read is logged, because auditors ask who looked.

Most CRMs log writes. A HIPAA access review or a GDPR subject access request needs to know who opened a record, when, and which fields they saw. Relay records that for every read and keeps it where nobody can edit it.

  • Read-level audit logging

    Every read is logged alongside every write: user, tenant, record, fields returned and timestamp. Screen views, API calls and exports land in the same append-only log, and nobody, including Tao, can edit or delete an entry.

  • Field-level permissions

    Roles decide which objects a user can open. Field permissions decide which columns they see inside those objects. That is how minimum-necessary access under HIPAA gets enforced rather than promised.

  • Per-tenant encryption keys

    AES-256 at rest with a separate key for every tenant, TLS 1.2 or higher in transit. The keys sit in your own AWS KMS, Azure Key Vault, GCP KMS or HSM, never with Tao.

  • SIEM export

    Stream the audit log to Splunk, Microsoft Sentinel or any other SIEM, so a bulk export of contact records at 02:00 shows up in the same place as every other access anomaly your security team watches.

For US healthcare customers, Tao Systems signs the Business Associate Agreement, and PHI is encrypted with AES-256 at rest and TLS 1.2 or higher in transit. Under GDPR, data residency is wherever your account or datacentre is, because Relay runs nowhere else. The Data Processing Agreement, with Standard Contractual Clauses and the UK International Data Transfer Addendum, and the BAA cover Tao's access during installation, onboarding and support, which is scoped and revocable. Subject access and erasure requests are handled with built-in tooling. The security page covers the SOC 2 Type II audit, penetration testing and the documents we share under NDA.

Deployment

Run it where your data has to live.

The platform is the same in both. What changes is whether the data sits in your own cloud account or your own building. Your own team runs it day to day either way, and neither option puts a byte on infrastructure Tao owns.

OptionWho operates itData residencySub-processorsSupport and updates
Your own cloud account AWS, Azure or GCP, deployed with Terraform into your own account, subscription or projectYour own team. Tao installs it and trains your admins, working through access you grant for installation, onboarding and support sessions (an IAM role, or a VPN or bastion you run), scoped, logged and revocable at any time.Any region your account supports, including the UK, EU and US regions of all three clouds. Data, backups and audit logs never leave the account.None. The cloud provider is already under your own agreement (AWS BAA, Azure or GCP DPA), and Tao adds nothing to the list.Email and remote screen-share from the UK, 09:00 to 18:00 UK time, one-working-day response. Quarterly updates, LTS releases and security patches. Backups are yours, taken with your cloud provider's tooling; Relay documents how.
On-premises Your datacentre, typically alongside Basin. Air-gapped sites supported.Your own team. Tao installs it over a VPN or bastion you run, or from an offline install bundle at an air-gapped site, and trains your admins. The same scoped, logged, revocable access applies.Inside your network. Nothing leaves the building.None.The same email and screen-share support with a one-working-day response. Quarterly updates and LTS releases arrive as a bundle you apply yourself, offline if need be. Backups on your own storage, with your own tooling.

We don't run Relay on our own infrastructure, and that's deliberate: keeping every byte inside your own compliance boundary is the point. Tao never holds your customer or patient data, your existing AWS BAA or Azure and GCP DPAs already cover the infrastructure, and nothing gets added to your sub-processor list. Tao's only sub-processor, Cloudflare for the taosystems.dev website and its email, never touches product data.

Your own team operates Relay, because it runs on your infrastructure. Tao installs it, which is what the setup fee covers, trains your admins, and then supports them by email and remote screen-share, 09:00 to 18:00 UK time, with a response within one working day. Access for installation, onboarding and support sessions is granted by you, scoped, logged and revocable. Backups are yours as well: Relay documents how to take them with your cloud provider's or datacentre's tooling.

On-premises installs usually sit next to Basin, our data platform, so CRM records reach the lake and the dashboards without leaving your network.

References

Who runs it today

Customers rarely allow logo use, so these are anonymised. Ask and we'll arrange a reference call.

  • UK insurance broker network

    1,200 member agencies

    Runs Relay, branded as its own product, for around 9,000 users across 1,200 member agencies, in the network's own Azure subscription in UK South. Its team moved twelve years of records out of the old on-premises system with Relay's importers and ran both systems in parallel for five months before switching over.

    Users
    About 9,000
    Parallel run
    Five months
    Runs in
    Own Azure subscription, UK South

  • Professional membership body

    180,000 members

    Uses Relay as its member CRM, with single sign-on against the identity provider it already ran, a branded member portal, and a mobile app published under its own name.

    Identity
    SSO to existing provider
    Portal
    Branded member portal
    Mobile
    App in its own name

Commercials and timeline

How it's priced, and how long it takes

Relay is included in the platform subscription: £250 a month covers Relay and Basin together, with a £500 one-off setup fee for installation, configuration and training. Prices exclude VAT, billing is monthly and rolling, and you can cancel with 30 days' notice. Reseller networks with thousands of users are quoted after a call. The pricing page lists what's included.

A standard installation is live within two weeks of the setup fee being paid. The importers for Salesforce, HubSpot and Dynamics 365 are part of the product and the onboarding sessions cover using them. How long you keep the old system running alongside is up to you; the broker network above ran both for five months before switching over.

Two weeks

Standard installation to go-live

  1. 1

    Install

    Tao deploys Relay into your cloud account or datacentre with Terraform, connects SSO to your identity provider and hands your admins the keys. The setup fee covers this.

  2. 2

    Configure and brand

    Your admins set up objects, pipelines, roles and workflows, then apply the brand: domain, sending domain, login page and apps. Admin training runs alongside, over screen-share.

  3. 3

    Import

    Run the Salesforce, HubSpot or Dynamics 365 importer. It brings across objects, custom fields, attachments and activity history, and reports row counts and checksums so you can check the result against the source.

  4. 4

    Go live

    Move users across, keep the old system read-only for as long as you want a parallel run, and raise anything that comes up with support by email or screen-share.

See Relay wearing your brand.

Book a demo with the engineers who build it. We'll show you a branded tenant, the audit log and whichever deployment option fits where your data has to live, then come back on fit, timeline and cost within one working day.

Book a Relay demo Read the security overview