Operators
How relays are vetted and run
Anyone can read the Glossia specification and run a test network. Only vetted organizations run relays in the public directory, because the people who rely on Glossia have to be able to trust the network as a whole.
Who runs relays
Every operator meets these requirements before its first relay is listed, and at every annual review afterward.
- A registered organization with a public-interest purpose: a university, library, newsroom, community network, digital rights group or not-for-profit hosting provider. Relays are never run by individuals, and never by governments.
- Independence. The organization must not be controlled or funded in a way that would let anyone else direct how its relay is run.
- Two named technical contacts, each able to apply a security update within fourteen days, and to respond to an urgent one within a day.
- A jurisdiction where running a relay will not put the operator at risk, and where the organization is prepared to resist demands for data it does not have.
- Hardware the organization controls, in a place where it can say who has physical access.
From invitation to listing
-
Invitation
Frothly invites organizations it already knows, often on the recommendation of an existing operator. Relays are run by invitation only.
-
Review
We review the organization’s governance, funding, jurisdiction and technical capacity, and talk to people who have worked with it.
-
Conversation
A long conversation with the technical contacts about how they would respond to a seized server, a legal demand or a compromised machine.
-
Probation
The relay joins the directory and carries a limited share of traffic for sixty days while it proves it is stable and up to date.
-
Listing
The relay carries full traffic. Every operator is reviewed every year, and Frothly checks every relay continuously.
There are no trick questions in the conversation, and we are not testing anyone’s empathy. We want to understand how an organization would act under pressure, because sooner or later most of them are put under some.
What every operator agrees to
- Logs
- Hourly counts of traffic and errors only. No addresses, no connection times, no message identifiers.
- Updates
- Security releases applied within fourteen days; urgent ones within a day.
- Software
- Only the published relay software, unmodified. Every relay is checked for conformance continuously.
- Inspection
- No inspection, filtering or shaping of Glossia traffic, for any reason.
- Keys
- Relay keys generated on the relay and never copied off it. If a relay is seized or compromised, its keys are revoked at once.
- Legal demands
- Reported to Frothly within a day, unless the law forbids it. Reported in aggregate in our transparency reports, with the operator’s permission.
- Availability
- At least 98 percent uptime over any ninety days. Planned maintenance announced in advance.
Removal
Frothly removes a relay from the directory when it no longer meets the standards: when it repeatedly falls behind on updates, when its software has been modified, or when its operator can no longer meet the requirements. Removal takes effect at the next hourly directory, and clients stop using the relay at once.
Removed relays stay on the record, with the reason. Most operators who leave do so by retiring their relays themselves, usually because funding or hosting has changed.
See every relay that has been removed, or browse the operators.
The relay software
Every relay runs glossia-relay, Frothly’s open-source relay software, currently at version 4.0.1. It runs on Linux, needs modest hardware and was part of the 2026 audit. It keeps nothing on disk but its own keys, its configuration and the encrypted messages waiting in its mailboxes.
The source is published with the specification. It is distributed to operators directly, and is not offered for download on this site.