---
url: /relyai-acellemail/features/file-integrity.md
description: >-
  Advisory HMAC-SHA256 tamper-detection on the Integrity & Updates tab — see
  whether your files match a signed baseline, with Auto-Sync that self-heals
  after a legitimate upgrade. Never blocks the plugin.
---

# File integrity

File integrity gives you a simple, honest answer to one question: **have RelyAI's files changed
since it was installed?** It keeps an HMAC-SHA256 signed baseline of the plugin's files and compares
against it, so you can spot an unexpected edit — a botched manual patch, a half-finished upload, or
anything that shouldn't be there.

You'll find it on **RelyAI → Settings → Integrity & Updates**. It's **advisory**: it tells you what
it sees, and that's it.

![The integrity status on the Integrity & Updates tab](/relyai-acellemail/img/relyai-file-integrity-status.png)
*RelyAI → Settings → Integrity & Updates*

## What the statuses mean

| Status | What it's telling you |
| --- | --- |
| **Everything in sync** | Files match the signed baseline — nothing to do |
| **All files verified** | HMAC signatures are valid |
| **Sync required** | Something differs from the baseline; the list shows what changed |
| **n files tracked** | How many files are covered, plus when the last snapshot was taken |
| **No baseline yet** | No checksum baseline has been recorded so far |

## Auto-Sync on Admin Page Load

Turn on **Auto-Sync on Admin Page Load** and RelyAI re-baselines itself when it notices a mismatch
as an admin opens a page. This is what makes integrity checking practical: after a legitimate
upgrade the files naturally change, and Auto-Sync quietly records the new, correct baseline so you
aren't left staring at a "Sync required" warning for something you did on purpose. In short, it
**self-heals** after an expected change.

## What it is — and isn't

* **Admin-only.** The status and controls live in the admin area; customers never see them.
* **It never blocks.** A mismatch is a heads-up, not a lockout — the plugin keeps working normally
  whatever the status says.
* **It is not tamper-proof.** Because it's advisory and self-heals, treat it as an early-warning
  signal, not a security guarantee. Anyone who can change the files can also trigger a re-baseline.

Used the way it's meant to be — a quick glance after an update or when something feels off — it's a
reassuring confirmation that what's running is what you installed.

## Related pages

* [Updating RelyAI](/relyai-acellemail/updating) — updates verify and re-baseline files as they apply
* [Backup and restore](/relyai-acellemail/backup-and-restore) — the snapshot taken before every update