Security

Security, stated as it works today.

Layar is a beta product. This page covers the controls we enforce now, where the current boundaries are, and where operator access still exists.

Private-by-default Vaults

Memory is scoped to the signed-in user and their Vault. Reads, exports, and retrieval are checked against Vault ownership.

Scoped data access

Ask, locker exports, document views, and connected app routes are checked against the current owner before content is returned.

Secure sessions

Sessions are stored server-side, verified on each request, and designed to expire after inactivity.

Encrypted transport

Traffic is served over HTTPS in production. Managed Postgres connections are configured over SSL.

Controlled exports

Exports are generated on demand, checked against the owner, and logged so usage can be reviewed later.

Deletion and portability

Users can export memory and schedule account deletion. Access is revoked immediately, with a seven-day cancellation period before active database and object-storage data is removed.

Current security checks

These are the controls we actively enforce today. They are intentionally practical and specific rather than overstated.

Database reads and writes are scoped by user and Vault ownership.
Protected routes require an active session.
New accounts require verified email before any session or connector credential is issued.
Password resets use hashed, single-use 30-minute tokens and revoke existing credentials.
Sensitive security and deletion actions require authentication within the previous 10 minutes.
Ask retrieval is scoped to the current owner and selected locker.
Exports are scoped to the owner before files or context are returned.
API access is scoped to the workspace owner and usage limits.
Uploads use signed URLs and temporary object paths scoped by Vault.
Signed read URLs are used when stored files need to be fetched.
Files are not served from public object paths.
Operator access may still exist for support and service operations during beta.

Storage posture

Uploaded files are stored in a private managed storage bucket. Uploads use signed upload URLs, and reads use signed read URLs rather than public object paths.

That reduces accidental exposure, but it is not a zero-knowledge model. Layar operators may still need limited access for service operation and support during beta.

Auditability and control

Usage, exports, failed access attempts, deletes, and settings changes are logged so the product can be supported, reviewed, and debugged when issues occur.

Still in beta

Enterprise controls such as SSO, SCIM, customer-managed keys, and certification work are not part of the beta promise yet. They stay on the roadmap until implemented and verified.

SSO / SAMLSCIMCustomer-managed keysRetention policiesSOC 2 readinessISO 27001 readiness