Security, stated as it works today.
Layar is a beta product. This page covers the controls we enforce now, where the current boundaries are, and where operator access still exists.
Private-by-default Vaults
Memory is scoped to the signed-in user and their Vault. Reads, exports, and retrieval are checked against Vault ownership.
Scoped data access
Ask, locker exports, document views, and connected app routes are checked against the current owner before content is returned.
Secure sessions
Sessions are stored server-side, verified on each request, and designed to expire after inactivity.
Encrypted transport
Traffic is served over HTTPS in production. Managed Postgres connections are configured over SSL.
Controlled exports
Exports are generated on demand, checked against the owner, and logged so usage can be reviewed later.
Deletion and portability
Users can export memory and schedule account deletion. Access is revoked immediately, with a seven-day cancellation period before active database and object-storage data is removed.
Current security checks
These are the controls we actively enforce today. They are intentionally practical and specific rather than overstated.
Storage posture
Uploaded files are stored in a private managed storage bucket. Uploads use signed upload URLs, and reads use signed read URLs rather than public object paths.
That reduces accidental exposure, but it is not a zero-knowledge model. Layar operators may still need limited access for service operation and support during beta.
Auditability and control
Usage, exports, failed access attempts, deletes, and settings changes are logged so the product can be supported, reviewed, and debugged when issues occur.
Still in beta
Enterprise controls such as SSO, SCIM, customer-managed keys, and certification work are not part of the beta promise yet. They stay on the roadmap until implemented and verified.