LayerV Platform

Your app stays private. Access comes through LayerV.

LayerV gives people and software controlled access to an HTTP app or API without a direct public route to the app itself.

Public internet: open and untrustedYour private environment: not exposed

Hide

The Enterprise connector takes the app off the internet.

One container, or the qurl binary, runs beside the application and opens a single outbound connection to LayerV. It proves its identity with an authenticated packet first, and LayerV answers nothing until that proof arrives. Nothing on your side listens, so a scanner gets no reply, no banner, no certificate. There is no inbound rule to open and no public DNS record to find.

The Enterprise connector →See the access diagram →

Outbound only: one authenticated UDP packet, then one TCP tunnel out
Pinned image, read-only root, non-root user, your own state volume
Enrolls once with a one-shot token; the credential stays in your state directory
Keys sealed to the TPM, or held by AWS KMS, GCP KMS, Nitro, or Confidential Space
Generated deploys for Docker, Compose, ECS/Fargate, and Kubernetes
An existing public hostname or load-balancer route stays open until you close it

Access

Your own sign-in decides who gets a way in.

The app keeps its own authentication. Your identity provider or backend issues the link after its own checks, and the link is the way back in once you close any existing public route.

Every access control →Issue links from your code →

Single-use, or up to 1,000 concurrent sessions per link
IP allowlists of up to 100 addresses or ranges
Issued from your backend with the SDKs or the REST API
Revoked from the dashboard or the API, ending live sessions

The life of one link

Two separate limits: an opening deadline from 1 minute to 30 days, and a session length from 1 second to 24 hours once the link is opened. Revoking the link ends its live sessions. See every access control →

Control

See what is active, and send every event to your own systems.

Everything the dashboard shows, the API and SDKs can read and change, and signed webhooks carry access events to wherever you keep records.

Open the dashboard →API reference →

Dashboard: resources, links, active sessions, usage, API keys, devices, domains
OpenAPI reference and three SDKs for the same endpoints
HMAC-signed webhooks for access, denial, revocation, and quota events
Scoped API keys and one-shot enrollment tokens; nothing durable in config files
Custom domains for the links your people receive

Where people and agents use it

One access layer, six ways to reach it.

The boundary

Your app stays yours. LayerV only handles access.

LayerV checks access grants, carries approved traffic, and runs the API. Your app and its data stay in your environment, and your identity provider keeps control of sign-in. LayerV processes traffic in transit as described below.

You operate and control

Your application and its data
Your users’ identities, which stay with your provider
App authentication, sessions, and permission checks
The connector’s keys, its state, and your network
Your code, your repositories, your infrastructure
The decision to issue a link, and to take it back

What LayerV handles

Request: That a valid one arrived, and from which address
Link events: Issued, opened, denied, revoked, and when
Session: Source IP, user agent, first and last seen
Usage: Against your plan

Unencrypted qURL traffic at TLS termination points is processed transiently to route it; relayed content is not retained.

Built on a standard.
Run as a service.

The protocol is OpenNHP, published by the Cloud Security Alliance and on the IETF track, with LayerV as co-author. The platform is how you use it without building it.

Pilot LayerV