Trust
What LayerV runs, what it sees, and what stays yours.
The facts a security review asks for first, stated plainly. Where something is not offered today, this page says so.
Where it runs
LayerV operates
The hosted control plane
The API, the knock and tunnel services, and the qurl.link opening flow run on Amazon Web Services in US regions. There is no self-hosted control plane.
You run
The connector
A container or binary you deploy in your own network. It only connects outward, over UDP 443 and one TCP tunnel, and needs no inbound port.
Stays put
Your application
It keeps listening on localhost or a private network, with its own sign-in, its own permissions, and its own data.
What LayerV sees
LayerV checks each access grant and carries approved traffic between the opener and your connector. Your users never sign in to LayerV.
LayerV sees
That a valid knock arrived, and from which address
Which links were issued, opened, denied, or revoked, and when
Session metadata: source IP, user agent, first and last seen
Usage against your plan
Unencrypted qURL traffic at TLS termination points, processed transiently to route it; relayed content is not retained
Stays yours
Your application, its data, and its own sign-in
Who a person is: identity stays with your provider
The connector state, its keys, and the network it runs in
The decision to issue a link, and to take it back
Sign-in, keys, and records
- Who a person is
- Identity stays with your provider. Your own sign-in, approval, or agent logic decides when a link is issued. A qURL is a bearer credential: pair it with your application’s own sign-in when the opener’s identity must be verified.
- Console sign-in
- The LayerV dashboard signs in through Auth0, operating under LayerV’s domain. The Enterprise plan adds SSO for the console, set up in the contract.
- Connector keys and credentials
- The connector enrolls once with a one-shot token and keeps its credential in your state directory. Its keys can be sealed to a TPM, or held by AWS KMS, GCP KMS, AWS Nitro, or GCP Confidential Space. API keys are scoped; nothing durable lives in a config file.
- Access records
- Live sessions can be listed and ended through the API. Signed webhooks send access, denial, revocation, and quota events to an endpoint you choose. These are integration points, not a retained audit log. The Enterprise plan adds audit export with retention set in the contract. See access controls.
- Subprocessors
- Amazon Web Services for hosting and Okta (Auth0) for console sign-in, among the providers listed in the privacy policy.
Assurance
- Certifications
- LayerV holds no third-party certification today. Our hosting provider maintains its own, including SOC 2, ISO 27001, and FedRAMP. The protocol underneath, OpenNHP, is published by the Cloud Security Alliance and is an IETF Internet-Draft, with LayerV as co-author.
- Service levels
- Service levels are set in the contract. Outside a signed agreement, the Terms make no service-level commitment.
- Your own testing
- You may run penetration tests and vulnerability assessments against your own LayerV-protected resources. Testing LayerV’s shared infrastructure or other customers’ resources is not permitted.
- Reporting a vulnerability
- Write to security@layerv.ai. We aim to respond within 24 hours. The disclosure policy has the details.