A personal address is typed
Alice types her personal address into a mail sign-in on her work laptop and presses Next.
Share the account. Never the password.
A security layer in the browser your team already uses. People sign in to shared accounts without ever seeing a password.
Live demo
No new browser. Nothing new to learn. Just a layer.
LayerT runs inside Chrome, the browser your people already use. It stays out of the way until a sign-in or a shared account needs it.
Half the team knows the password. That’s the problem.
Shared logins live in spreadsheets and chat threads. When someone leaves, you change every password and hope you found them all.
Without LayerTWith LayerT
Drag to compare. Fictional accounts and dummy passwords.Someone leaves? Remove them in your directory, and their access goes with them.
Try it
Type an email. Watch LayerT decide.
This is a fictional mail site on an Acme Corp work laptop. Try a work address, then a personal one. Your network sees the same thing both times. LayerT doesn’t.
Try itThe block card here is a picture of the real one.
Try:
Nothing you type leaves this page.
What your network sees
- Destination
accounts.postbox.example:443- Traffic
- Encrypted. The form’s contents aren’t visible.
- Whose account
- Unknown
An ordinary website. Whatever you type, it goes through.
What LayerT sees
- Page
- Sign-in form on
accounts.postbox.example - Typed address
- Nothing yet
- Person
- Alice Chen, Finance (from your directory)
- Rule
- Personal sign-ins on work laptops
Waiting for a sign-in.Press Next to see what LayerT does.That isn’t an email address yet. Try one of the examples.A work account. LayerT lets the sign-in through and stays out of the way.Stopped before it left the browser. Alice can ask for access if she needs it for work.
The product
Four jobs, done inside the page.
Scroll through four real LayerT flows, rebuilt with dummy data. Click any step to jump to it.
Sign-in control
See the last mile.
Block a personal sign-in before it leaves the browser. People who need it can ask.
Sign-in controlStopped in the page
LayerT checks what she typed against your rules and stops the sign-in before the request leaves the browser.
She asks for access
She says why she needs it. The prompt updates by itself when an approver decides.
Approved for 1 hour
An approver says yes and picks how long. Alice presses Try again. Every step lands in the audit log.
DemoWhat your team sees on a blocked sign-in
Shared accounts
Share access, not passwords.
Sensitive accounts need an approver first, and every session ends on time.
Shared accountsOpens ready to search
The LayerT launcher opens from the toolbar with search focused. Each account has one button that does what it says.
Ask in place
Vendor Billing Admin needs an approver. Alice gives a reason and sees who decides and how long the session lasts.
Waiting on an approver
The request waits in the launcher and in the approver’s Inbox. Accounts that one person holds at a time say who has them.
Approved and signed in
LayerT signs Alice in without showing her the password. The session ends on time, and LayerT signs her out.
DemoThe LayerT launcher in the browser toolbar
Session governance
Know who did what.
Every shared-account session in one list. Recording is off until you turn it on.
Session governanceEvery session, live first
Every time someone used a shared account, with live sessions at the top. Recorded sessions offer Watch.
Watch, with typing masked
Watching needs a reason and is logged against your name. It’s a replay of the page, not a video. What people typed is masked where they typed it. The replay still shows what the page shows back.
End it remotely
An admin ends Alice’s live session from the console.
Her browser signs out
Within about a minute, LayerT signs Alice out of the vendor site. She’s told an administrator ended it, not who or why.
DemoThe admin console
The console
Decide in one Inbox.
The people who configure aren’t the people who grant exceptions.
The consoleEverything waiting on you
Shared-account requests, bypasses, password requests, rule changes and access reviews in one list. The badge counts only what you can act on.
Decide in place
Pick how long: one attempt, 15 minutes, up to 24 hours. Permanent exceptions belong to Compliance, not IT.
The badge counts down
Bob sees the answer in the page he was blocked on, or as a desktop notification if he left. The decision is in the audit log.
DemoThe admin console Inbox
Recently built
New in LayerT.
Built and tested ahead of launch. Each card links to the page that shows it.
Every new browser waits for a yes
A new browser gets no rules and no shared accounts until an Owner or IT Admin approves it on Devices, however LayerT was installed.
Read
Rules for files and typed text
A rule can stop a file by its name, or by the text inside a plain-text file of up to 1 MB. A rule about file text also stops a file LayerT can’t read. A rule can also act on text typed into the fields it names.
Read
Continue with a reason
On a form or paste rule, a block can let people carry on once they say why. The reason is recorded with their name before anything proceeds, and no approver is involved.
Read
Rules for a directory group
A rule can apply to the people in a directory group, or to everyone outside one. A change in your directory reaches a running browser within about 15 minutes.
Read
Gateways on a server you rent Early access
Send a shared account through a gateway, so the vendor sees one address it can allow-list. The session starts at the gateway, and a chip on the page names the gateway and the address the vendor sees. The sign-in isn’t opened when its gateway can’t be reached, unless you set the account to go direct.
Read
Sign-in forms that ask for more
LayerT fills extra sign-in fields, keeps notes with the account and shows the current authenticator code. It also fills a sign-in form that sits in a frame from the same site, and says which address the form belongs to.
Read
Warn, and let people decide
A rule can warn instead of block. The person reads your note, then goes back or carries on, and carrying on is logged.
Read
Approve from your inbox
Approvers hear about requests by email, Slack or a browser notification, and can decide straight from Slack.
Read
Access reviews that show use
See who can use each shared account and when they last did, then remove what nobody used.
Read
Codes from a shared inbox
When a vendor emails a sign-in code to a team address, LayerT fills it in. Password-reset emails go to the account’s owner, never to the person signed in. Switched off in production until LayerT’s compliance review.
Read
A routing map
Who can reach each shared account, the route it takes and the sites it reaches, with a what-if for a gateway going down.
Read
How policy stays honest
What’s inside a signed policy bundle, how every browser checks it, and what a compromised laptop can and can’t do.
ReadWhy not just use what you already have?
Fair question. Each of these does its own job well. None of them sits in the page at the moment someone signs in.
“Our network security covers this.”
Network and cloud security tools
They seeEncrypted traffic to a website.
LayerT seesThe sign-in form in the page, and whose account it is.
“We could switch to an enterprise browser.”
Enterprise browsers
They askEveryone moves to a new browser, and you roll it out.
LayerTWorks inside the browser your team already uses.
“Our password manager can share logins.”
Password managers with sharing
They shareThe password. People can see it and copy it.
LayerT sharesAccess. It signs people in and ends the session on time.
“Isn’t this privileged access management?”
Privileged access suites
They bringHeavy infrastructure, built for large enterprises.
LayerT bringsA browser layer, built for SaaS-heavy teams.
Built on open standards. Tested like it matters.
LayerT speaks the protocols your stack already uses, and its core flows are tested end to end in a real browser.
Works with
- BrowsersA Manifest V3 extension, rolled out by your MDM with Chrome enterprise policy files for macOS and Windows.
Google ChromeToday
Microsoft EdgeComing soon
Mozilla FirefoxComing soon
OperaComing soon
- JumpCloud Built forDirectory sync over SCIM 2.0. Console sign-in over OpenID Connect.
- Your MDM Templates readyPushes the Chrome policy that installs LayerT and pins it to the toolbar.
- Built-in sign-in rulesPersonal Google sign-ins, Telegram Web and WhatsApp Web, ready on day one. Point at any other site to write your own rule.
- Other identity providers Not yet certifiedOkta, Microsoft Entra ID and Google Workspace speak the same standards (SCIM 2.0 and OpenID Connect), but we haven’t certified them yet.
SCIM 2.0OpenID ConnectEd25519AES-256-GCMTOTP, RFC 6238Manifest V3rrweb replayEncrypted object storage
Tested with
As of 3 October 2026.
- 8,370Automated unit testsAcross ten packages, the extension and the console among them.
- 82End-to-end browser scenariosReal Chromium with the real extension loaded. All green on 3 October 2026.
- Demo walk-throughsThe stories we run in a demo, on fictional sites with dummy data.
- Colour contrast checked by testsEvery colour pair LayerT draws meets WCAG AA, checked automatically.
End-to-end runs use fictional vendor sites and faithful stand-ins for the sign-in pages LayerT targets.
Ed25519-signed policyAES-256-GCM, a fresh key per secretFails closed on stale policyRemote sign-out in about a minute365-day audit log6 built-in rolesSeeing a password takes two approvalsRecording off by default
Rolled out through the tools you already run.
- Your directoryJumpCloud, over SCIM 2.0
- LayerT consoleRules, shared accounts, Inbox
- Signed policy to the extensionChrome, pushed by your MDM
- The pageWhere LayerT blocks, asks or fills in
Requests, sign-ins and sessions flow back to the Inbox and audit log.
Deploy
Your MDM pushes a Chrome policy that installs LayerT and pins it to the toolbar. People sign in once with their company identity. Each new browser then waits for an administrator’s approval.
macOS and WindowsSet policy
Write rules and add shared accounts in the console. Build a rule by pointing at the page.
Signed before it shipsEnforce
The extension reads only what your rules name. It acts in the page on form submissions, pastes, typed text and files, and fills in shared-account sign-ins.
Fails closed on stale policyDecide and prove
Requests land in the Inbox, and reach approvers by email or Slack too. Every block, approval, sign-in and session goes into one audit log, in plain words.
Kept 365 days by defaultWhere teams start.
Six problems LayerT solves on day one. Pick the one that sounds like your week.
Keep personal accounts off work laptops
Personal email, Telegram and WhatsApp sign-ins are stopped in the page, with a way to ask for access.
Read the use case
Share the social accounts safely
Marketing signs in through LayerT. Nobody learns the password.
Read
Vendor and finance portals
A manager’s yes first, one person at a time, recorded if you choose.
Read
Contractors without the keys
Time-boxed access, their name on the page, gone when the work ends.
Read
Offboarding in one step
Remove someone in your directory. LayerT ends their sessions and their access everywhere.
Read
Evidence for auditors
Who approved what, who used which account, and when, in plain words.
ReadSecurity
What’s true today, and what isn’t yet.
How it’s built
- Signed policy, checked before it’s usedRules ship signed with Ed25519, and the browser’s own crypto checks them. Stale or tampered policy blocks rather than lets things through.
- Every secret sealed with its own keyAES-256-GCM envelope encryption. Recordings are encrypted on the device, with a key made for that session.
- Seeing a password takes two approvalsAuthenticator codes are made server-side. Seeing a stored password or setup key takes two approvers, one an Owner or Compliance Officer. It’s shown once and logged.
- Separation of dutiesIT configures. Compliance grants lasting exceptions. Nobody approves their own request.
- Every new browser waits for approvalA new browser gets no rules and no shared accounts until an Owner or IT Admin approves it, however LayerT was installed. Each browser’s credential is tied to a key made in that browser that can’t be exported.
Limits, stated plainly
- Chrome todayEdge, Firefox and Opera are coming. No Safari, mobile or desktop apps.
- Rules read plain text, and only what they nameRules act on form submissions, pastes, typed text and files given to a page. LayerT doesn’t read inside PDFs, Office files or images: a rule about a file’s text stops those and says it couldn’t check them. What a site uploads by itself in the background isn’t checked.
- What a matched rule recordsLayerT reads only the fields your rules name. When a rule matches, LayerT records what matched, and for a typing rule the text of the field, so an auditor can check the decision. A rule can mask or hide its values.
- Recording is off by defaultYour company confirms a lawful basis first, and people are told on the page. What they type is masked where they type it, in form fields and rich-text editors. A recording still shows what the page shows back. A watermark deters and attributes; it can’t stop a phone camera.
- Pre-launch, with no certifications yetLayerT produces the evidence your auditors ask for. It runs in a test environment with dummy data, and production is not deployed. Keys held in a cloud key service are built, and in use in that test environment.
How to tell a real LayerT prompt
LayerT never asks for your password. And when it’s on the page, its icon in your toolbar lights up. A website can copy a prompt, but it can’t draw in your toolbar.
reports.vendor.example
LayerT · Acme CorpLayerT prompts never ask for your password.
The dot is on while LayerT is on the page
What’s next.
Everything above this section is built. Here’s what we finished most recently, and what’s on the way, each labelled with exactly where it stands.
Recently builtBuilt
Built and tested like the rest of LayerT. LayerT runs in a test environment with dummy data. Production is not deployed.
Every new browser waits for approval
A new browser gets no rules and no shared accounts until an Owner or IT Admin approves it on Devices.
Set-up with a work account
People can set up LayerT themselves: they type their work email and sign in through your company’s own sign-in. No token to paste.
A key for each browser
Each browser’s credential is tied to a key made in that browser that can’t be exported.
Rules for files
Stop a file by its name, or by the text inside a plain-text file of up to 1 MB. A file LayerT can’t read is stopped by a rule about file text.
Rules for typed text
A rule can act on text typed into the fields it names. It tells the person, and stops the text being sent with a form, a submit button or Enter.
Rules for a directory group
A rule can apply to a directory group, or to everyone outside one.
Continue with a reason
On a form or paste rule, people can continue past a block by giving a reason. It’s recorded with their name before anything proceeds.
Sign-in forms inside frames
LayerT fills a sign-in form shown in a frame from the same site, and says which address the form belongs to.
Other sites of a shared account
An account can list the other sites it uses, such as a separate sign-in address.
What’s new, in the console
A page lists what changed in LayerT, newest first, in plain words.
Warnings people can continue past
A warn rule shows your message with Go back and Continue. Continuing is logged.
Approvers hear at once
Requests reach approvers by email, in Slack and in the browser, as well as in the console Inbox.
Password requests with two approvals
Seeing a stored password takes two approvers, one of them an Owner or Compliance Officer. It’s shown once.
An alert when a password is seen
Owners, Compliance Officers and the account’s owner hear straight away.
Audit log filters, export and redaction
Filter by person, rule, account or date, export what you see, and mask values rule by rule.
Access reviews
Each quarter, account owners confirm who still needs access, seeing who actually used it.
Sign-in health
Which shared-account sign-ins worked, and where the others stopped, in words.
Extra sign-in fields and notes
Account ID, organisation ID and PIN fields, plus notes on each shared account.
The current authenticator code
In the toolbar popup, for the person signed in, if a code doesn’t go in by itself. Views are logged.
Import from JumpCloud Password Manager
Bring shared accounts across from an export. The preview never shows a password.
Routing map
See who reaches which account through which route, at a glance.
Email sign-in codes
Codes a vendor emails to a shared inbox are filled in for whoever is signed in. Switched off in production until LayerT’s compliance review.
Shared mailboxes
Read a team inbox in the console, with approval, a watermark and every email logged. Switched off in production until the same review.
Device trust
Keep a vendor’s “remember this device” cookie, so people aren’t asked to verify every time.
Console home
What needs you, what’s live and what needs fixing, on one page.
Keys in a cloud key service
Built. In use in the test environment; production is not deployed.
Force-install from a signed package
So people can’t remove LayerT from a managed browser. Built; switched on with the first production release.
Early accessEarly access
Gateway routing
Send a shared account through a gateway on a server you rent, so the vendor sees one address it can allow-list. Off for every account until you switch it on.
Gateways on your own servers
Rent a small server with a static IP, paste one command, and manage it from the console.
The session starts at the gateway
The vendor’s first sight of the session is the gateway, and a chip on the page names the gateway and the address the vendor sees.
Not opened without its gateway
The sign-in isn’t opened when its gateway can’t be reached, unless you set the account to go direct.
Built and tested; it has run in our test environment only.
Coming soonIn progress
Edge, Firefox and Opera
LayerT in more browsers.
ProposedDesigning
Alerts on exports
Exports are logged today. An alert would tell Owners as they happen.
Tamper-evident audit storage
A log whose history can be checked, not only protected by access control.
Team Approvers for their own team
Today a Team Approver can decide requests across the organisation.
Automatic password changes
LayerT changing a shared password at the vendor by itself.
Want a say in the order? Request a demo and tell us what you need first.
Questions a good security lead asks.
Straight answers. If yours isn’t here, ask us in the demo.
Do people have to switch browsers?
No. LayerT is an extension in Chrome, the browser they already use. Your MDM rolls it out, and people sign in once with their company identity. Every new browser then waits for an administrator’s approval before it gets any rules or shared accounts.
Does LayerT read everything people do in the browser?
No. LayerT reads only the fields your rules name. When a rule matches, LayerT records what matched, and for a typing rule the text of the field, so an auditor can check the decision. A rule can mask or hide its values. Tell your people what your rules record. Session recording is a separate thing: it’s off by default, needs your company to confirm a lawful basis, and tells people on the page when it’s on.
What happens if LayerT can’t reach its servers?
The extension keeps working from its last signed policy. If that policy gets too old, LayerT fails closed: it blocks the actions your rules cover and tells the person why, until it can sync again. A block that people can continue past with a reason stays a block while LayerT is offline, because the reason has to be recorded first.
Can people see or copy a shared password?
Not while they sign in. LayerT fills the sign-in form for them, and the password never shows on screen or lands in the browser’s password manager. If someone really needs to see it, they can ask: two other people must approve, one of them an Owner or Compliance Officer. They see it once, it’s logged, and the account’s owner is asked to change it.
Which identity providers does it work with?
LayerT is built for JumpCloud, over SCIM 2.0 and OpenID Connect. Other providers that speak those standards may work, but we haven’t certified them yet.
Is this data loss prevention?
Not in the broad sense. LayerT’s rules act on form submissions, pastes, typed text and files given to a page, by a file’s name or by the text inside a plain-text file of up to 1 MB. LayerT doesn’t read inside PDFs, Office files or images: a rule about a file’s text stops those and says it couldn’t check them. What a site uploads by itself in the background isn’t checked. We’d rather tell you now than in a security review.
Can a vendor allow-list our address?
Yes, one shared account at a time. Send the account through a gateway on a small server you rent, and the vendor sees one address it can allow-list. Routing is off until you switch it on for an account, and the sign-in isn’t opened when its gateway can’t be reached, unless you set the account to go direct. Gateways are in early access: built and tested, and they have run in our test environment only.
Is LayerT SOC 2 or ISO 27001 certified?
Not yet. LayerT is pre-launch. What it does today is produce the evidence your own auditors ask for: approvals, sign-ins and sessions in one readable log.
How much does it cost?
Pricing is on application. It depends on how many people use LayerT and which parts you need, so tell us about your team in a demo request and we’ll put a proposal together.
Put a layer on the browser.
LayerT is pre-launch and taking demo requests. Tell us what you want to solve, and we’ll show you the product doing it.
