Architecture

Data handling

What LayerT keeps, where it keeps it, how long for, and what it never collects. Written so your privacy team can fill in their records without a call.

Describes LayerT as built on 18 September 2026. Anything not built is labelled.

What LayerT stores

Data	Where	Protected by	Kept for
People from your directory: name, email, job title, manager, active status	Postgres	Access controls; your directory is the source	While they’re in your directory; deactivated people are kept for the audit trail
Groups and memberships	Postgres	Access controls	As your directory says
Devices: enrolled browser profile, who it belongs to, last seen	Postgres	Credentials stored as hashes	Revoked devices are removed after 90 days idle
Audit events, including matched values and the sites they happened on	Postgres	Access controls; readable on purpose	365 days by default, configurable
Access requests: the value, the site, the person’s reason	Postgres	Access controls	180 days after they close, unless an active exception depends on them
Shared-account passwords and authenticator seeds	Postgres	AES-256-GCM envelope encryption, one data key per account	Until the account is deleted or the secret replaced
Shared-account sessions	Postgres	Access controls	180 days after they end
Session recordings	Object storage	AES-256-GCM, a fresh key per recording, encrypted on the device	90 days by default, 7 to 365 configurable
Recording index: which session, which pages, timings	Postgres	Access controls	Deleted with the recording
Signed policy versions	Postgres	Ed25519 signature	The latest 20, plus anything from the last 30 days

What never leaves the laptop

Anything typed into a field that no rule names.
Your people’s browsing history. LayerT doesn’t collect it.
The raw recording key, after it’s handed over once to be wrapped.
Keystrokes in a recording: every input is masked before anything is encrypted.

What the extension receives

Every enrolled browser in your organisation receives your organisation’s signed policy. That policy includes the rules, and the approved exceptions and per-person settings that rules need, such as corporate phone numbers or approved personal accounts. Treat the policy as internal to your organisation.

Shared-account passwords and authenticator codes are sent only to the enrolled browser of a person with an active session, only when needed to sign in, and never stored in the browser by LayerT.

Deletion

People: deactivating someone in your directory ends their access at once. Their records stay for the audit trail until the retention period ends.
Your organisation: when an organisation closes, LayerT keeps its data for a 30-day grace period, then deletes everything in one step, including stored recordings, and records a receipt of the deletion.
Recordings and old records: deleted automatically by daily retention jobs, and each recording deletion is logged.

Sub-processors and location

LayerT will run on three infrastructure providers. Each one processes your data only on LayerT’s instructions, under a data processing agreement.

Provider	Contracting entity	Planned use
Cloudflare	Cloudflare, Inc. (United States)	Network edge and delivery
Google Cloud	Google Cloud EMEA Limited (Ireland)	Cloud infrastructure, including the managed key service
Amazon Web Services	Amazon Web Services EMEA SARL (Luxembourg)	Cloud infrastructure

Before launch. LayerT isn’t in production yet. Which service runs where, the regions (the first planned region is in the United States), the safeguards for transfers outside the EU, and data residency options will be published here before the first customer goes live.

If you’re filling in a record of processing

Purpose: controlling which accounts people sign in to on work devices, brokering access to shared accounts, and keeping an audit trail of both.
Data subjects: your employees and contractors with a managed browser.
Special categories: LayerT doesn’t set out to process them. A recording can capture whatever a vendor’s page shows, which is why recording needs the Owner’s attestation first.
Legal basis: yours to determine. LayerT asks the Owner to record it before any recording can happen.