Everything waiting on you
Shared-account requests, bypasses, password requests, rule changes and access reviews in one list. The badge counts only what you can act on.
The console
Decide in one Inbox.
Security work is mostly decisions. LayerT puts every decision in one place, gives it to the right person, and writes it down in words an auditor can read.
Decisions, approvals, reviews and the routing map
The console
Decide in one Inbox.
The people who configure aren’t the people who grant exceptions.
The consoleDecide in place
Pick how long: one attempt, 15 minutes, up to 24 hours. Permanent exceptions belong to Compliance, not IT.
The badge counts down
Bob sees the answer in the page he was blocked on, or as a desktop notification if he left. The decision is in the audit log.
DemoThe admin console Inbox
The console
Approve from wherever you are.
Requests reach approvers by email and in Slack, as well as in the console Inbox.
The consoleAlice asks
Vendor Billing Admin needs an approver. Alice asks from the LayerT launcher and says why.
Bob hears by email
Approve and Deny in the email open the request in LayerT. Nothing happens until Bob confirms there, and the email never asks for a password.
Or in Slack
The same request arrives as a Slack message. LayerT checks every click, and whether the person clicking may decide this request.
Decided in one click
Bob approves. The message updates in place, and the audit log records that the decision was made in Slack.
Alice is signed in
Her launcher updates by itself, with no reload. She presses Enter, LayerT signs her in, and the session ends on time.
DemoAlice’s browser
The console
A new browser waits for a yes.
Every new browser waits for an administrator’s approval before it gets any rules or shared accounts.
The consoleDana sets up her browser
Dana has LayerT in her Chrome and sets it up herself. She types her work email and signs in through Acme Corp’s own sign-in. There’s no token to paste.
It waits, and says so
The browser is registered, but it gets no rules and can’t use shared accounts yet. The set-up page and the LayerT popup both say it’s waiting for an administrator.
Bob sees it on Devices
Devices lists it under Waiting for approval: who, which browser, and how the browser says it was installed. Bob’s Inbox lists it too.
One yes
Bob approves, and the audit log names him as the approver. Approval lets a browser in. It doesn’t prove the laptop is managed, so the list still says this one wasn’t installed by policy.
Her browser starts working
Dana does nothing more. Her browser picks up Acme Corp’s rules and the shared accounts she may use.
DemoDana’s browser: LayerT’s set-up page
The console
Review access with the facts.
Every quarter, each account’s owner confirms who still needs it, and sees who actually used it.
The consoleWho can use it, and who did
Carol, in Compliance, owns Vendor Payroll, so its quarterly review is hers. Each entry shows when someone last signed in through it.
Remove what nobody used
Sam’s access wasn’t used this quarter. Carol removes it and writes the reason for the auditor.
Nothing changes until she submits
She confirms that everyone she’s keeping still needs the account. Nobody loses access automatically, and nobody confirms their own.
On the record
The review lands in the audit log. Its report and CSV carry a SHA-256 checksum for the auditor.
DemoThe admin console
The console
Every route, on one map.
Who can reach each shared account, the route it takes and the sites it reaches, without opening ten settings pages.
The consoleWho reaches what, and how
People and groups on the left, then the shared accounts they can use, the route each one takes, and the sites it reaches.
Trace anything
Select Payroll portal and everything else fades: Finance can use it, it goes through the London 1 gateway, and the vendor sees 203.0.113.7.
Things worth a look
LayerT points out what’s easy to miss, such as a gateway with no backup or an account nobody has used in months.
What if a gateway goes down?
Switch London 1 off on screen. Payroll portal would be blocked: its sign-ins wouldn’t be opened. HR benefits portal would go direct, because that account is set to. It’s a what-if: nothing changes for real. Gateway routing is in early access: it has run in our test environment only.
DemoThe admin console: shared accounts as a map
Built for how security really runs
- One Inbox Shared-account requests, bypass requests, password requests, rule changes, sign-in fixes and access reviews. The badge counts only what you can act on. New browsers waiting for approval are listed there too.
- Devices, and the browsers waiting for a yes A new browser does nothing until an Owner or IT Admin approves it on Devices, under Waiting for approval: it gets no rules and can’t use shared accounts, however LayerT was installed. With two or more waiting, one button approves the browsers the page lists and no others. For 7 days after a decline, the browser can be put back in the queue, which approves nothing. Approval is a person’s decision, not proof the device is yours: what a browser says about how it was installed is shown to the approver and decides nothing.
- Approve by email or in Slack Approvers hear by email, in Slack and in the browser. Email buttons open the request and change nothing until confirmed. Slack checks every click, and the audit log records where a decision was made. Password requests and permanent exceptions stay in the console.
- Six built-in roles Owner, IT Admin, Compliance Officer, Team Approver, Auditor and Read-only, mapped from your directory groups.
- Separation of duties IT configures. Compliance grants lasting exceptions by default. Nobody approves their own request. Optional two-author review for publishing rules.
- Access reviews that show who used what Each quarter, each account’s owner confirms who still needs it. Every entry shows whether anyone signed in through it in the period. Nobody loses access until the reviewer submits, and nobody confirms their own. The report and CSV carry a SHA-256 checksum.
- An audit log in plain words Every block, warning, request, decision, sign-in and session, readable by an auditor. Filter by person, account, rule or date, and export what you see as CSV or JSON Lines. Typed values stay out unless you include them, and each export is logged before the file starts. Kept 365 days by default. A reason someone gives to continue past a block is kept with the event, and shows in Rule matches under Reason given.
- Redaction per rule A rule can drop or mask the values it catches before they’re stored, so the log holds only what you need.
- Sessions Every shared-account session, live ones first, with Watch and End session where you’re allowed.
- Built on your directory People and groups arrive over SCIM 2.0, and admins sign in with OpenID Connect. Built for JumpCloud, with a set-up guide in the console that carries your organisation’s own values.
- A console home What needs you, what’s live now and what isn’t healthy, on one page.
- What’s new A page lists what changed in LayerT, newest first, in plain words, with a dot while there’s something you haven’t seen.
- A routing map Who can reach which shared account, the route it takes and the sites it reaches, on one screen. Select anything to trace it, and see a short list of things worth a look. The what-if for a gateway going down changes nothing for real; it works with gateway routing, which is in early access and has run in our test environment only. Compliance Officers and Auditors see every account on the map, read-only.
For your security review
How it works underneath, written for the people who have to sign it off.
Put a layer on the browser.
LayerT is pre-launch and taking demo requests. Tell us what you want to solve, and we’ll show you the product doing it.
