A personal address is typed
Alice types her personal address into a mail sign-in on her work laptop and presses Next.
Sign-in control
See the last mile.
Your network sees a website. LayerT sees who’s signing in. It stops personal sign-ins on work laptops in the page, before the request is sent, and gives people a fair way to ask. The same kind of rule can cover files and typed text.
A block, a warning, a file and a reason, start to finish
Sign-in control
See the last mile.
Block a personal sign-in before it leaves the browser. People who need it can ask.
Sign-in controlStopped in the page
LayerT checks what she typed against your rules and stops the sign-in before the request leaves the browser.
She asks for access
She says why she needs it. The prompt updates by itself when an approver decides.
Approved for 1 hour
An approver says yes and picks how long. Alice presses Try again. Every step lands in the audit log.
DemoWhat your team sees on a blocked sign-in
Sign-in control
A warning, not a wall.
Some rules only need a nudge. LayerT explains, and the person decides.
Sign-in controlA personal address on a work tool
Alice signs in to Vendor Reports with her personal address. The rule for this site is set to warn, not block.
Warned in the page
Before anything is sent, LayerT shows the message IT wrote for this rule. Go back is the default, and pressing Esc does the same.
She goes on
Alice presses Continue. LayerT sends the form for her, and she’s in. That address won’t be warned again in this tab for ten minutes.
Both steps on the record
The audit log shows the warning and that she went on. If warnings aren’t enough, IT can turn the rule into a block.
DemoWhat your team sees on a warning
Sign-in control
A file stopped at the door.
Rules act on files given to a page too: by a file’s name, or by the text inside a plain-text file.
Sign-in controlA file is dropped on a sharing site
Alice drops customers-2026.csv on Sharebox, a file-sharing site. One of Acme Corp’s rules covers files given to this page and checks their text.
Stopped before the page gets it
LayerT reads the file in the browser, finds customer numbers in it and stops it. A file a blocking rule matches never reaches the page.
A file LayerT can’t read is stopped too
She tries holiday.jpg. LayerT reads plain text only: it doesn’t look inside images, PDFs or Office files. A rule about a file’s text stops those, and anything over 1 MB, and says it couldn’t check them.
On the record, without the contents
Rule matches shows both, with each file’s name, type and size and how it was given to the page. The file’s text is read in the browser to decide. It’s never sent or stored.
DemoA file-sharing site, in Alice’s browser
Sign-in control
Continue, with a reason.
A rule for a form or a paste can block and still let people go on, once they’ve said why.
Sign-in controlA customer number in a vendor’s form
Alice writes a support ticket to a vendor and includes a customer number. The rule for this form is set to block, and to let people continue with a reason.
Blocked, with a way on
LayerT stops the form before it’s sent and shows the message IT wrote, with a box for her reason. Back leaves it blocked.
She says why
Alice writes her reason and presses Continue. No approver is involved, and the reason is recorded with her name before anything proceeds.
Recorded, then sent
LayerT sends the form for her only after its server has recorded the reason. If it can’t reach the server, the form stays blocked and the card keeps what she typed.
The reason, on the record
Rule matches shows the block and, under Reason given, her own words. The reason is in the audit log and in exports too. The text of the field is recorded as well, unless the rule masks or hides its values.
DemoA vendor’s support form, in Alice’s browser
Rules that act where the typing happens
- Personal sign-ins, stopped in the page LayerT checks the address typed into a sign-in form against your rules and cancels the submission before the site’s code sends it. Built-in rules cover personal Google sign-ins, Telegram Web and WhatsApp Web.
- Point at the page to write a rule Admins pick the fields with the extension’s picker, then publish from the console. No selectors to write by hand.
- Rules for files A rule can stop a file by its name, or by the text inside a plain-text file of up to 1 MB, when someone gives it to a page through a file box, a drop or a paste. A file a blocking rule matches never reaches the page. A rule about a file’s text also stops a file LayerT can’t read, such as an image, a PDF, an Office document or anything over 1 MB, and says it couldn’t check it.
- Rules for typed text A rule can act on text typed into the boxes and editors it names. It tells the person, and stops the text being sent with a form, a submit button or Enter. It can’t keep the text out of the page: a page that sends as you type already has it. A typing rule never reads password boxes, one-time-code boxes or fields LayerT filled.
- Rules for a directory group A rule can apply to a directory group, or to everyone outside one. It goes by the person signed in to LayerT in that browser, whatever they type. A change in your directory reaches a running browser within about 15 minutes. A browser that doesn’t know its person’s groups stops the action on pages where a blocking rule names a group.
- Monitor, warn, block, or block with a request Start by watching, then warn or block. Force sign-out clears a site’s session entirely.
- Block, with a way to continue On a form or paste rule you can choose Block (people can continue with a reason). The person sees the block with a box for their reason, and LayerT lets the action through only after the reason is recorded with their name. No approver is involved, and offline it stays blocked. Asking for an exception and continuing with a reason aren’t offered on file or typing rules.
- A warning, not a wall A warn rule shows the message you wrote, with Go back and Continue. Continue sends the form for the person, and that address isn’t warned again in that tab for ten minutes. Both steps land in the audit log.
- Ask for access, get an answer A blocked person explains why. An approver picks a single attempt, 15 minutes, or up to 24 hours. The prompt updates by itself when they decide.
- Approvers hear wherever they are Requests reach approvers in the console Inbox, by email and in Slack. Email buttons open the request and change nothing until the approver confirms. Slack checks every click. Permanent exceptions stay in the console.
- Exceptions belong to Compliance By default, only the Compliance Officer or the Owner can grant a permanent exception, never IT. An Owner can give that right to one named person. Nobody approves their own request.
- Rule matches Every block, warning and monitor as a list, with who, where, and whether they went on after a warning. A reason someone gave to continue past a block shows under Reason given.
- What a matched rule records LayerT reads only the fields your rules name. When a rule matches, LayerT records what matched, and for a typing rule the text of the field, so an auditor can check the decision. A rule can mask or hide its values. For a file rule, what’s recorded is the file’s name, type and size: its text is read in the browser and never sent. No rule reads a password or code that LayerT filled. Tell your people what your rules record.
- What rules can’t see LayerT reads plain text only. It doesn’t look inside PDFs, Office files or images, and it doesn’t read or control the clipboard: a paste rule acts on pastes into the single-line boxes it names. What a page sends by itself in the background, without a form, a paste, a typed field or a file someone gives it, is outside every rule.
- See which browsers are protected Coverage lists each browser with its LayerT version, how the browser says it was installed, and which have gone quiet. A new browser shows on Devices under Waiting for approval, and gets no rules until an Owner or IT Admin approves it.
- Signed policy that fails closed Rules ship as an Ed25519-signed policy, checked in every browser. A browser that can’t get current policy blocks the risky action instead of allowing it.
- An emergency stop The Owner can switch enforcement off across the organisation in one signed step, logged.
For your security review
How it works underneath, written for the people who have to sign it off.
Put a layer on the browser.
LayerT is pre-launch and taking demo requests. Tell us what you want to solve, and we’ll show you the product doing it.
