The problem
An auditor asks who used the payment portal last Tuesday, and who approved it. The vendor’s log says “finance@”. The approval was a chat message. Nobody can say for sure.
How LayerT handles it
- Every decision in one place. Requests, approvals and exceptions go through the console Inbox, with the approver’s name and the reason. Approvers can also decide from email or Slack, and the log records where each decision was made.
- Every session, attributed. Who used which shared account, when, for how long and how it ended.
- Plain words. The audit log is written to be read by an auditor, not decoded by an engineer.
- Recordings where you need them, encrypted, with every viewing logged against the viewer’s name and their reason.
- Separation of duties you can show. IT configures. Compliance grants exceptions. Nobody approves their own request.
- Access reviews on a schedule. Each quarter, every shared account’s owner confirms who still needs it, seeing who actually used it. The result is a printable report and a CSV with a checksum.
Good to know
- LayerT produces evidence for your audits. LayerT itself isn’t certified yet.
- Audit events are kept for 365 days by default. Filter them by person, account, rule or date, and export exactly what you see as CSV or JSON Lines. Every export is itself logged.
- The audit log isn’t tamper-evident yet: it’s protected by access control, and exports carry checksums.
