Enterprise-Grade Security

Security isn't
a feature.
It's every layer.

Your MSP handles sensitive client data every day. LayerOps protects every credential, every action, and every query with a multi-layered security architecture built from the ground up.

AES-256
GCM Encryption
4 Roles
Granular RBAC
3 Layers
Key Hierarchy

Architecture

Three layers of encryption.
Zero points of failure.

Layer 1

Root Key Management

Hardware-backed managed KMS in production. Generates and protects all data encryption keys. Keys never leave the HSM boundary.

Layer 2

Organization Key Wrapping

Each workspace gets a unique Data Encryption Key, wrapped by the root KMS. Key rotation without re-encrypting data.

Layer 3

Per-Credential Encryption

AES-256-GCM with unique initialization vectors per value. Tamper-evident via authenticated encryption. NIST-standardized algorithms throughout.

Unique IV per valueAuthenticated encryptionNIST-standardizedTamper-evident

Security Pillars

Protection at every level.

Credential Vault

  • Every API key, token, and secret encrypted at rest with AES-256-GCM
  • Organization-scoped encryption keys. One workspace can never decrypt another's data
  • Credentials auto-redacted from chat history after integration setup
  • Password fields masked in API responses. Never exposed to the client

Access Control

  • Four default roles: Owner, Admin, Operator, Read-Only
  • Per-integration permission policies. Control who can read vs. write per tool
  • Wildcard expansion: set permissions once, applied to all integrations automatically
  • Live membership verification on every request. No stale session trust

Execution Safety

  • All write operations require explicit user approval before execution
  • Mass-delete and mass-update operations blocked by hardcoded guardrails
  • Batch write limit: max 10 operations per plan to prevent runaway changes
  • Actions stored server-side with 10-minute TTL. Clients only see an action ID

Access Control

Right person.
Right permissions.

Every team member gets a role. Every role maps to specific API verbs per integration. The AI assistant checks permissions before every action. If a read-only user asks to close a ticket, the request is denied before it ever reaches the API.

Per-integration permission policies
Wildcard rules expand to all enabled integrations
Re-validated at approval time, not just request time
Graceful fallback for workspaces without custom roles
Owner

Full platform access. Manages billing, members, and all integrations.

GETPOSTPATCHPUTDELETE
Admin

Full CRUD across all integrations. Cannot manage billing or ownership.

GETPOSTPATCHPUTDELETE
Operator

Day-to-day operations. Can read and create, but not delete.

GETPOSTPATCH
Read Only

View-only access. Cannot modify any data through any integration.

GET

Approval Workflow

AI proposes. You decide.

Every write operation follows the same path: the AI describes what it wants to do, you review, and only then does it execute - with your permissions re-validated at approval time.

01

Request

AI identifies a write operation is needed

02

Validate

RBAC + guardrails check permissions

03

Approve

User reviews and approves the action

04

Execute

Permissions re-verified, then dispatched

Defense in Depth

Security at every boundary.

Multi-Tenant Isolation

Every database query is scoped to the workspace. Cross-workspace access is structurally impossible - enforced by schema constraints, not just application logic.

Credential Redaction

After integration setup, credentials are automatically scrubbed from chat history. Tool call arguments and user messages are both scanned and redacted.

Security Headers

X-Frame-Options: DENY prevents clickjacking. X-Content-Type-Options: nosniff blocks MIME attacks. Strict referrer policy and disabled device APIs.

Audit Trail

Every workflow execution, approval decision, and API call is logged with user, workspace, method, and endpoint. Step-level visibility for investigations.

Session Security

7-day session expiry with daily refresh. 5-minute cookie cache. Live membership verification on every request. No stale session trust.

Data Retention

Webhook events auto-expire after 7 days. Notifications after 14 days. Pending actions expire in 10 minutes. No indefinite data accumulation.

Your data deserves
this level of care.

Start using LayerOps with confidence. Every query encrypted, every action audited, every credential protected.

Get StartedBack to Home