Security
Access down to a single page. Data where you decide.
Permissions and an access log across every product, confidentiality labels for pages and meetings — and the option to keep everything on your own server in an air-gapped network.
01 · Sharing outside
A public link behind a PIN code
A page can be opened by link for people outside the team — and locked with a code.
A PIN code on the public link
Five digits — your own, or random with one button. The code can be changed or deleted at any time.
02 · Audit log
See who opened, who changed and who was denied
Every page has its own audit. On your own server there is also a server-wide log with filters, export and an integrity check.
Who opened the page
How many times it was opened and by how many people, who changed what and when. Filters by period, people and actions.
Who was denied access
The server log has an Access denials filter: who, to which folder or attachment, and when.
Export and integrity check
Export saves the log for the selected period. Check integrity verifies the hash chain, which is turned on in the server settings.
03 · Sign-in
Who signs in, and how
Sign-in with familiar services, access cut off with one button, and tokens with scoped access and an expiry.
Access is cut off with one button
A person’s card in the server panel: sessions with address and expiry, Cut off sessions and Disable access.
API tokens with scoped access and an expiry
Read only, or read and write. Expiry from 7 days to a year, or never.
Everything that protects your data
Access
- Roles: owner, co-owner, admin, member, guest
- Access to an object: view, edit or full
- Inherited permissions, teams and groups
- Invitations with a role, expiry and limit
Confidentiality
- Labels for pages and meetings: participants only · need to know · whole organization · unrestricted
- A label can block meeting recording
- …meeting analysis by external AI
- …and public links
- PINs and one-time codes
Audit log
- Who opened, changed, downloaded
- Who was denied access
- A log of user actions
- Log export to CSV
- A hash chain against tampering — turned on in the server settings
Sign-in
- Google, Yandex, VK, Gosuslugi; Apple in the Mac app
- Admins cut off sessions, block sign-in and see failed attempts
- API tokens: read only or read and write, with an expiry
Storage
- Secrets are encrypted (AES-GCM)
- Self-hosted: data, files and AI stay inside your network
- Local storage or S3
Build
- Secret leak scanning
- A dependency inventory (SBOM)
- A vulnerability scanner
In the browser, on desktop, on your phone or on your own server
Frequently asked questions
Can I keep meeting conversations away from external AI?
Yes. The participants only and need to know labels don’t send the conversation to an external model: meeting transcription and analysis don’t run. Participants only also blocks recording.
Where is the data stored?
In the Layers cloud or on your own server — your choice.
Is there SSO via SAML, LDAP or SCIM?
Not yet. Sign-in is by password, or with Google, Yandex, VK and Gosuslugi.
Bring your team’s work together in Layers
Start free in the cloud — up to 20 people, no time limit — or deploy Layers on your own server.