Security FAQ

Short answers for buyers — what Layr reads, what it does not, how credentials are protected, how deletion works, and how AI is used.

Sales and security reviewers usually need five answers first. This page covers what Layr does with product data today.

For deeper detail, see Data and privacy and Permissions and access.

What does Layr read?

Only sources your team includes.

Connecting Slack, Jira, Linear, Notion, or Intercom authorizes Layr through OAuth. Layr then discovers available sources (channels, projects, teams, pages, inboxes). New sources start excluded. Sync and ingest run only after an authorized user confirms inclusion and enables specific sources.

When a source is included, Layr may read content from that source — for example Slack channel messages and threads, Jira or Linear issues and comments, Notion pages or database items you shared, and Intercom conversations for an included inbox.

Reading for analysis is the default. Creating a ticket or publishing a page into your tools is a separate, intentional action in Layr.

What does Layr not read?

Out of scope	Meaning
Unconfirmed sources	Discovered but excluded channels, projects, pages, or inboxes are not ingested
Slack direct messages	Current ingest covers channels you include, not DMs
Tool passwords	Layr stores OAuth tokens for the connection, not your password to that tool
Other customers’ workspaces	Product data stays scoped to your workspace

Excluding a source later stops new ingest from that source. Existing history already stored in Layr is managed through your retention and offboarding process — see below.

How are credentials protected?

Secret	How Layr protects it
Integration OAuth tokens	Encrypted at the application layer before storage. Tokens are not kept as plain text in the database
Account passwords	Stored with a one-way password hash. Layr cannot reverse a password from storage
Inbound webhooks	Provider signatures or secrets are verified before event payloads are accepted

Layr does not keep your third-party tool password.

Crypto algorithms, key management, and related controls are available in security review.

How does deletion work?

In product, authorized users can:

Disconnect an integration — Layr stops using that connection for further sync and ingest from that tool
Exclude a source — newly excluded sources stop contributing new evidence
Remove a workspace member — that person loses membership access
Deactivate a user account — active sessions are revoked; the user loses normal product access (reactivation is available for a limited window)

Full workspace or account erasure is handled on request. Contact privacy@uselayr.com. We confirm scope with an authorized admin and walk through what is removed as part of that process.

Legal or billing records we are required to keep may remain in minimized form where the law or payment rules require it.

How is AI used?

Your browser talks to Layr. Layr’s servers call the model provider.

Customers do not send product content from the browser directly to a model API. Features such as embeddings, classification, answers, and drafting run on Layr’s backend.

We do not train Layr models on your product data. Product content is used to operate your workspace (search, recommendations, drafts), not to train shared Layr models.

Named subprocessors, model families, and contractual options for your evaluation are available through privacy@uselayr.com.

Connect one primary tool
Include a small set of high-signal sources only
Keep write-back gated until the workflow feels right
Invite security early if you need a DPA or subprocessor review

Contact

Security review, DPA, subprocessors, or erasure requests: privacy@uselayr.com