> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section/trust.md). # Trust and security LayerLens Stratix is built for teams whose AI ships in front of paying customers. That means evaluation data, traces, judge outputs, and audit history are treated with the same care as the production systems they govern. This page is the consolidated security and compliance summary for buyers, IT, and security reviewers. For an in-depth review, contact . For procurement and contract questions, contact . ## Encryption * **In transit:** All traffic between clients, the SDK, the public catalog, and the workspace is TLS 1.2 or higher. Internal service-to-service traffic is mutually authenticated. * **At rest:** All persistent data — evaluation results, traces, judge configurations, datasets, customer-supplied content — is encrypted with AES-256. * **Customer-managed keys:** Available on the Enterprise tier. ## Compliance commitments * **GDPR-aligned data handling** — DPA available; sub-processor list and data-flow diagram available on request. * **CCPA** — consumer-data subject requests are supported through the same flow as GDPR data-subject requests. * **HIPAA** — available on the Enterprise tier with an executable Business Associate Agreement (BAA). PHI workloads must be provisioned under a BAA-enabled tenant before any PHI is sent to the platform. For the current compliance posture and timeline, request the latest summary from . ## Tenant isolation Every record — evaluations, judges, scorers, traces, datasets, API keys, audit events — is scoped to the organization that created it. * **Per-org data scoping** at the database layer with row-level access controls. No application code path returns another organization's data. * **No cross-tenant flow:** A judge built in Org A cannot read Org B's traces. A scorer registered in Org A is not visible to Org B unless explicitly published to the public catalog. * **Workspace isolation:** Each organization is provisioned with its own logical workspace, including its own catalog overlay (private models, private benchmarks, private evaluations). * **Cache and queue isolation:** All caches and processing queues are keyed by organization so that one tenant's burst cannot affect another tenant's latency or quality of service. ## Authentication Three customer-facing authentication paths, all always active: * **Workspace login** (Stratix Premium) — managed identity with email + password, Google OAuth, and GitHub OAuth out of the box. Sessions issued as short-lived JWTs. * **API keys** (SDK, CLI, automation) — created from the workspace, rotated by an admin, scoped to one organization. Old keys remain valid for 24 hours after rotation so deployments can roll forward without downtime. * **Single Sign-On (SSO)** — Enterprise tier. Okta, Azure AD / Entra ID, and any SAML 2.0 or OIDC identity provider. Group-to-role mapping is configurable per organization. Multi-organization users switch between organizations from the workspace picker; every API call carries the active organization context. ## BYOK custom models Customers can register their own OpenAI-compatible endpoints and bring their own provider keys (BYOK). When BYOK is configured: * Keys are encrypted at rest within the customer's tenant boundary. * Keys are used **only** to fulfill that customer's own evaluation, judge, or trace workload. * Keys are never logged, never used outside the requesting organization, and never shared with the Stratix Public catalog. * A customer can rotate or revoke a BYOK key from the workspace at any time; in-flight runs that depend on it will fail closed. ## Audit trail Every meaningful action on the platform is recorded to an append-only audit log: * Evaluation created, started, completed, cancelled * Judge created, updated, run, optimized * Trace ingested * Dataset uploaded or deleted * API key created, rotated, revoked * Organization, team, or role change * BYOK key registered or rotated Workspace admins can view audit history from the Admin section. **Enterprise tier** customers can export the audit log on a schedule (CSV / JSON / Parquet) into their own SIEM or data warehouse. ## Data residency * **Default:** US region. * **Enterprise:** Additional regional residency options on request, including dedicated-tenant deployments and hybrid configurations where evaluation execution runs inside the customer's own VPC. The data-residency story is part of every Enterprise procurement conversation. Reach out to for the current set of supported regions. ## Sub-processors LayerLens Stratix relies on a short list of sub-processors for hosting, identity, and operational telemetry. The current sub-processor list is maintained as part of the DPA and is available to current and prospective Enterprise customers from . The list is versioned; customers under contract are notified before any material change. ## Vulnerability disclosure We welcome responsible disclosure of security issues. Report findings to . Please include: * A description of the issue and the affected surface (catalog, workspace, SDK, API). * Steps to reproduce. * Impact, if known. We will acknowledge receipt within two business days, work with you on a remediation timeline, and credit you once a fix is shipped if you would like to be named. ## Run a security review For a guided security review — questionnaire response, architecture walk-through, sub-processor list, DPA, BAA, contact . For a product demo that includes the security and compliance surface, [schedule a demo](/more-in-this-section/schedule-a-demo.md). ## Where to next * [Schedule a demo](/more-in-this-section/schedule-a-demo.md) * [Pricing — Enterprise tier details](/3.-pricing/enterprise-tier-details.md) * [Three experiences](/1.-introduction/three-experiences.md) * [Brand assets](/more-in-this-section/brand-assets.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section/trust.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.