> ## Documentation Index > Fetch the complete documentation index at: https://docs.uselayers.com/llms.txt > Use this file to discover all available pages before exploring further. # Security overview > How Layers protects your store's data and your shoppers' data, covering infrastructure, encryption, access controls, application security, monitoring, and personnel practices. *Last updated: 2026-09-04.* This page describes how Layers secures the platform today. It is an operational overview, not a contractual commitment. For the legal terms that govern your use of Layers, see the [Terms of Use](/legal/terms-of-use) and [Privacy Statement](/legal/privacy-statement). For how AI features handle data, see [AI & your data](/legal/ai-data-use). For retention and deletion, see [Data lifecycle](/legal/data-lifecycle). For how Layers handles production incidents, see [Incident response overview](/legal/incident-response). ## The short version * Layers runs on AWS, in Layers' own account, behind a global edge network. * All data is encrypted in transit and at rest. * Access to production is limited to a small number of engineers, protected by MFA, and reviewed regularly. * Layers undergoes independent third-party penetration testing and is pursuing SOC 2 Type 1 certification. * Every action taken through the Layers dashboard, API, or MCP servers is recorded in a per-store activity log. ## Infrastructure and hosting * **Cloud provider:** Amazon Web Services (AWS). Storefront APIs are served from multiple availability zones behind a global edge network so that most infrastructure failures are absorbed without an incident being declared. * **Data plane:** Storefront traffic terminates at the edge and is served by regional application clusters. Catalog synchronization and dashboard traffic run in the same AWS environment. * **Isolation:** Each store's data is logically isolated. Every request through the storefront APIs, dashboard, and MCP servers is scoped to a single store by the authentication layer. * **Sub-processors:** The full list of infrastructure and service vendors that process data on Layers' behalf is on the [Infrastructure & Sub-processors](/legal/sub-processors) page. ## Encryption * **In transit:** All traffic to Layers, from the storefront pixel and from the dashboard, uses TLS 1.2 or higher. HTTPS is required end to end. Internal service-to-service traffic inside AWS is also encrypted. * **At rest:** All primary databases, object storage, and backups are encrypted at rest using AES-256. Encryption keys are managed by AWS KMS. * **Secrets:** Application secrets and third-party API credentials are stored in a managed secret store, never in source code or configuration files. ## Identity and access ### Customer access to the Layers dashboard * **Authentication:** Dashboard access uses email and password with optional multi-factor authentication (MFA). * **Roles and permissions:** Access is role-based. Roles control what a user can see and change within a store, and permissions can be scoped further at the resource level. Managing users and roles is documented under **Configure → Access & Security** in the dashboard. * **API keys:** Storefront and management API access uses signed keys with configurable scopes. Keys can be rotated at any time from the dashboard. * **Activity log:** Every configuration change and every write action through the API or MCP servers is recorded in the per-store activity log under **Configure → Access & Security → Activity Log**. See [MCP audit log](/developers/mcp-servers#mcp-audit-log) for detail on how agent actions are captured. ### Employee access to customer data * **Least privilege:** Access to production systems is limited to the small number of engineers who need it to operate the service. Most engineering work happens against non-production environments that do not contain customer data. * **Multi-factor authentication:** MFA is required for all internal systems that touch production, including cloud consoles, source control, and the deployment pipeline. * **Auditability:** Production access is logged. Sensitive actions are reviewed after the fact. * **Offboarding:** Access is revoked as part of the departure process on a defined timeline. ## Application security * **Development lifecycle:** All changes to the codebase go through pull request review before merge. Automated tests run on every change, and deployments are automated and repeatable. * **Dependency management:** Third-party dependencies are tracked and automatically monitored for known vulnerabilities. Advisories are triaged and patched on a schedule keyed to severity. * **Static analysis:** Automated static analysis and secret scanning run against every change to catch common classes of issue before merge. * **Environments:** Non-production environments are isolated from production and do not receive real customer data. ## Vulnerability management * **Third-party penetration testing:** Layers engages an independent security firm to test the platform on a recurring basis. Executive summaries and full reports are available under NDA to customers on the [Enterprise Security & Compliance](/legal/compliance#security-documentation) package. * **Responsible disclosure:** Anyone can report a suspected vulnerability through the process on the [Security disclosure](/legal/security-disclosure) page. Layers acknowledges reports promptly and works to resolve confirmed issues on a schedule keyed to severity. * **Remediation:** Confirmed vulnerabilities are triaged into severity tiers and remediated according to internal targets, with the most severe issues addressed first and tracked to completion. ## Monitoring and logging * **Continuous monitoring:** Production is monitored continuously for availability, latency, error rates, and infrastructure health. An on-call engineer is paged for critical alerts 24 hours a day, 7 days a week. Full detail is on the [Incident response overview](/legal/incident-response) page. * **Application logs:** Application logs are retained for 14 days. Error reports and performance traces follow the retention of the monitoring vendors on the [Infrastructure & Sub-processors](/legal/sub-processors) page. * **Customer-facing audit trail:** The per-store activity log described above is the customer-facing record of every configuration and write action. ## Business continuity and disaster recovery * **Redundancy:** Storefront APIs run in multiple availability zones. The catalog mirror can be rebuilt from Shopify at any time, so catalog data is never the limiting factor in a recovery. * **Backups:** Primary databases are backed up automatically, encrypted at rest, and used only for disaster recovery. The backup rotation window and combined deletion timeline are on the [Data lifecycle](/legal/data-lifecycle#backups) page. * **Recovery targets:** Operational recovery time and recovery point targets are published on the [Incident response overview](/legal/incident-response#recovery-targets) page. ## Vendor and sub-processor management Layers uses a limited set of vendors to run the platform, each selected for their own security posture. New vendors that would process customer data go through review before onboarding, and customers are notified in advance of material changes to the sub-processor list. The full list is on the [Infrastructure & Sub-processors](/legal/sub-processors) page. ## Personnel security * **Confidentiality:** Every employee and contractor is bound by a written confidentiality agreement before they are granted any access. * **Security awareness:** Security expectations are covered during onboarding, and all personnel with access to production systems are expected to keep current on the security practices that apply to their role. ## Physical security Layers does not operate its own data centers. Physical security for the systems that host customer data is inherited from AWS. Details are published in AWS's own compliance materials, including its SOC 2 and ISO 27001 reports. ## Questions If a security review needs more detail than this page provides, or you need materials from the [Enterprise Security & Compliance](/legal/compliance#security-documentation) package, contact your account team or [support@uselayers.com](mailto:support@uselayers.com). ## Next steps * [AI & your data](/legal/ai-data-use) for how AI features handle data. * [Data lifecycle](/legal/data-lifecycle) for what is collected and how long it is kept. * [Incident response overview](/legal/incident-response) for how Layers handles production incidents. * [Infrastructure & Sub-processors](/legal/sub-processors) for the full vendor list. * [Compliance](/legal/compliance) for certifications and security documentation availability.