Security and trust
Security controls before model execution.
Layer8 Adaptive is designed so authentication, tenant resolution, policy, quotas, redaction, and credential isolation occur before provider routing. This page describes architectural intent and implemented controls without claiming certifications that have not been independently verified.
Tenant-aware access and data boundaries
API keys are hashed, scoped, revocable, and associated with a tenant. Runtime authorization checks tenant status and model permissions. Cache keys and persisted data must retain tenant identity to prevent cross-tenant reuse.
Secrets stay behind the control plane
Provider credentials are referenced through controlled configuration rather than returned to clients. Production deployments should use a managed secret store and separate credentials, databases, queues, and buckets by environment.
- Rate and quota enforcement before provider calls
- Optional prompt logging with conservative defaults
- Signed Stripe webhooks and idempotent event processing
- Dependency, secret, container, and static analysis scanning
Current trust posture
SALTI8 does not currently claim SOC 2, ISO 27001, HIPAA, FedRAMP, or other third-party certification in this repository. Those claims should appear only after the relevant scope has been independently assessed.
Report a security concern
Use the SALTI8 contact form to provide a high-level description and request a secure reporting channel. Do not place credentials, customer data, working exploit code, or sensitive vulnerability details in the public contact form.
Good-faith research must avoid privacy violations, data destruction, persistence, social engineering, denial of service, and access beyond what is necessary to demonstrate the issue. SALTI8 will coordinate scope and remediation directly.
Frequently asked questions
Is Layer8 SOC 2 certified?
No certification claim is currently made. The architecture includes controls that can support a future assurance program, but certification requires independent assessment.
How are API keys stored?
The backend stores a hash and prefix rather than the raw API key and supports revocation and rotation.