How we protect your data

Encryption

ImageLayer is served over HTTPS/TLS. Password records use bcrypt hashes, and API key values are SHA-256 hashed before database storage. Neon and Cloudflare R2 document managed encryption at rest for their respective database and object storage services. See Neon's security overview and R2 data security.

Authentication & Access Control

Secret API keys authorize server-side access for an organization and must stay on your backend. Publishable widget keys have restricted scope and configured origin checks. Server-issued session tokens identify end users, and organization checks restrict access to their workspace's resources. Workspace email verification is required to create API keys and use authenticated generation flows.

Generated media is delivered through authenticated routes or expiring signed links. Anyone holding a valid signed link can use it until it expires; treat these links as private when sharing or storing them. See the integration documentation for the server-side session flow.

Abuse Prevention

Registration uses Cloudflare Turnstile and IP-based request limits to reduce automated signup abuse. Known disposable-email domains are blocked, and a unique database email constraint rejects duplicate registrations. Security-relevant authentication events are recorded for investigation. These controls reduce abuse risk; they do not guarantee that every automated request will be detected.

Infrastructure

Our platform runs on managed cloud infrastructure. File storage uses access-controlled object storage with signed URLs for generated media delivery. Service credentials control access to the database and object storage. Encryption and access controls address different risks; a signed download link still needs to be kept private.

Data Handling

• ImageLayer does not use your prompts or generated assets to train ImageLayer-owned models; configured AI providers process requests under their applicable terms
• Brand assets are stored in organization-scoped records with access controls
• Temporary media normally has a 72-hour retention target. Accepted media may remain in plan-based archive storage for the period shown in your workspace
• Scheduled cleanup and deletion retries can extend the time before files are removed. Media needed to finish or reconcile an active operation may be retained longer
• Media expiry does not delete all account, billing, or security records. See our Privacy Policy for data handling and deletion requests

API Security

API routes apply request limits and organization-level usage controls. Critical authentication limits deny production requests when the shared limiter cannot provide a valid result; other limits can use a local fallback. Request size limits bound accepted payloads, and error sanitization reduces disclosure of internal details.

The Dashboard lets you create replacement API keys and revoke old ones. Update your integration before revoking a key that it still uses. Security-relevant actions are logged in structured form to support investigation.

Public Configuration Checks

These third-party tools can inspect public transport, certificate and header configuration. Results depend on the scan time and what the scanner can reach; follow the links for the available report or scan options:

External scanners are helpful for transport and header checks, but they are not a substitute for a formal compliance program or independent penetration test.