Architecture
Sessions and recording
Every use of a shared account is a session you can see and end. Recording, watermarking and gateway routing are there for the accounts that need them, and all three are off until you switch them on.
Describes LayerT as built on 18 September 2026. Anything not built is labelled.
Sessions
A session starts when someone’s use of a shared account is approved (or starts straight away, for one-click accounts) and ends when they sign out, when time runs out, or when an admin ends it.
- The console’s Sessions page lists every session, live ones first: who, which account, when, how long, and how it ended.
- A session counts as live only while it’s active and its end time hasn’t passed. That’s worked out when the list is read, so a late background job can’t make an ended session look live.
- Owners, IT Admins, Compliance Officers, Team Approvers and Auditors can see every session. Everyone else sees their own, and sessions on accounts they own.
Ending a session remotely
- ConsoleEndAn Owner or IT Admin ends a live session and gives a reason.
- LayerT cloudRefuseAt once: no new grants or extensions for that session, and any gateway route is revoked. Logged with the admin and the reason.
- BrowserNoticeWhile a session is live, the extension checks in every minute.
- BrowserSign outLayerT clears the site’s cookies and the tab’s storage, and tells the person an administrator ended their session.
Recording Off by default
Recording is for accounts where a replay is worth having: a finance portal, a social account, a contractor’s access. It’s off for every account until two things are true:
- The Owner has attested in writing that the company has a lawful basis, has done an impact assessment and has consulted worker representatives, or doesn’t need to. The attestation is logged. Withdrawing it switches recording off on every account.
- Recording is switched on for that account by an Owner or IT Admin.
What’s recorded, and what isn’t
LayerT uses rrweb, an open-source recorder, to capture a replay of the page: its structure and text, clicks, scrolling and the timing of network requests. It’s a replay, not a video.
| Captured | Never captured |
|---|---|
| The page’s structure, text and styles | What anyone types: every input is masked |
| Clicks, scrolling, mouse movement | Password, one-time-code and sign-in fields, which are left out completely |
| Which requests were made, their status and timing | Request and response bodies or headers |
| The account’s own site | Other tabs, other sites, anything outside the browser, canvas drawings, images and fonts |
| LayerT’s own prompts |
Recording also pauses while LayerT fills a sign-in form, so the fill itself never appears.
Telling the person
While a session is recorded, the session chip reads “recording”. The first recorded session shows a notice that doesn’t go away by itself. If recording can’t start, the chip says so and the person’s work carries on.
Encryption
- BrowserNew keyThe extension makes a fresh AES-256 key for this recording, kept in session memory only.
- BrowserEncryptEvents are compressed and encrypted in chunks before they leave the browser.
- LayerT cloudWrapThe key is sent once and wrapped immediately. Only the wrapped key is stored.
- Object storageStoreThe bucket holds ciphertext only.
- Each recording has its own key. Each chunk has its own random nonce.
- Chunks waiting to upload are kept encrypted on the device, with a size cap.
- The key-encryption key is held on LayerT’s servers today. Moving it to a managed cloud key service is in progress Coming soon.
Who can watch
- Only the Owner, IT Admins and Compliance Officers.
- Every viewing needs a typed reason and is written to the audit log against the viewer’s name.
Retention
Recordings are kept for 90 days by default. The Owner can choose anything from 7 to 365 days. A daily job deletes expired recordings (the stored chunks first, then their records) and logs each deletion.
Recordings are evidence, not proof
The recorder runs inside the vendor’s page, so a page could in principle interfere with it. Treat a recording as strong evidence of what happened, alongside the audit log, not as tamper-proof proof.
Watermark Off by default
When switched on for an account, LayerT draws a faint, tiled watermark over the vendor’s site with the person’s name, email, a short session ID and the time. It doesn’t block clicks, comes back if the page removes it, and prints.
Gateway routing Early access
Some vendors expect a shared account to come from one known IP address. Gateway routing sends one shared account’s traffic through a LayerT gateway, so the vendor sees a single company address.
- It applies per account, and only while someone has an active session on it. Everything else goes direct.
- TLS stays end to end. The gateway sees which host is being reached, and when, but not the content.
- The gateway asks LayerT’s servers to admit each new connection, so ending a session also ends its route.
- An account can be set to fail closed: if the gateway is unreachable, its traffic stops instead of going direct.