Trust & security

Security at Laya Studio: we don’t keep what you send

The short version: we don’t keep what you send, we can’t read your keys, and inference servers are not reachable from the internet directly.

Swiss data residencyReport a vulnerability

Last updated September 23, 2026

In one glance

Four promises, in plain words

  • Your content is not kept

    Text and questions are held in memory only for the duration of inference. They are never written to a database, log or training set.

  • We can’t read your keys

    Keys are shown once at creation. We store only a SHA-256 hash and a short display prefix.

  • GPUs are not on the open internet

    Inference servers accept requests only from our gateway, authenticated with a shared secret.

  • No card data here

    Payments are handled by Stripe; card data never touches our systems.

API keys

The life of an API key

From the moment you create a key to the moment you revoke it, nobody at Laya Studio can read it.

  1. 1

    Created

    You see the full key exactly once, at creation.

  2. 2

    Hashed

    We keep only its SHA-256 hash and a short display prefix.

  3. 3

    Scoped

    Each key belongs to one workspace, always derived from the key, never from the request body.

  4. 4

    Revoked

    Revocation takes effect within 30 seconds across the edge.

Try typing anything. Hashing happens in your browser; nothing is sent.

SHA-256

What our database stores

…

A hash only goes one way: we can check a key you send, but we cannot turn the hash back into your key.

Infrastructure

Layers between the internet and your data

Each layer only talks to the one next to it.

  1. Layer 1

    TLS on every hop

    All traffic is TLS-encrypted.

  2. Layer 2

    Cloudflare edge gateway

    The public API terminates on Cloudflare’s edge, which forwards requests encrypted and does not store their content.

  3. Layer 3

    Isolated GPU servers

    GPU inference servers accept requests only from our gateway, authenticated with a shared secret over Cloudflare Tunnel or the cloud provider’s authenticated endpoint.

  4. Layer 4

    Row-level security

    Dashboard data is protected by Postgres row-level security; privileged operations run server-side only.

Payments are handled by Stripe; card data never touches our systems.

Data residency

Processed in Switzerland, stored nowhere

Laya Studio answers your questions on GPUs located in Switzerland, keeps its account database in Zurich, and never writes the content of a request to disk. Turn on Swiss-only mode and a request can never leave the country, not even as a failover.

  • GPUs in Switzerland

    Our primary inference pool runs on dedicated GPUs located in Switzerland. Every API response tells you where it was processed in the x-laya-region header.

  • Swiss-only mode

    One switch per workspace (or the x-laya-residency: ch header per request) and requests are only ever answered in Switzerland. If the Swiss pool is unavailable you get an error, never a silent detour abroad. It is an add-on: +15% credits per request, still about 20% below Jev.

  • Account data in Zurich

    Accounts, API keys (stored only as SHA-256 hashes), credit balances and usage metadata live in a Postgres database in the AWS Zurich region (eu-central-2).

See how Swiss data residency works

Responsible disclosure

Reporting a vulnerability

Email security@laya.studio. We acknowledge reports within two business days.

Email the security team

See also our privacy policy and nFADP and GDPR notes.