Trust & security

Security at Laya Studio: we don’t keep what you send

The short version: we don’t keep what you send, we can’t read your keys, and inference servers are not reachable from the internet directly.

Swiss data residency Report a vulnerability

Last updated October 1, 2026

In one glance

Four promises, in plain words

What happens to your text, your keys, our servers and your card, without the jargon.

Your content is not kept. Text and questions are held in memory only for the duration of inference. They are never written to a database, log or training set.
We can’t read your keys. Keys are shown once at creation. We store only a SHA-256 hash and a short display prefix.
GPUs are not on the open internet. Inference servers accept requests only from our gateway, authenticated with a shared secret.
No card data here. Payments are handled by Stripe; card data never touches our systems.

API keys

The life of an API key

From the moment you create a key to the moment you revoke it, nobody at Laya Studio can read it.

Created. You see the full key exactly once, at creation.
Hashed. We keep only its SHA-256 hash and a short display prefix.
Scoped. Each key belongs to one workspace, always derived from the key, never from the request body.
Revoked. Revocation takes effect within 30 seconds across the edge.

Try it: hash a fake key

The same SHA-256 we run on your key, computed in your browser. Change one character and the whole hash changes; nothing is sent anywhere.

Your API key (shown to you once)

Try typing anything. Hashing happens in your browser; nothing is sent.

SHA-256

What our database stores

…

A hash only goes one way: we can check a key you send, but we cannot turn the hash back into your key.

Infrastructure

Layers between the internet and your data

Each layer only talks to the one next to it.

Layer 1
TLS on every hop
All traffic is TLS-encrypted.
Layer 2
Cloudflare edge gateway
The public API terminates on Cloudflare’s edge, which forwards requests encrypted and does not store their content.
Layer 3
Isolated GPU servers
GPU inference servers accept requests only from our gateway, authenticated with a shared secret over Cloudflare Tunnel or the cloud provider’s authenticated endpoint.
Layer 4
Row-level security
Dashboard data is protected by Postgres row-level security; privileged operations run server-side only.

Payments are handled by Stripe; card data never touches our systems.

Data residency

Processed in Switzerland, stored nowhere

Laya Studio answers your questions on GPUs located in Switzerland, keeps its account database in Zurich, and never writes the content of a request to disk. Turn on Swiss-only mode and a request is only ever answered on GPUs in Switzerland, never by a failover abroad. On the way it is handled in memory by our Cloudflare API gateway at the edge location nearest the caller, which can be outside Switzerland and stores none of the content.

GPUs in Switzerland. Our primary inference pool runs on dedicated GPUs located in Switzerland. Every API response tells you where it was processed in the x-laya-region header.
Swiss-only mode. One switch per workspace (or the x-laya-residency: ch header per request) and requests are only ever answered in Switzerland. If the Swiss pool is unavailable you get an error, never a silent detour abroad. Switching it on applies to keys already in use within about 5 seconds. It is an add-on: +15% credits per request, still below Jev.
Account data in Zurich. Accounts, API keys (stored only as SHA-256 hashes), credit balances and usage metadata live in a Postgres database in the AWS Zurich region (eu-central-2).

See how Swiss data residency works