Security is the first layer, not an add-on.
We’ve cleaned up hacked small-business sites, so we build like it will be attacked. Here is how the Layered platform protects your business and your customers’ data.
Your data stays yours
Every contractor’s records are kept separate in four independent layers: the web address, strict host rules, a database filter that fails closed, and a guard on raw queries. Crossing between companies is only possible from a short list of admin tools, and every crossing is logged with a reason.
Keys locked in a vault
The keys that connect your software are encrypted (XChaCha20-Poly1305) with a key kept apart from the rest of the app, and they are sent only to the vendor’s own address. Logs and error reports mask keys, tokens and personal data automatically.
Two-step sign-in, everywhere
Every portal and admin sign-in requires a second step. Admin roles must use an authenticator app. Passwords must be 12+ characters and are checked against known breaches, and repeated failed logins are throttled.
Hardened edge and servers
The platform sits behind Cloudflare, sends strict browser security headers on every page, and runs on its own dedicated server. Our marketing sites are static, with no plugins to exploit.
Shadow mode before go-live
New features and new clients run in shadow mode first: every text, booking and email is held and logged instead of sent, then checked against what really happened. Nothing reaches a customer until it matches.
Encrypted backups and an audit trail
Nightly backups are encrypted so that even our own server can’t read them back, and stored off the server. Key changes, permission changes and admin actions are kept in an audit log.
Least privilege, always
We ask for the minimum access each connection needs, and we never ask you to email a password or a key. When a connection is no longer needed, the key is removed and the vendor access is revoked.
Reviewed, not assumed
The platform had a full security review in October 2026, covering company separation, key encryption, sign-in, rate limits, injection, file uploads, webhook signatures and dependencies. Every code finding was fixed and is covered by automated tests that run on every change. Dependency checks run automatically on every code push.
Security questions
Can another contractor on the platform see my data?
No. Every record carries your company’s ID, and the platform refuses any database query that doesn’t name the company it is working for. Asking for another company’s record returns “not found.” This is tested automatically on every code change.
Where are my Housecall Pro and GoHighLevel keys kept?
In an encrypted vault inside the platform, encrypted with a separate key from the rest of the app. Nobody can read a key back out through the portal: pages show only the last four characters. We never ask you to send a key or password by email.
Do you need admin access to my software?
We ask for the least access each connection needs and remove it on request. For the free audit, read-only access is enough.
What happens if I cancel?
You have 90 days to export your data, then it is deleted from the platform. Your domain, phone number and customer data stay yours.
How do I report a security problem?
Email [email protected] with “SECURITY” in the subject. You will get a reply within one business day.
Want a security check on your current stack?
The free Operations Stack Audit includes a look at who has access to what, which logins are shared, and where your customer data really lives. Free. Five business days.
Audit my stack Run the leak calculator