Skip to main content
This page points to the page that answers each security or privacy question. It also says how long OuterLayer keeps data and how to report a vulnerability.

Find a security or privacy fact

How long data is kept

OuterLayer deletes agent session records automatically after your plan’s retention period. The period is 90 days on Team and the period in your order form on Enterprise. Plans and limits shows the same periods. OuterLayer keeps other organization and account data while your account is open. After an account closes, OuterLayer deletes it as the Data Processing Addendum describes. OuterLayer keeps billing records as long as tax and accounting law requires. It keeps usage data, error reports and logs only as long as they help run, secure and fix the service.

Contracts and vendors

The Privacy Policy says what personal data OuterLayer collects and why. The Data Processing Addendum governs the customer data your organization submits and lists the security measures. The subprocessors page lists the vendors that host and run OuterLayer. To see, correct, export or delete your data, email hello@outerlayer.ai.

Report a vulnerability

Email security@outerlayer.ai. Do not open a public issue for a vulnerability. To encrypt your report, say so in your first message, and OuterLayer sends a key. Include as much of this as you can:
  • What an attacker can do, and what they need to do it.
  • The affected part, such as the dashboard, the gateway or the CLI, and its version.
  • The smallest steps that reproduce the problem.
  • Whether you tested your own deployment, the hosted service or the source.
OuterLayer acknowledges your report within 3 business days. It gives an initial assessment within 10 business days. The assessment states the severity and whether OuterLayer can reproduce the problem. Test against your own local or self-hosted deployment when you can. To test the hosted service, use your own account and your own data, and email first. Do not access another customer’s data, run volume tests or try social engineering. If you reach another organization’s data by accident, stop and tell OuterLayer what you saw. Do not keep it. OuterLayer has no paid bounty program today.