WinLayer Docs
Product documentation · Beta behavior. A documented path is not production acceptance; availability still depends on source health, workspace plan, provider setup, and deployed evidence.

Security & tenancy

Tenant boundaries, restricted database roles, and audit records are built into the access path.

Two data planes: a shared reference plane for federal market facts and a tenant-scoped plane for workspace records.
The two-plane model: shared federal facts and tenant-scoped workspace data.
Verification status. Forced row-level security and restricted runtime roles pass local isolation checks. Their application and two-tenant exercise in staging, production verification, and independent acceptance remain open.
  • Tenant isolation — tenant-owned tables use tenant_id, forced row-level security, scoped database sessions, and isolation tests.
  • Two data planes — shared federal reference data and tenant data (profiles, pursuits, notes, keys) have separate write and access paths.
  • Authoritative audit history — meaningful user, AI, workflow, integration, configuration, and security actions retain actor, timestamp, entity, reason, request context, and bounded before/after evidence in the owner/admin Audit Center.
  • Credentials — API keys stored as SHA-256 hashes, shown once; webhook secrets per endpoint; cloud secrets live in a secrets manager, never in code.
  • Report sharing — shared reports use 256-bit random bearer tokens with only SHA-256 digests stored, explicit expiry and download permission, immediate revocation, no workspace credential forwarding, and immutable tenant snapshots.
  • Network — the database is not publicly reachable; webhook deliveries are SSRF-guarded; the public API is key-scoped and rate-limited.