Security & Compliance

The questions a security review tends to ask, with concrete answers. For anything not covered here — or for responsible disclosure — email root@semilayer.dev.

Where your data lives

Cryptography

Identity and access

• Authentication. Single sign-on via OIDC (RFC 6749, RFC 8414 discovery, RFC 7519 JWTs). The SaaS plan uses a SOC 2 Type 2 audited IdP; enterprise tenants point at any compliant OIDC provider — Okta, Azure AD, Keycloak, Cognito, Ping, etc. There is no provider-specific SDK in the frontends; swapping IdPs is a configuration change. The SaaS IdP name is disclosed in the DPA on request.
• End-user identity flow-through. When an application embeds SemiLayer queries on behalf of a logged-in end user, the end-user JWT is forwarded to SemiLayer over an X-User-Token header (REST) or userToken parameter (WebSocket) and validated against the application's own JWKS (RFC 7517). Lens-level access rules then evaluate against those validated claims server-side.
• Authorization. Role-based access control across an Organization → Project → Environment hierarchy. Roles: Owner, Admin, Developer, Viewer. Lens-level access is gated by declarative rules per operation (query, search, similar, stream).
• API key types. Four key prefixes, all SHA-256 hashed at rest:
  • sk_… — service key, server-to-server, full read of the environment.
  • pk_… — public key, browser-safe, requires lens-level rules to permit the operation.
  • ik_… — ingest key, write-only via the ingest webhook.
  • rk_… — runner key, used only by the runner-to-gateway WebSocket.
• Tenant isolation. Strict environment-scoped queries on every read path. Vector indexes are isolated per environment at the storage layer, so isolation is enforced below the application — not by query-time filtering.

Network posture

• No inbound to your infrastructure. SemiLayer never opens a connection toward your database. There are exactly two read paths:
  1. Direct (managed-source path). SemiLayer connects outbound to your database from a small set of static egress IPs that we publish at semilayer.dev/ips. You allowlist those IPs in your firewall.
  2. Runner (airgap path). A small process you run inside your network maintains an outbound wss:// connection to runner.semilayer.com. SemiLayer dispatches jobs over the open socket; the runner does the local database connection. Zero inbound to your network. In runner-local credentials mode, SemiLayer never even sees the URL.
• No public database endpoint. The platform database has a private IP only (RFC 1918 range) reachable through private VPC peering. There is no public path into the platform DB — even from our own laptops.
• WebSocket gateway authentication. The runner gateway requires a valid rk_ runner token before completing the WebSocket handshake; internal dispatch from the SemiLayer service is gated by a separate shared bearer rotated at the platform level.

Email security

• SPF, DKIM, and DMARC records are published on semilayer.com and semilayer.dev.
• DMARC policy is p=quarantine with aggregate reports collected.
• DKIM keys follow RFC 6376, including the multi-segment TXT encoding for keys longer than 255 characters.
• No SMTP AUTH endpoint is exposed to the public internet. SaaS outbound mail is API-gated through a SOC 2 Type 2 certified provider; enterprise deployments support BYO SMTP via configuration.

Audit and observability

• Audit log. Every privileged platform-admin action is recorded with actor user, source IP, target, outcome, and timestamp. The same surface is queryable for support investigations and exportable on request.
• Operational logs. Identifiers + correlation IDs only — no user-supplied query content is logged. Default retention is 30 days; configurable for enterprise.
• Health and uptime. Operational status is shared on request during enterprise evaluations and during active incidents. A self-serve public status page is on the roadmap.

Token and credential lifecycle

Backups, durability, and disaster recovery

• Recovery point objective (RPO): ≤ 5 minutes (point-in-time recovery against the platform database).
• Recovery time objective (RTO): ≤ 1 hour for the SaaS multi-tenant deployment.
• Backup retention: 7 days for automated daily backups + PITR. Longer retention available on enterprise contracts.
• Region: Active deployment lives in our US East region. Data residency and active-active multi-region are available on enterprise contracts.

Compliance posture

• SOC 2 Type 2 audit trajectory in Year 1; readiness assessment available on request.
• GDPR compliant by design: data residency selectable in enterprise contracts; data-subject deletion cascades through projects, environments, lenses, sources, keys, and embeddings within the request and out of backups within the PITR retention window.
• Customer data export is available in declarative form via semilayer export config. Vector-data portability is on the Year-1 roadmap.

Subprocessors

Vulnerability disclosure

• Email: root@semilayer.dev. PGP key on request.
• Acknowledgement: within 2 business days.
• Resolution targets: 30 days for high severity, 90 days for medium.
• In scope: the SemiLayer platform, the public runner image, and any first-party package on npm.
• Out of scope: denial-of-service against shared infrastructure, social engineering, or third-party services (please report directly to the relevant subprocessor for those).

Working with us on a security review

The fastest path is usually:

1. Email root@semilayer.dev and tell us what stage your evaluation is at — RFP, vendor onboarding, internal architecture review, etc.
2. We send a CAIQ-style questionnaire pre-filled, the latest SOC 2 readiness statement, and a draft DPA.
3. If your review needs anything not covered above, we schedule a 30-minute call with engineering to walk through it.

We aim to never be the long pole in a customer's procurement timeline.