Trusted with your keys.
To protect your systems, BurstLayer needs access to them. Here is exactly how we hold that access, what we do with it and how you take it back at any moment.
Six promises about your access.
They are part of how BurstLayer is built, so you never have to take them on trust alone.
Read-only by default
Every new connection can only look. BurstLayer cannot change anything until you switch on a specific fix.
You approve each new power
When a fix needs to change something, we ask for that one permission, on that one service, and say why.
Keys sealed per workspace
Your access keys are encrypted with a key that belongs only to your workspace and never leaves tamper-resistant hardware.
Every action on the record
Everything BurstLayer reads or changes is logged with the time, the reason and who approved it.
Your data stays in your region
Choose the European Union or the United States when you sign up. Your logs, findings and keys stay there.
One click to disconnect
A single button removes every connection and stops every agent. Your keys are deleted on the spot.
You see every permission before you give it.
Connecting a service looks like signing in with Google or GitHub. A clear screen lists what BurstLayer will be able to see, and what it will not be able to do.
- Read-only to start, on every service
- Each extra permission is asked for on its own
- Remove access from BurstLayer or from the service itself
BurstLayer wants to connect to your Vercel project “acme-web”.
It will be able to:
- See your deployments
- Read your logs
- See which settings are in use
- Change anythingNot requested
You can remove this access at any time, from BurstLayer or from Vercel.
A signed record of everything we do.
The activity log shows every read and every change, with the reason and who approved it. Each entry is signed, so an edited record would stand out straight away.
- Filter by person, service or action
- Export it whenever you like
- Send it to the log system you already use
Activity log
Today- 14:02Read the latest login recordsServer fra-01 · routine check Signed
- 14:03Blocked an address guessing passwords412 attempts in one minute · your rule Signed
- 14:05Asked to update PHP on 3 serversSecurity fix released this morningWaiting for you
- 14:07Update approved by Maria K.From the Slack alert Signed
- 14:11Updated PHP on 3 serversTested on one server first · can be undone Signed
If something goes wrong on our side, you hear it from us first.
No system is perfect, ours included. This is what we commit to if an incident ever touches your data.
We cut access first
Our first step is to switch off the affected access, even if that means pausing a feature for a while.
We tell you directly
You get a message from a person: what happened, what it reached and what we are doing about it.
We publish what we learned
Afterwards we write up what went wrong and what we changed, in plain words, for every customer to read.
Where we stand on certifications.
We are preparing for SOC 2 Type II and ISO 27001. Until those audits are done, we share our security documents under a confidentiality agreement and answer your security questionnaire ourselves.
Found a weakness in BurstLayer?
Tell us at security@burstlayer.com. We reply to every report, we will not take legal action against research done in good faith, and we will thank you publicly if you would like us to.
- Give us a fair chance to fix it before you share it.
- Don’t open, copy or change other people’s data.
- Don’t run tests that slow down or break the service.
Questions people ask before they connect.
Can BurstLayer staff see my passwords and keys?+
No. Keys are stored encrypted, and the master key that protects them never leaves tamper-resistant hardware. Support staff can see that a key exists and when it was last used, never the key itself.
Where is my data stored?+
In the region you choose when you sign up: the European Union or the United States. It stays in that region.
What happens to my data if I leave?+
Disconnecting deletes your keys straight away. Logs and findings are deleted within 30 days of closing your workspace, and you can export them before you go.
Do you use my data to train AI?+
No. Your logs, code and findings are used only to protect your own systems.
Can BurstLayer break something in production?+
It is built to avoid that. Changes go to a small test group first, every change can be undone, and anything you mark as sensitive waits for your approval.
Protection you can check for yourself.
Start on the free plan with read-only access, read every line of the activity log, and decide from there.