Security
at Mixlayer.
Your data deserves a secure foundation. We build with privacy in mind, limit access by design, and make our security commitments clear.
How we protect your dataA security program with clear commitments.
Our approved policies define how we protect information, manage risk, and assign responsibility across Mixlayer.
Least privilege
Our Access Control Policy requires access to be based on job responsibilities and business need, with only the permissions necessary to perform the work.
Security by design
Our engineering policies call for secure defaults, multiple layers of protection, and privacy considerations throughout the development lifecycle.
We are working toward SOC 2 and use Vanta to track controls and collect evidence. We do not yet have a completed SOC 2 report to share.
Your data stays yours.
Private inference starts with minimizing what we keep and protecting the data our services handle.
Zero data retention by default
By default, inference prompts and outputs are processed in memory and discarded after inference. We do not use your inputs or outputs to train general-purpose models by default.
Read the retention docsControl over stored content
Optional features, including stored Responses, can retain content. Organization administrators can set a retention window or select Never store for supported APIs. Account, billing, usage, and security records are handled separately under our Privacy Policy, which also explains support, security, and legal retention exceptions.
Encryption and secrets
We use TLS to protect data in transit. Our Cryptography Policy requires encryption of confidential data at rest and restricts access to encryption keys and secrets under our access control requirements.
Security throughout development.
Our development and operations policies establish requirements for changes, testing, and vulnerability management.
Secure development
Our Secure Development Policy requires security testing during the development lifecycle, documented test results before production deployment, and separation of production, staging, and development environments.
Vulnerability management
Our Operations Security Policy calls for vulnerability scanning and monitoring of vendor alerts. Findings are to be evaluated by risk, with remediation plans and timelines documented when standard deadlines cannot be met.
Protection beyond the product.
People, access, and operational readiness are part of the same security program.
Identity and access
Our policies require role-based access and multi-factor authentication for privileged access to production infrastructure. Privileged access must be authorized, and privileged logins and activity must be logged.
Security awareness
Employees and third parties with privileged technical access are required to complete security awareness training when they join and annually thereafter, with guidance appropriate to their roles and data handling responsibilities.
Third-party risk
Our Third-Party Management Policy sets security expectations for service providers and requires risk assessment of cloud services, with annual agreement reviews for inherently high-risk providers.
Incident response and recovery
We maintain an Incident Response Plan and a Business Continuity and Disaster Recovery Plan. These define response responsibilities and recovery planning. Our incident policy requires notification of affected parties in accordance with contractual commitments and applicable requirements.
Clear about privacy.
Understand what information we collect, how we use it, and the choices available to you.
Data handling and your choices
Our Privacy Policy explains data collection, service providers, retention, and how to request access, correction, or deletion of personal information. Our Terms of Service describe the commitments that apply when you use Mixlayer.
Questions or a security concern?
Contact us about our security practices or report a suspected vulnerability. Include the affected service and relevant details, without sending passwords, API keys, or customer data.