Control document data
across its full lifetime
Manage storage retention, isolate capture credentials, restrict workspace access with enterprise SSO, and maintain append-only audit trails.
Free account, no credit card
Set the boundary for each request
Authorize the request
Use an organization-managed key or service identity with the scope the workflow needs. Keep human membership and unattended automation separate.
Isolate the job
A capture runs in its own browser session. Cookies, headers, and credentials are scoped to the job, while secret values are redacted from covered operational logs.
Choose delivery and retention
Return output in the response, deliver it to a configured storage destination, and use signed webhooks for status. Select managed storage or secure-mode behavior for the request.
Decide where the finished file lives
While managed CDN links are convenient, strict privacy requirements often demand that sensitive files never persist on third-party infrastructure. Choose the storage model that matches your compliance requirements: stream bytes directly, use cloudlayer.io temporary storage, or forward renders directly to your private buckets.
Set that behavior on the request. A PDF, image, or capture can return in the response or move to a configured destination. Secure mode provides the separate path for work that must not retain managed output.
This choice changes the work your team must do. A response body puts storage entirely in the caller's hands. Managed storage gives the application a file to retrieve later. An external destination brings the output under your cloud account, but it also makes your bucket credentials and policy part of the delivery path. Pick the model on purpose, then test who can read the result and when it disappears.
- Private S3 delivery supports a chosen storage class for active or archived output
- Your destination applies its own bucket policy, lifecycle rules, and access logs
- Test destination failures and documented fallback behavior before production use
Signed webhooks let the receiving endpoint verify a callback before acting on it. Treat them as notifications, not as a durable queue: the current webhook delivery makes one attempt. Read job state from the Jobs API when the receiver missed an event.
Apply retention by data type
Output files, form submissions, capture credentials, and audit events serve different purposes. Choose the storage and deletion rule for each one instead of applying a single lifetime to the whole account. Select a data type below to see its governing control.
Start with the business reason for keeping each record. A file used only in a synchronous response may need no managed lifetime. A submission used by support may need time for a case to close. Audit events may need a longer policy because they explain changes to both. Clear rules reduce old data without removing evidence that an active process still needs.
A PDF or image returned by a render request. Choose its delivery and managed-storage behavior for each job.
- Made The request combines a template with input data to create the requested output.
- Delivered Return it in the response or send it to Amazon S3, Google Cloud Storage, Azure Blob Storage, Cloudflare R2, Backblaze B2, or DigitalOcean Spaces. S3 supports private delivery and storage-class selection.
- Held Managed storage is selected per request. Own-bucket delivery follows its documented success and failure behavior.
- Gone Documented purge timing governs managed output. Secure mode is the path for a job that must not retain it.
The control you get: Secure mode, managed storage, or configured destination delivery.
Write down the owner of each rule and test it with sample data. Confirm when the record appears, who can find it, and what deletion removes. Repeat the test when the workflow adds a form, webhook, or storage destination. Retention works best as part of the design, not as a clean-up task after sensitive data has spread.
Combine identity policy with scoped access
A role states what a person can do; its scope states where. Apply roles at the organization, workspace, or team boundary and review both direct and inherited access. Entitled plans can add custom roles and permission bundles for more specific operating models.
Signing in
- SAML and OIDC single sign-on with verified domains
- Multiple identity providers for organizations that need separate policies
- Single sign-on optional or enforced, per domain or per group
- Just-in-time provisioning, or SCIM for people and groups
- A controlled administrator recovery path for identity-provider outages
Staying signed in
- Two-factor authentication set through organization policy
- Session duration and reauthentication policies you choose
- API keys, webhooks and destinations administered centrally
- Service identities for automation, kept separate from human membership
- External sharing and public links governed by organization policy
Organization-owned resources remain when a member is removed. Transfer last-owner duties and replace personal credentials before completing offboarding. See how roles and workspaces fit together.
Roll identity changes out in stages. Verify the domain, connect the provider, and test a small group before requiring SSO for everyone. Check how a new user enters, how a group change affects access, and how a removed user loses it. Keep the recovery path controlled and tested so the team is not forced to weaken policy during an outage.
Reduce what a compromised key can reach
Secret storage matters, but so do scope, inventory, and revocation. A key can still appear in source control, a support ticket, or an application log. Prepare for that case by limiting its reach and keeping a clear path to replace it.
Keep keys under organization administration and give each automation a service identity. Scope credentials to the resources the workflow needs, then rotate and revoke them without relying on a human account's lifecycle.
Give each credential one job and an owner. Record where it is used, choose a rotation date, and make replacement part of the runbook. When a key appears where it should not, the first step should be revocation, not a search for every system that might depend on it. A smaller scope and a current inventory make that response faster.
What limits the damage
- Organization isolation prevents a key from crossing into another customer account
- Central administration provides an inventory of keys, webhooks, and destinations
- An administrator can revoke the exposed credential and issue a replacement
- A service identity keeps automation separate from a member who may leave
What you can show afterwards
- Covered credential creation, change, and revocation actions produce audit events
- Event search and export help build an incident timeline from account records
- The credential inventory and audit trail support review without claiming they capture activity outside the platform
Practice the response before a real key leaks. Revoke a test key, issue its replacement, update the calling service, and confirm that the old key stays rejected. Check the audit trail and job results during the exercise. The goal is a short window between discovery and containment, with enough evidence to explain what changed. If one credential powers many unrelated jobs, split it before an incident makes that dependency costly.
Control inbound access and outbound capture requests
A capture job makes an outbound request to the URL you provide, while members and API clients make inbound requests to the account. Review the controls on both sides of that boundary.
Outbound, from a capture
- SSRF and destination controls restrict requests to disallowed targets
- Authenticated proxy configuration for publicly reachable pages, with geography selection by plan; it does not provide access to a private network
- A proxy failure follows documented behavior instead of silently changing routes; proxy secrets are redacted from covered operational logs
- Optional ad, font, and script blocking limits selected third-party requests
Inbound, into your account
- Network and IP access policy at the organization level
- Session duration and reauthentication set as policy rather than per person
- Two-factor recovery codes and a controlled administrator recovery path
- Owner-transfer rules that require another owner before the last one is removed
Regional processing and storage options depend on the contracted service. Confirm the region, data path, and exceptions your review requires before implementation.
A proxy changes the route to a public page; it does not join your network. If a capture needs an internal hostname or a service that is reachable only through your VPN, proxy configuration on this platform is not the answer. Keep that boundary explicit in the design. For public pages that vary by country, choose the required proxy geography and test the page from that route before scheduling production captures.
Bring concrete controls to the security review
Administrative event history
Covered administrative and security actions create append-only events. Search, filter, and export them within the account's retention policy for review and investigation.
Retention and legal hold
Set automatic deletion for form submissions and retention rules for covered records. A contracted legal hold overrides routine deletion for the data within its scope.
Capture-secret handling
Capture cookies, headers, and authentication stay with the isolated job. Secret values are redacted from covered operational logs. Rotate credentials through your own secret process.
Protected documents and forms
Add password protection to a generated PDF when the delivery path requires it. Forms can encrypt collected data when the workflow calls for that control.
Tokenized payment fields
A supported payment field sends card details to the payment gateway for tokenization. Use the returned token in the workflow instead of placing the raw card number in form data.
A shorter processor path
Collection, design, generation, signing, and delivery can stay in one workflow. Count the processors used by your actual configuration, including storage and payment providers.
Separate product controls from attestations
A product control and an independent attestation answer different questions. This page describes configurable behavior in the platform. It does not imply a certification or audit report that is not named and available for review.
Ask us to demonstrate the controls your design depends on, including:
- secure-mode output behavior and an own-bucket delivery
- secret redaction and audit-event export
- single sign-on policy for a verified domain
Name the report or attestation your review requires and ask for its current status. Do not treat a demo of a control as evidence that an outside auditor certified the wider program.
Contracted figures such as retention periods, service levels, and regional terms belong in the plan or agreement that governs the account. Review current plan inclusion on the pricing page and confirm security-specific terms before purchase.
Keep the review tied to the workflow you will run. Ask for the path of the input, output, credentials, and event records. Test deletion and failed delivery as well as the happy path. Record which controls come from the product, which come from your configuration, and which depend on a contract. That produces a useful decision even when a checkbox list uses different names for the same control.
Security and data-handling questions
Can I stop you storing the output at all?
Yes. You can disable storage per request with storage: false to ensure zero retention in our infrastructure. You can also stream files directly in the API response or deliver them straight to your own S3, GCS, Azure, or R2 cloud bucket.
Where is my data processed?
Processing and storage region options depend on the contracted service and the region you need. Confirm the available region, data path, and any exceptions during review before building a residency requirement around it.
What happens to credentials I give a capture?
Cookies, headers, and authentication are scoped to the capture job and run in an isolated browser session. Secret values are redacted from covered operational logs. Use short-lived credentials where possible and rotate them through your normal secret-management process.
What does the audit trail record?
Covered administrative and security actions create append-only events with an actor, action, target, and time. Search, filter, and export events within the retention policy. A contracted legal hold can override routine deletion for the records it covers.
Do you support our identity provider?
Enterprise identity controls include SAML and OIDC for verified domains, optional or required SSO policies, more than one provider, just-in-time user creation, and SCIM for users and groups. Confirm the plan and rollout policy that fit your organization.
Are you SOC 2 certified?
Cloudlayer has not obtained a SOC 2 report. Do not infer certification from the controls on this page.
You get single sign-on, provisioning, and audit controls on Business, from $89 a month for 20,000 renders. Plan entitlement changes which identity and governance controls are available. Confirm the required tier before rollout. Plans open at $9 a month for 1,000 renders, and the free account needs no card. See what each plan includes.
Start generating documents
in minutes
Sign up, build something real, and move to a paid plan only when you need more capacity.
No credit card required.
Trusted by teams at