Get in Touch
Tell us about yourself and we will get back to you as soon as we can.
Tell us about yourself and we will get back to you as soon as we can.
Financial data tells the story of your business. We treat it accordingly with strict controls, clear policies, and a genuine commitment to your privacy.
All connections use TLS 1.2 or higher, covering the web app, mobile apps, APIs, QuickBooks integration, and bank connectivity through Plaid. Insecure HTTP is rejected at the network edge.
Customer data is encrypted at rest using AES-256 across primary databases, document and receipt storage, and automated backups. Encryption keys are managed and rotated on a defined schedule.
Production infrastructure runs on AWS in Canada and the United States. Single-tenant architecture ensures each customer's data is logically isolated from all others.
Redundancy is maintained across multiple availability zones to ensure service continuity in the event of a hardware or zone failure.
Encrypted backups run daily and are restorable to a point in time. Backup archives persist for up to 30 days after deletion from primary systems. Recovery procedures are tested as part of regular operational readiness.
Continuous monitoring, logging, and alerting for security events is maintained across infrastructure and application layers.
Periodic security assessments and reviews of systems, codebase, and operational practices are conducted on a regular basis.
User identity is managed by Auth0. Passwords are never stored, logged, or visible to LayerNext at any point.
QuickBooks access is authorized via OAuth 2.0. LayerNext does not store QuickBooks usernames or passwords. You may revoke access at any time through QuickBooks settings.
MFA is available to every customer regardless of plan. MFA is required for all LayerNext internal systems and personnel.
Role-based access controls are enforced for all internal system access across all personnel and service accounts.
Engineering access to production systems follows the principle of least privilege. Routine access to customer data is not granted.
Single-tenant AWS architecture ensures each customer's data is logically isolated. Cross-tenant requests are rejected at the data layer and recorded as exceptions.
All production access for incident response or support is recorded and reviewed. Detailed logs of activities on company resources are maintained and reviewed to identify irregularities.
LayerNext collects only what is needed to provide the subscribed service: bookkeeping automation, bank reconciliation, and financial reporting. Data is not requested or retained beyond that scope.
Account and profile data is retained up to 12 months after account termination. Financial and transaction data is deleted or anonymized within 90 days of termination. Backup archives may persist for up to 30 additional days.
Upon account closure, customer data is removed according to a documented deletion process. Longer retention may apply where required by tax, accounting, or legal obligations.
Customer data can be exported at any time through the Service export features or by contacting support@layernext.ai. Following termination, data is available for export for 30 days before deletion.
LayerNext does not sell personal information or financial data to third parties.
Production and development environments are maintained separately to ensure stability and prevent unauthorized access to live customer data.
LayerNext does not sell personal information or financial data to third parties under any circumstances.
LayerNext does not use third-party advertising cookies and does not allow advertisers to serve targeted ads based on browsing behavior on our platform.
LayerNext uses only strictly necessary, analytics, and preference cookies. No third-party advertising cookies are used or permitted.
Customers may request access to, correction of, deletion of, or export of their personal information. Requests are responded to within 30 days (45 days for California residents under CCPA/CPRA).
California residents have the right to know, correct, delete, and opt out of the sale or sharing of personal information. LayerNext does not discriminate against customers exercising their CCPA/CPRA rights.
Canadian residents have the right to access, correct, and challenge the accuracy of personal information held by LayerNext under PIPEDA.
Affected customers are notified directly and promptly in the event of a confirmed security incident affecting personal data, with known scope, data categories involved, and immediate guidance.
A documented incident response plan covers detection, containment, customer notification, and post-incident review for all potential security incidents.
Continuous monitoring, logging, and alerting for security events is maintained across all infrastructure and application layers.
Affected customers are notified directly and promptly following a confirmed security incident. Notification includes the known scope, data categories involved, and immediate guidance.
After remediation, a written summary covering root cause, timeline, customer impact, and corrective actions taken is provided to affected customers.
Security findings reported to security@layernext.ai are acknowledged within 2 business days with a status update within 10. LayerNext does not pursue legal action against good-faith reporters.
Periodic security assessments and reviews of systems, codebase, and operational practices are conducted to proactively identify and address risks.
LayerNext does not train AI models. Third-party AI services used by LayerNext are configured to not retain or train on customer data. Customer financial data is never used to train any AI model, ours or any third party's.
AI services operate on customer data only to process specific requests such as transaction categorization, reconciliation, and financial insights. Data transmitted to third-party AI services is not stored beyond the duration needed to generate a response.
All third-party AI providers used by LayerNext are contractually configured to not retain or train on customer data. Customer outputs are returned only to the authorized customer.
LayerNext may use anonymized, aggregated, and de-identified usage patterns to improve product features and reliability. This data cannot identify any customer or their business.
We use third-party subprocessors to provide our services. These subprocessors are carefully vetted and are subject to strict data privacy and security requirements.
Company
Category
Purpose
Auth0
Identity
User authentication, password management, and multi-factor authentication workflows.
Amazon Web Services
Hosting
Compute, managed databases, and object storage. Single-tenant infrastructure hosted in Canada and the United States.
ChatGPT
AI processing
Powers transaction categorization, bank reconciliation suggestions, and AI-generated financial insights. Data is transmitted per request and is not retained or used for model training by OpenAI under LayerNext's API agreement.
Intuit (QuickBooks)
Ledger integration
Synchronization of bookkeeping records to the customer's QuickBooks Online account via OAuth 2.0.
Plaid
Bank connectivity
Read-only retrieval of bank and card transactions for accounts the customer has authorized. LayerNext does not receive or store banking credentials.
Stripe
Payments
Subscription billing and payment processing. Payment card details are handled directly by Stripe and are not stored by LayerNext.
Additional providers (analytics, monitoring, email delivery, customer support tooling) are described in the Privacy Policy.
A complete list is available on request at support@layernext.ai.
LayerNext maintains continuous monitoring and a documented incident response plan covering detection, containment, notification, and post-incident review. If a security incident affecting personal data is confirmed, affected customers are notified directly and promptly with known scope, data categories involved, and immediate guidance. A written summary is provided after remediation.
If you have identified a potential security vulnerability in LayerNext, please report it to support@layernext.ai. Reports are acknowledged within two business days. We do not pursue legal action against good-faith researchers.
May 11, 2026
Trust Center published. Controls, subprocessors, incident response, FAQ, and contact information reflecting current practices as of the Privacy Policy and Terms of Service effective date.
March 11, 2026
Privacy Policy and Terms of Service effective. Updated AI data practices, retention schedules, CCPA/CPRA and PIPEDA rights, subprocessor disclosures (AWS, Stripe, Plaid, Auth0, Intuit), and single-tenant infrastructure documentation.
We take every security question, privacy request, and vulnerability report seriously. Reach out and someone on our team will respond directly.