Security & credential handling

VaultLayer runs training jobs on your own cloud (BYOC) or on managed GPU capacity. Here is exactly what it accesses, how credentials are handled, and how compliance works when your training runs in your own cloud — stated plainly, without security theater.

What VaultLayer accesses

Only the credentials you provide, and only to do one thing: provision, run, and tear down the compute for your training job. Under BYOC the job runs on your own cloud account. VaultLayer is a control plane, not a data broker — it does not use your credentials for anything outside running your jobs.

Fail-closed by design

vl run --byoc errors hard and stops if no compute credentials are set — it does not silently fall back to managed capacity, so a job cannot end up running somewhere you did not intend. BYOC jobs run only on the cloud you connected.

Per-job isolation

Each job runs on its own provisioned instance with credentials scoped to that job — you are not sharing a container with other customers, and instances are torn down after the run. For managed runs, checkpoint storage uses short-lived, job-scoped credentials rather than a shared long-lived key.

Compliance & certification

Under BYOC, your training runs inside your own cloud account — AWS, Azure, GCP, or any provider — so it inherits that environment's certifications (SOC 2, ISO 27001, HIPAA-eligibility) and your existing controls, and your data and models never leave your cloud. VaultLayer is the control plane that provisions and orchestrates the run; it does not take custody of your data. For a regulated or audited workload, run it on the certified cloud you already trust — and if you have specific compliance requirements, email the founder and we'll map them to your setup.

Frequently asked questions