> ## Documentation Index
> Fetch the complete documentation index at: https://docs.layarva.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Understand the security boundaries used by Layarva.

Layarva is a multi-tenant platform. Workspace isolation applies to database access, API authorization, cached data, and mutations.

## Key controls

* API credentials are stored as hashes rather than raw keys.
* Queue API credentials are scoped to a workspace, Queue Unit, permissions, and configured location or category boundaries.
* Publishing pins immutable content versions for Player delivery.
* Device unlock passcodes are stored as salted hashes and are never returned in full after creation.
* Public errors use stable codes while technical diagnostics remain in restricted logs.

Additional device controls include temporary pairing codes, per-Screen and per-Kiosk unlock PINs, a separately audited emergency workspace PIN, request replay protection, and immutable device tokens after pairing.

<Note>
  Never include API keys, pairing tokens, device tokens, or unlock passcodes in screenshots, support messages, or documentation examples.
</Note>

## Related guides

* [Manage Roles and Permissions](/platform/roles-permissions)
* [Secure and Release a Screen](/screens/device-security)
* [Authenticate Queue API Requests](/developers/authentication)
* [Verify Queue Webhooks](/developers/webhooks)