layahost

Are scope, spend, and authority enforced while the agent runs?

The strongest runtime posture of the three entities scored today, and the only 2. The capture publishes concrete limits enforced per API key at run time - 600 requests per minute by default, a maximum of 32 questions per request and 32,000 characters of text - alongside flow-level spend scoping ("only the questions on the path are billed") and a borderline branch that diverts low-confidence answers to a human. Held to 2 rather than 3 because every one of those is a platform default rather than a customer-configurable policy: no spend ceiling, budget cap or authority scope can be set by the customer, and no behaviour on breach is described. Note these same rate limits were removed from the usage_restrictions field in this run, which asks for prohibited uses under the terms of service; they are genuine evidence here and were simply filed under the wrong question.

Counts Human oversight and Runtime governance, each cited below.

Is there a tamper-evident record of what it actually did?

A retained, reviewable record exists with a stated retention period: logs keep verdicts and metadata for 7 days, with request text logged only if the customer turns it on. Publishing a specific retention window and an opt-in boundary for sensitive content is more than most entities in the index manage, so this is not 0. It is not 2 or 3 because nothing is tamper-evident or hash-chained, no export or customer-review mechanism is described, and 7 days will not survive a dispute that surfaces later than a week - which is the use this dimension exists to measure.

Counts Data handling, each cited below.

Are compliance obligations attached per engagement?

Not nothing, but nothing certified. The page publishes a GDPR-relevant processing posture - Laya served from the vendor's own servers in Helsinki, text processed in memory and never used for training, Cloudflare-served Clef requests disclosed as possibly leaving the EU - and offers a DPA and company invoicing on the Custom plan. A DPA on offer and a disclosed processing location are contractual and factual artefacts, which is why this is 1 rather than 0. No certification, auditor, report date, SOC 2, ISO 27001 or framework attestation appears anywhere in the capture, and no per-engagement compliance schedule is described, so it is nowhere near the top band.

Counts Deployment options, Data handling and Supported regions, each cited below.

Does payment depend on a verified result?

Payment tracks decisions consumed, not decisions that turn out to be right: $15 per million Laya decisions, or per input token for the Clef models, on prepaid credit or a monthly plan. The page's two refinements - failed and rejected requests are free, and only the questions on a flow's path are billed - are billing accuracy, not settlement on a verified outcome, and the vendor is explicit that a decision costs the same whatever the text. Nothing is conditioned on the classification being correct, which is the whole of this dimension.

Rests on Price point and Pricing model, each cited below.

Can the deployment be insured, and is the customer indemnified?

No cover, no carrier, no limit, no customer indemnity and no liability cap appears in the capture. Material in this case rather than routine: the product is sold to sit in front of moderation, PII detection and prompt-injection screening decisions, where a wrong answer is the customer's liability event, and the vendor's own page concedes that Laya trails larger models on hard questions. Nothing is offered against that exposure.

Rests on Insurance available, Insurance carriers, Coverage limits and Indemnification, recorded as undisclosed and cited below. For a 0 that absence is the finding. What a score rests on