Security and data FAQ

Laya is operated from the United Kingdom and hosted on Amazon Web Services in the United States (US East). International transfers are covered by Standard Contractual Clauses and the UK IDTA. See How Laya protects your data.

A durable, synced copy of each item on the boards you choose to connect — fields such as title, status, assignees and dates — kept until you disconnect, when Laya deletes its mirror. Comments are not copied into Laya: they are read live from the source tool when you open an item. See Mirror vs import.

For as long as your account exists — nothing is auto-purged on a schedule. You can request erasure by emailing privacy@laya.net; requests are answered within one month.

No. Laya does not sell your data and does not use your content to train AI models. AI features send only the content you choose to run them on to the AI provider.

Passwords are hashed and never stored in plaintext. Credentials for connected tools — OAuth tokens and API keys — are encrypted at rest with AES-256-GCM and are never returned by the API once saved. See Provider permissions and scopes.

Yes — it is opt-in from the Security page in your account menu. Passkeys (Face ID, Touch ID, Windows Hello or a security key) are the primary factor, an authenticator app is the fallback, and single-use recovery codes cover you if you lose both. Once on, it applies to every sign-in route, including magic links and the "Continue with" buttons. See Two-factor authentication.

The Security page lists your Active sessions with a Sign out button on every other device. Linked sign-in identities are managed at Connected apps, workspace API tokens are revoked from Settings → Access tokens (Owner only), and tool connections are disconnected from workspace Settings. See Sessions and account security.

Email support@laya.net with the details and we will take it from there. For privacy-specific requests, such as data erasure, contact privacy@laya.net.