Trust and security: Laya Board for Jira
Where Laya Board for Jira runs, what it stores and never stores, how it uses AI, and answers to common security questions.
Last updated
On this page
Laya Board for Jira adds custom boards and external sharing to Jira Cloud, built on Atlassian Forge. On its own it keeps only its settings, in Atlassian. When you share a board with a guest link, or link your site to a laya.net workspace, it sends board data to laya.net, our own service, hosted on Amazon Web Services in the United States. On every install, upgrade and uninstall it also tells laya.net the Jira site’s id and address, the app version and the event, with no issue or personal data. It has no AI features.
Each Agile Pulse app is built differently, so each has its own trust page; this one covers Laya Board for Jira. Compare all five apps.
At a glance
| Item | Detail |
|---|---|
| Made by | LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse. |
| Marketplace listings | Laya Board (free) |
| Platform | An Atlassian Forge app. Its calls to laya.net are made by its Forge functions, server to server: the board in your browser talks only to Jira and to the app itself. |
| Runs on Atlassian | The app is not Runs on Atlassian: it always sends laya.net install, upgrade and uninstall signals (the site’s id and address, the app version), and board data when you share or link a board. |
| Where data is held | Settings in Atlassian. Shared and linked boards on laya.net, in the United States. Install, upgrade and uninstall signals always go to laya.net. |
| AI | The app has no AI features. |
| Turning AI off | Nothing to turn off: the app has no AI features. |
| Personal data | On laya.net, when you share or link a board: the issues can include people’s names, such as assignees. |
| Atlassian Marketplace programmes | In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified. |
| Security contact | support@laya.net, with "Security report" in the subject line |
Architecture and data flow
How Laya Board for Jira is connected, at a high level: where it runs, where your data goes and who keeps it. Each number matches an entry in the list under the diagram.
In words
- People use Laya Board for Jira inside Jira, signed in with their Atlassian account.
- Laya Board for Jira reads from Jira as it works. In Jira: when the site is linked to a laya.net workspace, changes made on laya.net are written back to Jira through the app. They show in Jira’s history as the Laya Board app by default; members who link their own Jira access on laya.net can choose to have their edits shown as their own.
- On every install, upgrade and uninstall: the app’s Forge functions tell laya.net the Jira site’s id and address, the app version and the event. No issue or personal data. Sent over HTTPS (TLS).
- Only when you share a board with a guest link, or link the site to a laya.net workspace: the app’s Forge functions send that board’s issues to laya.net. For a linked site, the recent comments go with each issue. Sent over HTTPS (TLS).
- Only when the board celebrates finished work: the browser loads GIF images from KLIPY. None of your data: the browser loads images.
- Only for a site linked to a laya.net workspace: changes made on laya.net come back to the app, which writes them to Jira. They show in Jira’s history as the Laya Board app by default.
- Only when you share a board: guests open the guest link and see the board on laya.net, with only the fields you choose. Once the site is linked to a workspace, a guest link can take a password.
The Laya Board for Jira Architecture Diagram and Data Flow has the diagram with a table of what is kept where and how it is protected, and prints as a document for your records.
What we store
When you share or link a board, laya.net keeps the board’s issues, which can include people’s names such as assignees, unless you hide them from a guest link.
In your Atlassian site
- Forge storage: the app’s settings and its link to laya.net.
- Jira itself: when the site is linked to a laya.net workspace, changes made on laya.net are written back to Jira through the app. They show in Jira’s history as the Laya Board app by default; members who link their own Jira access on laya.net can choose to have their edits shown as their own.
On our servers
- A guest link with no linked workspace: a copy of the shared board’s issues, deleted when you uninstall the app.
- A site linked to a laya.net workspace: copies of the connected boards’ issues, and the recent comments the app sends with each issue.
- Every install: the Jira site’s id and address, the app version, and when it was installed, upgraded or uninstalled. No issue or personal data.
What we never store
- Your Jira content, until you share a board or link the site to laya.net.
How AI is used
The app has no AI features and calls no AI service. If your site is linked to a laya.net workspace, laya.net’s own optional AI features belong to that workspace, and laya.net’s Trust Centre covers them.
Turning AI off
The app has no AI features, so there is nothing to turn off.
Where data is held
| What | Provider | Location |
|---|---|---|
| laya.net: install, upgrade and uninstall signals, and the boards you share or link | Amazon Web Services | United States |
The app’s own settings stay in your Jira site, in Atlassian’s Forge storage. Boards you share externally, or link to a laya.net workspace, are held on laya.net in the United States, its one hosting region today: see laya.net’s international data transfers. Atlassian’s data residency settings do not cover data on laya.net.
Connections outside Atlassian
| Address | From | What for |
|---|---|---|
app.laya.net | The app’s Forge functions | laya.net’s API: board data, only when you share a board or link the site. On every install, upgrade and uninstall: the Jira site’s id and address, the app version and the event. |
static.klipy.com | Your browser | GIF images for the celebration when work is done. |
Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Atlassian | Runs the app and its storage, and Jira. | The app’s settings. | Where your Atlassian site is hosted |
| laya.net (run by LayaNet LTD, which also makes this app) | Guest links and linked workspaces. laya.net is our own service, not another company; the companies it uses for that data are in laya.net’s sub-processors. | The boards you share or link. | United States |
| KLIPY | Serves the GIF images the board shows. | None of your data: the browser loads images. | United States |
We update this list at least 30 days before a new sub-processor starts processing your data.
Retention and deletion
- Uninstall: The app tells laya.net, turns off its guest links, removes its link to laya.net and deletes its Forge storage. A guest link’s copy of a board, with no linked workspace, is deleted.
- Deletion: In a linked laya.net workspace, a board’s copy stays until the board is removed or the connection is disconnected: see laya.net’s data retention and deletion.
- Atlassian’s personal data reporting: The app uses Atlassian’s personal data reporting every week, and closed accounts are erased on laya.net.
- Logs: laya.net’s own logging applies to data on laya.net.
- Deletion requests: to ask for your site’s data to be deleted, email privacy@laya.net.
Security practices
- The app’s calls to laya.net are made server to server, never from the board in your browser.
- Guest links show only the fields you choose, and can take a password once the site is linked to a workspace.
- Encryption: All of the app’s connections to laya.net use https. On laya.net, the Security programme applies.
- Atlassian Marketplace programmes: In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Common security questions
Does the AI run on Atlassian, or with an outside provider?
The app has no AI features and calls no AI service. If your site is linked to a laya.net workspace, laya.net’s own optional AI features belong to that workspace, and laya.net’s Trust Centre covers them.
Which data is sent to the AI?
The app has no AI features and calls no AI service. If your site is linked to a laya.net workspace, laya.net’s own optional AI features belong to that workspace, and laya.net’s Trust Centre covers them.
Is our data used to train AI models?
The app has no AI features, and we do not train AI models on your data.
Does the AI provider keep our data?
The app sends nothing to an AI provider.
Can a Jira admin turn AI off for the whole site?
The app has no AI features, so there is nothing to turn off.
Is our data encrypted in transit and at rest?
All of the app’s connections to laya.net use https. On laya.net, the Security programme applies.
Who in our Jira site can use the app and its data?
Inside Jira, the board reads and writes Jira as the person using it, so Jira’s permissions apply. A guest link made before the site is linked to laya.net can never show more than the person who shared it could see in Jira. You choose which fields guests see. Once the site is linked to a workspace, guest links can take a password.
Where is our data held, and can we choose the region?
The app’s own settings stay in your Jira site, in Atlassian’s Forge storage. Boards you share externally, or link to a laya.net workspace, are held on laya.net in the United States, its one hosting region today: see laya.net’s international data transfers. Atlassian’s data residency settings do not cover data on laya.net.
Which sub-processors does the app use?
The app uses Atlassian, laya.net, KLIPY. The Sub-processors table above says what each does, with which data and where.
What happens to our data when we uninstall the app?
The app tells laya.net, turns off its guest links, removes its link to laya.net and deletes its Forge storage. A guest link’s copy of a board, with no linked workspace, is deleted. To ask for your site’s data to be deleted, email privacy@laya.net.
How do we report a security issue or an incident?
Email support@laya.net, with "Security report" in the subject line. Include the steps to reproduce it, and never passwords or tokens. If a security incident affects your data, we tell you without undue delay after we become aware of it, with what we know: what happened, which data was involved, the likely effects and what we have done. Where the full picture is not yet clear, we send what we have and follow up.
Do you hold SOC 2 or ISO 27001?
LayaNet LTD does not hold a SOC 2 report or an ISO 27001 certificate, for this app or any other. The cloud providers we use, such as Atlassian and Amazon Web Services, hold certifications for their own platforms; those cover their infrastructure, not this app or LayaNet LTD. On the Atlassian Marketplace, the app is in Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Contact
- Security: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
- Privacy and deletion requests: privacy@laya.net.
- Support: the Agile Pulse support portal, or support@agilepulse.co.
Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.