Laya Export Studio Architecture Diagram and Data Flow
How Laya Export Studio is connected: where it runs, the data that moves, where it is kept and how it is protected, with a diagram to file with your security review.
Last updated
On this page
What this covers: Laya Export Studio on the Atlassian Marketplace (Laya Export Studio for Jira and Confluence), as it works in its current release: where it runs, the data that moves and where it is kept. It is made by LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse.
Last reviewed: 20 October 2026.
Architecture and data flow diagram
In words
- People use Laya Export Studio inside Jira or Confluence, signed in with their Atlassian account.
- Laya Export Studio reads from Jira and Confluence as it works. In Confluence: pages you create by importing a file or publishing Jira issues, and, when governance is used, a page property with its status, review state, classification, word count, next review date and owner. The app writes nothing into Jira.
- Optional: only when someone uses the AI feature and AI assist is on for the site: the app sends Forge LLMs, Atlassian’s AI service, only the fields listed under How AI is used. Never sent: issue content, comments, people’s names or email addresses. Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps no AI answers.
The app connects to nothing outside Atlassian: its Forge permissions allow no outside address.
What is kept, where, and how it is protected
| Data | Where it is kept | How it is protected |
|---|---|---|
| Forge storage: copies of the pages and attachments an export reads, and export job records (both with no expiry); finished Confluence exports (7 days), background Jira exports (6 hours), uploads and PDF tool results (2 hours); brand kits and logos, templates, document sets, the last 50 Jira exports, settings and export counts. Some records hold the account id of the person they belong to. | Inside your Atlassian site: Forge storage | The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center. |
| A PDF export’s password, if you set one: kept with its export job until the file is built, and kept if the job never finishes. | Inside your Atlassian site | The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center. |
| Confluence: pages you create by importing a file or publishing Jira issues, and, when governance is used, a page property with its status, review state, classification, word count, next review date and owner. The app writes nothing into Jira. | Inside your Atlassian site: Confluence | The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center. |
Never kept: Anything outside Atlassian: we run no servers for this app; the AI feature’s answers: they go back to the screen.
Retention and deletion
- Uninstall: The app has no uninstall step of its own. When an app is uninstalled, Atlassian soft-deletes its Forge storage and then deletes it under Atlassian’s own retention policy. A reinstall asked for within 21 days can be relinked to the old data. The governance details it saves on Confluence pages are part of those pages, so this does not cover them.
- Deletion: Some data deletes itself: finished Confluence exports after 7 days, background Jira exports after 6 hours, and uploads and PDF tool results after 2 hours. Copies of exported pages and attachments, export job records and the Jira export history have no expiry. People can delete their brand kits, templates and document sets, and an admin can clear the Jira export history.
- Atlassian’s personal data reporting: The app does not use Atlassian’s personal data reporting yet; it keeps some Atlassian account ids in Forge storage.
- Logs: The app sends no logs or error reports outside Atlassian.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian | Runs the app, its storage and its AI feature (Forge LLMs). | Where your Atlassian site is hosted |
About this document
- This document is drawn from the same records as the Laya Export Studio trust page, and changes when they change.
- Detailed network information is not published, to protect the service.
- Questionnaire references: CAIQ v4 DSP-05 (data flow documentation) and DSP-19 (data location). These are references for your review, not a compliance claim.
- Security contact: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
| Date | Change |
|---|---|
| 20 October 2026 | First published. |
Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.