Trust and security: Laya Export Studio
Where Laya Export Studio runs, what it stores and never stores, how it uses AI, and answers to common security questions.
Last updated
On this page
- At a glance
- Architecture and data flow
- In words
- What we store
- In your Atlassian site
- On our servers
- What we never store
- How AI is used
- Model training
- What the AI provider keeps
- Turning AI off
- Where data is held
- Connections outside Atlassian
- Sub-processors
- Retention and deletion
- Security practices
- Common security questions
- Contact
Laya Export Studio turns Jira issues and Confluence pages into documents. It runs entirely on Atlassian Forge: we run no servers for it, and it sends no data outside Atlassian. Its one AI feature uses Forge LLMs, Atlassian’s own AI service for Forge apps.
Each Agile Pulse app is built differently, so each has its own trust page; this one covers Laya Export Studio. Compare all five apps.
At a glance
| Item | Detail |
|---|---|
| Made by | LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse. |
| Marketplace listings | Laya Export Studio for Jira and Confluence (paid) |
| Platform | An Atlassian Forge app for Jira and Confluence with no outside connections: its Forge permissions allow none, and our build refuses a change that adds one. |
| Runs on Atlassian | The Marketplace listing shows Atlassian’s Runs on Atlassian badge. |
| Where data is held | Atlassian’s cloud only, following your site’s data residency. We run no servers for it. |
| AI | Atlassian’s Forge LLMs, inside Atlassian. |
| Turning AI off | A Jira admin setting, enforced by the app. |
| Personal data | Some Atlassian account ids, and names in copied pages, in Atlassian’s Forge storage. |
| Atlassian Marketplace programmes | In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified. |
| Security contact | support@laya.net, with "Security report" in the subject line |
Architecture and data flow
How Laya Export Studio is connected, at a high level: where it runs, where your data goes and who keeps it. Each number matches an entry in the list under the diagram.
In words
- People use Laya Export Studio inside Jira or Confluence, signed in with their Atlassian account.
- Laya Export Studio reads from Jira and Confluence as it works. In Confluence: pages you create by importing a file or publishing Jira issues, and, when governance is used, a page property with its status, review state, classification, word count, next review date and owner. The app writes nothing into Jira.
- Optional: only when someone uses the AI feature and AI assist is on for the site: the app sends Forge LLMs, Atlassian’s AI service, only the fields listed under How AI is used. Never sent: issue content, comments, people’s names or email addresses. Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps no AI answers.
The app connects to nothing outside Atlassian: its Forge permissions allow no outside address.
The Laya Export Studio Architecture Diagram and Data Flow has the diagram with a table of what is kept where and how it is protected, and prints as a document for your records.
What we store
All of it stays inside Atlassian. Some of the app’s Forge storage records the Atlassian account id of the person it belongs to, such as an export job’s owner. The copies of exported pages it keeps can include people’s account ids and names, from mentions, and a page’s governance details name its owner.
In your Atlassian site
- Forge storage: copies of the pages and attachments an export reads, and export job records (both with no expiry); finished Confluence exports (7 days), background Jira exports (6 hours), uploads and PDF tool results (2 hours); brand kits and logos, templates, document sets, the last 50 Jira exports, settings and export counts. Some records hold the account id of the person they belong to.
- A PDF export’s password, if you set one: kept with its export job until the file is built, and kept if the job never finishes.
- Confluence: pages you create by importing a file or publishing Jira issues, and, when governance is used, a page property with its status, review state, classification, word count, next review date and owner. The app writes nothing into Jira.
On our servers
Nothing: we run no servers for this app.
What we never store
- Anything outside Atlassian: we run no servers for this app.
- The AI feature’s answers: they go back to the screen.
How AI is used
AI runs on Atlassian. The app uses Forge LLMs, Atlassian’s AI service for Forge apps. It sends nothing to an AI provider of its own, and no data leaves Atlassian for AI.
| Feature | When it runs | What is sent | What we keep |
|---|---|---|---|
| AI JQL assist (Jira export) | When someone using the Jira export’s search asks it to write a query, and on its own when they type a query Jira finds invalid (a “did you mean” suggestion). | The words typed, or the query to fix with its error messages, and the site’s status, issue type and priority names and project keys. | Nothing: the answer goes back to the screen. A count of each person’s requests is kept for 2 hours, for the hourly limit. |
Never sent: issue content, comments, people’s names or email addresses. The words someone types into the request are sent as typed.
Model training
Atlassian has said, in its developer community, that prompts and answers sent through Forge LLMs are not used to train models, by Atlassian or by its sub-processors. We do not train or fine-tune any AI model on your data.
What the AI provider keeps
Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps no AI answers.
Turning AI off
A Jira admin can turn AI assist off for the whole site in the app’s admin settings, and the app then refuses every AI request. It is on until an admin turns it off.
Each person can make up to 20 AI requests an hour.
Where data is held
Everything stays in Atlassian’s cloud, in Forge storage and in your Atlassian site. The app’s stored data follows your Atlassian site’s data residency: Atlassian keeps Forge-hosted storage in the same location as your site and moves it with your site (Atlassian’s documentation). AI requests are processed inside Atlassian’s platform.
Connections outside Atlassian
The app connects to nothing outside Atlassian: its Forge permissions allow no outside address.
Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Atlassian | Runs the app, its storage and its AI feature (Forge LLMs). | Everything the app keeps. | Where your Atlassian site is hosted |
We update this list at least 30 days before a new sub-processor starts processing your data.
Retention and deletion
- Uninstall: The app has no uninstall step of its own. When an app is uninstalled, Atlassian soft-deletes its Forge storage and then deletes it under Atlassian’s own retention policy. A reinstall asked for within 21 days can be relinked to the old data. The governance details it saves on Confluence pages are part of those pages, so this does not cover them.
- Deletion: Some data deletes itself: finished Confluence exports after 7 days, background Jira exports after 6 hours, and uploads and PDF tool results after 2 hours. Copies of exported pages and attachments, export job records and the Jira export history have no expiry. People can delete their brand kits, templates and document sets, and an admin can clear the Jira export history.
- Atlassian’s personal data reporting: The app does not use Atlassian’s personal data reporting yet; it keeps some Atlassian account ids in Forge storage.
- Logs: The app sends no logs or error reports outside Atlassian.
- Deletion requests: to ask for your site’s data to be deleted, email privacy@laya.net.
Security practices
- The app makes no outside connections: its Forge permissions allow none, and our build refuses a change that adds one.
- It carries Atlassian’s Runs on Atlassian badge.
- Encryption: The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center.
- Atlassian Marketplace programmes: In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Common security questions
Does the AI run on Atlassian, or with an outside provider?
AI runs on Atlassian. The app uses Forge LLMs, Atlassian’s AI service for Forge apps. It sends nothing to an AI provider of its own, and no data leaves Atlassian for AI.
Which data is sent to the AI?
AI JQL assist (Jira export): The words typed, or the query to fix with its error messages, and the site’s status, issue type and priority names and project keys. Never sent: issue content, comments, people’s names or email addresses. The words someone types into the request are sent as typed.
Is our data used to train AI models?
Atlassian has said, in its developer community, that prompts and answers sent through Forge LLMs are not used to train models, by Atlassian or by its sub-processors. We do not train or fine-tune any AI model on your data.
Does the AI provider keep our data?
Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps no AI answers.
Can a Jira admin turn AI off for the whole site?
A Jira admin can turn AI assist off for the whole site in the app’s admin settings, and the app then refuses every AI request. It is on until an admin turns it off. Each person can make up to 20 AI requests an hour.
Is our data encrypted in transit and at rest?
The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center.
Who in our Jira site can use the app and its data?
The app opens inside your Jira or Confluence site, for people signed in to it. Only Jira admins can change its site settings, including AI assist.
Where is our data held, and can we choose the region?
Everything stays in Atlassian’s cloud, in Forge storage and in your Atlassian site. The app’s stored data follows your Atlassian site’s data residency: Atlassian keeps Forge-hosted storage in the same location as your site and moves it with your site (Atlassian’s documentation). AI requests are processed inside Atlassian’s platform.
Which sub-processors does the app use?
The app uses Atlassian. The Sub-processors table above says what each does, with which data and where.
What happens to our data when we uninstall the app?
The app has no uninstall step of its own. When an app is uninstalled, Atlassian soft-deletes its Forge storage and then deletes it under Atlassian’s own retention policy. A reinstall asked for within 21 days can be relinked to the old data. The governance details it saves on Confluence pages are part of those pages, so this does not cover them. To ask for your site’s data to be deleted, email privacy@laya.net.
How do we report a security issue or an incident?
Email support@laya.net, with "Security report" in the subject line. Include the steps to reproduce it, and never passwords or tokens. If a security incident affects your data, we tell you without undue delay after we become aware of it, with what we know: what happened, which data was involved, the likely effects and what we have done. Where the full picture is not yet clear, we send what we have and follow up.
Do you hold SOC 2 or ISO 27001?
LayaNet LTD does not hold a SOC 2 report or an ISO 27001 certificate, for this app or any other. Atlassian holds certifications for its own cloud platform, on which this app runs; those cover Atlassian’s platform, not this app or LayaNet LTD. On the Atlassian Marketplace, the app is in Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Contact
- Security: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
- Privacy and deletion requests: privacy@laya.net.
- Support: the Agile Pulse support portal, or support@agilepulse.co.
Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.