Trust and security: Laya WorkflowOS
Where Laya WorkflowOS runs, what it stores and never stores, how it uses AI, and answers to common security questions.
Last updated
On this page
- At a glance
- Architecture and data flow
- In words
- What we store
- In your Atlassian site
- On our servers
- What we never store
- How AI is used
- Model training
- What the AI provider keeps
- Turning AI off
- Where data is held
- Connections outside Atlassian
- Sub-processors
- Retention and deletion
- Security practices
- Common security questions
- Contact
Laya WorkflowOS automates Jira with rules, reports and AI help. It runs entirely on Atlassian Forge: we run no servers for it, and it sends no data outside Atlassian. Its AI features use Forge LLMs, Atlassian’s own AI service for Forge apps.
Each Agile Pulse app is built differently, so each has its own trust page; this one covers Laya WorkflowOS. Compare all five apps.
At a glance
| Item | Detail |
|---|---|
| Made by | LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse. |
| Marketplace listings | Laya WorkflowOS (paid) |
| Platform | An Atlassian Forge app for Jira with no outside connections: its Forge permissions allow none. |
| Runs on Atlassian | The Marketplace listing shows Atlassian’s Runs on Atlassian badge. |
| Where data is held | Atlassian’s cloud only, following your site’s data residency. We run no servers for it. |
| AI | Atlassian’s Forge LLMs, inside Atlassian. |
| Turning AI off | A Jira admin setting, enforced by the app for every AI feature. |
| Personal data | Rule owners’ Atlassian account ids, and names in reports, in Atlassian’s Forge storage. |
| Atlassian Marketplace programmes | In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified. |
| Security contact | support@laya.net, with "Security report" in the subject line |
Architecture and data flow
How Laya WorkflowOS is connected, at a high level: where it runs, where your data goes and who keeps it. Each number matches an entry in the list under the diagram.
In words
- People use Laya WorkflowOS inside Jira, signed in with their Atlassian account.
- Laya WorkflowOS reads from Jira as it works. In Jira: whatever your rules do, such as field changes, comments, transitions and new issues, made by the app. Emails a rule sends go through Jira’s own notifications.
- Optional: only when someone uses an AI feature, or a report with AI summary ticked is made, and AI assist is on for the site: the app sends Forge LLMs, Atlassian’s AI service, only the fields listed under How AI is used. Nothing is sent outside Atlassian for AI. Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps an AI answer only where it is saved: in a rule someone saves, in a report file for 24 hours, or in the conflict scan results for 24 hours.
The app connects to nothing outside Atlassian: its Forge permissions allow no outside address.
The Laya WorkflowOS Architecture Diagram and Data Flow has the diagram with a table of what is kept where and how it is protected, and prints as a document for your records.
What we store
All of it stays inside Atlassian. Each automation rule keeps the Atlassian account id of the person who made it, the audit log records who made each change, and reports can include people’s names from Jira, such as assignees.
In your Atlassian site
- Forge storage: automation rules (with the account id of the person who made each) and their last 20 versions, run logs (rule, issue key, trigger, result and errors), an audit log of changes (with who made them), settings, saved searches, schedules, AI usage counts, export and report jobs, and export files (kept for 24 hours).
- Jira itself: whatever your rules do, such as field changes, comments, transitions and new issues, made by the app. Emails a rule sends go through Jira’s own notifications.
On our servers
Nothing: we run no servers for this app.
What we never store
- Anything outside Atlassian: we run no servers for this app.
How AI is used
AI runs on Atlassian. The app uses Forge LLMs, Atlassian’s AI service for Forge apps. It sends nothing to an AI provider of its own, and no data leaves Atlassian for AI.
| Feature | When it runs | What is sent | What we keep |
|---|---|---|---|
| Build a rule from plain English | When someone building rules asks. | The request typed, and the site’s issue type, status and priority names and project keys. | The rule, if the person saves it. |
| Migrate a ScriptRunner script or Automation rule | When someone migrating rules pastes one in. | The pasted script or rule (up to 6,000 characters) and the site’s project keys. | The new rule, if the person saves it. |
| Explain a rule or a failed run | When someone viewing rules or run logs asks. | The rule’s full settings, including its JQL and any comment or email text; or, for a failure, the rule’s name, the issue key, the trigger, the error text and the failed steps. | Nothing: the answer goes back to the screen. |
| Describe or fix a JQL query, find a template, detect rule conflicts | When someone using these tools asks. The “did you mean” fix also runs on its own when someone types a query Jira finds invalid. | The words typed or the query to fix with its errors, and the site’s names; the search words and the built-in template list; or the rules’ names, trigger types and action types. | Conflict scan results, for 24 hours. The other answers go back to the screen. |
| AI summary on reports | When a report with AI summary ticked is made: from the Exports tab, where it is ticked by default, from scheduled reports, and from rules that make a report. The built-in weekly report template has it ticked. | A digest of the report: its title, key figures and up to 10 rows per section, which can include people’s names, such as assignees. | The summary, as part of the report file, for 24 hours. |
Nothing is sent outside Atlassian for AI. Text people type or paste into a request is sent as typed.
Model training
Atlassian has said, in its developer community, that prompts and answers sent through Forge LLMs are not used to train models, by Atlassian or by its sub-processors. We do not train or fine-tune any AI model on your data.
What the AI provider keeps
Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps an AI answer only where it is saved: in a rule someone saves, in a report file for 24 hours, or in the conflict scan results for 24 hours.
Turning AI off
A Jira admin can turn AI assist off for the whole site in the app’s admin settings. While it is off, the app refuses every AI request, including AI summaries on reports.
Interactive AI features are open only to Jira admins and, on the Advanced edition, the editor groups an admin chooses. A Jira admin can also set a monthly AI limit for the site; usage is counted per site per month.
Where data is held
Everything stays in Atlassian’s cloud, in Forge storage and in your Atlassian site. The app’s stored data follows your Atlassian site’s data residency: Atlassian keeps Forge-hosted storage in the same location as your site and moves it with your site (Atlassian’s documentation). AI requests are processed inside Atlassian’s platform.
Connections outside Atlassian
The app connects to nothing outside Atlassian: its Forge permissions allow no outside address.
Sub-processors
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Atlassian | Runs the app, its storage, Jira’s notification emails and its AI features (Forge LLMs). | Everything the app keeps. | Where your Atlassian site is hosted |
We update this list at least 30 days before a new sub-processor starts processing your data.
Retention and deletion
- Uninstall: The app deletes all the data it stored.
- Deletion: Export files are deleted after 24 hours. Rules, logs and the audit log stay, within their size limits, until you delete them or uninstall the app. A Jira admin can also erase all of the app’s data.
- Atlassian’s personal data reporting: The app does not use Atlassian’s personal data reporting yet; rules keep their owner’s Atlassian account id.
- Logs: The app’s run logs stay in Forge storage, inside Atlassian.
- Deletion requests: to ask for your site’s data to be deleted, email privacy@laya.net.
Security practices
- The app makes no outside connections: its Forge permissions allow none.
- It carries Atlassian’s Runs on Atlassian badge.
- Encryption: The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center.
- Atlassian Marketplace programmes: In Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Common security questions
Does the AI run on Atlassian, or with an outside provider?
AI runs on Atlassian. The app uses Forge LLMs, Atlassian’s AI service for Forge apps. It sends nothing to an AI provider of its own, and no data leaves Atlassian for AI.
Which data is sent to the AI?
Build a rule from plain English: The request typed, and the site’s issue type, status and priority names and project keys. Migrate a ScriptRunner script or Automation rule: The pasted script or rule (up to 6,000 characters) and the site’s project keys. Explain a rule or a failed run: The rule’s full settings, including its JQL and any comment or email text; or, for a failure, the rule’s name, the issue key, the trigger, the error text and the failed steps. Describe or fix a JQL query, find a template, detect rule conflicts: The words typed or the query to fix with its errors, and the site’s names; the search words and the built-in template list; or the rules’ names, trigger types and action types. AI summary on reports: A digest of the report: its title, key figures and up to 10 rows per section, which can include people’s names, such as assignees. Nothing is sent outside Atlassian for AI. Text people type or paste into a request is sent as typed.
Is our data used to train AI models?
Atlassian has said, in its developer community, that prompts and answers sent through Forge LLMs are not used to train models, by Atlassian or by its sub-processors. We do not train or fine-tune any AI model on your data.
Does the AI provider keep our data?
Requests are processed inside Atlassian’s platform, under Atlassian’s terms for Forge apps. The app keeps an AI answer only where it is saved: in a rule someone saves, in a report file for 24 hours, or in the conflict scan results for 24 hours.
Can a Jira admin turn AI off for the whole site?
A Jira admin can turn AI assist off for the whole site in the app’s admin settings. While it is off, the app refuses every AI request, including AI summaries on reports. Interactive AI features are open only to Jira admins and, on the Advanced edition, the editor groups an admin chooses. A Jira admin can also set a monthly AI limit for the site; usage is counted per site per month.
Is our data encrypted in transit and at rest?
The app makes no connections outside Atlassian: its data moves and is stored only inside Atlassian’s cloud, under Atlassian’s own security controls. Atlassian describes them in its Trust Center.
Who in our Jira site can use the app and its data?
The app opens inside your Jira site, for people signed in to it. Only Jira admins can change its site settings, including AI assist and the monthly AI limit, and each change is written to its audit log. Only Jira admins, and on the Advanced edition the editor groups an admin chooses, can create or change rules. Rules act in Jira as the app, not as the person who made them.
Where is our data held, and can we choose the region?
Everything stays in Atlassian’s cloud, in Forge storage and in your Atlassian site. The app’s stored data follows your Atlassian site’s data residency: Atlassian keeps Forge-hosted storage in the same location as your site and moves it with your site (Atlassian’s documentation). AI requests are processed inside Atlassian’s platform.
Which sub-processors does the app use?
The app uses Atlassian. The Sub-processors table above says what each does, with which data and where.
What happens to our data when we uninstall the app?
The app deletes all the data it stored. To ask for your site’s data to be deleted, email privacy@laya.net.
How do we report a security issue or an incident?
Email support@laya.net, with "Security report" in the subject line. Include the steps to reproduce it, and never passwords or tokens. If a security incident affects your data, we tell you without undue delay after we become aware of it, with what we know: what happened, which data was involved, the likely effects and what we have done. Where the full picture is not yet clear, we send what we have and follow up.
Do you hold SOC 2 or ISO 27001?
LayaNet LTD does not hold a SOC 2 report or an ISO 27001 certificate, for this app or any other. Atlassian holds certifications for its own cloud platform, on which this app runs; those cover Atlassian’s platform, not this app or LayaNet LTD. On the Atlassian Marketplace, the app is in Atlassian’s Marketplace Bug Bounty programme; not in Cloud Fortified.
Contact
- Security: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
- Privacy and deletion requests: privacy@laya.net.
- Support: the Agile Pulse support portal, or support@agilepulse.co.
Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.