Planning Poker Agility Architecture Diagram and Data Flow
How Planning Poker Agility is connected: where it runs, the data that moves, where it is kept and how it is protected, with a diagram to file with your security review.
Last updated
On this page
What this covers: Planning Poker Agility on the Atlassian Marketplace (Planning Poker Agility), as it works in its new version, built on Atlassian Forge, which a site gets when its admin updates the app: where it runs, the data that moves and where it is kept. It is made by LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse.
Last reviewed: 2 November 2026.
Architecture and data flow diagram
In words
- People use Planning Poker Agility inside Jira, signed in with their Atlassian account.
- Planning Poker Agility reads from Jira as it works. In Jira: the estimates people save, and what Ready or Not adds when someone asks it to: text added to a description or acceptance criteria field, comments, new split issues and the
ai-made-readylabel. - The app’s Forge functions call our servers to run tables (cards played, estimates and notes) and to make AI requests. Sent over HTTPS (TLS).
- Only when someone sends a message from the in-app Contact us form: the person types a subject and a message, and the app adds the Jira site, the app version and their email address from their Atlassian profile, so we can reply; it asks for an address only when Jira does not share one. The message goes through the app to our servers, which email it to our support team through Amazon Web Services’ email service in Stockholm (Sweden). Our servers do not keep the message. Sent over HTTPS (TLS).
- The browser keeps a secure WebSocket open to our servers for live updates at a table. Sent over Secure WebSocket (TLS).
- Our application servers keep your data in the database with MongoDB Atlas, on Amazon Web Services, in London (UK), and reach it over TLS. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster.
- Optional: only when someone uses an AI feature and AI is on for the site: our servers send OpenAI only the fields listed under How AI is used. Never sent to OpenAI: any person’s name or account details from Jira, Jira comments, attachments, cards played, email addresses, or who is at a table. OpenAI may keep a request for up to 30 days, solely to monitor for abuse, unless the law requires longer. We never store the prompt. Sent over HTTPS (TLS).
What is kept, where, and how it is protected
| Data | Where it is kept | How it is protected |
|---|---|---|
| Forge storage on your site: one record of when the daily personal data report last ran (dates only, no account ids). The rest of the app’s Forge storage serves an optional Laya.net connection, which this version does not offer. | Inside your Atlassian site: Forge storage | Atlassian’s own security controls. Atlassian describes them in its Trust Center. |
Jira itself: the estimates people save, and what Ready or Not adds when someone asks it to: text added to a description or acceptance criteria field, comments, new split issues and the ai-made-ready label. | Inside your Atlassian site: Jira | Atlassian’s own security controls. Atlassian describes them in its Trust Center. |
| Tables: the name and settings, the ids and keys of the Jira issues picked, the cards played and final estimates, notes written at the table, timers and AI hints. People at a table, and people asking to join a private one: their Atlassian account id, and the display name and avatar address Jira showed. Quick estimates in an issue’s Planning Poker Agility panel: the issue’s id and key, the account id and card of each person who played, and the final estimate. Player cards, one for each person on the site who started one and hasn’t deleted it (a card starts the first time the person is at the table, or when they save their figure while achievements and stats are off; after they delete it, only when they press Start my player card): their account id, when their card started, their achievements and the date of each, stat counts, card mix (how often they played each card value), the look of their figure, the items they unlocked, whether they hide their achievements and stats, and up to 2,000 one-way keys that stop double counting and name no one. A card holds no name. People at a table with them see their figure, and their achievements and stats unless they hide them; the card mix and the count of thanks they received are shown only to them. Deleted player cards, one note for each person on the site who deleted their player card and hasn’t started a new one: their account id and the date, nothing else, so that no new card starts by itself. Nobody sees it. It is removed when they press Start my player card, or when their Atlassian account is closed. Team tables, one for each Jira project whose tables someone with a player card sat at: the team’s counts, such as rounds played and issues settled, its runs of first-round agreements, its achievements and the date of each, its unlocks, up to 2,000 one-way keys that stop double counting and name no one, and the account ids of the people with a player card who sat at its tables. Team stats are shown only to those people, only when there are 3 or more of them, and never per person. Confidence check answers, kept with the table: for each issue, each person’s answer (confident or unsure), their account id and when they answered. People at the table see each answer on the person’s figure. Ready or Not results: each scanned issue’s key, summary and type, the AI’s assessment and suggestions, and the account id of the person who ran the scan. Project settings: reference issues (yardsticks), Definition of Ready rules, the estimation field and deck, and which issue fields the issue details show. Site settings: the Enable AI setting and the achievements and stats switch. | LayaNet service: MongoDB Atlas, on Amazon Web Services, London (UK) | All connections are encrypted: browsers and the app’s Forge functions reach our servers only over https and wss, and our servers reach the database over TLS, which MongoDB Atlas requires for every connection. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster. |
Never kept: Issue descriptions, Jira comments and attachments: the app reads them live from Jira; the prompts sent to OpenAI: each is built for one request and deleted straight after; a copy of your Jira projects: our servers keep only the issue ids and keys a table uses and, for Ready or Not, each scanned issue’s summary; reactions, and who is at the table right now: our servers pass reactions on to the people at the table as they happen, and hold who is at the table only in memory while it is open; table style choices, and the view each person opens tables in: they stay in each person’s browser.
Retention and deletion
- Uninstall: Nothing on our servers is deleted when the app is uninstalled: the app has no uninstall step.
- Deletion: Deleting a table in the app marks it deleted, and the record stays in our database. Nothing expires automatically. A person can delete their own player card with Delete my player card: their card, their place in team tables and their confidence check answers on that site are deleted, and nothing more is counted for them. A note that they chose to have no card (their account id and the date) is kept, so no new card starts by itself until they start one. The cards they played, their notes and the team counts stay.
- Atlassian’s personal data reporting: The app uses Atlassian’s personal data reporting every day. When Atlassian reports a closed account, we replace its id with a random one and remove its name and avatar; its cards and notes stay, anonymised. Its player card and any note that it chose to have none are deleted, and its confidence check answers and its place in team tables are removed.
- Logs: Our servers keep access logs, which hold IP addresses, for no more than 30 days.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Atlassian | Runs the app’s Forge functions and storage, and Jira. | Where your Atlassian site is hosted |
| MongoDB Atlas | Our database service, on Amazon Web Services. | London (UK) |
| Amazon Web Services | Hosts our application servers, and emails the messages sent from the in-app Contact us form to our support team. | Stockholm (Sweden) |
| OpenAI | AI features. | United States |
About this document
- This document is drawn from the same records as the Planning Poker Agility trust page, and changes when they change.
- Detailed network information is not published, to protect the service.
- Questionnaire references: CAIQ v4 DSP-05 (data flow documentation) and DSP-19 (data location). These are references for your review, not a compliance claim.
- Security contact: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
| Date | Change |
|---|---|
| 2 November 2026 | First published. |
Was this page helpful?
Still stuck?
Contact supportEmail support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.