SprintPoker for Azure DevOps Architecture Diagram and Data Flow
How SprintPoker for Azure DevOps is connected: where it runs, the data that moves, where it is kept and how it is protected, with a diagram to file with your security review.
Last updated
On this page
What this covers: SprintPoker for Azure DevOps on the Visual Studio Marketplace (SprintPoker for Azure DevOps), as it works in its current release: where it runs, the data that moves and where it is kept. It is made by LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Visual Studio Marketplace it publishes as Agile Pulse.
Last reviewed: 22 October 2026.
Architecture and data flow diagram
In words
- People use SprintPoker for Azure DevOps in Azure Boards, signed in to Azure DevOps.
- The extension gets the person’s Azure DevOps identity, and a short-lived access token for them, from Azure DevOps as it opens. On its General settings page it also turns its work item panel and its work item menu entry on or off for the project.
- The extension, in the browser, calls our servers to run sessions and Quick Estimation (votes, estimates and comments), to ask for AI hints, and to read and change work items in Azure DevOps. Sent over HTTPS (TLS).
- The browser keeps a secure WebSocket open to our servers for live updates in a session and in the Quick Estimation panel. Sent over Secure WebSocket (TLS).
- Our servers read work items, project details and people’s profile pictures from Azure DevOps, and make the changes people ask for, as the person using the extension: with the short-lived access token the extension sends with each request, which our servers never save. In Azure DevOps: the estimates people save to a work item’s estimation field, and the changes people make to work items from SprintPoker, such as a new title, description, state, assignee, iteration or place in the backlog, a new child work item, a comment, or an image added to a description. Each change is made as the person who makes it. Sent over HTTPS (TLS).
- Our application servers keep your data in the database with MongoDB Atlas, on Amazon Web Services, in London (UK), and reach it over TLS. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster.
- Optional: only when a session’s moderator asks for an AI hint, or starts or picks a work item with automatic hints on, in a session with AI features on: our servers send OpenAI only the fields listed under How AI is used. Never sent to OpenAI: any person’s account details from Azure DevOps, or their name except where it is written or @mentioned in a sent field (see below), Azure DevOps comments, attachments, votes, session comments, email addresses, or who is in a session. OpenAI may keep a request for up to 30 days, solely to monitor for abuse, unless the law requires longer. We never store the prompt. Sent over HTTPS (TLS).
What is kept, where, and how it is protected
| Data | Where it is kept | How it is protected |
|---|---|---|
| Azure DevOps itself: the estimates people save to a work item’s estimation field, and the changes people make to work items from SprintPoker, such as a new title, description, state, assignee, iteration or place in the backlog, a new child work item, a comment, or an image added to a description. Each change is made as the person who makes it. Azure DevOps project settings: whether the Quick Estimation panel and the work item menu entry show in the project, set from SprintPoker’s General settings page. | Inside your Azure DevOps organization | Microsoft’s own security controls. Microsoft describes them in its data protection overview for Azure DevOps. |
| Sessions: the name and settings, the organization name and the project and team they belong to, the work items in them (each one’s id, title, type and the type’s icon address, state and priority, its assignee’s display name and picture address, and its current estimate), the Azure DevOps user id of the person who created it, votes (each with its voter’s user id, and in Async Poker their display name) and final estimates, comments written in the session, AI hints and up to four reference work items (id and title). People in a session: their Azure DevOps user id, and the display name and picture address Azure DevOps showed (where Azure DevOps gives no display name, their email address stands in for it). Quick Estimation, for each work item someone estimates from its form: the votes, with each voter’s Azure DevOps user id, display name and picture address, whether the votes are shown, and the final estimate. Project settings: each work item type’s estimation field and card values, named card presets (with the user id of the person who made each), the project’s reference work items (id and title), and whether the Quick Estimation panel and the work item menu entry show. | LayaNet service: MongoDB Atlas, on Amazon Web Services, London (UK) | Connections are encrypted: the extension reaches our servers only over https and wss, our servers reach Azure DevOps and OpenAI over https, and our servers reach the database over TLS, which MongoDB Atlas requires for every connection. One exception: our servers fetch a profile picture over http when its address, or a redirect from it, uses http. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster. |
Never kept: Work item descriptions, acceptance criteria, Azure DevOps comments and attachments: our servers pass them between Azure DevOps and the extension, and keep none of them in our database; azure DevOps access tokens: the extension sends a short-lived one with each request, and our servers never save it; email addresses: the people search passes them from Azure DevOps to the extension, and our servers save one only where Azure DevOps gives a person no display name, as that person’s name in a session or a Quick Estimation; profile pictures: our servers fetch them from Azure DevOps for the extension to show, and keep each in memory for up to an hour, never in our database; the prompts sent to OpenAI: each is built for one request and deleted straight after.
Retention and deletion
- Uninstall: Nothing on our servers is deleted when the extension is uninstalled: the extension has no uninstall step.
- Deletion: Deleting a session in the extension marks it deleted, and the record stays in our database. Resetting a Quick Estimation clears its votes. Nothing expires automatically.
- Closed accounts: The extension has no step that removes a person whose account is closed or who leaves your organization: their user id, display name and picture address stay in past sessions and Quick Estimations.
- Logs: Our servers log each request that fails, with the full address requested (which can hold search words), the referring page, the browser’s user agent and the IP address it came from. Some warnings also record the Azure DevOps user id, organization and session involved, and the words of a people search that Azure DevOps could not answer. Those application logs have no set retention period yet. The web server’s access logs, which also hold IP addresses, are kept for 14 days.
Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft | Runs Azure DevOps, and serves the extension’s screens from the Visual Studio Marketplace. | Where your Azure DevOps organization is hosted |
| MongoDB Atlas | Our database service, on Amazon Web Services. | London (UK) |
| Amazon Web Services | Hosts our application servers. | Stockholm (Sweden) |
| OpenAI | AI features. | United States |
About this document
- This document is drawn from the same records as the SprintPoker for Azure DevOps trust page, and changes when they change.
- Detailed network information is not published, to protect the service.
- Questionnaire references: CAIQ v4 DSP-05 (data flow documentation) and DSP-19 (data location). These are references for your review, not a compliance claim.
- Security contact: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
| Date | Change |
|---|---|
| 22 October 2026 | First published. |
Was this page helpful?
Still stuck?
Contact supportEmail support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.