Skip to content
LayaHelp Centre
laya.netOpen app
GuidesIntegrationsTroubleshootingContactlaya.netOpen app

SprintPoker for Jira Architecture Diagram and Data Flow

How SprintPoker for Jira is connected: where it runs, the data that moves, where it is kept and how it is protected, with a diagram to file with your security review.

Last updated

Print-optimised: choose “Save as PDF” in the dialogue
On this page

What this covers: SprintPoker for Jira on the Atlassian Marketplace (SprintPoker and SprintPoker Free), as it works in its current release: where it runs, the data that moves and where it is kept. It is made by LayaNet LTD (company number 17430595), a company registered in England and Wales. On the Atlassian Marketplace it uses the vendor name Agile Pulse.

Last reviewed: 20 October 2026.

Architecture and data flow diagram

SprintPoker for Jira Architecture Diagram and Data FlowHow SprintPoker for Jira is connected: people use it inside their Atlassian site, where it runs on Atlassian Forge. It also uses the LayaNet service (London, UK; Stockholm, Sweden; United States). Sub-processors outside Atlassian: OpenAI. The numbered list under the diagram says what each arrow carries.Inside yourAtlassian siteLayaNetservice(London, UK;Stockholm,Sweden; UnitedStates)Sub-processorsOther webservices, notsub-processorsPeople in your JirasiteSigned in with theirAtlassian accountSprintPoker for JiraAn Atlassian Forge appKeeps data in ForgestorageJiraYour issuesYour data (database)MongoDB Atlas, on AmazonWeb ServicesLondon (UK)Encrypted at restApplication serversAmazon Web ServicesStockholm (Sweden)laya.netSessions shared withlaya.netAmazon Web ServicesUnited StatesOpenAIAI featuresUnited StatesOur websiteThe app’s icons and imagesProduct demoOnly if someone opens it12345678910SprintPoker for Jira Architecture Diagram and Data FlowHow SprintPoker for Jira is connected: people use it inside their Atlassian site, where it runs on Atlassian Forge. It also uses the LayaNet service (London, UK; Stockholm, Sweden; United States). Sub-processors outside Atlassian: OpenAI. The numbered list under the diagram says what each arrow carries.Inside your Atlassian siteLayaNet service (London, UK;Stockholm, Sweden; United States)Sub-processorsOther web services, notsub-processorsPeople in your Jira siteSigned in with their AtlassianaccountSprintPoker for JiraAn Atlassian Forge appKeeps data in Forge storageJiraYour issuesYour data (database)MongoDB Atlas, on Amazon Web ServicesLondon (UK)Encrypted at restApplication serversAmazon Web ServicesStockholm (Sweden)laya.netSessions shared with laya.netAmazon Web ServicesUnited StatesOpenAIAI featuresUnited StatesOur websiteThe app’s icons and imagesProduct demoOnly if someone opens it12345678910
Used whenever the app is usedDashed: only in the cases its words giveNumber: the same number in the list below says what the arrow carriesShaded area: a boundary, named on it

In words

  1. People use SprintPoker for Jira inside Jira, signed in with their Atlassian account.
  2. SprintPoker for Jira reads from Jira as it works. In Jira: the estimates people save, and what Ready or Not adds when someone asks it to: text added to a description or acceptance criteria field, comments, new split issues and the ai-made-ready label.
  3. The app’s Forge functions call our servers to run sessions (votes, estimates and comments) and to make AI requests. Sent over HTTPS (TLS).
  4. Only when someone sends a message from the in-app Contact us form: the person types a subject and a message, and the app adds the Jira site, the app version and their email address from their Atlassian profile, so we can reply; it asks for an address only when Jira does not share one. The message goes through the app to our servers, which email it to our support team through Amazon Web Services’ email service in Stockholm (Sweden). Our servers do not keep the message. Sent over HTTPS (TLS).
  5. The browser keeps a secure WebSocket open to our servers for live updates during a session. Sent over Secure WebSocket (TLS).
  6. Our application servers keep your data in the database with MongoDB Atlas, on Amazon Web Services, in London (UK), and reach it over TLS. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster.
  7. Optional: only when someone uses an AI feature and AI is on for the site: our servers send OpenAI only the fields listed under How AI is used. Never sent to OpenAI: any person’s name or account details from Jira, Jira comments, attachments, votes, email addresses, or who is in a session. OpenAI may keep a request for up to 30 days, solely to monitor for abuse, unless the law requires longer. We never store the prompt. Sent over HTTPS (TLS).
  8. Only for sessions shared with laya.net, after a Jira admin links the site to laya.net: our servers share each shared session, and the issues in it, with laya.net, our own service in the United States, where laya.net’s Trust Centre applies. In shared sessions, AI hints and writing help come from laya.net, which uses Anthropic. Sent over HTTPS (TLS).
  9. The browser loads the app’s icons and images from our website.
  10. Only if someone opens the product demo: the browser shows it in a frame from the demo’s own service.

What is kept, where, and how it is protected

SprintPoker for Jira: the data kept, where, and how it is protected
DataWhere it is keptHow it is protected
Forge storage on your site: the site’s guest and laya.net link settings, and each person’s saved session defaults, kept under their Atlassian account id.Inside your Atlassian site: Forge storageAtlassian’s own security controls. Atlassian describes them in its Trust Center.
Jira itself: the estimates people save, and what Ready or Not adds when someone asks it to: text added to a description or acceptance criteria field, comments, new split issues and the ai-made-ready label.Inside your Atlassian site: JiraAtlassian’s own security controls. Atlassian describes them in its Trust Center.
Sessions: the name and settings, the ids and keys of the Jira issues in them, votes and final estimates, comments written in the session, and AI hints. People in a session, and people asking to join one: their Atlassian account id, and the display name and avatar address Jira showed. Ready or Not results: each scanned issue’s key, summary and type, the AI’s assessment and suggestions, and the account id of the person who ran the scan. Site settings: the estimation field and scale, Definition of Ready rules, the Enable AI setting, and a count of the site’s active users.LayaNet service: MongoDB Atlas, on Amazon Web Services, London (UK)All connections are encrypted: browsers and the app’s Forge functions reach our servers only over https and wss, and our servers reach the database over TLS, which MongoDB Atlas requires for every connection. At rest, MongoDB Atlas encrypts the database’s storage and its backup snapshots, as it does for every cluster.
Sessions shared with laya.net: the shared session and the issues in it.laya.net, on Amazon Web Services, United Stateslaya.net’s Security programme applies.

Never kept: Issue descriptions, Jira comments and attachments: the app reads them live from Jira; the prompts sent to OpenAI: each is built for one request and deleted straight after; a copy of your Jira projects: our servers keep only the issue ids and keys a session uses and, for Ready or Not, each scanned issue’s summary.

Retention and deletion

  • Uninstall: Nothing on our servers is deleted when the app is uninstalled: the app has no uninstall step.
  • Deletion: Deleting a session in the app marks it deleted, and the record stays in our database. Nothing expires automatically.
  • Atlassian’s personal data reporting: The app uses Atlassian’s personal data reporting every day. When Atlassian reports a closed account, we replace its id with a random one and remove its name and avatar; its votes and comments stay, anonymised.
  • Logs: Our servers keep access logs, which hold IP addresses, for no more than 30 days.

Sub-processors

Sub-processors that may process SprintPoker for Jira data
Sub-processorPurposeLocation
AtlassianRuns the app’s Forge functions and storage, and Jira.Where your Atlassian site is hosted
MongoDB AtlasOur database service, on Amazon Web Services.London (UK)
Amazon Web ServicesHosts our application servers, and emails the messages sent from the in-app Contact us form to our support team.Stockholm (Sweden)
OpenAIAI features.United States
laya.net (run by LayaNet LTD, which also makes this app)Only for sessions shared with laya.net. laya.net is our own service, not another company; the companies it uses, such as Amazon Web Services and, for AI hints and writing help, Anthropic, are in laya.net’s sub-processors.United States

About this document

  • This document is drawn from the same records as the SprintPoker for Jira trust page, and changes when they change.
  • Detailed network information is not published, to protect the service.
  • Questionnaire references: CAIQ v4 DSP-05 (data flow documentation) and DSP-19 (data location). These are references for your review, not a compliance claim.
  • Security contact: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
SprintPoker for Jira Architecture Diagram and Data Flow: change history
DateChange
20 October 2026First published.
Still stuck?

Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.

Contact support