Skip to content
LayaHelp Centre
laya.netOpen app
GuidesIntegrationsTroubleshootingContactlaya.netOpen app

laya.net Architecture Diagram and Data Flow

How laya.net is connected: where it runs, the data that moves, where it is kept and how it is protected, with a diagram to file with your security review.

Last updated

Print-optimised: choose “Save as PDF” in the dialogue
On this page

What this covers: laya.net, the work management and cross-tool board mirroring service run by LayaNet LTD, as it works today: where it runs, the data that moves and where it is kept.

Last reviewed: 20 October 2026.

Architecture and data flow diagram

laya.net Architecture Diagram and Data FlowHow laya.net is connected: your members and your connected tools, the laya.net service on Amazon Web Services in the United States, and its sub-processors (Amazon Web Services (SES), Anthropic, OpenAI, KLIPY, Google Analytics). The numbered list under the diagram says what each arrow carries.Yourorganisationlaya.netservice(UnitedStates)Sub-processorsPeople youshare withYour membersIn their browserSigned in tolaya.netYourconnectedtoolsJira, AzureDevOps,monday.com,GitHub andGitLabYour ownsystems, notsub-processorsLaya Boardfor JiraOur app in yourJira site, ifyou install itSprintPokerfor JiraOur Jira app,for sessionsshared withlaya.netlaya.netThe web app and its APIAmazon Web Services, UnitedStatesYour workspace’s dataDatabase, file storage andbackupsAmazon Web Services, UnitedStatesAmazonWebServices(SES)EmaildeliveryUnitedStatesAnthropicOptional AIfeaturesUnitedStatesOpenAIOpenAIIrelandLimitedReady orNot scansof a JiraprojectUnitedStatesKLIPYGIF searchin BoardStudioUnitedStatesGoogleAnalyticsPublicmarketingpages only,afterconsentUnitedStatesGuests with a share linkPeople outside yourworkspace, in their browser123456789101112laya.net Architecture Diagram and Data FlowHow laya.net is connected: your members and your connected tools, the laya.net service on Amazon Web Services in the United States, and its sub-processors (Amazon Web Services (SES), Anthropic, OpenAI, KLIPY, Google Analytics). The numbered list under the diagram says what each arrow carries.Your organisationlaya.net service (UnitedStates)Sub-processorsPeople you share withYour membersIn their browserSigned in to laya.netYour connected toolsJira, Azure DevOps,monday.com, GitHub and GitLabYour own systems, notsub-processorsLaya Board for JiraOur app in your Jira site, ifyou install itSprintPoker for JiraOur Jira app, for sessionsshared with laya.netlaya.netThe web app and its APIAmazon Web Services, UnitedStatesYour workspace’s dataDatabase, file storage andbackupsAmazon Web Services, UnitedStatesAmazon Web Services (SES)Email deliveryUnited StatesAnthropicOptional AI featuresUnited StatesOpenAIOpenAI Ireland LimitedReady or Not scans of a JiraprojectUnited StatesKLIPYGIF search in Board StudioUnited StatesGoogle AnalyticsPublic marketing pages only,after consentUnited StatesGuests with a share linkPeople outside yourworkspace, in their browser123456789101112
Used whenever the app is usedDashed: only in the cases its words giveNumber: the same number in the list below says what the arrow carriesShaded area: a boundary, named on it

In words

  1. Your members use laya.net in their browser. They sign in with email and password, a magic link, or Atlassian, Azure DevOps, Google, Microsoft or Slack, with optional two-factor authentication. Sent over HTTPS (TLS).
  2. laya.net reads and writes the boards your workspace connects, in Jira, Azure DevOps, monday.com, GitHub or GitLab, only with the credential you grant. Boards you have not connected are never accessed. Sent over HTTPS (TLS).
  3. Changes made in your tools come back to laya.net over a webhook it registers with your tool, and Sync now pulls the latest on any board. Sent over HTTPS (TLS).
  4. Only if you install it: the Laya Board for Jira app sends laya.net the boards you share with a guest link or link to a workspace (for a linked site, with the recent comments it sends with each issue), and tells laya.net of each install, upgrade and uninstall. Sent over HTTPS (TLS).
  5. Only for sessions shared with laya.net, after a Jira admin links the site: SprintPoker for Jira shares each shared session, and the issues in it, with laya.net. Sent over HTTPS (TLS).
  6. laya.net keeps your workspace’s content and account data in its database and file storage, with backups, on Amazon Web Services in the United States. Managed storage and backups inherit the provider’s encryption at rest; connection credentials and webhook signing secrets are encrypted at rest, and passwords are hashed.
  7. laya.net sends service email, such as sign-in links, and product email through Amazon Web Services (SES): the recipient’s name and email address, the message, and delivery and engagement events.
  8. Optional: only when a member runs an AI action: laya.net sends Anthropic only the content they chose to run it on. It is not used to train models.
  9. Optional: only when a member scans a Jira project with Ready or Not: laya.net sends OpenAI the work item’s key, summary, description text, type, status, priority, estimate, labels, components, parent, linked items and dates. No assignee, reporter or creator, and no account ID, name or email field: laya.net removes those before sending.
  10. Only when someone searches for a GIF in Board Studio: laya.net passes the search words to KLIPY. KLIPY does not receive your identity or board content.
  11. Only on laya.net’s public marketing pages, and only after someone accepts analytics cookies: the browser sends page views and coarse device data to Google Analytics. Never inside the signed-in product.
  12. Only when you share: guests open a share link and see a read-only board, doc or roadmap on laya.net, with only the columns and card fields you choose. A link to a board mirrored from a connected tool can take a password, and every link can be revoked at any time. Sent over HTTPS (TLS).

What is kept, where, and how it is protected

laya.net: the data kept, where, and how it is protected
DataWhere it is keptHow it is protected
Customer content: boards, work items, docs, comments, attachments, and mirrored copies of items from your connected toolslaya.net service: Amazon Web Services, United StatesEncrypted in transit: TLS on all traffic, with HTTP Strict Transport Security. Managed storage and backups inherit the provider’s encryption at rest.
Account data: the account you create, sign-in records, security settingslaya.net service: Amazon Web Services, United StatesPasswords are hashed, never stored in reversible form. Optional two-factor authentication.
Credentials for your connected tools, and webhook signing secretslaya.net service: Amazon Web Services, United StatesEncrypted at rest. Once saved, an OAuth token, API token or personal access token is never returned by the API or shown again.

Retention

  • Customer content: boards, work items, docs, comments, attachments: For as long as the workspace exists. Not auto-purged.
  • Mirrors of connected boards: Until you remove the board or disconnect the tool. A disconnected Jira connection keeps its boards, paused, until you remove them.
  • Guest links shared from Laya Board for Jira with no linked workspace: A copy of the board’s issues, deleted when you uninstall the app.
  • Account data: profile, security settings: For as long as the account exists.
  • Connection credentials: Encrypted, held while the connection exists, destroyed when you disconnect.
  • Sessions: Until signed out, revoked from the Active sessions list, or expired.
  • Request logs: Kept for 30 days, then deleted automatically.
  • Error diagnostics: Kept with no set expiry, like the rest of the service’s records (see Data retention in our Privacy Policy).
  • Email delivery records: Kept so we can prove what was sent and honour unsubscribes and complaints.
  • Backups: Rolling. Deleted content ages out as the backup cycle turns over.

See data retention and deletion for what deletion removes.

Sub-processors

Sub-processors that may process laya.net customer data
Sub-processorWhat forProcessing location
Amazon Web ServicesCloud hosting, database, file storage and backupsUnited States
Amazon Web Services (SES)Email deliveryUnited States
AnthropicOptional AI featuresUnited States
OpenAIReady or Not scans of a Jira projectUnited States
KLIPYGIF search in Board StudioUnited States
Google AnalyticsPublic marketing pages only, after consentUnited States

Your connected tools (Jira, Azure DevOps, monday.com, GitHub and GitLab) are not laya.net sub-processors: they are your own systems, and laya.net reaches them with the credential you grant. The sub-processors page is the authoritative list.

About this document

  • This document is drawn from the same records as the Trust Centre, and changes when they change.
  • Detailed network information is not published, to protect the service.
  • Questionnaire references: CAIQ v4 DSP-05 (data flow documentation) and DSP-19 (data location). These are references for your review, not a compliance claim.
  • Security contact: support@laya.net, with "Security report" in the subject line. Please never include passwords or tokens.
laya.net Architecture Diagram and Data Flow: change history
DateChange
20 October 2026First published.
Still stuck?

Email support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.

Contact support