Sub-processors
The third parties that may process Laya customer data, what each is used for, where it processes, and how changes are notified.
Last updated
Laya engages a small number of sub-processors to deliver the service. Each is bound by written terms no less protective than our own Data Processing Agreement, and Laya remains responsible to you for their performance. This list is the authoritative one.
Current sub-processors
| Sub-processor | Purpose | Data it may process | Processing location |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, database, file storage and backups: the infrastructure Laya runs on | All customer content and account data | United States |
| Amazon Web Services (SES) | Delivery of service email (such as sign-in links) and product email | Recipient name and email address, message content, delivery and engagement events | United States |
| Anthropic | Powers the optional AI features. Only the content you choose to run an AI action on is sent, and it is not used to train models | The specific content submitted to an AI action | United States |
| OpenAI (OpenAI Ireland Limited) | Grades how ready a Jira work item is to estimate, for SprintPoker’s Ready or Not scans of a Jira project, an optional feature. Laya sends each scan to OpenAI through our own servers in Stockholm (Sweden). Runs only when a member scans a Jira project; not used for Laya boards or any other feature | The work item’s key, summary, description text, type, status, priority, estimate, labels, components, parent, linked items and dates. No assignee, reporter or creator, and no account ID, name or email field: Laya removes those before sending | United States |
| KLIPY | GIF search in Board Studio. Laya proxies the search term; the provider does not receive your identity or board content | Search terms only | United States |
| Google (Analytics) | Aggregate analytics on public marketing pages and on planningpoker.org’s public pages only. Loads only after you accept analytics cookies, and never inside the signed-in product | Page views and coarse device data of marketing-site visitors | United States |
| Cloudflare (Cloudflare, Inc.) | The human check (Turnstile) on the sign-up page, on the form a guest uses to join a session, and when someone starts a guest session on planningpoker.org, to tell people from automated programs | The visitor’s IP address and technical details of the browser and connection, such as the user agent | United States and other countries |
How changes are notified
- Laya gives at least 30 days’ notice before a new sub-processor begins processing customer data.
- Notice is published here, with the changelog below updated on the same day.
- To receive notices by email, write to privacy@laya.net and ask to be added to the sub-processor notification list.
- You may object on reasonable data protection grounds during the notice period. See clause 6 of the DPA.
Changelog
| Date | Change |
|---|---|
| 2026-11-10 | Google Analytics now also counts visits to planningpoker.org’s public pages, after consent, and Cloudflare’s human check now also runs when someone starts a guest session there. No new sub-processor. |
| 2026-10-29 | Added Cloudflare (Cloudflare, Inc.) for the human check on sign-up and guest joins (see the table). The check has run since 24 September 2026. |
| 2026-10-03 | Added OpenAI (OpenAI Ireland Limited) for SprintPoker’s Ready or Not scans of Jira projects, an optional feature (see the table). |
| 2026-08-07 | List first published in the Trust Centre. No change to the sub-processors in use. |
Was this page helpful?
Still stuck?
Contact supportEmail support@laya.net and include what you expected, what happened, and a link to the affected board or item so we can help quickly.