Laplace security, privacy and data processing

Personal data operator: Alexander Nekrashenko, an individual operating Laplace. Privacy requests: support@laplaceapp.com. This policy applies to SaaS users, workspace members, customer administrators, invitees, support contacts and individuals whose data is submitted by a customer into a workspace or Jira.

This policy does not cover Laplace employees, candidates or contractors. The service is not intended for children, special categories of personal data, biometric data, medical data or other highly sensitive data without a separate written agreement.

• Laplace acts as the personal data operator for accounts, authentication, service emails, support, billing/subscription, security logs and service administration.
• Laplace processes Customer Data inside a workspace on the customer instructions: chat messages, assistant messages, Jira data, embeddings, memory and data submitted or connected by the customer.
• The customer is responsible for the lawful transfer of Customer Data to Laplace, including Jira data and data entered by users into chat.
• Laplace may process data to provide the AI assistant, retrieval, long-term memory, embeddings, title generation, support, security, anti-abuse, backups and compliance.
• For Russia, legal bases include contract/terms, processing instruction under Article 6(3) of 152-FZ, consent where required and legal obligations where applicable.
• For international users, legal bases may include contract, legitimate interests, consent for optional analytics/cookies, legal obligation and processing Customer Data on customer instructions.

Laplace processes different categories of data depending on which features the user or customer uses. Data is not sold to third parties and Laplace does not use Customer Data to train foundation models.

The DPA describes customer data processing terms for B2B customers. It acts as a personal data processing instruction under Article 6(3) of 152-FZ.

Laplace operates in the Russian Federation under Russian law. The current list of engaged providers is disclosed in the subprocessors section.

Laplace retains data only as long as needed for processing purposes, contract, security, compliance and service recovery. Deletion is handled by request through support@laplaceapp.com.

Deletion SLA for active systems: up to 30 days after request verification, unless law or contract requires a longer period. Backups expire through rotation; default expected retention is 14 days.

Customer Data may be processed by the configured AI provider solely to provide the service, including runtime inference, retrieval, embeddings, memory extraction, classification/query expansion and title generation.

Embeddings are treated as Customer Data because they may mathematically reflect source content. Embeddings are stored in pgvector/Postgres and used for retrieval and long-term memory.

• The AI provider may change as the service evolves. Customer Data is sent to the configured AI provider only to provide AI features of the service.
• Laplace does not permit the AI provider to use Customer Data to train foundation models unless separately agreed with the customer.
• Provider retention and processing mode depend on the selected provider and applicable terms. Customers who require specific retention guarantees should document them separately before the relevant processing starts.
• Current embeddings storage: service database with vector search support.
• New memory records are associated with the relevant workspace and user.
• Workspace deletion, user leave/removal from a workspace and user removal from an organization clean up the matching scoped embeddings.

Jira is a customer-connected source. Customer decides which Atlassian account is connected to a workspace and what data that account may access. Laplace processes Jira-originated data according to customer instructions and connected account permissions.

For shared workspace connection, customers should use a dedicated Jira user with least privilege where possible.

• Laplace can read Jira data exposed by granted OAuth scopes and connected account role, including issues, descriptions, comments, authors/reporters/assignees and project metadata.
• Customer can disconnect the Jira integration; after disconnect, Laplace stops using the connection and removes related tokens/metadata from active systems through the normal deletion process.
• Workspace deletion or a verified deletion request removes related Jira-derived data from active systems; backups expire through rotation.
• Laplace currently does not download Jira attachments.
• Laplace does not change Jira data by default except through actions explicitly initiated by authorized users through available product features.
• Jira tokens are stored encrypted at application level using AES-256-GCM with a secret-derived key.

• Laplace Cloud is hosted in Russia on Selectel for pilot production.
• Public web/API traffic uses HTTPS/TLS through Caddy and external providers are accessed over HTTPS.
• Service connections are isolated within the application infrastructure network.
• Workspace and organization data are scoped by workspace/org identifiers; chat routes are workspace-scoped.
• Access control is based on organization owner/member and workspace admin/user roles.
• Extended audit trail is available only under a separate enterprise agreement.
• Official contact for support, privacy requests and security issues: support@laplaceapp.com. Telegram is not an official privacy/security request channel.

Users and customers can request deletion through support@laplaceapp.com. Laplace verifies requester authority before deleting workspace or account data.

For B2B customers, deletion confirmation can be provided upon written request.

• Target SLA: up to 30 days for active systems after request confirmation.
• Backups are removed through backup rotation and may retain deleted data until retention expires.
• Account or organization deletion is handled by verified request.

Laplace uses essential browser storage: sessionStorage for auth tokens and localStorage for language, theme, last workspace and the analytics consent choice.

After user consent, Laplace may use Google Analytics 4 and Yandex Metrica for product analytics, including page views, product usage events, referrer/source data, approximate device/browser data and aggregated usage statistics. Without consent, these analytics trackers are not initialized.

If Yandex Metrica is enabled, its features may include clickmap/link tracking, bounce analytics and webvisor/session replay within the counter settings. This data is used to understand UX and troubleshoot interface issues, not to sell data or run advertising cookies.

Laplace does not use advertising cookies.

Laplace is not intended for children and is not designed to knowingly collect minors’ data. If you believe a minor submitted data to Laplace without a proper basis or permission, contact support@laplaceapp.com.

After request verification, Laplace will remove such data from active systems through the standard deletion process unless law or contract requires otherwise.

Laplace may update this page as the product, providers, integrations, security measures or legal requirements change. The freshness date is shown at the top of the page.

Material changes that significantly affect processing of user or customer data may also be communicated through the product, email or contractual channels where applicable.

• Dedicated tenant, private connector, VPC and on-prem connector are available only under a separate written agreement.
• Per-user Jira OAuth/ACL may be agreed separately for enterprise scenarios.