Smart Templates allow you to reuse saved groups, items, and subitems in any monday.com workspace or board. It's the perfect tool for speeding up recurring processes, introducing standardization, and reducing human error.
Here are things you can do with Smart Templates:
Create tasks or processes once and reuse them as templates everywhere.
Document and standardize entire processes for all teams and projects.
Easily rearrange, add, or remove items and subitems within your templates when the workflow needs modifications or optimization.
Boost your workflow in monday.com with automated templates. Apply templates when the item status changes, a person is assigned, a specific date arrives, etc.
List of Features:
Save groups, items, or subitems as a template in various combinations.
Manage saved templates. Change template name, add or remove columns and update default values.
Use automations. Apply templates based on triggers in monday.com recipes like scheduled date, assignee, or status change.
Map the columns. Manually adjust any mismatches between boards and templates to ensure no data is lost.
Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?
Yes
Not applicable, app doesn’t have any redirects.
Does the app protect against mass parameter assignment attacks?
Yes
Not applicable, all requests to the backend are processed by “dry-rb“ and have strict structure Reference: https://dry-rb.org/
Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?
Yes
We do not render “unsafe“ user input at all (disallowed usage of “innerHTML“ and “dangerouslySetInnerHTML”) and we use DOMPurify to improve UX
Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?
Yes
Not applicable. Because we treat our backend as an API host and we are exchanging the information using credentials(JWT) provided by monday. Also our backend is used only by monday automations. For verifying requests we use credentials(JWT) provided by monday, and store all the data in the monday storage.
Does the developer have mechanisms to notify monday.com in case of a security breach?
Yes
We'll use direct communication channel we have with the marketplace team. The notification times are:• 0-8 hours (during business hours) for issues classified as High priority.• Within 48 hours for issues classified as Medium priority.• Within 5 working days for issues classified as Low priority.
Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?
Yes
1. Application-level updates and security patches installation process: - Frontend: Use yarn to manage dependencies. Regularly update dependencies to the latest versions, including React. Follow semantic versioning and release notes for potential breaking changes. Using Vite.js to manage bundles and regularly update it to benefit from new features and security fixes. Test updates in a separate branch or staging environment before deploying to production. - Backend (Rails, Redis, and Sidekiq): Manage gems with Bundler. Regularly update gems and Rails using version constraints in the Gemfile. Apply security patches promptly following announcements from the Rails Security Team. Enable automatic deployment via Heroku CI/CD pipeline triggered by Git pushes. Update the Redis add-on on Heroku through the Dashboard or CLI. Receive automatic notifications from Heroku regarding necessary updates and maintenance. Regularly update the Sidekiq gem using Bundler. Monitor Sidekiq releases and security advisories. Employ a rolling restart strategy to minimize service disruptions during updates. - GitHub: Leverage Dependabot for automated dependency updates, including GitHub Actions workflows. Regularly review and merge pull requests generated by Dependabot to apply updates. Extended PRs review, trunk-based branching strategy, limited access the staging/prod branches - Deploys Implement a branching strategy to test updates in a staging environment before production. deploying/releasing updates only after CI passed - both backend & frontend tests 2. Patching Time Frames for Vulnerabilities: Critical severity issues to be fixed within 4 weeks of being reported; High severity issues to be fixed within 6 weeks of being reported; Medium severity issues to be fixed within 8 weeks of being reported; Low severity issues to be fixed within 10 weeks of being reported.
Compliance
Is the app certified with the information security standard ISO/IEC 27001:2022?
Not answered
Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?
No
Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?
No
Is the app compliant with the General Data Protection Regulation (GDPR)?
Yes
Data
Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).
Not answered
Where does the app store logs data?
Not answered
Where does the app store the app data?
Not answered
Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?
Yes
We are using the out-of-the-box tools provided us by Rails: https://guides.rubyonrails.org/v7.0/security.html#logging
Is customer data segregated from the data of other customers (for example logically or physically)?
Yes
We do not store the customer data in any other from Monday GlobalStorageAPI sources. It is compartmentalized according to the accountId and app, so data from one account is not accessible from others.
Privacy
Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?
Yes
All accesses are managed in accordance with our company security policy. And we use forced multi-factor authentication for Heroku server https://devcenter.heroku.com/articles/multi-factor-authentication
Does the developer protect access to customer data based on the principle of least privilege?
Yes
We have a company-wide security policy and a dedicated security team that controls who has access to what. Access to sensitive data requires a very good reason and an explicit permission, and is normally granted only to core developers, who are trusted and have a great work ethic. Also we don't store user content at our end.
Reviews
No reviews yet.
Installation history
We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.
