Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?
Yes
We ensure secure redirects and forwards by using an allowlist, so users are only directed to trusted, pre-approved destinations. Any attempt to redirect to an unapproved location is blocked. Additionally, redirect URLs are validated against state parameters for extra security.
Does the app protect against mass parameter assignment attacks?
Yes
We safeguard against mass assignment attacks by explicitly whitelisting parameters in our code, allowing only approved parameters during database operations. Additionally, all inputs are thoroughly validated, filtered, and sanitized to ensure only expected and authorized data is processed.
Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?
Yes
Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?
Not answered
Does the developer have mechanisms to notify monday.com in case of a security breach?
Yes
Incident Response Plan: We have a formal plan to handle security breaches, including immediate notification to monday.com. Rapid Notification: We inform monday.com of any confirmed or potential breach within 24 hours. Severity Assessment: We evaluate the breach's impact and share a detailed report with monday.com. Ongoing Updates: We keep monday.com informed with regular updates during the incident. Post-Incident Reporting: We provide a final report with lessons learned and preventive measures after resolution. This approach ensures swift and transparent communication with monday.com during security incidents.
Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?
Not answered
Compliance
Is the app certified with the information security standard ISO/IEC 27001:2022?
Not answered
Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?
Not answered
Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?
Not answered
Is the app compliant with the General Data Protection Regulation (GDPR)?
Yes
Data
Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).
No
We do not transfer any data outside our system except to monday.com. If new features require external data handling, it will be clearly stated, and the details will be updated in our privacy policy. Additionally, notifications will be sent to account admins or app installers.
Where does the app store logs data?
aws
Our servers are hosted on AWS infrastructure, but we do not transfer any data outside our own secure environment except monday.com. We utilize our own MongoDB database hosted directly on our AWS servers All data remains within our own managed and hosted environment on AWS.
Where does the app store the app data?
other
Our servers are hosted on AWS infrastructure, but we do not transfer any data outside our own secure environment except monday.com. We utilize our own MongoDB database hosted directly on our AWS servers All data remains within our own managed and hosted environment on AWS.
Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?
Yes
We ensure that any Personally Identifiable Information (PII) is removed from our logs before they are created.
Is customer data segregated from the data of other customers (for example logically or physically)?
Yes
All customer data is segregated based on their monday.com account, following best practices for implementing multitenancy.
Privacy
Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?
Yes
Does the developer protect access to customer data based on the principle of least privilege?
Yes
We protect customer data from non-authorized employees through several measures: Role-Based Access Control (RBAC): Only employees with specific roles can access customer data. Principle of Least Privilege (PoLP): Employees get minimal access, strictly based on their job needs. Data Access Logging: All access is logged and monitored for any unauthorized attempts. Strict Authentication: Multi-factor authentication (MFA) and secure credentials are mandatory for access. Regular Audits: We conduct regular audits to ensure compliance and verify authorized access.
Reviews
January 23, 2025
X: Awesome app
Installation history
We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.