ActionLink turns your monday.com boards into branded client portals. Clients see a clean dashboard—not your workspace. You control exactly what's visible.
✅ Granular permissions ✅ Live file previews ✅ File Upload ✅ Chat feature ✅ Client approvals & comments ✅ One link for all clients ✅ 5-minute setup ✅ Audit Logs ✅ Weekly Updates ✅ Free Setup/Demo ✅ Color Themes ✅ Custom Workflows ✅ Custom Presentation ✅ Charts ✅ Gantt Charts ✅ Live PDF Viewer
Does the developer periodically perform penetration testing?
Not answered
Does the developer have a dedicated security and privacy point of contact for such issues or questions?
Yes
Users can contact will@actionlink.app at any time with security/privacy requests.
Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?
Yes
The app never redirects to any destination outside of the app.
Does the app protect against mass parameter assignment attacks?
Yes
We never auto-bind request bodies to models; each endpoint uses explicit allow-lists/DTO schemas and server-side validation, unknown fields are ignored/stripped, and sensitive attributes (e.g., roles/ownership/billing/status) are treated as read-only and not writeable via the API.
Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?
Yes
Yes. React auto-escapes values in JSX; when we intentionally render HTML we sanitize it (e.g., DOMPurify); and we enforce a Content-Security-Policy.
Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?
Yes
Yes. All state-changing routes are CSRF-protected: we require per-request CSRF tokens (per OWASP guidance), verify Origin/Referer on unsafe methods, and use SameSite cookies. Where the API uses bearer tokens in the Authorization header (not cookies), requests aren’t automatically sent by the browser, which prevents CSRF by design.
Does the developer have mechanisms to notify monday.com in case of a security breach?
Yes
Yes; We will notify monday.com and our users in case of a security breach and put our systems in panic mode.
Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?
Yes
Yes. We follow a documented patch/update process: prioritize and apply patches per NIST SP 800-40, aligned with CIS Control 7 and OWASP ASVS; automate dependency security updates (Dependabot PRs) and rebuild/redeploy base images; and keep managed databases on scheduled maintenance windows with automatic minor-version security upgrades.
Compliance
Is the app certified with the information security standard ISO/IEC 27001:2022?
Not answered
Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?
Not answered
Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?
Not answered
Is the app compliant with the General Data Protection Regulation (GDPR)?
Not answered
Data
Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).
Yes
ActionLink shares selected monday.com data to client-facing portals you create; only the fields you choose to expose (e.g., item/ subitem names, statuses, dates, numbers, files if enabled, and client comments/updates). It also transmits limited metadata needed to operate the portals and audit access (e.g., account/board/item IDs, portal/user IDs, request logs like IP/user-agent). This is inherent to providing external client dashboards/links and follows monday’s app privacy requirements to document any third-party domains used.
Where does the app store logs data?
other
Logs are stored on our dedicated Digital Ocean server protected by multi-factor authentication. Logs are additionally redacted of sensitive information before being stored/logged.
Where does the app store the app data?
DB
We use secure, encrypted Digital Ocean DBs.
Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?
Yes
PIIs are redacted via a middleware in the logger and are never printed or stored.
Is customer data segregated from the data of other customers (for example logically or physically)?
Yes
Customer data is segregated logically based on monday account id.
Privacy
Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?
Yes
The database is protected via multi-factor authentication.
Does the developer protect access to customer data based on the principle of least privilege?
Yes
Yes. We work based on least necessary privilege and access principle.
Reviews
July 2, 2025
M: Great app for sharing only what you want with external entities.
Developer response:
Thank you! Great to hear we help your business.
Historical data
Installation history
We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.
Total number of installs
Change in total number of installs in last 7 days
Compares the number of installs on each date with 7 days previously:
Max
Min
Current
Change in total number of installs in last 30 days
Compares the number of installs on each date with 30 days previously:
Max
Min
Current
Change in total number of installs in last 90 days
Compares the number of installs on each date with 90 days previously:
Max
Min
Current
Ratings history
Categories history
Each of the following is a yes/no answer, so the graphs show 1 for yes, and 0 for no.
