Make monday.com work with Microsoft 365 & SharePoint →
General Caster logo

General Caster

Omnidea S.r.l.

15,075 installs, since October 20, 2020.   255 installs/month.   Updated March 24, 2024.

Paid Best seller Existing legacy

Create formulas and perform operations with your columns

General Caster is a monday.com app. It features a collection of powerful integrations aimed at giving more power to your boards and automating recurring workflows. monday.com already provides a Formula column, but it can't be to trigger additional workflows and populate dashboards data. General Caster merges the power of Microsoft Excel formulas with the usability of "real" monday.com columns.

Security & Compliance

Security

Does the developer periodically perform penetration testing?

No
We perform a full penetration test annualy

Does the developer have a dedicated security and privacy point of contact for such issues or questions?

Yes
dpo@omnidea.it

Does the app restrict redirects and forwards only to approved destinations, or show a warning when redirecting to potentially untrusted content?

Yes
General Caster ensures that redirects and forwards are secure through the following measures: Allow List for Redirects: We enforce an allow list for all redirects and forwards, ensuring that users can only be redirected to trusted, pre-approved destinations. Any redirect attempt to an unapproved location is blocked. Input Validation: Redirect URLs are validated against this allow list to ensure no external or untrusted URLs can be injected into the redirection process. Warnings for Untrusted Content: If a destination URL is potentially untrusted or cannot be verified against the allow list, we show a warning to the user before proceeding, giving them a chance to confirm the action. These mechanisms protect the app from untrusted redirects and ensure user safety.

Does the app protect against mass parameter assignment attacks?

Yes
General Caster protects against mass parameter assignment attacks through the following measures: Explicit Parameter Whitelisting: We use explicit parameter whitelisting in our code, ensuring that only allowed parameters are processed during database operations. This prevents attackers from assigning unintended fields via form submissions or API requests. Framework-Level Protections: Our PHP framework includes built-in protections against mass assignment. We disable mass assignment by default and carefully control which fields can be updated. Input Validation and Filtering: All input is validated and filtered, ensuring that only expected and authorized data is accepted. This further mitigates the risk of mass assignment attacks. Role-Based Access Controls: Access to sensitive fields is restricted using role-based access control (RBAC), ensuring only authorized users can modify specific fields. These measures ensure that General Caster is protected from mass parameter assignment vulnerabilities.

Does the app perform encoding and sanitization on all user supplied parameters to protect against Cross-Site Scripting?

Yes
General Caster does perform encoding and sanitization of user-supplied parameters to protect against Cross-Site Scripting (XSS) vulnerabilities. Security Measures Implemented: (1) Input Sanitization - General Caster ensures that any input provided through formulas or user-defined values is sanitized. This means it strips or neutralizes potentially harmful scripts or tags before processing the input. (2) Output Encoding - When the results of a formula or a value are cast into a monday.com column, they are encoded appropriately for the target context (e.g., text, numbers, or links), reducing the risk of unintentional script execution. (3) No Direct HTML/Script Injection - General Caster does not allow users to inject or render raw HTML or JavaScript. All values passed into columns are treated as plain text or are validated according to the expected data type (e.g., number, status, etc.). (4) Platform-Level Protection - Since General Caster operates within the monday.com environment, it also benefits from monday.com’s platform-level XSS protections, which restrict unsafe content rendering in widgets, dashboards, or board views.

Does the developer protect all state-changing actions against Cross-Site Request Forgery (CSRF)?

Yes
General Caster protects all state-changing actions against Cross-Site Request Forgery (CSRF) attacks by implementing the following measures: CSRF Tokens: We generate and validate CSRF tokens for all state-changing actions (e.g., form submissions, updates, deletions). These tokens are unique to each session and user, ensuring that only legitimate requests are processed. Same-Site Cookies: We utilize the SameSite cookie attribute, which restricts cookies from being sent in cross-site requests. This mitigates CSRF by preventing unauthorized requests from other sites from being executed. Session Validation: All requests that result in state changes are validated against the active user session, ensuring that only authenticated users with valid tokens can perform these actions. Framework-Level Security: Our PHP framework includes built-in protections against CSRF, further reducing the risk of such attacks. These measures collectively ensure that all state-changing actions are protected from CSRF attacks in General Caster.

Does the developer have mechanisms to notify monday.com in case of a security breach?

Yes
Incident Response Plan: We maintain a formal Incident Response Plan that outlines the steps to be taken in the event of a security breach. This includes immediate notification to key stakeholders, including monday.com, once a breach is confirmed. Rapid Notification: Upon identifying a potential or confirmed breach, we notify monday.com within 24 hours. This is done through predefined communication channels, ensuring prompt and secure disclosure. Breach Severity Assessment: We assess the severity and impact of the breach, and provide a detailed report to monday.com, outlining the nature of the breach, affected systems, data involved, and steps taken to mitigate the issue. Ongoing Updates: We maintain regular communication with monday.com during the incident, providing updates on investigation status, remediation efforts, and any additional measures being implemented to prevent future incidents. Post-Incident Reporting: After resolving the breach, we provide a post-incident report to monday.com, including lessons learned and any system improvements to prevent recurrence. This structured approach ensures quick and transparent communication with monday.com during any security incident.

Does this developer have a process for installing application-level updates and security patches for the service (such as software packages and databases)?

Yes
Automated Security Updates: We use Runcloud to manage our VPS, which automates security patching for Ubuntu 20.04 LTS, PHP, MariaDB, and other server services. This ensures critical security updates are applied promptly. Application-Level Updates: Updates to General Caster are first deployed in a staging environment for testing before going live. We regularly update third-party libraries and monitor for security vulnerabilities using tools like Composer for PHP. Critical Patches: Critical security patches, particularly for the application or database, are manually reviewed by our development team before deployment to ensure stability and security. Database Updates: MariaDB updates are handled regularly, with both automated patching and manual intervention for major updates to ensure data integrity and compatibility. Monitoring and Alerts: We have monitoring systems in place through Runcloud and DigitalOcean, which alert us to vulnerabilities and required updates, ensuring timely action. Backup and Rollback: Before updates, we create full system backups to enable quick rollback in case of any issues post-deployment. This approach ensures General Caster remains secure, up-to-date, and compliant with industry standards.

Compliance

Is the app certified with the information security standard ISO/IEC 27001:2022?

No
General Caster is hosted on secure cloud infrastructure, which is SOC 2 Type II, ISO/IEC 27001:2013, PCI-DSS certified.

Is the app compliant with the Health Insurance Portability and Accountability Act (HIPAA)?

No
Currently, General Caster is not HIPAA compliant. While we prioritize security and data protection, our application is not specifically designed to handle Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) requirements. However, should the need arise to process PHI or comply with HIPAA standards, we are prepared to undergo the necessary steps to implement required safeguards, such as encryption, access control, and audit logging, to meet HIPAA compliance.

Is the app certified with System and Organization Controls (SOC 2 or SOC 3)?

No
Currently, we're not independently certified with System and Organization Controls (SOC 1, SOC 2, SOC 3). However, we adhere to industry best practices for security, privacy, and data protection, and our hosting provider, DigitalOcean, holds SOC 2 certification. This ensures that the underlying infrastructure meets the stringent security and privacy standards required for SOC compliance. While we do not have direct SOC certification, we implement robust security measures, including encryption, access controls, and regular audits, to align with SOC 2 principles.

Is the app compliant with the General Data Protection Regulation (GDPR)?

Yes
General Caster is GDPR compliant. More info on https://generalcaster.app/website/privacy/

Data

Does the app send any data outside of monday.com? If yes, indicate whether the data is customer-submitted (e.g., board names, item names, doc content) or non-customer-submitted (e.g., account ID, board ID, user ID).

Yes
General Caster does send data outside of monday.com, but only in a controlled and secure way that is essential for it to function. (1) Why General Caster Sends Data Outside of monday.com - General Caster is not a native monday.com automation—it is a third-party integration. When you use it: (A) Data from your monday.com boards (like values from columns, items, or formulas) is sent to General Caster's servers. (B) The app processes formulas or automation logic on its own infrastructure. (C) The results (e.g., computed values) are then sent back into monday.com via API to update items or columns. (2) What Kind of Data is Sent - Only the data relevant to the specific automation or formula is transmitted. This typically includes: (A) Values from trigger columns (B) Board and item identifiers (C) User-defined formulas and conditions It does not send all your board data indiscriminately. (3) Data Security and Privacy (A) All communication between monday.com and General Caster servers is done via secure HTTPS. (B) General Caster does not store your data permanently unless necessary for debugging or logs—and even then, it is minimal and temporary. (C) The app adheres to monday.com’s app framework security guidelines. (D) Data processing is compliant with GDPR and standard data protection practices.

Where does the app store logs data?

other
General Caster stores log data on secure cloud infrastructure, which is SOC 2 Type II, ISO/IEC 27001:2013, PCI-DSS certified.

Where does the app store the app data?

DB
General Caster stores app data on secure cloud infrastructure, which is SOC 2 Type II, ISO/IEC 27001:2013, PCI-DSS certified.

Does the developer ensure application logs do not contain secrets or personally-identifiable information (PII)?

Yes
General Caster ensures that logs do not contain secrets or Personally Identifiable Information (PII) through the following practices: Log Scrubbing: We use automated processes to scrub sensitive data from logs, ensuring that secrets (e.g., passwords, API keys) and PII are never recorded in any logs. Tokenization and Masking: For any necessary information in logs, we apply tokenization or masking techniques to obfuscate sensitive data such as email addresses or user IDs. Logging Best Practices: We follow logging best practices, only logging data essential for debugging and performance monitoring, without including sensitive or confidential customer information. Regular Log Audits: We conduct regular audits of our logging processes to ensure that no sensitive information is inadvertently captured in logs. These measures ensure that logs are secure and free from secrets or PII.

Is customer data segregated from the data of other customers (for example logically or physically)?

Yes
Logical Segregation at the Database Level: Customer data is logically segregated in the MariaDB database. Each customer’s data is uniquely identified and stored in isolated database tables, ensuring that data belonging to one customer cannot be accessed by another. This is enforced through application logic and database permissions. Access to data is restricted via strict role-based access control (RBAC) mechanisms within the application, ensuring that users can only access the data associated with their account. Multi-Tenant Architecture: General Caster follows a multi-tenant architecture, where customers share the same infrastructure (VPS and database server), but the data is logically separated to prevent overlap or unauthorized access. Application-Level Segregation: Within the PHP application, data handling and session management are built to ensure each session is tied to a specific customer or user account. Access to customer-specific data is verified through user authentication and session tokens, further preventing any possibility of data leakage across accounts. Encryption: Data is encrypted both in transit (using TLS/SSL) and at rest, ensuring secure communication and storage. This encryption adds another layer of segregation by ensuring that even if data were accessed improperly, it would remain unintelligible without the proper decryption keys. Infrastructure-Level Separation: Although the VPS is shared, DigitalOcean's VPS infrastructure ensures that each server instance is isolated from others. Each customer’s data remains isolated within the General Caster application, preventing cross-tenant access even at the physical infrastructure level.

Privacy

Does the developer enforce multi-factor authentication on employees access to systems which may process customer data?

Yes
General Caster enforces multi-factor authentication (MFA) for all employees accessing systems that process customer data. Our MFA enforcement includes the following: Mandatory MFA: All employees must use MFA to access any systems that handle or process customer data, ensuring an additional layer of security beyond just passwords. Authentication Methods: We use a combination of passwords and authentication apps (such as Google Authenticator or similar) for generating time-based one-time passwords (TOTP) to verify user identity. Access Control Systems: MFA is enforced for critical systems, including our servers (managed through Runcloud), databases (MariaDB), and any other systems interacting with customer data. Periodic Reviews: We regularly review and audit our MFA policies to ensure they meet industry standards and adapt to evolving security needs. By enforcing MFA, we significantly reduce the risk of unauthorized access to customer data.

Does the developer protect access to customer data based on the principle of least privilege?

Yes
General Caster protects customer data from access by non-classified company employees through the following measures: Role-Based Access Control (RBAC): We implement role-based access control, ensuring that only classified employees with specific roles have access to customer data. Non-classified employees are restricted from accessing any sensitive information. Principle of Least Privilege (PoLP): We adhere to the principle of least privilege, granting employees only the minimum access necessary to perform their job functions. Access to customer data is limited strictly to employees who require it for operational purposes. Data Access Logging: All access to customer data is logged and monitored. Any unauthorized access attempts are flagged, and appropriate action is taken immediately. Strict Authentication and Access Control: Employees must use multi-factor authentication (MFA) and secure credentials to access systems containing customer data, and additional authentication layers are required for accessing sensitive information. Regular Audits: We conduct regular access audits to ensure compliance with internal security policies and to verify that only classified employees have access to customer data. These mechanisms ensure that customer data is securely protected from non-classified employees.

Reviews

July 16, 2025

GB: Great and must have app!

August 28, 2024

JL: The absolute worst support. They don't respond to any support requests at all, ever!

February 15, 2023

ZV: i love gc! <3

January 13, 2023

MA: I use this app in almost every installation.

December 20, 2022

NZ: It really hard to find out how to stop the paying pay

December 19, 2022

CS: If you can get the formulas to work it is very useful. But really struggling.

Historical data

Installation history

We have data for December 28, 2024 onwards only. Collected sometime after 00:00 UTC daily.

Total number of installs

Change in total number of installs in last 7 days

Compares the number of installs on each date with 7 days previously:

Max
Min
Current

Change in total number of installs in last 30 days

Compares the number of installs on each date with 30 days previously:

Max
Min
Current

Change in total number of installs in last 90 days

Compares the number of installs on each date with 90 days previously:

Max
Min
Current

Ratings history

Categories history

Each of the following is a yes/no answer, so the graphs show 1 for yes, and 0 for no.

In "Featured" category?

In "Editor's choice" category?

In "Trending this week" category?

App metadata

ID: 8App ID: 8031Listing updated: July 21, 2025