monday.com uses world-leading security solutions to secure our service so your data can be kept safe.
How do we secure your data?
Our systems are hosted on multiple Availability Zones at Amazon Web Services. This allows us to provide a reliable service and keeps your data available whenever you need it. We have also established a disaster recovery site in another AWS US region.
These data centers employ leading physical and environmental security measures, resulting in highly resilient infrastructure. For more information about their security practices, see below:AWS security page
GCP security page
monday.com implements a security oriented design in multiple layers, one of which is the application layer. The monday.com application is developed according to the OWASP Top 10 framework and all code is peer reviewed prior to deployment to production.
Our controlled CI/CD process includes static code analysis, vulnerability assessment, end-to-end testing, unit testing which addresses authorization aspects and more. monday.com developers go through periodic security training to keep them up-to-date with secure development best practices.
- Firewalls for enforcing IP whitelisting and access through permitted ports only to network resources
- A web application firewall (WAF) for content-based dynamic attack blocking
- DDoS mitigation and rate limiting
- NIDS sensors for early attack detection
- Advanced routing configuration
- Comprehensive logging of network traffic, both internal and edge
- Traffic is encrypted using TLS 1.3 with a modern cipher suite, supporting TLS 1.2 at minimum
- User data is encrypted at rest across our infrastructure using AES-256 or better
- Credentials are hashed and salted using a modern hash function
External Security Audits and Penetration Tests
Independent third party assessments are crucial in order to get an accurate, unbiased understanding of your security posture. monday.com conducts penetration tests on an annual basis both in the application and in the infrastructure level using well-known, independent auditors.
Additionally, monday.com is going through external auditing as part of the SOC2 Type II audit, the ISO certifications and other external audits.
Bug Bounty Program
monday.com is a cloud-based company, with no part of our infrastructure retained on-premise. Our physical security in the offices include personal identification based access control, CCTV and alarm systems.
monday.com’s data centers are hosted on Amazon Web Services and Google Cloud Platform infrastructure, where leading physical security measures are employed.
Disaster Recovery and Backups
monday.com is committed to providing continuous and uninterrupted service to all its customers. We consistently backup user data every 5 minutes. All backups are encrypted and distributed to various locations, where they are retained for 25 days.
Our Disaster Recovery Plan is tested at least twice a year to assess its effectiveness and to keep the teams aligned with their responsibilities in case of a service interruption.