What can we help you with?

Understanding apps marketplace security

The monday apps marketplace contains ready-made, easy-to-use apps to expand the capabilities of the monday.com platform and fit the unique needs of your business’s workflows, processes, and projects.

But with great power comes great responsibility. Here are some privacy tips to keep in mind when you're installing apps by external developers on the apps marketplace.

 

Note: All apps in our marketplace are reviewed by our team for functionality and basic security, however, we do not endorse or certify any apps. As such, you should only install apps that you trust. When you install an app, you will see a list of permissions that the app will have access to. Read on to learn more.

 

 

Understand who can (and cannot) install external apps

Only account admins can install monday apps. If a non-admin wants to install an app, they can request that an admin install the app for them by clicking "Request" on the app page in the marketplace:

image_9__21_.png

The admin will then receive a notification in their bell notifications, such as the one below:

image_1__38_.png

 

 

Explore the apps in the apps marketplace

Selected apps can be found in the apps marketplace for you to explore and install. Apps will that were built by external developers will have the name of the app developer on the right side of the app description page. Each developer has an email contact for support, installation and sales queries.

 

 

Frame_1_-_2020-10-25T110155.527.png

 

Certain developers also submit detailed information about their security and privacy practices. If the app has submitted this information, it will be linked here on the description page as shown below:

Frame_1_-_2020-10-25T110510.959.png

Approve the app's permissions

Every app requires specific permissions from your monday.com account. Each of the app's permissions (or scopes) are specific to one part of the platform (for example, boards, or updates, or teams) and can be categorized as either read access or write access. When an admin install's an app, they will see a list of the permissions that the desired app is requesting and be able to approve (or cancel) the installation. 

 

image_8__7_.png

 

 

Define your organization's approach

Build an approach or policy for installing apps based on your organization's data management practices. Some factors to consider include: 

  • Which teams will get the most benefit from the app? 
  • Does your IT or legal team need to approve this app before you start using it? 
  • Does the app have additional licensing costs? Do you have to assign a budget for them? 

Keeping all these factors in mind when considering which apps to download will ensure that your organization manages its data securely. 

 

Tip: To learn more about how to install or build monday apps, check out this article

 

Reach out to the app developer to learn more

If you have any questions about an app or want to learn more about its data management policies, reach out to the developer. They will be able to clarify any specific questions you might have about their app. 

Review the security standards of our apps marketplace

To be included in our marketplace, all apps must comply with a basic set of security standards. To learn more about our relationships with our marketplace partners, you can read our Marketplace Partner Agreement here. Our security standards include the following:

  • The application must use TLS 1.2 or higher to encrypt all of its traffic.
  • HSTS must be enabled with a minimum age of at least one year.
  • The application must authenticate and authorize all requests.
  • The application must not collect user credentials.
  • Your app must store API tokens securely. They should never be logged, stored in client-side code and public repositories, or made accessible to end-users.
  • Request only the OAuth scopes needed for the documented use of the app.
  • Do not fetch or store data not needed for the publicly documented use of the app.
  • Tracking (and similar) cookies that will track users outside the scope of the app should require user consent.
  • HTTPS certificates must be valid and have an expiration date of at least 1 year from app submission date.
  • You must own the domain name that you use for your app, app’s privacy policy, support, and landing page URLs, or get the appropriate permission from the domain name owner.

 

Tip: Discover how to list your app in monday’s apps marketplace right here.

 

If you have any questions about the monday apps marketplace in general, please feel free to reach out to our Customer Success Team at support@monday.com. We are available 24/7 and happy to assist :)