The monday apps marketplace contains ready-made, easy-to-use apps to expand the capabilities of the monday.com platform and fit the unique needs of your business’s workflows, processes, and projects.
But with great power comes great responsibility. Here are some privacy tips to keep in mind when you're installing apps by external developers on the apps marketplace.
Understand who can (and cannot) install external apps
Only account admins can install monday apps. If a non-admin wants to install an app, they can request that an admin install the app for them by clicking "Request" on the app page in the marketplace:
The admin will then receive a notification in their bell notifications, such as the one below:
Explore the apps in the apps marketplace
Selected apps can be found in the apps marketplace for you to explore and install. Apps will that were built by external developers will have the name of the app developer on the right side of the app description page. Each developer has an email contact for support, installation and sales queries.
Certain developers also submit detailed information about their security and privacy practices. If the app has submitted this information, it will be linked here on the description page as shown below:
Approve the app's permissions
Every app requires specific permissions from your monday.com account. Each of the app's permissions (or scopes) are specific to one part of the platform (for example, boards, or updates, or teams) and can be categorized as either read access or write access. When an admin install's an app, they will see a list of the permissions that the desired app is requesting and be able to approve (or cancel) the installation.
Define your organization's approach
Build an approach or policy for installing apps based on your organization's data management practices. Some factors to consider include:
- Which teams will get the most benefit from the app?
- Does your IT or legal team need to approve this app before you start using it?
- Does the app have additional licensing costs? Do you have to assign a budget for them?
Keeping all these factors in mind when considering which apps to download will ensure that your organization manages its data securely.
Reach out to the app developer to learn more
If you have any questions about an app or want to learn more about its data management policies, reach out to the developer. They will be able to clarify any specific questions you might have about their app.
Review the security standards of our apps marketplace
To be included in our marketplace, all apps must comply with a basic set of security standards. To learn more about our relationships with our marketplace partners, you can read our Marketplace Partner Agreement here. Our security standards include the following:
- The application must use TLS 1.2 or higher to encrypt all of its traffic.
- HSTS must be enabled with a minimum age of at least one year.
- The application must authenticate and authorize all requests.
- The application must not collect user credentials.
- Your app must store API tokens securely. They should never be logged, stored in client-side code and public repositories, or made accessible to end-users.
- Request only the OAuth scopes needed for the documented use of the app.
- Do not fetch or store data not needed for the publicly documented use of the app.
- Tracking (and similar) cookies that will track users outside the scope of the app should require user consent.
- HTTPS certificates must be valid and have an expiration date of at least 1 year from app submission date.
If you have any questions about the monday apps marketplace in general, please feel free to reach out to our Customer Success Team at firstname.lastname@example.org. We are available 24/7 and happy to assist :)