Trust & security
Every Candor app is built to be safe by default — isolated per account, verified on every request, and dependable in the state it owns.
Isolated per account
An app's stored data is scoped to a single account and app. On monday code, storage is reached with a per-account, per-app token — so one customer's install can never read another's data.
Every request verified
The app trusts nothing by default: the monday session that renders a view is a signed token verified against the app's client secret, and every inbound webhook is checked against its signing secret before it's acted on.
Dependable state, on the record
Where an app owns a decision — an approval, an envelope status — that state lives with the app so a board automation can't silently overwrite it, and Approval Flows writes every change to an immutable audit log.
Tenant isolation
Each account's data is walled off. An app's storage on monday code is addressed with a token scoped to the current account and app, and every read and write runs within that scope, so one account's install can never reach another's data. Isolation is a property of how the data is stored, not a promise in a policy.
Verified requests
Nothing is trusted on face value. When a view loads, the short-lived session token monday hands the app is verified against the app's client secret before any data is shown. When a provider or monday calls a webhook, the request's signature is checked against the app's signing secret before it changes anything — a forged or replayed call is rejected.
Dependable state & audit
The worst way state can fail is to silently revert. Where a Candor app owns a decision, that decision is app-owned state — it isn't a board column a stray automation can clobber. In Approval Flows, every request, decision, reminder and reopen is appended to an immutable, per-account audit log you can export.
Data protection & hosting
Candor apps run on monday code, monday.com's own cloud platform; any data an app stores is held within that infrastructure. We process personal data under our Privacy Policy and, for the board and item data an app handles on your behalf, our Data Processing Agreement — which lists our sub-processors. When you uninstall an app, we delete the data we hold for it.
Access & encryption
Data is encrypted in transit. Access to production is on a least-privilege basis and scoped to what operating the service requires. Each app requests only the monday scopes its function needs.
Responsible disclosure
Found a security issue? Email support@candor.datadir.co with the details and steps to reproduce. Please give us a reasonable window to fix it before disclosing publicly; we're grateful for reports and will credit you if you'd like.