Trust & security
Every Candor app is built to be safe by default — isolated per account, verified on every request, and dependable in the state it owns.
Isolated per account
An app's stored data is scoped to a single account and app. On monday code, storage is reached with a per-account, per-app token — so one customer's install can never read another's data.
Every request verified
The app trusts nothing by default: the monday session that renders a view is a signed token verified against the app's client secret, and every inbound webhook is checked against its signing secret before it's acted on.
Dependable state, on the record
Where an app owns a decision — an approval, an envelope status — that state lives with the app so a board automation can't silently overwrite it, and Approval Flows writes every change to an immutable audit log.
Tenant isolation
Each account's data is walled off. An app's storage on monday code is addressed with a token scoped to the current account and app, and every read and write runs within that scope, so one account's install can never reach another's data. Isolation is a property of how the data is stored, not a promise in a policy.
Verified requests
Nothing is trusted on face value. When a view loads, the short-lived session token monday hands the app is verified against the app's client secret before any data is shown. When a provider or monday calls a webhook, the request's signature is checked against the app's signing secret before it changes anything — a forged or replayed call is rejected.
Dependable state & audit
The worst way state can fail is to silently revert. Where a Candor app owns a decision, that decision is app-owned state — it isn't a board column a stray automation can clobber. In Approval Flows, every request, decision, reminder and reopen is appended to an immutable, per-account audit log you can export.
Data protection & hosting
Candor apps run on monday code, monday.com's own cloud platform; any data an app stores is held within that infrastructure. We process personal data under our Privacy Policy and, for the board and item data an app handles on your behalf, our Data Processing Agreement — which lists our sub-processors. When you uninstall an app, we delete the data we hold for it.
Access & encryption
Data is encrypted in transit (TLS 1.2+/1.3) and at rest via monday code's encrypted storage; tokens and secrets are stored encrypted, never in code. Access to production is on a least-privilege basis and scoped to what operating the service requires. Each app requests only the monday scopes its function needs, and we run no third-party analytics, advertising, or cross-site tracking — your data isn't sent to analytics or error-tracking vendors.
Certifications
We are not yet SOC 2 or ISO 27001 certified. We operate controls aligned with the SOC 2 Trust Services Criteria, and our apps inherit the platform controls of monday code, which runs on monday.com's SOC 2 / ISO 27001 / GDPR-certified infrastructure (that certification covers the platform, not our apps). We intend to pursue our own certification as we scale. We're glad to complete a security questionnaire or a CAIQ-style assessment on request.
Responsible disclosure
Found a security issue? Email support@candor.datadir.co with the details and steps to reproduce (our security.txt lists this contact). Safe harbour: for good-faith research that follows this policy, we will not pursue or support legal action against you. In scope: our apps and this website (the Candor apps on monday code and candor.datadir.co). Out of scope and not permitted: accessing or modifying data that isn't yours, degrading the service (no DoS/spam/automated high-volume scanning), social engineering, and physical attacks. Please give us a reasonable window to remediate before public disclosure; we're grateful for reports and will credit you if you'd like.