Security on Client Portal Builder for monday.com

Like every app in the monday.com app marketplace, Client Portal Builder went through a review process where it was checked for certain security aspects. Learn about what we do for security and compliance on this page.

Data storage

How data is stored

Client Portal Builder makes use of your monday.com account storage to store data such as the clients, accounts, and the portal configuration – monday.com encrypts the account storage at rest, learn more here. If you uninstall the Client Portal Builder app from your monday.com account, we as vendor lose access to your monday.com account storage.

  • File uploads from the portal

    When a client uploads a file from the portal, it is temporarily buffered in a Cloudflare R2 bucket for up to 24 hours. This buffering allows larger files to be transferred reliably.

  • Displayed images in the portal

    When images are displayed in the portal, thumbnails are generated and temporarily stored in a Cloudflare R2 bucket for up to 6 days. This is necessary because it would impact portal loading times negatively, if images were displayed with their original size.

  • Portal events

    Analytics events (Cloudflare): When a client uses the portal, analytics events are stored on Cloudflare for up to three months. These records can include the request path, portal and client-item identifiers, HTTP method, duration, response status, and a pseudonymous account identifier—a truncated hash of the client’s email address. They do not contain the actual contents of your boards. This data supports the app dashboard and service operation. App lifecycle events (Postgres): We store installation, uninstallation, trial, and subscription events in Postgres. The monday.com account ID, event type, and timestamp are stored in plaintext. The webhook payload is encrypted at rest with AES-256 and may include the installer’s name, email address and country, account metadata, and subscription details. Lifecycle records are retained while the app remains installed. After an account uninstalls, its records are eligible for deletion through our operator-run account cleanup process. This cleanup is performed periodically rather than according to a guaranteed deletion timeframe.

Hosting

How data is hosted

The backend of the Client Portal Builder app is hosted on the infrastructure provided by monday.com using monday code. To provide the best performance possible, the frontend of the Client Portal Builder is hosted on Cloudflare. Both of these service providers are SOC2 certified and regularly audited.

When Google login is enabled for a portal, Google is used as the authentication provider. During sign-in, the raw Google account email address is handled in memory and is not stored; only a hash is stored. The Google account ID is stored in the customer’s monday.com account. The display name and profile picture URL are carried in the session token and are not stored separately by Gorilla Apps.

Encryption

How data is encrypted

The data stored in your monday.com account is encrypted at rest, learn more here. All data transferred between the Client Portal Builder frontend and backend is encrypted through SSL. If you are using the apps custom domain feature, an SSL certificate will be issued for your domain using TLS 1.3.

Multi region

Where data is stored and served from

Client Portal Builder currently supports monday.com accounts in the EU and US regions. Portal content and client account data—including names, email addresses, and password hashes—is stored in the customer’s own monday.com account. For EU-region accounts, this data remains in monday.com’s EU region; for US-region accounts, it remains in monday.com’s US region. Gorilla Apps does not copy client account data into its own application database.

A limited set of operational data—including portal routing metadata, pseudonymous request analytics, cached image thumbnails, and encrypted app installation and subscription records—is processed outside this monday-hosted regional layer. These operational stores are not partitioned according to the customer’s monday.com region. Cloudflare services may process the relevant data on its global network.

Miscellaneous

List of used industry standards and best practises

  • Access tokens are stored in the monday.com secure storage (Hashicorp Vault)
  • Passwords are hashed with Scrypt
  • The frontend uses React with built-in protection against XSS attacks
  • Session tokens expire after five minutes and are stored in secure cookies. Every session token is issued with a seven-day absolute expiry that renewal cannot extend.
  • Secrets get redacted in the logs
  • Cloudflare is used as a layer to protect against DDOS and other common attacks
  • Login attempts an account can perform is limited to protect against brute-force attacks
  • We use Socket to regularly scan third-party dependencies for potential vulnerabilities
  • Monday code is set up in a way that it disallows outbound traffic by default
  • Locally we are using a password manager to store secrets

  • Is Client Portal Builder GDPR complient?

    Client Portal Builder currently supports monday.com accounts in the EU and US regions. Portal content and client account data is stored in the customer’s own monday.com account and remains in that monday.com region. Gorilla Apps does not copy client account data into its own application database. Limited operational data—including portal routing metadata, pseudonymous request analytics, cached image thumbnails, and encrypted app installation and subscription records—is processed outside this monday-hosted regional layer and is not partitioned according to the customer’s monday.com region. The Client Portal uses only a technically necessary session cookie, so no cookie banner is shown. A Data Processing Addendum is available on request.

  • Is Client Portal Builder SOC2 certified?

    Client Portal Builder itself is currently not SOC2 certified, this might be something we'll do in the future – the app is still new. However, the app is heavily dependent on the infrastructure of monday.com and Cloudflare, which are both SOC2 certified.

  • Does Client Portal Builder support 2FA and SSO?

    We would love to add support for 2FA and SSO to the app. If this is something you require, please contact us.