Overview

As organizations handle increasing volumes of sensitive data, compliance and data protection have become critical. monday.com is committed to maintaining the highest standards of data privacy, security, and regulatory compliance. This article outlines how monday.com addresses global data protection laws such as GDPR and compliance standards like SOC 2.

---

🌍 Compliance at a Glance

Regulation/Standard	Description
GDPR	European Union’s General Data Protection Regulation
SOC 2 Type II	Service Organization Control for secure data management
ISO/IEC 27001	International standard for information security
HIPAA (optional)	Healthcare data compliance (available on Enterprise)
CCPA	California Consumer Privacy Act compliance
EU–US DPF	Framework for compliant EU-US data transfers

✅ GDPR: General Data Protection Regulation

Applies to: Users in the EU and companies processing EU citizen data.

monday.com is fully GDPR-compliant, ensuring:

• User data rights (access, correction, deletion, portability)
• Data minimization and purpose limitation
• Breach notification protocols
• Use of subprocessors under strict compliance agreements

How Users Can Exercise GDPR Rights

• Request data export via monday.com support
• Admins can delete user data upon request
• Opt-out and consent settings for communications and marketing

📌 monday.com hosts data in EU-based servers for applicable users, and uses secure encryption protocols.

🛡️ SOC 2 Type II Compliance

SOC 2 Type II ensures that monday.com securely manages data to protect:

• Confidentiality
• Integrity
• Availability

It involves:

• Independent audits of systems and controls
• Continuous monitoring of security protocols
• Role-based access controls and internal compliance training

📄 You can request the latest SOC 2 report by contacting monday.com’s support or your account manager.

🔐 ISO/IEC 27001 Certification

monday.com is certified for ISO 27001, which means:

• Formal information security risk management
• Company-wide security policies and incident response plans
• Continuous security audits and improvements

---

🏥 HIPAA (for US Healthcare)

For Enterprise customers, monday.com offers a HIPAA-compliant environment upon request. This includes:

• Signing a Business Associate Agreement (BAA)
• Applying administrative and technical safeguards to protect PHI (Protected Health Information)

📌 Contact sales or your account manager to enable HIPAA compliance features.

🔁 Data Residency and Transfer

monday.com stores data in Amazon Web Services (AWS) data centers located in:

• United States (default)
• European Union (for EU-based accounts)

It uses:

• Encryption in transit and at rest
• EU–US Data Privacy Framework (DPF) for compliant cross-border transfers

🔍 User Controls for Privacy

Feature	Description
Account Deletion	Users can delete their own account and data
Export User Data	Admins can export full user activity
Custom Retention (Enterprise)	Control how long data is stored
Consent Management	Options to manage opt-in/opt-out for emails

📄 Subprocessors and Third Parties

monday.com uses a small number of vetted subprocessors to help provide its service (e.g., AWS, Cloudflare, Zendesk).

You can view a list of current subprocessors here:
👉 https://monday.com/l/legal/subprocessors

Each vendor must comply with monday.com’s strict data processing agreement (DPA) and security requirements.

🔐 Security Features That Support Compliance

Feature	Description
Two-Factor Authentication (2FA)	Adds extra login protection
Audit Logs (Enterprise)	Track changes and access events
Role-Based Permissions	Control who can access/edit data
Data Encryption	AES-256 encryption at rest; TLS 1.2+ in transit
Session Timeout & IP Whitelisting (Enterprise)	Enhanced access control

🔚 Summary

monday.com is deeply committed to your data’s safety and your compliance requirements. With certifications like SOC 2, ISO 27001, and support for GDPR and HIPAA, you can confidently use monday.com in secure, regulated environments.

Let me know if you’d like a compliance checklist, data processing summary, or help with a DPA request!