monday.com
work-management · monday.com · last read 2026-10-07
Identity
No identity observation recorded yet.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Paid upgrade | Standard | support.monday.com | 2026-10-05 |
EU: EU Data Region storage is available for Enterprise plans, and for Standard and Pro plans created on or after January 23, 2023. Only Enterprise customers have Customer Data hosted solely in the EU; Standard and Pro EU accounts may also have data processed in the United States.
Subprocessor chain
28 third parties · 11 of the vendor's own group companies · 19 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| AlphaAI Technologies Inc. dba Tavily | — | Web-search engine for AI |
| Amazon Web Services EMEA SARL | US, EU, AU | Cloud computing provider |
| Anthropic PBC | — | LLM provider |
| Cloudflare, Inc. | — | CDN, security services |
| Cloudinary Ltd. | US, EU | File preview service |
| Coralogix, Inc. | EU | Log aggregation and correlation service |
| Datadog, Inc. | EU | application monitoring for servers, databases, tools, and services |
| dbt Labs, Inc. | — | Data build tool |
| EON.io Ltd. | — | Database backup service |
| Exa Labs, Inc. | — | Web-search engine for AI |
| Fortinet, Inc. | US, EU, AU | Advanced threat protection for uploaded files |
| Foundever Operating Corporation Limited | PL | Customer support & services |
| Functional Software, Inc. dba Sentry | US | Error and performance monitoring for applications |
| Google Cloud EMEA Limited | US, EU | Cloud computing provider |
| Hyperdoc Inc. (Recall.ai) | US, EU | Call recording and analysis service |
| Lakera AI AG | US, EU | Runtime security for AI |
| LangChain Inc. | EU | AI oversight and agent management service |
| Mailgun Technologies, Inc. | US, EU | Email notification service |
| Microsoft Corp. | — | AI functionalities |
| Microsoft Corp. | — | Azure cloud computing provider |
| Nebius Inc. | — | Data embedding service |
| Nebius, Inc. | — | AI functionalities |
| OpenAI, L.L.C. | — | AI functionalities |
| Redis Labs, Ltd. | US, EU, AU | Managed database platform |
| Snowflake Computing Netherlands B.V. | EU | Data warehouse service for AI functionalities |
| Superpowered Labs Inc dba Vapi | — | AI voice agent builder |
| Transactel International Services Limited d/b/a TELUS International | GT | Customer support & services |
| Twilio Inc. (SendGrid) | US, EU | Email notification service |
monday.com's own group companies listed as subprocessors (11)
| Company | Country | Purpose |
|---|---|---|
| monday.com GmbH | DE | Provision of the service |
| monday.com K.K. | JP | Provision of the service |
| monday.com Ltd. | IL | Provision of the service |
| monday.com Ltda. | BR | Provision of the service |
| monday.com Pte. Ltd. | SG | Provision of the service |
| monday.com SAS | FR | Provision of the service |
| monday.com sp. z o.o. | PL | Provision of the service |
| monday.com UK 2020 Ltd. | GB | Provision of the service |
| monday.com, Inc. | US | Provision of the service |
| monday.com, Pty Ltd. | AU | Provision of the service |
| MONDAY.COM, S.A. DE C.V. | MX | Provision of the service |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CSA Star · CSA | Claimed | — | monday.com | 2026-10-05 |
| EU-US Data Privacy Framework · DPF | Claimed | — | monday.com | 2026-10-05 |
| ISO/IEC 27001:2022 · ISO27001 | Claimed | — | monday.com | 2026-10-05 |
| ISO/IEC 27017:2015 · ISO27017 | Claimed | — | monday.com | 2026-10-05 |
| ISO/IEC 27018:2019 · ISO27018 | Claimed | — | monday.com | 2026-10-05 |
| ISO/IEC 27701:2019 · ISO27701 | Claimed | — | monday.com | 2026-10-05 |
| ISO/IEC 27032:2023 | Claimed | — | monday.com | 2026-10-05 |
| TX RAMP | Claimed | — | monday.com | 2026-10-05 |
| SOC 1 Type II · SOC1 | Claimed | — | monday.com | 2026-10-05 |
| SOC 2 Type II · SOC2T2 | Claimed | — | monday.com | 2026-10-05 |
| SOC 3 · SOC3 | Claimed | — | monday.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · monday.com Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-06 | 2026-10-07 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · monday.com Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-06 | 2026-10-07 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · monday.com Inc. | Active - Re-certification under Review | HR data, non-HR data | 2027-10-06 | 2026-10-07 |
- ACN qualified cloud (Italy): checked 2026-10-07, no entry under monday.com
- Data Privacy Framework List (US): checked 2026-10-07, 3 entries under monday.com
- FedRAMP Marketplace (US): checked 2026-10-07, no entry under monday.com
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-05 |
| residency | Public | full | 200 | 2026-10-05 |
| subprocessors | Public | full | 200 | 2026-10-05 |
History
Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.