At a glance
| Generated documents | Not stored. Uploaded straight to the item’s file column on monday.com. |
| Previews | Held in memory for 10 minutes, visible only to your account. |
| Templates and tokens | Encrypted at rest with AES-256-GCM. |
| Board data | Read when a document is made, used to fill it, not kept afterwards. |
| Uninstall | All account data deleted immediately when monday notifies us, and in any case within 10 days. |
| Transport | HTTPS only (TLS 1.2 or newer). |
| Cookies | None. The app authenticates every call with monday’s signed session token. |
| AI | None. Your data is not used to train any model. |
Data we hold
Per monday.com account, and only while the app is installed:
- Templates you upload (.docx files), encrypted.
- Access token from connecting monday (OAuth), encrypted. It lets the app read the board you work on and add files to it.
- Usage counters: number of documents generated per month, to apply your plan.
- Automation run records: the ids of recent automation runs (the last 500), so that a retried run never creates a duplicate file.
- Plan: your current plan as reported by monday.com.
We do not store item contents, generated documents, people’s e-mail addresses or file contents beyond the templates above. Server logs record only technical error messages, without document or board contents.
Encryption
- At rest: templates and tokens are sealed with AES-256-GCM using a master key kept outside the code repository and outside the data directory.
- In transit: all traffic between your browser, monday.com and the app uses HTTPS (TLS 1.2+), with HSTS.
- Secrets (client secret, signing secret, master key) live in environment variables on the server, never in source code or logs.
Authentication
- App views: every API call carries monday’s signed session token. We verify the signature, expiry and app id on every request and scope all data to the account in the token.
- Automations and lists: monday signs each call with the app’s signing secret; we verify the signature and audience before doing anything, and runs are idempotent.
- Connecting monday (OAuth): the authorization state is bound to your account with a one-time value, and the returned token must belong to the same account. Redirects go only to our fixed callback address.
- Roles: viewers and guests cannot generate documents or change templates.
Permissions (scopes)
| Scope | Why |
|---|---|
boards:read | Read the columns, items and subitems that fill your template. |
boards:write | Upload the generated file to the item’s file column. The app never edits or deletes items. |
me:read | Confirm which account and user connected the app. |
Retention & deletion
- Previews: deleted after 10 minutes.
- Templates: until you delete them in the app, or until uninstall.
- Everything for an account: deleted when monday.com sends the uninstall notification, and in any case within 10 days of uninstall.
- Want data deleted sooner or without uninstalling? Write to contact@jadeboards.com.
Infrastructure
The app runs at docs.jadeboards.com on servers we operate in the European Union (Poland), behind Cloudflare’s network for TLS and protection against abuse. Code changes go through automated tests, security linting and secret scanning before release.
Third parties
| Provider | Purpose | Data |
|---|---|---|
| monday.com Ltd. | Platform, app hosting frame, billing | Your board data (it is your monday account) |
| Cloudflare, Inc. | Network, TLS termination, DDoS protection | Encrypted traffic in transit; no storage |
The PDF and DOCX engine runs on our own servers; documents are not sent to any external conversion service.
Report an issue
Found a vulnerability? Please write to contact@jadeboards.com with “Security” in the subject. We reply within 2 business days and fix confirmed issues as a priority.