What Recognition Hub stores, where it goes, and how export, erasure and retention work on monday.com.
In short. monday.com does not offer an app database this product can use, so Recognition Hub runs its own PostgreSQL. Your recognitions live there rather than in monday.com storage, which means you choose the provider, the region and the jurisdiction. If your policy requires employee data to stay within monday.com’s own infrastructure, that is worth weighing early — the rest of this page sets out exactly what is held and where it goes.
Where the data lives
monday.com does not offer an app database this product can use — the managed option is MongoDB, exposed only as a short-lived read-only credential for inspection. Recognition Hub therefore brings its own PostgreSQL database, and that database is the system of record.
Held in that database, per account:
- Recognitions — title, message, the author and recipient monday user ids, company value, GIF reference, timestamps.
- Reactions and comments — the emoji or text, and who left it.
- Cached profiles — display name and avatar URL, refreshed from the monday API so the feed can render without a lookup per card.
- Rewards — pools, balances, ledgers, redemption records and their status.
- Badges, preferences and the audit log.
Board data is not stored. The only board information the app ever reads is who is assigned on an item, read in your browser on your own monday session at the moment you open the composer from that item, and used to prefill the recipient field. It is never written to the database.
Where data goes beyond monday.com
| Destination | What is sent | When |
|---|---|---|
| The app’s PostgreSQL | Everything listed above | Always |
| AWS SES | Recipient email address, recognition title, message, value, GIF still, deep link | When notification email is enabled |
| Anthropic | The occasion or message you type, plus your company-value names | Only when an admin connects an Anthropic key and someone uses AI Assist |
| GIF provider | Your search terms. No recognition content. | When the GIF picker is used |
| Tremendous | Recipient name, email address, reward amount | Only when rewards are connected and a reward is redeemed |
Every destination except the database is optional and off until an admin turns it on. Email and AI can both be pointed at credentials you own — your own AWS SES account, your own Anthropic key — so that path runs through infrastructure you control.
Access and permissions
- Every request is authenticated. The browser never asserts who it is: it sends a short-lived session token signed by monday.com, and the server verifies the signature and reads the acting user and account from the signed claims.
- Admin rights are resolved server-side against the monday API, not taken from the page or inferred from which screen an action came from. monday’s account settings view is reachable by any user, so placement authorizes nothing.
- Accounts are isolated. Every query is scoped to the acting account, and the OAuth token stored for an account is verified to belong to it before it is saved.
- Credentials are encrypted at rest — the monday token, the Anthropic key, the Tremendous key and the SES credentials are all stored encrypted and never returned to the browser.
OAuth scopes requested: me:read, users:read, account:read, teams:read, ai:consume and boards:read. Boards are read, never written.
Data-subject requests
Under GDPR your organisation is the data controller and this app is a processor, so both of these run as admin actions — an employee’s request goes to you, and you action it here. The app never acts on a request from a data subject directly, because it has no way to authenticate one.
- Export (Art. 15) — everything held about one person, as a JSON file an admin can hand over. Live redemption links are deliberately excluded: they are bearer URLs to spendable value, and an access request is not a reason to put one in an email attachment.
- Erasure (Art. 17) — the person’s identifiers are replaced with a fresh random pseudonym, so recognitions written by and about them stay coherent for everyone else while ceasing to identify them.
Both live under Settings > Privacy & Data.
Retention and deletion
- Retention is configurable per account, and a scheduled job prunes past the window you set. The audit log has a floor of 365 days — it is itself a security control, and a short retention on it would defeat the point.
- Uninstalling erases the account. monday.com notifies the app on uninstall and every table belonging to that account is purged. A registry test fails the build if a new table is added without being registered for the purge, which is what keeps that promise true as the schema grows.
Keeping the footprint small
The database is a fixed part of the architecture, but almost everything about it is yours to decide: run your own PostgreSQL in the region and jurisdiction that suit you, connect your own AWS SES, bring your own Anthropic key, and leave rewards and GIFs disconnected until you want them. Configured that way, the only parties handling your data are ones you already have a direct relationship with.