Q: What data does the plugin collect, store, and process from monday.com and Azure DevOps?
A: monday account id, email, monday workspace id , board id, ADO Org name, Project, Work Item links, Field Names, Ids and Types.
Q: Is any sensitive data (e.g., API keys, credentials) stored, and if so, how is it protected?
A: We store monday.com and Azure DevOps API keys in MongoDB using field-level encryption, ensuring only authorized components can access them. API keys are never hardcoded; they are securely retrieved when needed. All communications are encrypted via HTTPS, and access is restricted using role-based controls.
Q: Does the plugin support end-to-end encryption for data in transit and at rest?
A: The plugin ensures secure data transmission by using HTTPS for all communications, preventing interception. However, data at rest is not encrypted, except for API keys, which are protected using field-level encryption in MongoDB. No additional end-to-end encryption is implemented.
Q: How does the plugin ensure data integrity and prevent unauthorized modifications?
A: The plugin ensures data integrity using OAuth 2.0 and API keys, allowing only authorized access. HTTPS encryption secures data in transit, preventing tampering.