Security

How Coder protects your data · Last updated: 5 November 2026

Your Data Stays in Your Region

Coder runs on monday code, the hosting platform of monday.com, so your data never leaves monday.com’s infrastructure. Coder is deployed in every monday.com data region and works in the region of your account:

United States

Accounts hosted in the US region.

European Union

Accounts hosted in the EU region: data stays in the EU.

Australia

Accounts hosted in the AU region.

Israel

Accounts hosted in the IL region.

Board content stays in your monday.com account. The few records Coder keeps (reserved codes, sequences, QR profiles and QR codes) are stored in monday code storage in the same region.

How Coder Is Protected

Authorisation

Sign-in with monday.com OAuth 2.1 and PKCE. Access tokens are kept encrypted in monday code secure storage and refreshed automatically.

Verified Requests

Every request from monday.com (automations, the board view) carries a signed token that Coder verifies before doing anything.

Board Access

The board view only works on boards the person can see in monday.com: admins, board members and, for main boards, account members.

Signed QR Links

Each QR link is signed: it cannot be guessed or changed to reach another item. A revoked QR code stops working at once.

PIN Protection

PINs are stored only as salted hashes. After 5 wrong PINs a QR code is locked for 15 minutes, on every server.

Short-Lived Links

Print previews open with links that expire after 10 minutes.

Least Privilege

Coder asks only for the permissions it uses: reading and writing boards, reading workspaces, users and teams (to check board access), reading the account and the signed-in user, and sending notifications and updates. QR codes open to anyone change only the columns set in their profile.

Privacy by Design

No tracking or analytics cookies, no advertising, no selling of data.
People who scan a public QR code are not identified: only the time of the scan is kept.
All traffic is encrypted with HTTPS.
When Coder is uninstalled its authorisation is removed at once, and its data is deleted within 10 days.

Report a Vulnerability

If you find a security issue, write to [email protected] with the details. We acknowledge reports within 2 business days and ask you not to disclose the issue publicly until it is fixed.