Security basics: how your data is protected and what you can do

Security in Monfri is shared: we protect the platform and your data in it; you decide who gets in and what they can do. This page covers both halves.

Where your data is

Your data is stored on servers in the European Union, in Bulgaria. Two things leave the EEA, both named in the Privacy Policy, sections 5 and 10:

• AI features send the content they work on to OpenAI in the United States — for example the text an AI step in Automation summarises. This is covered by the EU Standard Contractual Clauses.
• Cloudflare, which stands in front of every Monfri service, sees the metadata of each request — such as the IP address and the browser — on its global network.

Some pages also load fonts and avatar images from other hosts, so your browser shares its IP address with them. The full list of third parties is in section 5 of the Privacy Policy.

How Monfri protects it

What section 6 of the Privacy Policy lists and we do:

• Encryption in transit — every connection uses TLS 1.2 or newer.
• Encrypted off-site backups — the encryption key is kept offline.
• Private databases — only the application services reach them, over a private network.
• Isolation between workspaces — one customer's data is never visible in another workspace. Roles decide what each person sees inside yours.
• Automated auditing and patching — the infrastructure is checked around the clock, with alerts, and updated regularly.

Every Monfri page also refuses to run scripts that are not ours. That is what stops an injected script from reading your data in your browser.

What you can do

• One login per person. Invite everyone with their own e-mail. A shared login hides who did what in the audit log.
• Give only what is needed. A member who reads reports needs Viewer, not Admin. See What each person can open: service access.
• Keep two owners. Then the workspace never depends on one person's mailbox. See Leave a workspace or remove a member.
• Use a password only for Monfri, or sign in with Google. Monfri refuses passwords that appear in public leak lists.
• Remove people the day they leave. Their access to every service ends at once.
• Look at the audit log now and then — especially after a change you did not make.

When something looks wrong

Someone may know your password

Change it in Profile → Change Password. Every other device and every service is signed out at once — see Reset or change your password. Then check the audit log of your workspace for sign-ins you do not recognise.

You got an e-mail about a change you did not make

Monfri e-mails you when your password changes, with the IP address it was changed from. If it was not you, reset the password from the sign-in page straight away and write to [email protected].

Your account has been suspended

Monfri stops an account and pauses its workspace when the browser repeatedly reports a script on Monfri's pages that is not ours — a sign that someone may be trying to read data through it. Sign-in then says Your account has been suspended. Write to [email protected]. Write to us from the address of your account: we look at what happened and lift the suspension once it is clear. Your data is not touched in the meantime.

You found a security problem

Write to [email protected] with what you found and how to see it. Please do not test it against other customers' data.

Contracts and requests

• Data Processing Agreement (DPA) — on request at [email protected].
• Requests about personal data — access, correction, deletion, portability — go to [email protected]; we reply within one month.
• Export or delete your own data — see Cancel, export everything, delete a workspace or your account.