monday CRM and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. monday.com states it does not use Customer Data or Content to train AI models and does not allow others to do so.

Vendor's wording: “monday.com does not use Customer Data and/or Content to train artificial intelligence models and does not allow others to do so.”

Source: monday.commonday AI Terms, section 6 Monitoring and ImprovementChecked on 19 October 2026

Stored in the US, Germany or Australia, in the data centre closest to the first user who created the account; some data may sit in other regions at sub-processors.

Vendor's wording: “Data is stored in the data center closest to the location of the first user who created the account.”

Source: monday.comFAQ: Where is account data stored?Checked on 19 October 2026

DPA on request.

Yes. A Data Processing Addendum is incorporated by reference into the Terms of Service, so it applies without a separate signature.

Vendor's wording: “This Data Processing Addendum (“DPA”) is incorporated by reference into monday.com’s Terms of Service”

Source: monday.comDPA preambleChecked on 19 October 2026

Published.

Yes, public list at monday.com/l/privacy/subprocessors: 14 infrastructure rows + 15 AI rows (29 rows) plus 13 monday.com entities and support providers. AI providers listed include OpenAI, Anthropic, Microsoft, Google Cloud, AWS and Nebius.

Vendor's wording: “Anthropic PBC AI Work Platform LLM provider”

Source: monday.comSub-processors tables and AI Work Platform tableChecked on 19 October 2026

On the list, under review.

Active (monday.com Inc.; EU-US DPF, Swiss-US DPF, UK Extension, re-certification under review)

Source: dataprivacyframework.govSearch 'monday.com'Checked on 19 October 2026

Interaction data with monday AI is kept up to 60 days. After termination, customer data stays until the customer or monday.com deletes it; customer is responsible for exporting or deleting it first.

Vendor's wording: “Such data will not be shared with third parties and may be retained by us for up to 60 days.”

Source: monday.commonday AI Terms, section 6Checked on 19 October 2026

SOC 1 Type II, SOC 2 Type II, SOC 3, ISO 27001, 27018, 27017, 27032 and 27701, and CSA STAR (9 listed), plus TX-RAMP.

Vendor's wording: “SOC 1 Type II Report SOC 2 Type II Report SOC 3 Report ISO/IEC 27001:2022”

Source: monday.comCompliance/CertificationsChecked on 19 October 2026

€28 / user / mo.

€28 per seat per month for monday CRM Pro, billed annually (shown for 3 seats; monthly billing costs more); prices exclude tax. AI credits are included in this plan.

Vendor's wording: “Prices do not include tax. The price is determined by the user's billing country.”

Source: monday.commonday CRM pricing, Pro planChecked on 19 October 2026