What Management OS does with your monday.com data.

Management OS reads CRM-shaped data from your monday.com workspace — specifically: boards (and their items, columns, and groups), updates (the in-item conversation thread), users, teams, and your own identity. We focus on boards in the monday Sales CRM product, but monday's GraphQL API is unified across Sales CRM, Work Management, Dev, and Service — so the token technically grants read access to any product the connecting user has access to. Management OS only reads boards you connect or that match CRM-shaped schemas (deals, accounts, contacts, activities).

We do not read files attached to items, workforms, automation logs, billing data, or workspace administration objects.

Why: Management OS is the leadership execution layer above the revenue stack. We synthesize CRM data into a Weekly Intelligence Brief that develops the leader, their team, and their business. monday's flexibility means every customer's board structure looks different, so we read the board schema first (columns + groups) and only then read items — ensuring the Brief reflects your actual pipeline shape.

We do not write to your monday.com workspace. Management OS is a read-only consumer of your monday data. We do not create, modify, or delete any monday objects — no boards, no items, no updates, no columns, no groups, no automations, no integrations.

We only invoke read queries against monday's GraphQL API (query operations). We never invoke mutation operations. The read-only posture is enforced in Management OS source code and verifiable on request.

All Management OS outputs (Account Plans, Coaching Briefs, Forecast Locks, Meeting Prep dossiers, Pitch Decks) are generated and stored in Management OS's own database and surfaced through the Management OS application — not pushed back into your monday workspace.

monday.com uses a personal V2 API token rather than per-scope OAuth grants. The token inherits the connecting user's account permissions. The recommended scope set below describes the read capabilities Management OS actually invokes; the token you generate carries the union of these (and whatever else your account permits).

Recommended read scopes (5)

These describe the GraphQL read surface Management OS invokes. boards:read is the required minimum — without it, no useful synthesis is possible.

User-level granularity: The practical limit on what Management OS can read is the connecting monday user's account permissions and board membership. If you want to further limit what Management OS can see, create a dedicated monday user for the integration with access only to the boards you want exposed, then generate the token from that user's Developer Center.

Token format + headers: monday V2 tokens are passed raw in the Authorization header (no Bearer prefix) alongside a required API-Version: 2025-04 header. Management OS pins to a specific API version so upstream schema changes do not silently break the Brief.

Application database: Supabase Postgres (Management OS's production database, US East). Encrypted at rest (AES-256), encrypted in transit (TLS 1.3). Workspace-scoped row-level security (RLS) means one customer's data is never visible to another.

API token storage: Stored in the same Supabase database under workspace-scoped RLS. Tokens are encrypted at rest and never returned to client browsers. Only the Management OS server-side runtime has access via service-role credentials. We never log or display the token after the initial save.

Inference layer: Anthropic API (Claude models). CRM data required for a specific brief generation is passed to Anthropic; outputs are returned to Management OS and stored in our database. Anthropic does not train on customer data per their API terms.

Retention: We retain monday-sourced data while your subscription is active. On disconnect we delete the API token immediately. On subscription cancellation, customer data is retained for 30 days for restoration, then permanently deleted. Data subject deletion requests are honored within 30 days per our Privacy Policy.

1. Sign in to monday.com and click your avatar → Developers to open the Developer Center
2. In the left sidebar, click My Access Tokens
3. Copy your personal V2 API token (or click Show if it's hidden). If your account requires generating a new one, click Generate
4. Sign up at mgmt-os.ai and complete onboarding to your workspace
5. Open Management OS → Settings → Integrations → find monday.com → click Connect monday.com
6. Paste the API token into the form and click Save. Management OS validates the token against monday's GraphQL API immediately ({ me { id name email } }); the initial sync starts on success and typically completes within 2-5 minutes

If you administer monday on behalf of an organization: Admin-level monday accounts can generate tokens with broader board access. For a dedicated integration user, create a new monday user, add them only to the boards Management OS should read, and generate the token from that user's Developer Center.

The Weekly Intelligence Brief is the primary surface. Three pillars synthesize your monday data:

• Develop Your Business — deal scoring (every open deal item scored against the Opportunity OS rubric), forecast accuracy, account plans, champion-behavior alerts, renewal cascade
• Develop Your Team — coaching priorities mapped to specific reps and deals, rep-effectiveness rankings, 1:1 prep, GROW conversation planners
• Develop Yourself — leader focus, calendar audit, ninety-day competency focus, decision deadlines you're sitting on

Ask Anything (AMA) — a conversational surface where you can query your monday data in plain English. Examples: "Which deals on the Q4 board slipped from this month?", "Show me the top 5 accounts with no update in 14 days", "What's my coverage ratio against quota by rep?"

1. Open Management OS → Settings → Integrations
2. Find monday.com in the connected integrations list
3. Click Disconnect → confirm

On disconnect we immediately delete the stored API token and stop reading any new data. Previously synthesized briefs remain in your Management OS workspace as historical records — they are not deleted automatically because they may contain decisions and context the leader still references.

Note: Deleting the token from Management OS does not invalidate it on monday's side. The same token can still be used by any other integration that has it. For full revocation, also regenerate the token in the monday Developer Center (see next section).

To remove all historical briefs and data after disconnect, email privacy@mgmt-os.ai with your workspace identifier. We process deletion requests within 30 days.

monday.com does not expose a per-integration revoke option for personal V2 tokens. The token is revoked by regenerating it, which immediately invalidates all previous copies (Management OS's included).

1. Sign in to monday.com and click your avatar → Developers
2. In the left sidebar, click My Access Tokens
3. Click Regenerate next to your personal API token

Regenerating the token invalidates the previous value immediately. Our next API call returns 401 and we surface a re-connection prompt in Management OS Settings.

Heads up: Because monday issues one personal token per user, regenerating it will also break any other integration you connected with the same token. If you need finer-grained revocation, use a dedicated monday user for the integration as described in the install section.

Security incident reporting: security@mgmt-os.ai
Privacy / data subject requests: privacy@mgmt-os.ai
Integration support: support@mgmt-os.ai

For general questions about Management OS, see our Support page or Manifesto.