Security
Spreadsheets often hold the numbers that matter most. Here is how SheetsBat keeps them safe.
In transit and at rest
- Every connection uses HTTPS with HSTS, including the live editing connection.
- Workbook snapshots and versions are stored encrypted at rest by our storage provider.
- Imported files are read in memory and are not kept after the import.
Who can open a workbook
- A workbook is private to its owner until they share it.
- Every request is checked against the workbook's owner, members and links, on the server, every time.
- Share links use long random tokens, carry a role (viewer, commenter or editor) and stop working the moment they are turned off.
- Workbooks that someone cannot open answer as not found, so their existence is not revealed.
Accounts and sign in
Sign in goes through OfficeBats with one time codes. Session cookies are HTTP only, SameSite and signed, and sessions expire. Signing out everywhere on OfficeBats ends SheetsBat sessions too.
Application security
- A strict Content Security Policy, frame protection and other hardening headers on every page.
- Cross site request checks on every change, and rate limits on the API.
- Uploaded files are checked for size and structure before they are read, including protection against compressed file bombs.
- Formulas are calculated by our own engine and never run as code.
Backups and recovery
Version history lets you restore any saved version of a workbook: 7 days on Free and 365 days on Pro and Business. Workbooks in the trash can be restored for 30 days.
AI requests
SheetsBat AI only runs when you ask. It receives the context the task needs, not your whole account, and changes only happen in your sheet when you apply them.
Report a vulnerability
If you find a security problem, email [email protected] with the details. Please give us a reasonable time to fix it before sharing it publicly, and do not access other people's data while testing. We are grateful for every report.