Trust & Safety

Security & Trust

How we protect your account and the data you share. We follow security good practice: HTTPS everywhere, encrypted secrets, 2FA available and daily backups.

Data Protection

  • While you build an app, your file is processed in your browser
  • When you share or save an app, the rows you share are stored on our UK servers, encrypted at rest, so the link works. They are deleted when the app expires, when you delete it, or when you delete your account
  • Encryption in transit: HTTPS on every connection
  • Encrypted secrets: Google OAuth tokens and other secrets are stored encrypted
  • Google Sheets access is only used for the sheets you choose, and we only write to a sheet when you use write-back (beta)
  • No AI service processes your data, and we never use it to train AI models

Infrastructure

  • Servers in the UK, operated by London-based APPS 365 LTD
  • Daily automated backups
  • A health check endpoint at /health that we use to check the Service is running

Access Controls

  • Passwords: minimum 12 characters, stored as a secure hash
  • 2FA: available on every account, and required for admin users
  • Account lockout: repeated failed sign-ins lock the account for a short period
  • Session timeout: you are signed out after a period of inactivity
  • Sign-in and security events are logged and kept for up to 12 months
  • Pro apps can be protected with a password or an IP allowlist

Privacy

  • We handle personal data under UK GDPR
  • Our sub-processors are Stripe (payments), Google (Sheets, OAuth and Google sign-in, if you use them) and our UK hosting provider
  • Built by APPS 365 LTD, Company No. 13955007, London, UK
  • See our Privacy Policy for full data handling details

Responsible Disclosure

  • Found a vulnerability? Email hello@sheetforge.ai with "Security report" in the subject
  • We aim to reply within 2 working days
  • Please give us a reasonable time to fix the issue before making it public