How we protect your account and data.

Last updated September 24, 2026

Your spreadsheets

• Sheet Studio opens and processes your files inside your browser. The contents are not uploaded to our servers.
• Project files you save can be protected with a password. They are then encrypted with AES-256-GCM, using a key derived from your password with PBKDF2-SHA256 (310,000 rounds). We cannot open them without your password.
• Sheet Studio can keep a working copy in your own browser so a refresh does not lose work. You can turn this off, and signing out clears it.

Your account

• Passwords are never stored. We keep a salted PBKDF2-SHA256 hash (100,000 rounds, unique salt per account), with an additional server-side secret.
• Sign-in sessions use a random 256-bit token in a Secure, HttpOnly, SameSite cookie. Only a SHA-256 hash of the token is stored, so a copy of our database cannot be used to sign in.
• Repeated failed sign-ins, password resets, coupon attempts and contact messages are rate-limited.
• You get a one-time recovery code to reset your password without email. Each code works once and is stored only as a hash.
• You can see recent sign-ins and devices, sign out other devices and delete your account at any time.

The website

• All traffic uses HTTPS (TLS), with HSTS so browsers never fall back to plain HTTP.
• A strict Content Security Policy allows scripts only from our own site, and pages cannot be embedded by other sites.
• Every database query uses bound parameters, and form submissions from other websites are rejected.
• Fonts and libraries are served from our own domain; we do not load third-party trackers or advertising scripts.
• The site runs on Cloudflare, which provides network-level protection against attacks. Our database is encrypted at rest by Cloudflare.

Payments

• Card details are entered on Stripe's checkout page and never reach our servers. Payment notifications from Stripe are verified with cryptographic signatures and applied only once.

What you can do

• Use a strong password that you do not use anywhere else.
• Keep your recovery code somewhere safe, such as a password manager.
• Password-protect project files that contain sensitive data.
• Sign out on shared computers.

Reporting a problem

If you believe you have found a vulnerability, please tell us through the contact form with enough detail to reproduce it. Please do not access other people's data or disrupt the service while testing.