Security at SheetTrack
Updated: October 20, 2026
SheetTrack is an Excel add-in that lists what changed in a workbook, keeps its versions and checks it for formula errors. It is built so that SheetTrack itself keeps almost nothing: workbooks and their versions stay on the user's computer or in their organization's own Microsoft 365 storage. This page says what SheetTrack's systems and its service providers (sub-processors) handle, how the service is protected, and how to report a problem. The IT admin page covers permissions and deployment; the privacy policy covers personal data in full.
What SheetTrack's systems hold
| Data | Where | How long |
|---|---|---|
| Whole workbooks and their saved versions | Not on SheetTrack's systems. Check Workbook runs inside the add-in, on the device. Versions are kept in the add-in's storage on the device, or the add-in uploads them straight to the organization's OneDrive or SharePoint through Microsoft Graph. (A shared-history save's change summary, below, does pass through the service.) | Not held |
| For history shared with a team: each version's note and change summary (changed cell addresses with their old and new values), the workbook's address, and the user's Microsoft access token | SheetTrack's service, in memory, while it writes the history index into the .sheettrack folder beside the workbook | That request only, except the user's identity and where the workbook is (the next two rows). Tokens are never stored or logged |
| The user's Microsoft name, email address and ID | The service's memory, keyed by a one-way hash of the token | Up to 5 minutes, then removed within a few minutes |
| Where the workbook is: its address, file name, folder and OneDrive or SharePoint IDs | The service's memory | Up to 10 minutes, then removed within a few minutes |
| The IP address of each request, for rate limiting | The service's memory | About a minute, then removed within a few minutes |
| Request logs: IP address, user agent, address requested, status, duration and size; browser security reports (the blocked address and the page's address) | Google Cloud Logging, in its global location, which Google may store in any of its regions | 30 days |
| The key that signs Team records | Google Secret Manager, in us-east1, readable only by the service's own account | Until it is replaced |
| Support and security email | SheetTrack's mailbox, hosted by GoDaddy | Up to 24 months after the conversation ends |
| Launch sign-ups (people who ask sheettrack.com to tell them when SheetTrack is on AppSource) | A Cloudflare D1 database | Until the launch email is sent |
Sub-processors
These providers handle personal data for SheetTrack. A new provider that would handle data of organizations using SheetTrack is posted here at least 30 days before it starts.
| Provider | What it does for SheetTrack | Personal data it handles | Where |
|---|---|---|---|
| Google Cloud (Google LLC) | Runs SheetTrack's service (Cloud Run), its request logs (Cloud Logging), the Team signing key (Secret Manager) and its uptime checks (Cloud Monitoring) | Requests to the service while they run (above); request logs | Service and key: United States (us-east1). Logs: Cloud Logging's global location (any of Google's regions) |
| Cloudflare (Cloudflare, Inc.) | Serves the add-in's pages (app.sheettrack.com) and sheettrack.com; stores launch sign-ups; runs the sign-up form's bot check (Turnstile) | IP addresses and request details of visits to those sites; launch sign-up addresses | Cloudflare's global network; the sign-up database in Asia-Pacific |
| GoDaddy (GoDaddy.com, LLC) | Hosts SheetTrack's email (support@, privacy@, security@ and business@sheettrack.com) | What people write to SheetTrack | United States |
Not sub-processors: Microsoft provides sign-in (Microsoft Entra ID) and the organization's OneDrive and SharePoint under the organization's own agreement with Microsoft; SheetTrack does not hold that data. Other tools SheetTrack uses, such as code hosting, never receive customer data.
How the service is protected
- In transit: HTTPS only, with HSTS on
sheettrack.comandapp.sheettrack.com. - The add-in's pages send a strict Content Security Policy and load scripts only from SheetTrack and Microsoft.
- Sign-in is Microsoft's (MSAL, Microsoft Entra ID). SheetTrack has no passwords or user accounts of its own, its Entra applications have no client secrets or certificates, and the production application is publisher-verified in Microsoft Entra.
- Least access: delegated Microsoft Graph permissions only, each asked for when a feature first needs it, so SheetTrack acts only as the signed-in person and only reaches files that person can open. The list, and which need an administrator, is on the IT admin page.
- No stored data: the service has no database and no persistent disk, limits request sizes and rates, and keeps each user's access token only for the request it came with.
- Team records are chained with SHA-256 and signed with a key only the service can read (one service account, with access to that key and nothing else), so records changed outside SheetTrack are detected. This is tamper-evident, not tamper-proof.
- Changes to the code go through automated tests, a dependency audit of the packages the add-in ships, a static security scan of the service and a secret scan of the code's history, and reach a staging copy before production.
- Monitoring: uptime checks from three regions every 5 minutes, and email alerts for outages and server errors.
What SheetTrack does not have yet
SheetTrack is a small company: a sole proprietorship in New Delhi, India. It has not completed a SOC 2 audit, ISO 27001 certification, Microsoft 365 Certification or a third-party penetration test. Google Cloud and Cloudflare publish their own certifications and audit reports.
If something goes wrong
- If a breach affects personal data SheetTrack handles for an organization, SheetTrack tells that organization without undue delay, and within 72 hours of becoming aware of it, and notifies regulators as the law requires.
- If SheetTrack's service is down, history kept on the computer and Check Workbook keep working; only shared history and Team features wait for it.
Report a security problem
Email security@sheettrack.com (also in security.txt). SheetTrack aims to reply within two business days. Please don't access other people's data or disrupt the service while testing, and give SheetTrack reasonable time to fix a problem before you publish it.
Data processing agreement
SheetTrack's data processing agreement, with the EU standard contractual clauses and the UK addendum, is being reviewed by counsel. Once that review is done, organizations that need one can ask for a copy signed by SheetTrack at privacy@sheettrack.com, which also answers privacy questions now. For the personal data it passes to its own providers (above), SheetTrack relies on their data processing terms, which include the same clauses, as the privacy policy says.