Sheetward User Guide

Security & data residency

Your records often hold things — salaries, card numbers, customer details — that must not leak. Sheetward protects them with access control, isolation and optional encryption. Here's what each one does for you, and where the limits are.

• Access & isolation. Every person has a role per app (owner / editor / viewer), so who can see and change what is always explicit. Admins can also temporarily lock the workspace for members. Your workspace's data is walled off from every other workspace: on shared hosting each workspace can only ever reach its own rows, and a self-hosted app keeps its own separate database file. Sign-in allows one active session: logging in on a new device signs the account out everywhere else.
• Automatic sign-out. A shared screen left open is an easy way to leak data. A workspace admin can set an idle timeout (Admin console → Users) so everyone is signed out after a period of inactivity — with a short warning first. It's off by default; leave it blank and people stay signed in until they sign out.
• Two-factor authentication (2FA). A stolen password on its own gets an attacker nowhere. Once your operator enables 2FA, you can add a one-time code from an authenticator app (Google Authenticator, 1Password, Authy…) to your password sign-in. Set it up in Settings › Account, next to Change password. Turning it on gives you ten single-use recovery codes: save them somewhere safe, as they're your only way back in if you lose your phone. 2FA covers password sign-in; Sign in with Google is already protected by Google.
• New-device sign-in alerts. If your operator has this on, you get an email whenever your account signs in from a device or country it hasn't used before — so an unexpected sign-in never goes unnoticed. If it wasn't you, change your password right away with Forgot password.
• Your data and your account. From Settings › Account › Your data you can ask for a copy or a correction of the personal data Sheetward holds about you (the request goes to the compliance contact and is answered within 30 days), or delete your account — a confirmation link goes to your email; opening it removes your sign-in and memberships. If you own a workspace, close it first from the Admin console. A workspace whose plan ended is locked after its grace period and kept for the retention period the operator sets (90 days by default), with reminders on day 60 and 83, then deleted with its apps, records, files and backups.
• Agreements you accepted are listed under Account → Your data, each with a permanent link to the exact version you agreed to. Published versions never change; if we revise the Terms or the Privacy Policy, Sheetward asks you to review and accept the new version at your next sign-in.
• Field encryption (encryption at rest). When your operator enables it, sensitive fields are encrypted before they ever reach the database, with a key the database never holds — so anyone looking at the raw database, a backup or a dashboard sees only unreadable text. It covers ssn and credit_card fields automatically, plus any field you tag sensitive, mask or pii on the Rules sheet. That means a salary column or a free-text notes field can be encrypted too. Values are shown only to people entitled to see them, and stay masked in exports and support sessions by default. Card numbers are always cut to their last 4 digits. One trade-off: an encrypted field can't be searched by part of its text.
• Support access. Sheetward support can see your data only after you grant read-only, time-limited consent — and sensitive fields stay masked even then. You can also mark an app's data so support can't open it at all.
• Data residency. Your hosted data lives in the region of the Sheetward deployment you sign in to; there is currently no per-workspace region choice, and field encryption uses a single key managed by the operator. If your data must stay in a specific country — or you want to hold the encryption key yourself — self-host the app or a published standalone app. Then where the data lives, and who holds the keys, is fully in your hands.