Skip to main content

Security

Last updated: August 31, 2026

Your transactions belong in a Google Sheet or Excel workbook. We use read-only bank access through Plaid, encrypt sensitive tokens at rest, and do not sell your financial data. Contractual detail lives in our Privacy Policy and Terms of Service.

What we optimize for

  • Least data exposure: we request only what we need to sync rows into the spreadsheet you choose.
  • Least privilege on banks: Plaid connections are read-only; we cannot move money or change bank credentials.
  • Defense in depth: encryption in transit and for sensitive tokens at rest, monitoring, and rate limits on sensitive routes.

Bank connections (Plaid)

You authenticate with your financial institution through Plaid. Sheetful does not receive or store your bank login password. We store encrypted tokens required to refresh read-only access until you disconnect or tokens expire.

Spreadsheets and OAuth

Transaction data is written to a Google Sheet or Excel workbook you connect. You remain the customer of Google or Microsoft for those files. We encourage multi-factor authentication on the account that owns your spreadsheet.

Encryption and sessions

  • In transit: HTTPS (TLS) for browser traffic.
  • At rest: Plaid and spreadsheet OAuth tokens encrypted with AES-256-GCM.
  • Sessions: signed HTTP-only cookies for app login.

Monitoring and supply chain

We use error monitoring and structured logging to catch regressions. Dependency reviews run in CI. We do not claim a standalone SOC 2 audit for Sheetful; hosting and payment partners publish their own compliance materials.

If outages affect you materially, we communicate in the app and on our Updates page. If one of your own syncs fails, we email you about that failure.

Responsible disclosure

Report suspected vulnerabilities to security@sheetful.io. Include steps to reproduce. Do not test against accounts you do not own.

Vault and Compass, LLC

Sheetful is published by Vault and Compass, LLC, an independent software studio. This page summarizes how we protect Sheetful. It does not replace our Privacy Policy or Terms of Service for contractual detail.

Vault & Compass builds more than one product. Each has its own site and policies; links are for convenience only:

  • Sheetful (this site): spreadsheet-based budgeting with bank sync to Google Sheets or Microsoft Excel.
  • Prismfolio (prismfolio.io): portfolio analysis for self-directed investors.

For studio-wide security, privacy, and legal notices that apply across all Vault & Compass products, visit:

Questions specific to Sheetful (exports, Plaid, spreadsheets, billing)? Email support@sheetful.io or use sheetful.io/contact.