Security

Sheetful connects to your bank through Plaid with read-only access to your transactions. It keeps that access as an encrypted token until you disconnect the bank.

You sign in to your bank on Plaid's screen, and Plaid gives Sheetful the read-only token. You sign in to Sheetful with Google.

• In transit: HTTPS (TLS) for browser traffic.
• At rest: Plaid and spreadsheet OAuth tokens encrypted with AES-256-GCM.
• Sessions: signed HTTP-only cookies for app login.
• Hosting: our hosting provider has a SOC 2 Type II attestation.

Export all your data as CSV from Settings at any time. To delete your account, go to Settings, then Delete Account. Your financial and account data is removed from active systems within 30 days. Encrypted disaster-recovery backups are overwritten within a further 7 days and are used only for recovery. Security and audit logs are retained up to 90 days, then deleted.

Your transaction history (date, merchant, amount, category), bank account details (bank name, account type, last 4 digits), and your spreadsheet connection. Your spreadsheet in Google Drive or OneDrive is the copy you control. Sheetful also keeps its own copy of your transactions to run sync, categories and your dashboard, and deletes it when you delete your account.

You. Your data is isolated to your account and encrypted in transit and at rest. Your Plaid and spreadsheet tokens are additionally encrypted with AES-256-GCM, so they are unreadable even to someone with database access. Transaction rows themselves are not separately encrypted, so in principle they are readable to the small number of people who administer the database. Sheetful accesses them only where it is necessary to operate or debug the service.

Transactions are written to a Google Sheet or Excel workbook you connect, which stays in your Google or Microsoft account. Turn on two-step verification for that account.

Error monitoring catches problems early, and dependencies are reviewed automatically. Hosting and payment partners publish their own compliance materials.

If an outage affects you, the app says so and the Updates page carries the detail. If one of your syncs fails, you get an email about it.

Report suspected vulnerabilities to security@sheetful.io. Include steps to reproduce. Do not test against accounts you do not own.