Security

Typesheet holds data other people send you, which makes this a page you are entitled to read before you point a supplier at us. Here is where that data lives, who touches it, and what we do not claim.

Where your data lives

Sheets, rows, and imported files are stored by Supabase (database, authentication, and file storage). The application runs on Vercel. Data is encrypted in transit over TLS and at rest by those providers. Every sheet belongs to a workspace, and access is scoped to that workspace’s members.

Signing in

Sign-in is Google OAuth through Supabase Auth. We receive your email address, name, and profile image; we never receive your Google password and there is no Typesheet password to leak. Sessions are held in an HTTP-only cookie. Sign-ups from disposable inbox providers are refused.

API keys and connected agents

API keys are stored as a SHA-256 hash plus a short display prefix. The full key is shown once, at creation, and cannot be recovered from us afterwards. Connecting an assistant over MCP uses OAuth rather than a key: you sign in once in a browser, and the tokens issued to that client are what it holds.

Import links

An import link is a capability: the unguessable key in its URL is the credential, and there is no account behind it. Three properties bound what that key can do.

• It only writes.It accepts rows and reports on the rows just sent. It cannot read what the sheet already holds, and one sender cannot see another sender’s submission.
• It is per sheet. A key is scoped to the one sheet it was minted for, never to a workspace or an account.
• It is rotatable.Rotating from the sheet’s share menu retires the old address immediately.

Treat a key like a password: anyone holding it can post rows. Because it is a credential in a URL, every /import/ page is served with a noindex header so a shared link cannot end up in a search result.

Webhooks

When an import is marked ready, its certified records are POSTed to a destination you set. Every request carries a Typesheet-Signature header holding a timestamp and an HMAC-SHA256 of timestamp.bodyunder that sheet’s signing secret, so your endpoint can prove the request came from us and reject replays. Destinations must be https. Failed deliveries are retried on a backoff, and every attempt is recorded where both sides can see it. Retries reuse one delivery id, so handlers can be idempotent.

Who else processes your data

Four companies hold or read customer data, each only what its job needs: Vercel (hosting), Supabase (database, auth, file storage), Anthropic (the models that read a PDF or screenshot into rows and match columns to your fields, configured not to train on what they receive), and Polar (checkout and subscriptions, as merchant of record; we never see or store card details). The full current list by name is available on request at hello@typesheet.com, and Privacy describes what each receives.

What we do not do

• We do not use your sheets or the data imported into them to train models, and the model providers we use are configured not to train on API traffic.
• There are no third-party analytics or tracking scripts, no advertising cookies, no ad networks, and no data brokers. The only cookies are your session and the one remembering which workspace you last used.
• We do not sell data, and there is nobody to sell it to.

Deleting things

Deleting a sheet deletes its rows and its imports. Deleting your account removes your workspaces and everything in them. Ask at hello@typesheet.com if you need a deletion confirmed in writing, or need a copy of your data before it goes.

What we are not claiming

A security page that lists only strengths is not worth reading, so here is the other half honestly.

• No SOC 2 or ISO 27001. Typesheet is a small product and has not been through either audit. If your procurement process requires one, we are not a fit yet, and saying so now is cheaper for both of us than saying it in week six.
• No contractual uptime. The service is provided as-is. We depend on the providers above and inherit their availability.
• Webhook destinations are checked, not sandboxed. We require https and block the obvious internal targets, but a hostname that resolves to a private address can still be reached. Treat the destination field as something only your own trusted members should be able to set.
• Automated reading can be wrong. A column can be matched to the wrong field and a value can be misread. Every import shows you what it produced before it merges. The guarantee we do make is narrower and firmer: nothing that fails validation can be exported, and that check runs on our server without consulting a model.
• Fonts are served by Google. Your browser fetches our typefaces from Google Fonts, which means it makes a request carrying its IP address and the page it is on.

Reporting something

If you have found a vulnerability, write to hello@typesheet.comwith enough detail to reproduce it. We will acknowledge it, and we will not pursue anyone who reports a problem in good faith and does not access or destroy other people’s data while finding it. There is no bounty programme.