Security

Typesheet holds data other people send you, which makes this a page you are entitled to read before you point a supplier at us. Here is where that data lives, who touches it, and what we do not claim.

Where your data lives

Sheets, rows, and imported files are stored by Supabase (database, authentication, and file storage). The application runs on Vercel. Data is encrypted in transit over TLS and at rest by those providers. Every sheet belongs to a workspace, and access is scoped to that workspace’s members.

Signing in

Two doors, both through Supabase Auth, and neither of them a password. Google OAuth: we receive your email address, name, and profile image, and never your Google password. Or your email address on its own, which gets a sign-in link and a six-digit code, either of which works once. There is no Typesheet password to leak because there is no Typesheet password. Sessions are held in an HTTP-only cookie. Sign-ups from disposable inbox providers are refused.

Connected agents

Connecting an assistant over MCP is an OAuth sign-in, not a key: you sign in once in a browser, and what the client holds afterwards is the tokens issued to it, which you can withdraw. There are no API keys to store, leak, or rotate — the key-issuing half of the product this one replaced was removed along with it.

Import links

An import link is a capability: the unguessable key in its URL is the credential, and there is no account behind it. Three properties bound what that key can do.

• It only writes.It accepts rows and reports on the rows just sent. It cannot read what the sheet already holds, and one sender cannot see another sender’s submission.
• It is per sheet. A key is scoped to the one sheet it was minted for, never to a workspace or an account.
• It is rotatable.Rotating from the sheet’s share menu retires the old address immediately.

Treat a key like a password: anyone holding it can post rows. Because it is a credential in a URL, every /import/ page is served with a noindex header so a shared link cannot end up in a search result.

Webhooks

When an import is marked ready, its certified records are POSTed to a destination you set. Every request carries a Typesheet-Signature header holding a timestamp and an HMAC-SHA256 of timestamp.bodyunder that sheet’s signing secret, so your endpoint can prove the request came from us and reject replays. Destinations must be https. Failed deliveries are retried on a backoff, and every attempt is recorded where both sides can see it. Retries reuse one delivery id, so handlers can be idempotent.

Who else processes your data

Five companies hold or read customer data, each only what its job needs: Vercel (hosting), Supabase (database, auth, file storage), Anthropic (the models that read a PDF or screenshot into rows and match columns to your fields, configured not to train on what they receive), Polar (checkout and subscriptions, as merchant of record; we never see or store card details), and Resend(the email we send you: a sign-in link, an invitation, a note that data arrived, a trial notice — your address and the message, never your rows). The full current list by name is available on request at hello@typesheet.com, and Privacy describes what each receives.

What we do not do

• We do not use your sheets or the data imported into them to train models, and the model providers we use are configured not to train on API traffic.
• There are no third-party analytics or tracking scripts, no advertising cookies, no ad networks, and no data brokers. The only cookies are your session and the one remembering which workspace you last used.
• We do not sell data, and there is nobody to sell it to.

Deleting things

Deleting a sheet deletes its rows and its imports. Deleting your account removes your workspaces and everything in them. Ask at hello@typesheet.com if you need a deletion confirmed in writing, or need a copy of your data before it goes.

What we are not claiming

A security page that lists only strengths is not worth reading, so here is the other half honestly.

• No SOC 2 or ISO 27001. Typesheet is a small product and has not been through either audit. If your procurement process requires one, we are not a fit yet, and saying so now is cheaper for both of us than saying it in week six.
• No contractual uptime. The service is provided as-is. We depend on the providers above and inherit their availability.
• Webhook destinations are checked, not sandboxed. We require https and block the obvious internal targets, but a hostname that resolves to a private address can still be reached. Treat the destination field as something only your own trusted members should be able to set.
• Automated reading can be wrong. A column can be matched to the wrong field and a value can be misread. Every import shows you what it produced before it merges. The guarantee we do make is narrower and firmer: nothing that fails validation can be exported, and that check runs on our server without consulting a model.

Reporting something

If you have found a vulnerability, write to hello@typesheet.comwith enough detail to reproduce it. We will acknowledge it, and we will not pursue anyone who reports a problem in good faith and does not access or destroy other people’s data while finding it. There is no bounty programme.