SheetsaSecurity and data handling
Where your drawings go, and who can see them.
Filling in a security questionnaire? Write to support@sheetsa.com and we'll answer it in full.
In place today
How your drawings are protected.
Your Library
- Stored in the United States, on Amazon Web Services through Supabase, and encrypted in transit and at rest.
- Walled off by organization in the database itself: no one outside your organization can read or change your records, and an automated test checks it.
- Roles for everyone: owner, admin, member and viewer, enforced by the database, not only by the app.
- Private by default. No file is ever public. Files open through short-lived links for signed-in members.
- A record of everything: every automatic read, correction, send and deletion is kept with who and when, and cannot be edited.
- Nothing deleted on a schedule. Retention periods flag a record for review; a person decides.
- No AI company receives your drawings or your questions.
When others are involved
- Sending drawings: the person you send to opens a link with no account. You choose how long it works and whether they can download or print, you see each time it's opened, and you can close it at any time.
- Review links: a consulting firm sees only the round's sheets and comments, answers under their own name, and loses access when you close the link.
- Receiving drawings: files sent to you through a request link wait in your Inbox and nothing is filed until a member accepts them. Accepted files are read and filed on Sheetsa's servers, and the working copies are removed when filing is done.
- The free tools read your file in your browser. Specs never uploads it; the others save it only when you're signed in to a plan. The privacy policy says exactly what each one sends.
- The website loads no third-party scripts, fonts or trackers.
Not in place yet
- No SOC 2, ISO 27001 or similar certification, and no penetration test report yet. Our providers hold their own certifications for their infrastructure.
- Single sign-on and two-factor sign-in are set up for an organization that needs them, as part of a pilot.
- One storage region, the United States, unless your files stay in your own SharePoint (below).
We'd rather say this plainly than have a reviewer find it.
Service providers
Who else handles your data.
| Provider | What for |
|---|---|
| Supabase, on Amazon Web Services (United States) | The database, file storage and sign-in |
| Vercel | Serves the website; no drawing passes through it |
| GitHub | Runs the server-side filing of drawings you accept into your Inbox |
| Resend | Notification emails about review comments, when switched on |
| Stripe | Billing, when an organization pays for a plan; card details stay with Stripe |
| Microsoft | Only if your organization keeps its files in its own SharePoint, under your own agreement |
No other provider receives your data. How long each kind of record is kept is in the privacy policy.
For owners and agencies
When "our servers" isn't acceptable.
- Keep the drawings where they are. Your sets and files can stay in your own SharePoint library, with Sheetsa's index written alongside them.
- Run it inside your network. The reading engine can run on a machine you control, reading sets from your own file share.
- Your own cloud. The Library can be set up in your own cloud tenant, under your existing controls, as part of a pilot.
- See For owners & agencies, or write to support@sheetsa.com.
Reporting a problem
Found a security issue?
Write to support@sheetsa.com with what you found and how to reproduce it. You'll get a reply from a person, and we won't take action against anyone who reports in good faith. Please don't include a client's drawings in the report.