Security

Least-privilege spreadsheet access

Google connections use the drive.file OAuth scope: SheetLink Forms can only see and write the spreadsheets you pick in the Google picker or create through the product - never the rest of your Drive. This is a non-sensitive Google scope with a normal consent screen. Microsoft connections write to the Excel table you choose via Microsoft Graph.

Token handling

OAuth refresh tokens are stored encrypted at rest (AES-256-GCM) and used only to mint short-lived access tokens at delivery time. Disconnecting from the dashboard invalidates the stored connection; revoking access from your Google or Microsoft account settings is honored on the next refresh.

What we store, and why

Submission content plus request metadata (IP, origin, user agent) is stored to screen for spam, deliver to your spreadsheet, retry failures, and let you review quarantine. It is used for nothing else and is never sent to third-party AI providers. Retention and processor roles are spelled out in the privacy policy.

Abuse protection on an open endpoint

• Rate limits per form token and per IP
• Origin allowlists - bind a form to your domains; mismatched browser origins are refused, and CORS echoes only allowlisted origins
• Honeypot + timing signals catch the bulk of bots invisibly
• Content heuristics with a per-form strictness dial, and optional Cloudflare Turnstile
• Quarantine, not silent drops - a false positive is reviewable, so protection never costs you a real lead

Your spreadsheet is protected from submissions too

Cell values beginning with =, +, -, or @ are prefix-escaped before delivery, so a hostile submission cannot plant an executing formula in your sheet (CSV/formula-injection defense). Webhook ingestion (Webflow, Framer, email-in) is signature- or token-verified.