Security and your data
What is never stored
- The rows from your data sources and the contents of your spreadsheet cells. They are held in memory while an import runs and written to your spreadsheet. They are not written to our database or to our logs.
- Payment card details. Payments are taken by Dodo Payments. Card details never reach us.
- The values a write-back writes or replaces. Only who wrote, when, how many rows and which columns.
In the Excel add-in the rows travel through the service to your own copy of Excel, which writes them into the workbook. They are not stored on the way.
What is stored
| What | Why | How it is protected |
|---|---|---|
| Your email address and your Google account's identifier (in Excel: your Microsoft account's identifiers and sign-in name) | To sign you in and place you in your team | Encrypted at rest by the database |
| A Google authorisation token | To write to your spreadsheet when a scheduled import runs while you are away, and to read the Google sources you connect | Encrypted by the service before it is stored; deleted when you disconnect |
| Credentials for other sources: database passwords, API keys, tokens | To read that source on your schedule | Encrypted by the service before they are stored, each bound to its own record. Never returned by any part of the service and never shown again |
| Connection settings that are not secret: host names, database names, project IDs | To reach the source | Encrypted at rest by the database |
| Import definitions: the table or query, columns, filters, destination tab, schedule, and the descriptions you write | To run the import | Encrypted at rest by the database |
| Run history: time, status, number of rows, and error messages | To show what happened | Deleted after 90 days. An error message from a source can contain part of a query |
| Where each alert is sent: email addresses or a chat webhook address | To deliver alerts | Encrypted like a credential; never returned |
| A one-way fingerprint of each assistant key and each connection link | To recognise it when it is used | The key or link itself is shown once and not kept |
| Subscription state, and a record of each payment event: identifiers, amount, currency and status | To apply your plan and match each payment to a team | No card details are included |
| If your team switches AI drafts on: what was asked and the draft returned | To troubleshoot | Deleted after 30 days |
| A record of actions taken through an AI assistant, a connection link or a write-back | Accountability | Names and counts only; deleted after 400 days |
How it is built
- Teams are kept apart. Every request is checked against the team of the person making it. Another team's import or connection answers "not found", as if it did not exist.
- Imports only read. A query you type against a database runs where the database itself refuses writes, or inside a wrapper that accepts a query and nothing else. The connection forms ask for read-only credentials, which remain the stronger protection.
- Nothing from a source can run in your sheet. Values are written as plain values. Text that looks like a formula stays text.
- The part that runs imports is not on the internet. Only the service's own scheduler and task queue may call it.
- Addresses you supply cannot be used to reach inside. Connections to a host or URL you type are refused if it resolves to a private or internal network address.
- Credentials go in and never come out. No screen and no interface returns a stored password, key or token.
- Write-back is off until an administrator allows it for one connection, and writes only the changes a person has reviewed, all together or not at all.
- AI drafts see names, not data. The model is sent the names and types of tables and columns and what you typed. It is off until an administrator switches it on.
- Who has paid is decided by the payment provider's own records. A plan changes only after the service has fetched the subscription from Dodo Payments itself.
- This website runs no scripts and loads nothing from other sites.
Who processes data for us
| Company | Role | What it handles |
|---|---|---|
| Google Cloud | Runs the service. Also runs the Gemini models that write AI drafts, for teams that switch them on | Everything in the table above; your rows in memory while an import runs. For AI drafts: what you typed, and the names and types of tables and columns, never rows |
| Neon | Hosts the service's database | Everything in the table above, with credentials in encrypted form. Never your rows |
| Dodo Payments | Sells subscriptions as merchant of record | Your email address, what you bought, and your payment details |
The sources you connect, the places you send alerts to, and any AI assistant you connect with a key are your own providers: the service sends them what you set up.
The service and its database run in the United States.
What has not been done yet
SyncStudio is in early access. It has not had an independent penetration test, and it holds no certification such as SOC 2 or ISO 27001. The add-on has not yet completed Google's verification of its access to Google data, or the Google Workspace Marketplace review. This page will be updated when each of these changes.
Reporting a problem
If you believe you have found a security problem, write to support@novabytelab.in. Please give us reasonable time to fix it before making it public.