Skip to content
Privacy & Security

Your spreadsheet never leaves your spreadsheet.

Formula Foundry was built around a single architectural premise: the editor runs on the client, the data stays in the sheet, and the AI assistant only sees what you explicitly ask about. This page is what that means in practice — and what it means for your IT and procurement reviews.

Read our privacy policyQuestions? Talk to us

Data privacy architecture

Three architectural decisions worth knowing about.

Your data stays in your spreadsheet

The editor itself — multi-line authoring, syntax highlighting, @@variables, the visual builder — runs entirely on the spreadsheet client. @@variable definitions are stored in a hidden sheet inside your workbook, not on our servers. We don't transmit your cell values or any other workbook content to Formula Foundry servers as part of the editing experience. The two exceptions are ones you trigger: an AI request, and a formula you save as a snippet. Every snippet, personal or shared, is stored with your workspace so it syncs across Google Sheets, Excel and, on Business, your team. If you've installed the add-on and never used the AI assistant or saved a snippet, your spreadsheet contents have never reached our infrastructure.

The AI assistant is opt-in and scoped

AI features are off by default until you click into them. When you do, the request carries the formula or selection you reference plus the context the model needs to resolve column names: the active sheet's name, its header row (the column titles) and the values of your @@variables — never the rest of your data, never other tabs. Each AI request is independent; we don't aggregate or retain a copy of your formula context beyond the duration of the request itself.

Analytics is consent-gated by default

On the marketing site, product analytics (PostHog) and ad measurement (Google tags) run only after you grant consent through the cookie banner. The default is opt-out: until you click Accept, no analytics events are sent. Strictly necessary cookies (session, anti-fraud) are the only ones that run unconditionally. Inside the add-on, we record product usage events (which features you use, linked to your account) to improve the product.

Data we collect

Data we collect — and don't.

Concrete answer to the first question every IT review asks.

We never collect

  • Your full spreadsheet contents
  • Cell values outside what an AI request needs: the rest of your data, other tabs, collaborators' content
  • Workbook structure (sheet names, tab order, named ranges) outside the formulas you explicitly send to the AI
  • Formulas from cells you don't open in the editor
  • Your @@variable definitions — they're stored in a hidden sheet inside your workbook, not on our servers (an AI request carries their names and values only while it runs)
  • Your collaborators' edits, comments, or activity
  • Anything from sheets you didn't open Formula Foundry on

We do collect (with your knowledge)

  • Your Google sign-in profile data — email, display name, profile photo URL (if your Google account exposes one), and locale preference (used for sign-in and billing)
  • What an AI request carries: the formula or selection you reference, the conversation so far, the active sheet's name and header row, and your @@variable names and values — for the duration of that request, not retained afterwards
  • Aggregate, anonymous usage events on the marketing site, if you've granted analytics consent
  • Product usage events inside the add-on (which features you use, linked to your account)
  • Standard server logs (IP, user agent, request path) for security and abuse detection
  • Snippets you save, personal and shared — the formula and the name you give it — stored with your workspace so they sync across Google Sheets, Excel and, on Business, your team

Infrastructure & hosting

Where things run.

Transport

All traffic over HTTPS (TLS 1.2+). The add-on talks to our backend through the same encrypted channels your spreadsheet client uses for its own API calls.

Authentication

Sign-in is handled by Firebase Auth — Google's identity infrastructure. We don't store passwords; authentication tokens are short-lived and refreshed transparently.

Hosting

The marketing site runs on Vercel; the customer-facing portal and API run on Firebase Hosting and Firebase Functions. Both are major cloud platforms with their own security postures and audit history; we don't reinvent transport or storage primitives.

Account data residency

Account, billing, and snippet library data lives in a single Google Cloud region selected at the Firebase project level — not per-user. If your procurement has specific region requirements, talk to us before signing so we can confirm whether they can be met.

Compliance & legal

What we have today.

GDPR-aligned cookie consent flow on the marketing site, built on Google Consent Mode v2 (default-deny baseline; analytics fires only after explicit acceptance). Privacy policy and terms of service are publicly available and version-controlled. Data Processing Agreement (DPA) and a sub-processor list are available on request for Business-tier customers — drop us a line and we'll get them to your legal team within one business day. Formal third-party security audits (SOC 2, ISO 27001) aren't on the shelf yet; if your procurement requires them, talk to us early so we can help your team make a documented risk assessment in the meantime.

Request a DPA

Security FAQ

Security FAQs

Security review for teams

Reviewing Formula Foundry for
your team or organization?

If you're running a procurement or IT review, we'd rather get questions early than discover surprises late. Email us with what your security review needs and we'll either point you at existing documentation or tell you honestly what we don't have yet.

Talk to usRead the privacy policy

Average reply time: under 1 business day.