Security
GRID's products are software libraries and not a hosted service. The spreadsheet engine, viewer, editor and agent tools install from npm and run inside your application, on your infrastructure and under your control. This page describes what that means in practice and what GRID does on its side.
- Runs in-process in the browser or in Node.js. There is no GRID-hosted server in the path.
- Commercially licensed builds make no network calls. Your spreadsheet data never leaves your infrastructure.
- Macros and VBA are carried through untouched and never run.
- Packages are published only from CI through npm trusted publishing.
- SOC 2, ISO 27001, PCI DSS and HIPAA apply to GRID the way they apply to any library in your build. See compliance.
- Security questions and reports go to [email protected].
The deployment model
GRID's packages are libraries you bundle into your own product. They run wherever your code runs, whether that is the user's browser, Node.js on your servers, or your private cloud. There is no GRID account at runtime, no API key to protect, and no GRID service that has to stay available.
The controls you already have, such as network policy, identity and access management, secrets handling, logging and backup, apply to GRID the same way they apply to the rest of your code. GRID adds no new trust boundary to your architecture.
Network behavior
Commercially licensed builds make no network connections of any kind. They do not check licenses online, send telemetry, fetch updates, or contact GRID for any reason. They work in air-gapped and egress-restricted environments without configuration.
The free evaluation builds on npm send one small request to GRID when they initialize, carrying the package name, version and runtime environment. Like any request over the internet, it also reveals the sender's IP address and the time it was sent, which we log. It carries no spreadsheet content. The privacy policy describes it in full.
Your data
Your workbooks, cell values, formulas and any information about the people who use your product never leave your process. Loading a workbook, recalculating it and saving it all happen in memory. Nothing is written anywhere unless your code writes it.
GRID never sees your spreadsheets or data unless you choose to send them to us, so there is nothing on our side for your data governance to account for.
Compliance
Because GRID runs inside your own systems, it enters your compliance work as a software dependency rather than as a data processor. It sits alongside your other libraries in dependency review, SBOM and CVE monitoring, and it is not a subprocessor. There is no hosted service on our side to certify, and no data flow an auditor needs to trace back to GRID.
Whatever standards your product meets, whether SOC 2, ISO 27001, PCI DSS, HIPAA or sector regulation, apply to GRID the same way they apply to any other library in your build. If your review needs information from us that this page does not give, reach out to us at [email protected].
Macros and external data
The engine parses the XLSX file format and evaluates spreadsheet formulas with its own calculation engine. It does not run macros, VBA, scripts or external links. Macros and VBA present in a file are carried through unchanged when the file is saved, so the workbook stays intact, but they are never executed.
No formula can reach outside the workbook. Functions that fetch external data in Excel or Google Sheets, such as WEBSERVICE, IMPORTRANGE and RTD, are not implemented, by design. The engine never evaluates file contents as code.
Treat an untrusted workbook the way you would treat any untrusted document, and parse it in a process with the privileges appropriate to that level of trust.
Agent Tools and MCP
The MCP server and the SDK tools run in-process on the engine with the permissions of the process that starts them. They can load and save workbooks at any path that process can reach, and they make no network connections of their own.
Run the server the way you would run any local developer tool, from a working directory scoped to the files the agent should touch and under the permission model of your agent runtime. Cell contents are untrusted input to a language model. Treat text from a workbook you did not author as you would treat any other untrusted content handed to an agent.
Supply chain
The public packages @grid-is/spreadsheet-engine, @grid-is/spreadsheet-viewer, @grid-is/spreadsheet-editor and @grid-is/agent-tools are published to npm only from GitHub Actions through npm trusted publishing. No long-lived publish token exists, and every published version carries a registry signature that you can verify with npm audit signatures.
The commercial packages are private on npm and install under your own access token, so you control which versions enter your build. A software bill of materials listing the third-party dependencies of any package is available on request.
Security contact
If you believe you have found a security issue in a GRID package, or your review needs something this page does not cover, email [email protected]. We get back to people as soon as we can. For a suspected vulnerability, include the package name and version and how to reproduce it.
Please give us reasonable time to address a reported issue before disclosing it publicly. The same contact is published at /.well-known/security.txt.
Personal data
How GRID handles personal data on this website, in our forms and in support files is covered by the privacy policy.