Operator details, monitored contacts, and production arrangements still require confirmation. The clauses below distinguish the current browser sample from proposed paid services.
A practical account of current handling, production prerequisites, and responsible reporting.
01Current security boundary
SheetSnapshot currently offers a browser sample rather than a hosted document-extraction service. A selected image is displayed locally; the example grid is authored data. The frontend does not upload your selected document to an OCR service or create a server-side document record.
The website is delivered over HTTPS through its hosting platform. Website delivery may produce technical request records independently of the local preview. The operator must confirm the hosting arrangement, access layer, and related logs before production. This page does not assert certification, penetration-testing completion, or a guaranteed level of security.
02The document lifecycle
A JPG or PNG selected in the workspace changes the preview but not the sample extraction values. Edits and sample history stay in page memory. Refreshing or closing the page resets that state. XLSX and CSV files are generated in the browser and saved through your device’s download mechanism.
Your downloaded files can contain values you entered. They are outside SheetSnapshot’s local session after download, and may be included in your device backups or shared folders. Remove unnecessary personal details and choose an appropriate storage location.
03Transport and encryption
HTTPS protects the website connection in transit, subject to your device and network environment. Do not enter information on a lookalike site or bypass a browser certificate warning. A secure connection alone does not establish that a document-processing provider or account system is safe.
There is no SheetSnapshot-hosted document database in this frontend whose at-rest encryption can be claimed. Before hosted extraction starts, storage and backup encryption, key access, secret handling, and secure connections to each processor must be verified. Specific algorithms or TLS-version guarantees will be stated only after configuration is confirmed.
04Access and authentication
The product login and signup forms are unconnected demonstrations. They do not provide real password security, multi-factor authentication, account recovery, or organization permissions. Access restrictions imposed by the hosting platform operate separately.
Production readiness requires least-privilege access, reliable account isolation, secure session handling, and appropriate administrator protections. Access to confidential source files should be limited to people and services that need it for an authorized purpose. Access logging and periodic permission review must be implemented before claiming those controls are active.
05Retention, backups, and deletion
The proposed upload-retention target is 24 hours for source files and temporary extraction data. It is a production design target, not an implemented server-deletion guarantee. Local sample data resets with the page, while browser theme storage and downloaded files require separate removal.
Before accepting real uploads, deletion must cover successful, failed, and abandoned jobs, temporary copies, exports held on the server, and bounded backup retention. Required legal preservation must be narrowly documented. A deletion request should identify the relevant account or file without including sensitive originals.
06Provider transparency
No OCR processor is connected. Hosting details need confirmation, and Stripe is a proposed hosted billing provider with payments currently disabled. Licensed font files are served locally with the website and do not make requests to an external font provider. The provider table below describes configuration status rather than an audited subprocessor inventory.
Each production provider needs a defined purpose, data scope, location, retention policy, training restrictions, and applicable contractual safeguards. Hosted payments should keep full card details with the payment processor. SheetSnapshot must separately verify its own integration; use of a payment provider does not make the entire application certified.
| Service | Purpose | Current status |
|---|---|---|
| Website hosting | Site delivery and hosting access | Active hosting; legal provider, location, logs, and agreements require confirmation |
| Self-hosted fonts | Typography assets | Served from the website origin; no external font requests |
| OCR / AI provider | Future extraction | Not selected or connected |
| Stripe | Proposed hosted billing | Payment links and subscriptions disabled in this configuration |
| Contact service | Future support messages | No endpoint configured |
07Monitoring, incidents, and maintenance
Before production, the operator must establish proportionate monitoring, patch management, dependency review, backup restoration checks, and an incident response process. Logs should exclude document contents and credentials wherever possible. No live security-monitoring or scheduled audit program is claimed by this demo.
If a production incident affects personal information, the operator must assess the impact, contain it, preserve appropriate evidence, and notify affected people or regulators when required by the applicable rules. Notification periods and obligations depend on the confirmed operator and affected jurisdictions.
08Reporting a concern
Use a confirmed, monitored security or support channel once it is published. The current contact form is not connected and the placeholder address is not a reliable reporting route. Do not send vulnerability details containing real customer data to an unconfirmed recipient.
A useful report identifies the affected URL, the behavior observed, safe reproduction steps, and the potential impact. Use your own data, stop if another person’s information appears, and do not disrupt availability or download unrelated records. This page does not establish a bug bounty, authorize access to another system, or promise a reward.
09Your part in keeping documents safe
Use an up-to-date browser and operating system. Review the correct site address, avoid shared-device exposure, and close the sample when finished. A future account should use a unique password and any verified protections the service offers.
Keep the source for verification, review exported values, and restrict access to downloaded spreadsheets. Do not include confidential attachments in support messages unless a secure, approved exchange method is available. Privacy and Cookie Policy pages explain how local storage differs from document processing.