Security
GRID’s products are software libraries and not a hosted service. The spreadsheet engine, viewer, editor, and agent tools install from npm and run inside your application, on your infrastructure and under your control. This page describes what that means for a developer integrating them. The security page on grid.is covers the same ground for a security review.
Where the packages run
Section titled “Where the packages run”The packages run wherever your code runs, in the user’s browser or in Node.js on your servers. There is no GRID account at runtime, no API key to protect, and no GRID service that has to stay available. Your existing controls, such as network policy, secrets handling, and logging, apply to GRID the same way they apply to the rest of your code.
Network behavior
Section titled “Network behavior”Commercially licensed packages make no network connections of any kind. They do not check licenses online, send telemetry, fetch updates, or contact GRID for any reason. They work in air-gapped and egress-restricted environments without configuration.
The free evaluation packages send one small request to GRID when they initialize, carrying the package name, version, and runtime environment. Like any request over the internet, it also reveals the sender’s IP address and the time it was sent, which we log. It carries no spreadsheet content. The evaluation license and the privacy policy describe it in full.
Your data
Section titled “Your data”Your workbooks, cell values, formulas, and any information about the people who use your product never leave your process. Loading a workbook, recalculating it, and saving it all happen in memory. Nothing is written anywhere unless your code writes it. GRID never sees your spreadsheets or data unless you choose to send them to us.
Compliance
Section titled “Compliance”Because GRID runs inside your own systems, it enters your compliance work as a software dependency rather than as a data processor. It sits alongside your other libraries in dependency review, SBOM and CVE monitoring, and it is not a subprocessor. There is no hosted service on our side to certify, and no data flow an auditor needs to trace back to GRID. Whatever standards your product meets apply to GRID the same way they apply to any other library in your build.
Macros and external data
Section titled “Macros and external data”The engine parses the XLSX file format and evaluates spreadsheet formulas with its own calculation engine. It does not run macros, VBA, scripts, or external links. Macros and VBA present in a file are carried through unchanged when the file is saved, so the workbook stays intact, but they are never executed.
No formula can reach outside the workbook. Functions that fetch external data in Excel or Google
Sheets, such as WEBSERVICE, IMPORTRANGE, and RTD, are
not implemented, by design. The engine never
evaluates file contents as code.
Agent Tools and MCP
Section titled “Agent Tools and MCP”The MCP server and the SDK tools run in-process on the engine with the permissions of the process that starts them. They can load and save workbooks at any path that process can reach, and they make no network connections of their own.
Run the server the way you would run any local developer tool, from a working directory scoped to the files the agent should touch and under the permission model of your agent runtime. Cell contents are untrusted input to a language model. Treat text from a workbook you did not author as you would treat any other untrusted content handed to an agent.
Supply chain
Section titled “Supply chain”The public packages @grid-is/spreadsheet-engine, @grid-is/spreadsheet-viewer,
@grid-is/spreadsheet-editor, and @grid-is/agent-tools are published to npm only from GitHub
Actions through npm trusted publishing. No long-lived publish token exists, and every published
version carries a registry signature that you can verify with npm audit signatures.
The commercial packages are private on npm and install under your own access token, so you control which versions enter your build. See installing packages. A software bill of materials listing the third-party dependencies of any package is available on request.
Contact
Section titled “Contact”If you believe you have found a security issue in a GRID package, or your review needs something this page does not cover, email security@grid.is. We get back to people as soon as we can. Please give us reasonable time to address a reported issue before disclosing it publicly. The same contact is published at grid.is/.well-known/security.txt.