Security, privacy, and operations

In an embeddable product, security is not a section at the end of the contract but part of the contract itself: the boundaries run right along the calls. For a security team this means it is known in advance where the trust boundaries are, what goes into the logs, which credentials never leave, how the runtime is updated, and how resources are released.

The main rule: the core and the processor never call out. Documents stay inside your perimeter, and document content never goes into the logs.

Area	What SumOffice is responsible for	What stays on your side
Network boundary	For documents, the editor service listens only on a local address: it cannot be reached from outside, even from your own network. For spreadsheets in the browser there is no separate service at all — the core computes in the page’s memory, and the workbook never leaves. Data providers do not go to the network without explicit permission in either case.	Set the allowed source addresses, root directories, and network rules.
Secrets	The SumDoc editor service is protected by a pass, new on every start and valid while the service runs; secrets are cut out of the output, and credentials are passed as opaque identifiers.	Do not log passes, addresses, or credentials; choose where the performance metrics go. If you set your own pass, its strength and rotation on every start are your responsibility: the core only checks that the string is not empty.
Storage	The save contract, transfer as bytes or a stream, address-based access only with a declared capability, replacing the file in one atomic action.	Paths, access rights, backups, retention periods, leak control.
Read-only mode and roles	The restriction is checked when a command runs, not just by graying out buttons in the interface.	The roles themselves and permission decisions.
Logs	Counters, durations, codes, and checksums — without the document’s content.	Agree on what gets redacted, what goes into the audit trail, and how long it’s kept.
Supply chain	Signatures, component inventories, checksums, and update compatibility rules. Not everything is signed yet, and it differs by system — exactly what is verified today is summarized under risks.	The rollout and rollback process, approvals, the support channel.
Lifecycle	Closing twice is safe; acceptance requires that no resource stays held after shutdown.	Monitoring the process, timeout rules, deciding what happens to an unsaved document.
Ready-made apps	The only outbound channel is the support assistant in the ready-made SumDoc and SumSheet apps. It sends to the support service only messages, problem reports, and automatic error reports: on desktop systems — a snapshot of the document window, a recording of the last minute of interface actions, and the app logs; on mobile — only the tail of the log. The same error is sent once, no more than five automatic reports per hour; there is no off switch. The support service is hosted by a partner (privacy policy).	Decide whether such a channel is allowed inside your perimeter; if it is not, do not deploy the ready-made apps — embed the core instead.

What can be collected without content

• the runtime version, the contract version, the capability profile identifier;
• the operation identifier, the command family, duration in milliseconds, the outcome class;
• document size to within a range and the number of structural elements — without the text itself;
• the reason the process ended, peak memory use, timeout and retry counters;
• versions of the system, WebView, browser, and runtime, and the update channel.

Don’t log

Tokens, full addresses, document text, comments, author names, source markup, workbook bytes, credentials, and absolute paths — unless a redaction rule is defined for them.

What’s left of a redacted value

Cutting out does not drop the value silently: a separate, deliberately sparse projection is built for the log. Whoever decides where such a log goes needs to know what it contains.

What remains of a value is its length in bytes, a sha256 hash, and, for binary data, up to the first sixteen bytes. The bytes themselves, base64, and field contents are never carried over; for records with fields, only their count and a “cut out” mark remain. Credentials, addresses, and local paths are masked before the value gets into the projection. But sixteen bytes of binary data remain, and the hash of a short value can be brute-forced — for a log that goes outside, this is worth considering separately.

For developers

For documents everything is collected on one page; for spreadsheets it is split by topic.

• The SumDoc service pass: 256 bits from the system’s source of randomness, new on every start; your own pass — about --token. The minimal security model, the local address, and forbidden workarounds — Responsibility and security.
• SumSheet, where the data stays: in the browser the workbook lives in the tab’s memory — the core in the browser; on the server, client isolation, quotas, and the log remain yours — the processor on the server.
• SumSheet, boundaries for outside input: allowed directories and file types, a ban on passing a destination address from an external client — integration into an application.
• SumSheet, what never leaves: credentials and the source text of Power Query queries and macros don’t go into events — runtimes; source privacy levels — trust and privacy.
• What comes back in a refusal, and why a refusal is safer than silent corruption — How the session API works.