Security Risk of shared data tables putting all data in one Google Sheet

[Danielsntgd]

I was told it's best to use a shared data table vs private due to private tables being unable to update for users without losing their data. When I use a shared table, it keeps everything in a Google Sheet on my account. Is this secure enough, and If not, what would be the best way to go about this?

Thanks!

[SkrOYC]

---

@Danielsntgd wrote:

I was told

---

Who? How?

Private tables - AppSheet Help

[Danielsntgd]

In the community q&a I was told private may not be the best solution for me. Regardless, Should I make the tables private for an Inventory app which allows notes so that the users data is stored on their own devices instead of my cloud?

[SkrOYC]

Their notes are the ones that shouldn't be shared? Then make just a table for that, a little one that won't change it's schema in the near future

[Steve]

Private tables are a bad idea, period. They are practical in only a very, very few situations. Yours is not one of those situations.

What do you want to be considered "secure enough"?

[Danielsntgd]

This is an Inventory app for products bought, sold, and returned. It contains notes, suppliers.

[dbaum · Accepted solution]

---

@Danielsntgd wrote:

When I use a shared table, it keeps everything in a Google Sheet on my account. Is this secure enough

---

If you consider any other file in your Google Drive secure enough, a file used as a data source for an AppSheet app is no different. Via the app, ensure that you:

• apply the right security filters so that users don't have access to portions of the file's data  that you don't want them to access
• limit the actions (e.g., update, delete) available to users who shouldn't be able to perform those actions

[Danielsntgd]

They're only able to access data through views? Or is there more I need to filter. With the help of people here, I finally figured out how to make an email security filter for added records.

[dbaum]

The crucial feature is each table's security filter. That governs what data is even sent from the server to the user's device.

Anyone using your app as you designed it will indeed be limited to the data you show in views. However, there are ways for savvy people to get at data allowed through a security filter even if it's not included in any view.

Be sure to review Security: The Essentials - AppSheet Help and its related articles. If you have specific questions about the information there, certainly ask in the community.

[Danielsntgd]

I'm trying to avoid people getting past my security filters, (even if they're saavy What's the best way to do this. And side question. Should I only show info in slices if I want to limit files that get exported to certain columns?

[dbaum]

---

@Danielsntgd wrote:

I'm trying to avoid people getting past my security filters, (even if they're saavy What's the best way to do this.

---

Define your security filter to exclude data that you don't want available to a user. If you do that, there's no way for the user to access that data via your app nor even via savvy use of the browser that's running your app and has data beyond what's explicitly displayed in your app's UI.

---

@Danielsntgd wrote:

Should I only show info in slices if I want to limit files that get exported to certain columns?

---

There are multiple ways to create file exports. Export this view to a CSV file - AppSheet Help indeed exports the columns that you include in the view where you make the action available. In addition, you can create an automation to export whatever data you want to make available in any of multiple file formats: Create and save a file from an automation - AppSheet Help.