SQL Spreads security: your data stays in your database
SQL Spreads is an Excel add-in that runs on your users’ computers and connects directly to your own databases. Your database data never passes through SQL Spreads, and there is no AI in the product.
Download: Security and deployment overview for IT (PDF), one page for your IT and security review.
Where your data goes
SQL Spreads is software installed on your users’ computers. It works directly with data in your on-premises servers or in your organization’s cloud databases, such as Azure SQL. There is no SQL Spreads server to install, and no SQL Spreads cloud service between Excel and your database. For Fabric, Databricks and Snowflake, sign-in also goes directly to Microsoft, Databricks or Snowflake.
All your business data, in Excel and in your databases, is stored and processed on your own machines, cloud accounts and databases. Obnex Technologies, the company behind SQL Spreads, does not access, process or store your business data.
What leaves your network
Your data travels only between Excel and your database. If the database is in your own network, that traffic never leaves it. These are the only connections SQL Spreads makes to SQL Spreads services:
| Connection | When | What is sent | Can it be turned off? |
|---|---|---|---|
| License activation and license checks | When a license key is entered. After that, at most once a day, when a user loads or saves data with SQL Spreads or opens the About dialog | HTTPS on port 443, to licenseserver.sqlspreads.com. The Windows login with domain, the SQL Spreads version, a client ID, a timestamp, the license key and the key the license is bound to. Activation also sends the computer name | Yes. An offline activation key is available from support@sqlspreads.com |
| Update check | When Excel starts or the Designer opens, at most once a day. Subscriptions only, never for trials or lifetime licenses | An HTTPS request to sqlspreads.com for the latest version list, with the installed version | Yes, set the registry value Disable_CheckForUpdate to 1 |
| Trial usage statistics | During the 14-day trial only | Anonymous usage data, such as installation and Designer usage, with no customer data. None for commercial licenses | No, but it ends with the trial |
If the license server cannot be reached, SQL Spreads tries again every hour. A license keeps working for 14 days without a successful check, with a warning during the last 7 days.
You decide who can change what
SQL Spreads does not have its own user management for database access. Users can only reach the data their Windows, SQL Server, Microsoft Entra ID or other database login allows. SQL Spreads cannot change data that the user’s login is not allowed to change. On top of that:
- Two roles. A Designer sets up the Excel documents. Data Editors can edit data, but cannot change which tables, columns or rows a document uses. The role is set by the license key.
- Insert, update and delete settings per table. Turn off deleting, turn off inserting, allow only new rows, or set a column to read-only.
- Row-level access. A Tree filter combined with a user access table limits the rows each user can load, by Windows login or by Active Directory or Microsoft Entra ID group (Pro plan and above).
- Design mode password. Protects a document’s setup from users who have the Designer role.
- Change tracking. Writes who created or changed each row, and when, to columns in your table (Pro plan and above). For a full history of changes, SQL Spreads recommends SQL Server temporal tables.
- Confirm before saving. By default, users see a confirmation dialog with the number of modified rows before changes are saved to the database.
- Conflict detection. Warns a user if someone else changed the same row in the meantime. Off by default since version 7.9.2, and can be turned on per table.
These settings control what users can do through SQL Spreads. The database permissions control the data from every tool, so set them to match.
Sign-in
| Database | Sign-in options |
|---|---|
| SQL Server and Azure SQL | Windows Authentication, SQL Server Authentication, Microsoft Entra ID with MFA (Pro plan and above) |
| Microsoft Fabric | Microsoft Entra ID |
| PostgreSQL | Microsoft Entra ID, username and password |
| Databricks Lakebase | Databricks sign-in, external browser sign-in |
| Snowflake | Username and password, key pair, encrypted key pair, external browser sign-in, authenticator |
Every sign-in goes directly to your own database or platform, never through SQL Spreads, and users can only reach the data their login allows.
For SQL Server, SQL Spreads recommends Windows Authentication or Microsoft Entra ID Authentication where possible, following Microsoft’s best practice.
Encryption
- Database connection: for SQL Server, turn on Encrypt in Advanced Connection Settings to encrypt data in transit with TLS, using what the Windows and SQL Server environment supports (for example TLS 1.2 on SQL Server 2016 and later). It is off by default, and SQL Spreads recommends turning it on. Turning it on also makes SQL Spreads verify the server’s certificate. Microsoft Fabric connects the same way, and Fabric only accepts encrypted connections, so a Fabric connection is always encrypted with TLS. For PostgreSQL and Databricks Lakebase, SSL mode is set to Prefer by default and can be changed. Snowflake connects over HTTPS. Encryption at rest is handled by your database and your own infrastructure.
- License Manager: TLS 1.0 and 1.1 are disabled, with protection against downgrade attacks (TLS Fallback SCSV), since version 7.9.2 (May 2026).
- SQL Spreads documents: the setup stored in each document is encrypted. Since version 7.4.1, passwords and connection strings in the document are encrypted with AES, so they cannot be read by anyone who opens the file. For the strongest protection, each user should remember their password on their own machine, where it is also protected by the Windows Credential Manager, or use Windows Authentication or Microsoft Entra ID. Documents created before 7.4.1 keep the older encryption until a Designer turns it off in Document Settings.
- Saved passwords and sign-in tokens: for SQL Server Authentication, PostgreSQL and Snowflake, users can choose to remember the password on the local machine. It is then stored in the Windows Credential Manager, which is protected by the user’s Windows login. SQL Spreads also encrypts the password with AES before saving it, so it cannot be read in Credential Manager. From version 8.0.60, Microsoft Entra ID and Databricks sign-in tokens are also kept in the Windows Credential Manager. For Snowflake, remembering the sign-in token can be turned on in the Snowflake options. For SQL Server Authentication, a password can also be saved inside the Excel document, encrypted with AES. SQL Spreads strongly recommends against this, because an Excel file can be shared. Use Windows Authentication or Microsoft Entra ID, or remember the password on the local machine.
AI and your data
SQL Spreads has no AI features. The add-in does not send your data to any AI service or AI model. Because your database data never reaches Obnex Technologies, it cannot be used to train AI.
The Privacy Notice mentions an AI assistant. That is an internal work tool the Obnex Technologies team uses, the same way it uses cloud file storage and a note-taking workspace. It is not part of SQL Spreads. It is used with customer company names for marketing work only, never with contact details such as email addresses or phone numbers, and it never has access to your databases or the data in them.
Independent penetration testing
SQL Spreads was penetration tested by Zerotak, an independent information security firm, starting in December 2025, followed by further tests. Every finding was fixed in version 7.9.2, released in May 2026. The report can be sent to customers on request. The tests covered:
- the SQL Spreads Excel add-in
- the SQL Spreads License Manager
Recent security work, from the release log:
- Version 7.9.2 (May 13, 2026): hardened application obfuscation, local logging that no longer exposes license details, password fields that hide password length, error messages that no longer expose license information, restricted access to the License Manager API documentation, and TLS 1.0 and 1.1 disabled on the License Manager.
What is stored on the user’s computer
| What | Where |
|---|---|
| The add-in (default per-user install) | C:\Users\[user]\AppData\Local\Obnex Technologies AB\SQL Spreads Desktop |
| The add-in (per-machine install) | C:\Program Files (x86)\Obnex Technologies\SQL Spreads Desktop |
| User settings, including saved connections | Per user: C:\Users\[user]\AppData\Local\Obnex Technologies AB\SQL Spreads Desktop\Settings.xml. Per machine: C:\Users\[user]\AppData\Roaming\Obnex Technologies AB\SQL Spreads Desktop\Settings.xml |
| Registry settings | HKEY_CURRENT_USER\Software\Obnex Technologies AB\Obnex SQL Spreads (per-machine: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Obnex Technologies AB\Obnex SQL Spreads) |
| Saved passwords and sign-in tokens | Windows Credential Manager, only if the user chooses to remember them. Passwords are also encrypted with AES. Microsoft Entra ID and Databricks tokens from version 8.0.60 |
| The Excel documents | Wherever users save them, like any Excel file. A document contains the data loaded into it and its SQL Spreads setup, with the connection details encrypted with AES. A password is stored in the document only if the user chooses to save it there, which is not recommended |
| Logs | Only if startup logging or extended logging is turned on for troubleshooting |
| Diagnostic file | Only when a user creates one from Help in the SQL Spreads ribbon to send to support. It holds technical details only, such as the software version, error messages, settings and logs, and no data from your tables |
What SQL Spreads stores about you
As a customer, your contact details, purchase information and license keys are stored, plus the License Manager data: Windows login name, computer name, license key, activation date and the time of each user’s last license check. Support emails are stored in HelpScout. See the Privacy Notice for what is stored, why, and for how long.
Compliance
SQL Spreads does not hold ISO 27001 or SOC 2 certification. Your business data never reaches Obnex Technologies, so a vendor review covers the add-in and the License Manager, both independently penetration tested. All your business data stays in your own environment, where you manage access control, user permissions and audit logging in SQL Server. Obnex Technologies is incorporated in the EU and follows GDPR.
Support and your data
Support works by email and with the diagnostic file, without access to your data. SQL Spreads staff never ask for direct access to your systems, databases or networks. If you choose to share a file or your screen, it is used only to solve the support case and is not kept.
Report a security issue
Email support@sqlspreads.com with security questions or to report a vulnerability.
Frequently asked questions
Does SQL Spreads store my data? No. SQL Spreads works directly with your own databases, and all your business data is stored on your own machines, cloud accounts and databases. Obnex Technologies does not access, process or store your business data.
Do I need to install a server? No. SQL Spreads is an Excel-only add-in that connects directly to your database.
Does SQL Spreads use AI? No. SQL Spreads has no AI features, and the add-in does not send data to any AI service.
Does it need admin rights to install? No. The default installer installs SQL Spreads per user without administrator rights. If prerequisites such as the Visual Studio 2010 Tools for Office Runtime are missing, installing them needs administrator rights. The per-machine installer, needed for Remote Desktop and Citrix, needs administrator rights.
Can it run without internet access? Yes, with an offline activation license key from support@sqlspreads.com.
Is SQL Spreads HIPAA compliant? SQL Spreads holds no compliance certification. Your business data never reaches Obnex Technologies. It stays in your own environment, where your own access controls, permissions and audit logging apply.
Can users change data they are not allowed to? No. The database permissions of the user’s login always apply, so SQL Spreads can never change more than that login allows. On top of that, a Designer can restrict what users can do in SQL Spreads, for example by setting a column to read-only or turning off deleting. These settings apply only in SQL Spreads. A user who opens another tool with the same login, such as SQL Server Management Studio, can still change whatever the login allows. To block a change in every tool, set it in the database permissions.