What a dashboard can't do here.

Dashboards are served from larssonipages.com or larssoni.co, never from larssoni.com.

The domain that holds your login never serves a dashboard, and the domains that serve dashboards set no cookies.

Free dashboards live on larssoni.co; paid and locked ones on larssonipages.com.

If someone abuses the free plan and a filter blocks that domain, business dashboards are not on it.

sandbox="allow-scripts", and nothing else.

No access to the page around it, no pop-ups. It is set twice: on the frame, and as a response header on the dashboard itself.

connect-src 'none'.

A dashboard cannot fetch, post or open a socket. It draws what it was given.

form-action 'none'.

It cannot submit a form anywhere, which is what a phishing page needs.

Its own inline code, plus libraries from jsDelivr, cdnjs and unpkg.

So charts render. No other host can serve it a script.

Images only from inside the file. Fonts from Google Fonts.

There is no network source for images, so no tracking pixel can load.

Thumbnails and PDF exports run under the same policy.

Our own render service blocks every outside request the policy would block in a browser.

Anyone with the link. Only the email addresses you list. Only addresses at your company's domain.

Locking a link is on Pro and Team. There are no shared passwords anywhere in the product.

The viewer types their email and we send a six-digit code. It works once, for ten minutes.

No account, and no password for your people to reuse. We store a hash of the code, never the code.

Nothing.

The page answers the same way whether or not the address is on the list. A code is only sent if it is.

The gate's one reply, whether or not the address is on the list.

Five tries per address in ten minutes, with a separate limit per network address.

When a limit is hit the gate refuses. It never fails open.

A pass in that browser, for seven days.

HttpOnly, Secure, SameSite=Lax. Take someone off the list and their pass ends with that save.

Seven days, readable by no script.

Each load uses a signed address that expires after two minutes.

Copying the frame's address out of the browser gets you nothing a moment later.

How many people opened it. Never who.

On the Team plan. A viewer's email is reduced to a keyed hash, separate for every dashboard, and is never shown to the owner.

An emailed link, or Google. There are no passwords to steal.

The link works once, for fifteen minutes.

Thirty days, in a cookie marked HttpOnly, Secure and SameSite=Lax.

We store only a hash of the session token.

Thirty days, readable by no script.

The request is tied to the browser that started it.

That stops someone finishing a sign-in they began elsewhere.

A key for publishing from an AI tool or a script is shown once, stored as a hash, and can be revoked at any time.

Only the workspace owner can make one.

On Team: an owner, who handles billing, invitations and deletion; members, who make and share dashboards.

The one tab you point us at, through Google's own link export.

Only Google's hosts are contacted. A redirect anywhere else is refused.

At set-up, and each time a scheduled update runs. Nothing in between.

Column names, made-up rows, and your numbers with every digit masked: £46,200 becomes £##,###.

Anthropic's model, once, at set-up. There is no setting that sends it real values.

No AI at all.

Each update is a plain substitution, checked against the shape the dashboard expects. If the check fails, viewers keep the last good version, with its date.

Not yet: the sheet has to be viewable by link.

We wrote the Google sign-in route and never linked it in: the permission Google offers covers every sheet in the account, and we won't ask for that.

We refuse files that register a service worker, redirect on load, or embed outside pages. A dashboard can be up to 6 MB.

If a pasted file contains a live key or password, publishing stops until its owner says otherwise.

The override is written to the change log.

Every file is scored for brand names, password fields, urgency and QR codes. Above the line, a person looks before it goes live.

On the free plan any password field waits for a person.

Every dashboard page has a report link.

Three separate reports take a free dashboard offline at once. A paid one goes to the front of our queue and stays up until someone has looked.

Disabling a dashboard takes effect on its next request.

Workers, R2 storage, the D1 database, KV and Queues.

There are no servers of ours to patch.

The database is provisioned in Western Europe.

Every email we send comes from hello@larssoni.com, through Postmark.

One file: every dashboard, the list of them, the change log, the view counts and where each dashboard came from.

The workspace owner can ask for it once a day.

What the export contains.

Its link stops at once. You have 30 days to undo it; then the files are erased.

The workspace closes at once and any subscription is cancelled. The files are erased after 30 days.

Not yet. Sign-in is an emailed link or Google.

Not yet. One region, Western Europe.

Not yet. See 5.5.