campaign

Looking for an Airtable alternative? See how Grist compares.

Enterprise role-based access control for spreadsheets

Traditional spreadsheets are all-or-nothing when sharing. Grist lets you control access by table, column, row, and cell.

Try access rules
Request demo

Why spreadsheets fail at access control

lock

Traditional spreadsheets (Excel, Google Sheets) offer only document-level permissions.

copy_all

Common workarounds (hiding columns, making copies, separating files) leads to insecure and fragmented data.

house

Compliance requirements (GDPR, HIPAA, SOC 2) demand granular data access control, or even self-hosting.

Role-based access control, row by row

What does RBAC in spreadsheets look like?

Table-level permissions

Hide entire tables from specific user groups.

Use case: Separating sensitive financial data (like budgets) while sharing operational data (like timelines).

Column-level permissions

Show/hide specific columns based on user role. Make certain columns read-only while others remain editable.

Use case: An HR system where employees update addresses but can’t see salary data.

Row-level permissions

Users see only rows relevant to their role, region, or assignment.

Use case: Sales teams see only their territory’s customers in a CRM, or a regional manager sees their region’s employees in an HR workflow.

Granular permission and user data

Built for Complex Security Requirements

Conditions

Allow specific changes only when conditions are met (e.g., status is “approved by manager”).

Use case: Workflows where records move through approval stages.

User attributes

Map users to specific fields in a table within the document and reference those fields in access control rules.

Use case: Growing teams where role assignments change frequently. No manual rewriting of rules for each new user.

Link Keys

Generate secure, unique URLs that grant access to specific rows to external parties without login.

Use case: Collaborating with external vendors or subcontractors.

Define. Evaluate. Validate.

See data from other users’ perspectives to test access rules.

1

Reference user attributes and record data to define conditions with simplified Python syntax.

2

Rules are evaluated from top to bottom, with first-match logic.

3

Preview user roles with “View As” feature for quick validation.

Enterprise-grade security built-in

check

Access rules enforced at API and database level, not just UI

check

Self-hosting option for complete data control

check

Export restrictions respect access rules (unlike column hiding)

check

Supports compliance requirements for data segregation (GDPR, HIPAA, etc.)

check

Open-source codebase allows security auditing