About this demo. This demo workspace uses synthetic data to show what’s possible. Its Connected Reports and country pages use Google’s Publish to web, which anyone with the link can open: fine for made-up figures, never for real ones.
For your company’s workspace, we build on your own Google Workspace security instead: sign-in for your company accounts only, sheets that are never published, and Google checking each person’s access on every view. Please read our implementation guidelines below, including the go-live checklist your IT team runs with us.
Summary for the CEO
Your financial data stays in your own Google Workspace, and only your own signed-in staff can see it.
The management reporting app that AccountingBPO builds for you is a secure window onto Google Sheets you already own: it does not copy, store or publish your numbers. Three things make that hold, and your IT team can verify each one before launch:
- Only your company accounts can sign in. Login is Google sign-in, registered in your own Google Cloud project as an Internal app, so Google itself turns away any account outside your domain.
- Google checks every view. Each report is your normal, unpublished Google Sheet. Google decides, person by person, who may open it, using the sharing you already control. The CEO sees everything shared with the CEO; a head of department sees only their own reports.
- You hold the keys. The app, its login and its access all sit in your Google Workspace. Your admin can audit it or switch it off at any time, without us.
This page is written to be passed to your IT head or CTO. The go-live checklist below is run together before launch, with a pass or fail test for each control.
How the app is built
The app handles who you are and what is on your menu; Google handles your figures and who may see them.
- Sign-in. The viewer signs in with their company Google account. The app is an Internal app in your Google Cloud project, so Google accepts only your domain, and the server checks the domain again.
- Menu. The app shows the reports that person can already open in Google. It reads only which sheets exist (read-only metadata), never their contents.
- Figures. Each report is your normal, unpublished Google Sheet, shown inside the app. Google checks the viewer’s own permission on every view, so a copied link is useless to anyone without access.
The app runs over HTTPS, either in your own cloud account or on our hosting. In both cases it holds no report data, only sign-in records.
Our security commitments
Every build follows these eight commitments. Each one names how it is enforced, so your IT team can check it rather than take our word for it.
| # | Commitment | How it is enforced |
|---|---|---|
| 1 | Your data stays in your Google Workspace | Reports are shown as your Google Sheets inside the app. The numbers travel from Google to the viewer’s browser; our server never receives, copies or stores them. |
| 2 | Nothing is published to the web | We never use Publish to web for real data. Your admin can disable it company-wide, so it cannot happen by mistake. |
| 3 | Only your company accounts can sign in | Google sign-in, registered as an Internal app in your Google Cloud project. The server also rejects any account whose domain is not yours. |
| 4 | Each person sees only their part | Google checks every view against the sheet’s sharing. The app lists only the reports a user can already open in Google. No shared master account reads your reports. |
| 5 | You own and control the app | The OAuth client and project live in your Google Cloud organisation. Your admin can audit or revoke them at any time. |
| 6 | Minimum permissions | The app asks for the user’s name and email, and at most read-only metadata to list which sheets they can open. It never asks for edit or download rights. |
| 7 | Secure by default in transit and in session | HTTPS only, secure and HTTP-only session cookies, sessions that expire, and no credentials or secrets ever sent to the browser. Logs record sign-ins, never report contents. |
| 8 | Leavers lose access at once | Access follows the company account. Suspend the account in Google Workspace and the person can no longer sign in or open any sheet. |
Google Workspace controls your admin switches on
These are standard Google Workspace admin settings. They protect your data everywhere in Google, not only in this app, and we recommend all of them before go-live.
| Control | Why it matters | Required? |
|---|---|---|
| 2-step verification enforced for all staff | A stolen password is the most likely way in. This closes it. | Required |
| Publish to web disabled | Removes the one feature that makes a sheet public. | Required |
| Sharing outside your domain blocked or warned | Stops a sheet being shared with a personal Gmail by mistake. | Required |
| Department reports shared through Google Groups | One group per audience (for example finance-heads@) keeps access tidy and easy to review. | Recommended |
| Download, print and copy disabled for viewers on sensitive sheets | Reduces copying out of the most confidential reports. | Recommended |
| Audit log review | Google records who opened which file and when. Your admin can check access at any time. | Recommended |
| Your sheets can be shown inside your own app | We confirm together that your Workspace and browser policies let signed-in staff view your sheets inside the app. If not, every report opens in Google Sheets with one click instead. | If needed |
What remains your responsibility, and the limits we state plainly
No system can promise that an authorised person will never misuse what they are allowed to see. We would rather state the limits than overclaim.
- Authorised viewers can still screenshot or retype a report. The defence is sharing each sheet only with the people who need it, and disabling download and copy on the most sensitive ones.
- A sheet shared with the wrong person is visible to that person. Sharing stays in your control in Google. The go-live checklist tests a sample, and a periodic access review keeps it right.
- A compromised Google account sees what that person sees. Enforced 2-step verification is the main protection, and suspending the account cuts access at once.
- Browser privacy settings can block a sheet shown inside the app. When that happens the viewer is offered “Open in Google Sheets”, which keeps exactly the same permissions. No data is exposed; it is one extra click.
- Data you copy out of Google is outside these controls. Exports, email attachments and printouts follow your normal company policies.
How we build and hand over
Our team builds and tests on synthetic data, and your own admin connects your real sheets at the end. That way we never need standing access to your figures.
- Design together. We agree which reports exist, who should see each one, and the Google Groups that carry that access.
- Build on synthetic data. We build and test the app with made-up figures in the same layout as your reports, like this demo.
- You create the keys. Your Workspace admin creates the Google Cloud project and Internal OAuth client, following our step-by-step guide, and shares the real sheets with the right groups.
- Connect and verify. Your admin points the app at your sheets. We run the go-live checklist below together, and nothing goes live until every required item passes.
- Remove our access. Any temporary access our team was given is removed at go-live and confirmed on the checklist.
Confidentiality and PDPA. Our engagement letter includes a confidentiality clause covering anything we see during the build. FP&A reports are mostly company data. Where a report holds personal data, such as salaries or staff names, we agree with you how it is limited and who may see it, in line with Singapore’s Personal Data Protection Act (PDPA).
Independent testing. For larger organisations, we recommend an independent security test before launch. We will support whichever provider you choose.
Go-live checklist we verify together
The app goes live only when every test below passes, run by your IT person with us watching. Each test is something you do, not something we report.
| # | Test | How to run it | Pass when |
|---|---|---|---|
| 1 | Outside accounts are refused | Try to sign in with a personal Gmail account | Google refuses the sign-in |
| 2 | Signed-out access is refused | In a private browser window, open a copied report link | Google asks for a company sign-in; no figures appear |
| 3 | Nothing is published | Check the Workspace admin setting and each report’s Publish to web status | Publish to web is disabled; no report is published |
| 4 | Department separation holds | Sign in as one head of department, then open another department’s report link | Google denies access, and the report is not in their menu |
| 5 | The CEO sees the full pack | Sign in as the CEO | Every agreed report opens |
| 6 | 2-step verification is enforced | Check the Workspace security settings for all users of the app | Enforced for every user |
| 7 | No sharing outside the domain | Try to share a report with an outside address | Blocked, or a warning your policy requires |
| 8 | Leavers lose access | Suspend a test account, then try to sign in and open a report | Both are refused |
| 9 | Our server holds no report data | Inspect the server’s storage and logs with us | Sign-in records only; no figures or sheet contents |
| 10 | Permissions are minimal | Review the OAuth consent and scopes in your Google Cloud project | Name, email and read-only metadata only |
| 11 | Traffic is encrypted | Open the app over plain http | Redirected to https; the certificate is valid |
| 12 | Our build access is removed | Review sharing on each report and the Cloud project’s members | No AccountingBPO accounts remain |
Go-live is agreed when every required test passes and your IT head, your CEO or project sponsor, and our project lead sign off. Questions, or a security review you would like us to support: contact your AccountingBPO project lead.