šŸ†• Security Center

Hey guys - working on an app and need some guidance. I have a contact sheet for employees. It’s a Pro App, public with email.

I’d like to have layers of access (basic, manager, admin) on one of the tabs with the employee profile. I don’t have really confidential data in this sheet, but don’t want my managers to be able to download an export with each other’s pay rates.

In my user profile sheet, I have their roles attributed. On my Store Profile sheet, I have a join function to group all of the emails in comma separated lists for each store (i.e. email1@example.com,email4@example.com). Then I have an array formula in my sheet to lookup the specific store’s team to pull in the string of emails as row owners.

For example:
Row 1: Sally Jane | Restaurant 1 | $11 | Cook | email1@example.com,email2@example.com
Row 2: Levonte Test | Restaurant 2 | $7.25 | Host | email4@example.com,email5@example.com

My app isn’t recognizing the string of emails, though the columns show up as ā€œbasicā€ in the glide data. Any advice? I have over 60 managers, administrators and executive team members that would need access to this app. The teams don’t change that frequently, but it’s nice to have the information populate from the join columns and array functions so I can edit the team directly from the Profile spreadsheet.

Thanks!

Maybe make the pay in a glide sheet and create a relation with your employee sheet so only you can see the pay. Also are the emails listed as row owners?

image

For multiple row owners, you’re best to set up columns in your sheet the are numbered consecutively (for example ā€œEmail 1ā€ , ā€œEmail 2ā€ , ā€œEmail 3ā€ ), then in Glide, those columns will be grouped together in an array. That array column can then be designated as the Row Owner and each email in the array will have access to that row of data.

I’m not sure I understand. I would like all 60 managers to have access to rows with hourly employees, general managers to have access to management teams and administrators to have access to managers and above. The sheet is populated by Zapier. Is there a way to do this through a relation to the array?

Hello! Why is this app a Public app if it’s meant for internal use within a company and contains salary information?

According to our terms of service, apps for internal use within a company must be Private (Section 3), and employee salary information requires a Private app plan.

With our Private app plan, you can use Roles and securely manage access to data.

1 Like

To be completely honest, the original design was much simpler – a scheduling tool for managers to give feedback on candidates. App hasn’t launched yet and I’ve been tweaking it to do more as time permitted. I missed that note. Thanks for sharing. We’re a small restaurant group so in light of the pandemic, the private app will fall outside of our spending limit. I’ll just have reduce its function back to limits for pro.

How many people would use the app each month?

1 Like

In that type of set up, Roles will be more helpful for you. You’d need a Private Plan though.

Dream scenario is that I’d hoped to have a screen with just the user profile for all staff (250 - 300 people) so they could see just their row. That was why I felt public would be best with row owners on the sensitive data. Approximately 70 managers would have additional access with different roles (view only, request changes, approve changes). To get it to work, the 70 managers would suffice. I had been trying to design something at or below $100/month that was scalable.

2 Likes

I had the same issue only today but on a smaller scale. A yoga studio business with 70 clients. I have to reduce functionality because roles only exist in private plans. I had hoped there might have been a cutdown version of roles for public pro, perhaps just 2 or 3 but nothing on the horizon I fear. It is extremely frustrating and I have always felt that providing secure solutions to the SME market was being ā€œprice punishedā€ to accommodate enterprise users.

@Deena @ThinhDinh This is really interesting. So I’ve been putting off releasing an app based on my doubt of how secure it really is. Based on what @Jeff_Hager said, having multiple row owners works when there is an array column - so the number of users that can own that row is limited to the number of columns in an array - which I believe at the moment is 10.

My issue is that my app allows users to invite multiple people into a group - I want only users within the group to have access to view the group information, but I don’t want the limit of only 10 people in a group.

I believe right now computed columns can’t leverage the protected columns feature, only the array or single, email fields.

I’m wondering if there is a workaround with using the roles feature. My initial thought is no, because you wouldn’t be able to define the group (or multiple groups) that the person is added to… :thinking:

3 Likes

um, yes you can (assuming Private Pro).
Row Owners can be a mix of both emails and roles, and users can have multiple roles, and any role can be assigned to any or all users. So there is essentially no limit. Or am I missing something?

1 Like

The app isn’t for Private Pro, it’s public sign-in. The app is designed for anyone to create an account.

2 Likes

Sorry @Lisa where did you get the figure of 10 from?

Yeah I think this is tricky. We have not built any group chats that utiliizes the role feature, and your concerns are valid, I don’t think there’s a good way to do it as of now to be fully secured.

If there’s an upper limit of 10 then I would say it’s a no go.

For some reason, early on, I thought I saw a tutorial where you can do up to ten columns for an array column - I’m thinking it was the image carousel example? Am I imagining it, or did the limit increase? Either or is great news for me :crossed_fingers:

1 Like

So I tested it, no limit to 10 from what I can see. It will be a pain to add each user to the correct column but this will work :slightly_smiling_face: thankfully for my app, more than 20 users is highly unrealistic, but for unlimited users I don’t think this would be a good solution.

Thanks for having me double-check!

2 Likes

I am sure no upper limit…I have one with 26 a-z emails with access to same image?

1 Like

Looking for clarity…I run a project management company and I created an app to duplicate for each of my clients. Which is the best pricing plan to choose for my company? The only personal info I am capturing is email and phone number.

Am I still able to request a free, private, one-on-one security review? The link on the page linked to error page.

Thanks,