Overview
Smartsheet makes it easy to collaborate across the university and with external partners. That convenience can also expose information to more people than intended or allow accidental changes. The recommendations below reduce those risks without preventing ordinary academic and administrative work.
Share only with people who need access
- Share sheets, reports, dashboards, and workspaces with the smallest practical group. Access should be based on a person’s university role or a specific collaboration need. This limits unnecessary exposure if a link is forwarded, an account is compromised, or someone changes roles.
- Choose the lowest permission level that allows the person to do their work. Use Viewer when someone only needs to read information, Commenter when feedback is sufficient, and Editor only when they must change data. Reserve Admin and Owner permissions for people responsible for managing the asset. This reduces accidental edits, deletion, and inappropriate resharing.
- Review access at useful points in the work, such as the end of a term, project, contract, or collaboration. Remove guests, former team members, and others who no longer need access. External access is easy to forget after the work has ended, leaving information available longer than intended.
Protect sensitive information
- Use Smartsheet only for information appropriate to the service and necessary for the business process. Even routine university information can create risk when combined, retained unnecessarily, or shared too broadly.
- Where practical, expose only the rows, fields, reports, or views a collaborator needs. A person may need to participate in a process without seeing the entire underlying sheet.
- Check attachments before uploading them. Files often contain more information than the sheet itself, including hidden details, prior versions, or data about people outside the intended audience. Confirm both the content and the source are appropriate.
Avoid unnecessary public access
- Publish a sheet, report, form or dashboard only when the business need requires public or broadly available access. Published items may be accessible without signing in, so normal person-by-person sharing protections may not apply.
- Use direct sharing with named collaborators when the audience is known. Avoid placing unrestricted links on public websites, in broadly distributed messages, or in locations where they may be indexed, copied, or forwarded beyond the intended audience.
- Review published content periodically and stop publishing it when the need ends. Information that was appropriate to publish for an event or project may become outdated or inappropriate to leave public later.
Protect your account and API integrations
- Select Microsoft when signing in and complete any multi-factor authentication prompts. These controls help protect university information when a password is guessed, reused, or exposed.
- Never share passwords, authentication codes, or personal API tokens. API tokens can provide broad access under your identity and should be treated like passwords.
- Review connected applications and integrations periodically. Remove access for tools you no longer use or do not recognize, because a connected application may continue to access information after you stop using it.
- Report suspected account or API token compromise promptly so access can be reviewed and contained before additional information is exposed or changed. Reports can be sent to infosec@uoregon.edu, or submitted through the Report A Security Concern Service, listed on the right-hand side of this page in the Related Services area.
Review activity and changes
Unexpected changes are not always malicious; they may result from mistakes, misunderstood permissions, or automated workflows. Activity Log, Cell History, and System Columns can help determine what changed, who made the change, and when it occurred. Use this information to restore data where possible, correct access, and provide useful details when requesting support.
Get additional support
For help with Smartsheet security or access, use the Smartsheet Support Request listed in the Related Services section on this page.