Security & privacy

What your spreadsheet reveals about you when you email it

Author names, internal folder paths, hidden sheets, tracked revisions and comment authors all travel with the file. Most people never check.

DODaniel OseiPrincipal Engineer2 min read
Post on XLinkedIn

Send a workbook to a client and you send more than the numbers. Here is the full list of what travels with it, ordered by how often it causes an actual problem.

The last-saved-by name and file path

docProps/app.xml records the application and, on some save paths, the full local path of the file. That path frequently reveals a username, an internal project codename, or a folder structure that maps your org chart.

I have seen a pricing spreadsheet sent to a prospect that recorded its path as C:\Users\jsmith\Deals\Acme - aggressive discount scenario\pricing.xlsx.

Hidden and very hidden sheets

A hidden sheet appears in Excel's unhide dialog. A *very hidden* sheet, set through VBA, does not — it is invisible unless you open the VBA editor or inspect the file directly. Old scratch calculations, previous client names and superseded assumptions live in these.

Use the Excel Metadata Viewer to list both kinds before sending anything externally.

Comment and note authors

Comment text is obvious. Comment *authorship* is less so, and threaded comments carry a full participant list. "Can we get away with this number?" is bad. "Can we get away with this number? — J. Smith, Finance Director" is worse.

Tracked changes and revision history

If shared-workbook tracking was ever enabled, the change log persists in the file. Every prior value of every changed cell.

Defined names pointing at deleted ranges

These carry the names of ranges that no longer exist, which often describe what the workbook used to contain. Q3_Redundancy_Costs referring to #REF! still tells a story.

Custom document properties

Add-ins, DMS integrations and templates write custom properties. Approval workflow tools in particular store reviewer names and internal document classifications here.

What to do about it

Before any external send:

  1. Run Excel Metadata Viewer and read the full report.
  2. Run Excel Metadata Remover to strip author, company, path and custom properties.
  3. Delete — do not hide — any sheet the recipient should not see.
  4. Send the scrubbed file *without opening it in Excel again*, because Excel repopulates the author field from your Office account on save.

Step 4 is the one people miss. Scrubbing then opening then saving undoes the scrub.

For anything genuinely confidential, sheet protection is not the answer either — it prevents editing, not reading. Use file-level encryption via File → Info → Protect Workbook → Encrypt with Password, and send the password over a different channel.

DO

Daniel Osei

Principal Engineer

Daniel builds the parsing and conversion engines behind ExcelToolkit Pro. He has spent more time inside the OOXML specification than is healthy and enjoys explaining why your file is 40 MB when it only has 3,000 rows.

Get the next one by email

New guides every other Tuesday. Unsubscribe in one click.

No spam. Unsubscribe in one click.

Keep reading