Your token and your data

Your token

1. You paste it in

   Rowtrace uses the token to call the Smartsheet API. The only servers Rowtrace talks to are Smartsheet's: its API, and the download links Smartsheet hands back for your attachments.

2. It's saved, encrypted, on your computer

   The token is encrypted with Windows' built-in data protection (DPAPI), tied to your Windows user on this computer, and kept in %LOCALAPPDATA%\Eskley, outside OneDrive. Copied to another computer or opened by another Windows user, the saved file can't be read.

3. You can revoke it at any time

   Revoke the token in Smartsheet under API Access and Rowtrace can no longer reach your account. Forget this account in Rowtrace deletes the saved copy.

Which account to use

Use a dedicated account that's shared to everything you want backed up. Smartsheet recommends a shared account for API work (Smartsheet API authentication guide), and it keeps backups running when people change roles, since deactivating a user revokes their tokens (Smartsheet Help).

If your plan sets an expiry on access tokens (Smartsheet Help), generate a new token when it expires and connect again.

Your data

Backups go to the folder or SharePoint library you choose. Rowtrace sends no usage data, and it checks your trial code on your computer. The one thing it sends to Eskley is the status email, and only if you turn it on in Settings: the schedule names, outcomes, counts and times that email reports, and the addresses to send it to, go to Eskley's sending service, which mails them to you. That service never receives your token, sheet contents, file names or paths. Your backup is plain folders and files you can open in File Explorer and Excel.

Signed by Eskley LLC

Windows shows Rowtrace's publisher as Eskley LLC. To check, right-click Rowtrace.exe, choose Properties, and open Digital Signatures. If your organization only allows approved software, your IT team approves it once.