Handover Ledger

Overview

A PIN-gated dashboard over a private Google Sheet, built for the handover period of a business sale. The seller keeps editing the spreadsheet as normal; the buyer gets a readable, downloadable view of it and can change nothing. Every login, view and download is recorded.

The problem

During the handover of a business, the buyer needs to see the books and the seller needs them to stay exactly as they are. Sharing the spreadsheet directly means granting edit access or fielding export requests by hand; publishing it means anyone with the link can read it.

The approach

The spreadsheet stays the source of truth and is never published — the app authenticates to Google through a service account with viewer permission and renders what it reads. Nothing is written back to the sheet. Pages revalidate on a five-minute window, so the seller's ordinary edits show up without a redeploy, and the buyer signs in with a name and a shared six-digit PIN behind a signed, httpOnly session cookie.

Outcome

• The seller's workflow did not change at all: they keep editing the same spreadsheet, and the site follows within five minutes.
• Downloads are proxied from Drive's own export endpoint as .xlsx and .pdf, so the buyer can take a copy without being given access to the file.
• Every login, view and download is logged with name, IP and timestamp, behind an interface structured so the backend can be swapped from runtime logs to durable storage without touching the call sites.
• The privacy, terms and FAQ pages are readable without signing in — a visitor should be able to see what the site records about them before handing over a name and a PIN.
• The security tradeoffs are written down rather than glossed: one shared PIN cannot attribute access to a person, and the login throttle alone would not stop a determined brute force. Both were acceptable for a short handover between two parties who trust each other, and both are stated as unacceptable outside it.

What it does

• PIN-gated read-only view

  Name plus a six-digit PIN, a seven-day signed session, and no path to edit anything.

• Tabbed report

  Each sheet tab rendered as its own table behind sticky tab navigation.

• Proxied downloads

  Spreadsheet and PDF exports served through the app, so the underlying file is never shared.

• Audit log

  Structured records of every login, view and download, with name, IP and timestamp.