Summary
On Feb 23, 2026, we’re rolling out a security enhancement that adds an additional entitlement check before sheet/report data can display in dashboards on another plan.
If you embed a sheet or report you own into a dashboard on another plan (for example, a customer account) and Safe Sharing is enabled on your plan, that widget may appear blank and show “Data access restricted” unless the viewer is authorized (via your Safe Sharing allowlist or explicit access to the source asset).
Update (Feb 23, 2026): This enhancement is now live for all organizations with Safe Sharing enabled.
________________________________________________________________________________________________________________________
What’s changing
Starting Feb 23, 2026, for organizations with Safe Sharing enabled, when a sheet or report owned by your plan is embedded as a widget in a dashboard that lives on a different plan, the embedded data will only display if the dashboard viewer is authorized through one of the following:
- Their domain (or account) is allowed via your organization’s Safe Sharing settings, or
- They have explicit access to the underlying source asset (the sheet/report).
If a viewer isn’t authorized, the widget will appear blank and display: “Data access restricted.”
Who is impacted
This may impact you if:
- Safe Sharing is enabled on your plan, and
- You own sheets/reports that are embedded in dashboards created in another plan (for example, a customer account).
Internal dashboards will continue to work as expected.
What you can do now
This change only impacts cross-plan dashboards where the embedded sheet/report is owned by a plan with Safe Sharing enabled.
- If you do not want external visibility: no action is needed — widget data will be blocked for unauthorized viewers automatically.
- If you want external parties to continue viewing embedded data: review your Safe Sharing allowlist and ensure the customer domain/account is included (or grant direct access to the underlying source sheet/report).
- If a customer reports a widget is “broken”: this may be the issue; add their domain/account to your allowlist (or share the source asset explicitly) to restore visibility.
What customers will see
If they aren’t authorized, the embedded widget will be blank with the message “Data access restricted.”
________________________________________________________________________________________________________________________
Any questions? Feel free to post in the comments below!
