Underwriting is not a private activity. A deal that goes anywhere gets examined by a lender, capitalized by investors, negotiated with a seller through a broker, and every one of those audiences needs to see the model. Just not the same model, and the industry's standard solution to that problem, exporting a spreadsheet and deleting tabs before each send, is a data breach with a delay on it, as anyone who has found their full waterfall forwarded down a broker chain can confirm.
Because the audiences genuinely need different things, and the differences are not cosmetic. The lender is underwriting their downside: debt structure, coverage through the weak years, the rollover schedule, sponsor assumptions they can stress. Your promote structure is irrelevant to them, and your LP economics are none of their business. The investor needs the opposite slice: equity, distributions, waterfall, their returns, presented cleanly enough to answer questions before they get asked. The seller and broker need almost nothing, credibility that the buyer is real and the analysis exists, the deal shell, and handing them more than that is negotiating against yourself with your own documents. One model, three legitimate views, and the promote in particular belongs in exactly one of them.
The spreadsheet-splitting workflow fails this problem twice. Operationally, because every version is a manual fork that goes stale the moment an assumption changes, and the lender is now reviewing Tuesday's deal while you are negotiating Thursday's. And structurally, because a spreadsheet's redaction is an honor system: hidden tabs unhide, deleted formulas leave traces, and a file, once sent, is forwarded at the recipient's discretion forever. The information you removed travels with the information you sent more often than anyone admits.
Scoped sharing inverts the model: one live deal, multiple views, each audience granted a slice, enforced server-side, which is the phrase doing the security work, since a view assembled on the server contains only what that audience is permitted, and there is nothing in the wire to unhide. The live part matters as much as the scoped part: assumptions updated once propagate to every audience's view, so the lender, the LP, and the broker are all looking at the current deal, and the conversation shifts from reconciling versions to discussing the property, which is the conversation that closes.
PropCalc™ ships this as Smart Share Links, four scoped views, lender, investor, seller, broker, off the single live model, promote never in the wire for the audiences who should not see it. There are live shared deals on this site, linked below, which are themselves scoped views, so the fastest way to evaluate the claim is to notice what the page you open is choosing not to show you.