Step-by-step guide Claude Code for Non-Developers: internal tool from a spreadsheet →
Most businesses run on at least one spreadsheet that only one person really understands. It works until that person is on holiday, someone types over a formula, or a price changes in one tab but not another. Claude Code, Anthropic's AI assistant for building software, now lets people who have never written code turn that file into a web tool their team opens from a private link. It also makes it easy to build something that leaks. We tested the whole route for our new guide, on a fictional kitchen fitter's quote workbook with five hidden mistakes. Here's what worked.
Why a spreadsheet is worth replacing
A spreadsheet never tells you it's wrong. It just gives a number. In Ray Panko's review of field audits, presented to the European Spreadsheet Risks Interest Group in 2000, the audits from 1997 onwards found errors in 91% of the 54 real spreadsheets they checked (Panko, EuSpRIG 2000). The data is old, but the pattern is familiar: hidden columns, numbers typed over formulas, settings that nothing uses.
A purpose-built tool doesn't make mistakes impossible, but it leaves them fewer places to hide. The rules live in one readable file, users can only fill in the inputs, and every change is checked against answers you already trust.
Is Claude Code the right tool for yours?
Not every spreadsheet should become an app:
| If what you need is | Use | Why |
|---|---|---|
| A one-off sum or a formula fix | Claude chat, or the spreadsheet itself | There's no tool to maintain |
| A shared list that many people edit all day | A no-code database | Logins, permissions and history come built in |
| A calculator or checker your team uses daily, with your own rules | Claude Code | You own it, it follows your rules exactly, and it can be tested |
| A public form, or anything that stores customer or patient data | A stricter build | It needs logins, backups and legal care that a calculator doesn't |
The best first build calculates from your rules but stores nothing: quotes, estimates, planning, commission sums. Non-developers already do this: in July 2025 Anthropic reported that its legal team had built prototype phone-tree tools to route colleagues to the right lawyer, and that its growth marketers built a workflow that turns CSV files of ads into new variations (Anthropic, July 2025).
Set up so every mistake can be undone
Claude Code works inside one folder on your computer: it reads the files there, writes new ones and runs commands. You talk to it in plain language in the Code tab of the Claude desktop app, which needs a paid plan. Five habits keep it safe:
- Switch off model training first. On the Free, Pro, Max and Ultra plans, Anthropic trains on your data only if a privacy setting is on, and then keeps it for five years rather than 30 days. Team and Enterprise plans aren't used for training (Claude Code data usage documentation, checked November 2026).
- Give it its own folder and a safe copy. Never point it at your Documents folder or desktop. Work on a copy of the spreadsheet with customer names, addresses and notes deleted, and keep the original somewhere else.
- Pick a careful mode. Plan mode while Claude thinks, Accept edits while it builds, and never Bypass. Check the mode selector every session, because current versions start terminal sessions in Auto.
- Make save points. Pressing Esc twice rewinds Claude's file edits, but not everything a command changed. Ask Claude to record the folder with Git after every step that works.
- Write house rules. Claude reads a file called
CLAUDE.mdat the start of each session. Ours said: stay in this folder, treat the spreadsheet as read-only, and ask before installing anything or contacting another website.
Map the spreadsheet before you build anything
The most useful thing Claude does happens before any building. Ask it to read the workbook and write a plain-English map: every input, every rule and the cell it lives in, every output, and anything odd, with how sure it is.
Our fictional Brink Kitchens workbook has three working tabs, twelve logged quotes and five planted faults. A clean Claude Code session (version 2.1.296) wasn't told about them. It opened the file without installing anything and, in about two minutes, found all five, listed seven minor oddities and asked thirteen numbered questions.
| What Claude reported | What it really was |
|---|---|
| Tall units are timed with the wall-cabinet hours | A formula copied one row off |
| The composite worktop price is typed into a formula, at last year's price | Every composite quote this year was too cheap |
| A 10% waste allowance sits in a hidden column, while the prices tab says 12% | A setting change that never took effect |
| Travel fees are listed including VAT, then VAT is added on top | VAT charged twice on travel |
| One logged total doesn't add up | A discount typed over the formula |
Claude knows what the sheet says; only you know what your business means, so answer every question. One of ours settled the key decision: copy the spreadsheet exactly first, mistakes included, and fix things one at a time afterwards.
Turn past results into tests
Your past quotes are the best test you'll ever have: real inputs, and the answers your business actually sent. Claude turned the log into a file of known answers, eleven usable and one exception, and the build centred on a check that replays them all. It earned its keep:
- Rounding traps. Excel always rounds an exact half up, and 11.0 m of worktop plus 10% waste must buy 12.1 m. Plain computer arithmetic gets both wrong by a hair, so each now has its own check.
- A test of the test. Unprompted, Claude fed the check a wrong price for one material. All three quotes using it failed, proving the check catches real mistakes.
- A wrong answer, not a wrong tool. When we planted a digit swap in one known answer, Claude changed nothing. It showed that the answer itself was wrong and waited for our OK.
After the second build step, all eleven past quotes matched the spreadsheet to the cent, and the finished tool passes 209 checks. Only then did the fixes start, one step each, while the old quotes kept checking against the spreadsheet's old values. That way, every change in a total comes from a fix you chose.
Keep the technology boring, too: plain HTML, CSS and JavaScript, no add-on packages, nothing stored and nothing sent. Every extra part is one more thing to secure.
Ship it safely: a link only your team can open
This is where AI-built apps usually go wrong. A study of 200 publicly deployed apps built with Claude Code or Lovable found at least one vulnerability in 91% of them. About two thirds of the flaws were rated critical or high, and broken access control showed up in 64% of the apps. Better prompts reduced the flaws but never removed them all, and the authors conclude that generated apps "should be treated as prototypes and not casually exposed to real users" (Deng, Fan and Meng, arXiv, September 2026, a preprint not yet peer reviewed).
Before publishing, we had Claude review its own work in plain language: who could open it, what it accepts, secrets, outside requests, stored data and which files belong online. Four findings apply to any tool like this:
- The built-in review may not run. Claude Code's
/security-reviewcompares your work with a copy on GitHub, so in our local-only folder it stopped with an error. The plain-language check found a real bug instead: entries like1e3were quietly read as 1,000. - A web page can't hide its prices. Anyone who can open the address can read every file behind it, the prices file included. The lock must sit in front of every file; a password box inside the page protects nothing.
- Publish only the tool. The project folder also holds your notes, the known answers and a hidden save-point history, so Claude made a separate publish folder.
- Printouts can leak your folder path. A browser may print a double-clicked file's address, user name included, in the margin of a PDF. Removing the page margin fixed it.
A synced team folder is enough if everyone quotes at a computer. Brink Kitchens' owner quotes on an iPad, so on 9 November 2026 we tested a private link behind Cloudflare Access, where only listed email addresses can sign in, each with a one-time code. An empty placeholder went up first, so the brief unlocked moment exposed nothing. Claude then requested every file without logging in, including the prices file, odd spellings and plain http: 152 requests, and every one landed on the sign-in page. Two warnings: Cloudflare's account-wide lock switch would also lock any other live site on the same account, and deleting the project left its access rule behind.
Change prices without breaking it
In the tool, a price change is a routine: you describe it in plain words, and Claude updates the prices file with a note of the old value, adds a check worked out by hand, runs every check, shows you a few past quotes before and after, and makes a save point without publishing. Our test change, a new composite worktop price, took Claude 55 seconds, and the eight past quotes without composite worktops didn't move. Run old and new side by side for a week or two before you retire the spreadsheet.
When to stop and bring in help
Choose a different route when the next tool involves any of these, because each brings logins, stored data, backups and legal duties a calculator never has:
- Customer or patient data, or a form the public fills in.
- Payments.
- Many editors changing the same records at once, where a no-code database is often the better start.
- Connections to your accounting or booking system.
The whole route, step by step
We've written the full method up as Claude Code for Non-Developers, spreadsheet-tool edition. Its 24 pages follow the Brink Kitchens build from set-up to private link, with our prompts, timings and problems, plus a prompt library and a pre-publish checklist. Claude's working time for the whole build was 34 minutes, yet the guide plans a whole weekend for a first build, because reading every answer and checking every step is the point. Our other fast-track guides are in the guides catalogue.
Whichever way you go, the order stays the same: map it, prove it, then lock it. If you'd rather have it built for you, Neurova AI builds internal tools and AI systems to healthcare standards: tested against your own data and private by default.
Frequently asked questions
Do I need to know how to code to build a tool with Claude Code? No. Claude Code writes and runs the code. Your job is to describe clearly what the tool must do, answer its questions about your business and check the results against answers you know are right. You do need a paid Claude plan and a computer where you are allowed to install apps.
Which spreadsheets are a good fit for a Claude Code tool? Spreadsheets that calculate from your own rules but store nothing, such as quotes, estimates, planning and commission sums. A shared list that many people edit all day is usually better served by a no-code database. Anything that stores customer or patient data, takes payments or lets the public fill in a form needs a stricter build.
Is it safe to let Claude Code read my business spreadsheet? Work on a copy with customer names, addresses and notes removed, in a folder that holds nothing else. On the Free, Pro, Max and Ultra plans, switch off model training in the privacy settings first: with it on, Anthropic keeps your data for five years, and with it off, for 30 days. Team and Enterprise plans are not used for training.
How do I share an internal tool without making it public? Put a login in front of every file, not a password box inside the page, because anyone who can open the address can read the files behind it. In our test we used Cloudflare Access with a list of named email addresses and one-time codes, and 152 requests made without logging in all landed on the sign-in page. If everyone works at a computer, a shared team folder also works.