Analytics for thousands of customers. Each sees only their own.

Row-level security, SSO, roles and a full audit trail — the controls that let you embed analytics across every tenant without a data leak, and prove it to the security teams that sign off your deals.

one query on subscriptions · two signed-in customers
Signed in as · Acme Corp
AccountMRRSeats
Acme · West€18.2k240
Acme · EMEA€11.6k154
hidden by RLS▪▪▪▪▪
hidden by RLS▪▪▪▪▪
✓ sees Acme rows only
Signed in as · Globex
AccountMRRSeats
hidden by RLS▪▪▪▪▪
Globex · Core€22.9k318
Globex · Labs€7.4k96
hidden by RLS▪▪▪▪▪
✓ sees Globex rows only

same query, same dashboard — each customer sees only their own rows. One deployment, every tenant isolated.

Defense in depth

Security in layers. Not a checkbox.

From how users sign in to where the bytes live, every layer is governed — so access is safe by default, not bolted on afterwards.

Layer 01 · Identity
Single sign-on

Users sign in through your identity provider — no separate passwords to manage or leak. Provisioning and de-provisioning follow your directory.

SAMLOIDCSCIM provisioning
Layer 02 · Access
Roles & permissions

Roles decide who can view, build or share — down to a single dashboard. Least-privilege by default; elevated access is explicit.

Role-based accessPer-object scopesLeast privilege
Layer 03 · Data
Row-level security

Rules bind each user to their own rows, so one deployment safely serves every tenant. This is what makes embedded analytics safe at scale.

Row-level rulesTenant isolationColumn masking
Layer 04 · Infrastructure
Encryption & residency

Data is encrypted in transit and at rest, with EU data-residency options — so where your data lives is a choice you get to make.

TLS in transitEncrypted at restEU residency

Nothing goes unseen

Every action, on the record.

Who viewed what, who changed a definition, who exported a report — logged, immutable, and yours to export.

audit trail · liveimmutable · exportable
TimeActorActionScope
08:14c.meyer@acmevieweddashboard · Revenue
08:14systemapplied RLStenant · Acme
09:02a.lopez@acmeexportedreport · Churn Q3
09:37your Toucan leadsignedmetric · active_customer v4
10:05j.wei@globexdeniedrow · out of tenant scope

When a buyer's security team asks "who can see this?", the answer isn't a promise — it's a log you can export.

Built to pass review

Ready for your buyers' security team.

The controls, certifications and data-residency options enterprise buyers expect — so security review speeds your deal up instead of stalling it.

GDPREU compliant
EU residencydata stays in EU

Embed with confidence — secure by default.

Start free →

Want it set up and governed for you? Hire a Crew →