Security
Built for data somebody would be upset to lose
Your operational exports are not a toy dataset. Here is how Dashful keeps them separated, governed and out of places they do not belong.
Separation between tenants
Every tenant gets its own database schemas. Queries run with the search path set to just those, so an unqualified table name can only ever resolve inside your own data, and a query naming any other schema is rejected outright.
- Uploads and datasets live in schemas belonging to one tenant.
- Every row carries its tenant, and every read filters on it.
- The tenant is required, not assumed — a query can never run without one.
Permissions you control
Roles are a name and a set of permissions, held in the database you can see. Built-in roles are seeded and editable; custom roles are assembled from the same catalog, and a permission the catalog does not define cannot be granted.
- Access is checked per feature and per individual report.
- Nothing is cached across a request, so a revoked role takes effect immediately.
- Directory groups from your identity provider map onto roles.
Credentials in a vault
A connection row holds only a reference. The value is resolved server-side at sync time and is never returned to the browser, put into an AI prompt, or written to a log.
- Encrypted with a key that lives outside the database, so a dump alone reveals nothing.
- Or point Dashful at your own secret manager, and nothing sensitive touches our tables.
- Credentials are proved against the provider before they are stored.
What the AI can and cannot do
The agent prepares data and proposes structure. It does not write the SQL your dashboard runs, and the analyst attached to a dashboard is read-only and scoped to that dashboard's tables.
- Dashboards are deterministic specs, so results do not drift with a prompt.
- The dashboard analyst cannot change a dataset or a dashboard.
- Bring your own Anthropic, OpenAI or Google key, or use ours.
Hosted, or inside your network
The same build runs both ways. Installed in your environment, people sign in with your own OIDC provider and permissions are answered from your own database — the same answer, with our control plane unreachable.
- Connect databases with a read-only role and read-only drive scopes.
- Your identity provider, your network, your data residency.
- Deleting a tenant drops its schemas and every row belonging to it.
Bring your security team
Happy to walk through any of this in detail, including the parts that are not on this page.