◎ Embedded analytics, distilled
Every dashboard, one portal
Embedportal is the glass your customers look through to see the dashboards you’ve already built in Tableau, Power BI, QuickSight and Metabase. White-labeled, row-level secure, SSO-ready — in under an hour.
VENDORS
LABEL
- Tableau
- Power BI
- QuickSight
- Metabase
A portal.
Not a pipeline.
Your data is already where it lives — BigQuery, Snowflake, Redshift, Postgres. Your dashboards are already where they’re built — Tableau, Power BI, QuickSight. We don’t move any of that.
Embedportal is the glass in between. The one surface where every customer-facing dashboard shows up, themed to your brand, scoped to the right rows, behind your auth.
See what’s inside →
- Embeds
- ✓ every major BI vendor
- Branding
- ✓ colors, logo, typography
- RLS
- ✓ by tenant, region, role, custom
- Auth
- ✓ JWT SSO · anonymous · OAuth
- Audit
- ✓ every view, every filter
Everything an embed
needs. Nothing it doesn’t.
01
Multi-vendor embedding
Your data is already where it lives — BigQuery, Snowflake, Redshift, Postgres. Your dashboards are already where they’re built — Tableau, Power BI, QuickSight. We don’t move any of that.
Tableau
Power BI
QuickSight
Metabase
02
Row-level security
Define rules once: by tenant, region, role, or any attribute on the JWT. We forward them into every BI vendor’s native RLS mechanism.
03
White-label branding
Theme colors, surfaces, borders, typography — all via organization settings. Each tenant looks like it was built for them.
04
Multi-tenant orgs
A single Embedportal instance powers unlimited organizations, each with its own dashboards, branding, users, audit trail, and auth policy.
acme
globex
initech
umbrella
hooli
05
Authenticated & public
Gate dashboards behind your existing SSO or publish signed public links with scoped data and expiry.
Your data is already where it lives — BigQuery, Snowflake, Redshift, Postgres. Your dashboards are already where they’re built — Tableau, Power BI, QuickSight. We don’t move any of that.
06
Audit & observability
Every view, filter, export — logged, searchable, streamable to your SIEM or data warehouse.
Scoped at the row.
Signed at the edge.
Every embed is served behind a short-lived JWT signed by your backend. Row filters are forwarded into the BI vendor’s native RLS — so Tableau enforces Tableau’s rules, Power BI enforces Power BI’s, and we just make sure the right claims reach them.
- Short-lived signed tokens (≤ 5 min)
- Tenant isolation per organization
- TLS 1.3 in transit, AES-256 at rest
- Immutable audit log, streamable to your stack
- SSO via SAML, OIDC, JWT
- Content Security Policy + frame-ancestors pinning
// one token. the right rows. every vendor.
const token = sign({
tenant: session.orgId,
user: session.userId,
rls: {
region: session.region, // → Tableau UserFilter
role: session.role, // → Power BI EffectiveIdentity
plan: session.plan, // → QuickSight TagSession
},
exp: now() + 300, // 5-minute ceiling
}, process.env.EMBED_SECRET)
return { url: `https://portal.acme.io/d/revenue?t=${token}` }Under an hour,
front to back.
01
Connect your BI
Paste the service-account credentials for Tableau, Power BI or QuickSight. We verify the link, we never copy the data.
≈ 4 min
02
Define tenants & RLS
One JSON: tenants, roles, filter attributes. Embedportal routes each attribute into the right vendor-side rule automatically.
03
Drop in the component
One React component or iframe. Pass dashboardId and tenantId. Ship.
≈ 8 min
Looks like
yours.
A palette, a font, a logo — and every dashboard in the portal adopts your brand. Each organization keeps its own theme; users switch tenants without ever seeing ours.
Dashboards / Revenue
Revenue
Built for the teams
doing the hard part.
FOR
SaaS products
Ship a customer-facing analytics surface without rebuilding your BI in React. Keep the charts your analysts already trust.
→ case study: Fintech with 400 tenants
FOR
Data & analytics teams
Own the model in dbt, own the viz in Tableau, own the distribution in Embedportal. No duplicated dashboards, no duplicated truth.
→ reference: atSpark + Embedportal
FOR
Internal portals
One URL for every dashboard across every vendor. Your ops team stops hunting through bookmarks, your security team stops hunting through accounts.
→ guide: Migrating from shared logins
FOR
Agencies & consultancies
Deliver reporting portals per client, themed per client, scoped per client — from a single Embedportal workspace.
→ template: Client report kit
Reasonable
questions.
Do you store or move my data?
No. Your data stays inside your BI vendor’s stack (and, behind that, your warehouse). Embedportal only routes signed tokens and renders the vendor’s embed.
Which BI vendors do you support today?
Tableau (Server, Cloud, Public), Power BI, QuickSight and Metabase. Additional vendors are on the roadmap — ask us.
Can we host it ourselves?
On the Enterprise plan, yes — single-tenant deployments into your VPC, in your region. Everyone else gets the managed cloud.
How does row-level security actually work?
You define rules in one place. We translate them into Tableau User Filters, Power BI Effective Identities, or QuickSight session tags — whichever vendor the dashboard lives in. Every request is scoped, logged, and time-bound.
Is there a free trial?
Yes — a 14-day free trial on the Professional plan, no credit card required. Existing atSpark customers can upgrade to Embedportal at no additional cost.
How is this different from atSpark?
atSpark is the full analytics platform: connectors (Airbyte), modeling (dbt), warehouse (BigQuery) and embedded viz. Embedportal is just the embedding and distribution layer, pointed at BI tools you already own.
Ship embedded analytics.
This week.
Fourteen days, no card. Bring a dashboard, leave with a portal your customers actually want to visit.