Security at EmbedPortal
How data flows through EmbedPortal, what we store, what we never store, and the controls you can use to protect your portal.
How an embedded dashboard loads
Viewer signs in
Through an email invite or your identity provider using SAML SSO. MFA is available on Professional and Enterprise plans.
EmbedPortal checks access
It works out which organization, groups and dashboards the viewer may see, and which row-level security values apply.
A short-lived view is requested
EmbedPortal asks your BI tool for a signed, short-lived embed token or URL that carries the viewer's filters.
Your BI tool renders the dashboard
The dashboard and its data load from your BI tool directly in the viewer's browser. EmbedPortal does not proxy or copy that data.
What we store and what we do not
We store account details (name, work email, organization, role), configuration (dashboard IDs, row-level security rules, branding, tenant mapping), audit records and basic operational telemetry.
We do not store the rows, columns or cells inside your dashboards, your warehouse credentials or your BI tool’s source data. We do not sell personal data or use it to train models.
Retention: account and configuration data are kept while the account is active plus 30 days, audit logs for 13 months by default, telemetry for 30 days, and backups on a rolling 35-day cycle. Details are in the privacy policy.
Security controls in the product
Encryption
Data in transit is encrypted with TLS 1.3. Data at rest is encrypted with AES-256.
Row-level security
One dashboard serves many tenants. Each viewer's values are applied by your BI tool every time a dashboard loads.
Single sign-on
SAML 2.0 with group mapping from identity provider claims.
Session controls
Auto-logout after 5 minutes to 30 days of inactivity, access re-verification and active session revocation.
Audit log
Logins, views, exports, impersonation sessions and admin changes are recorded. Audit logs are kept for 13 months by default.
Tenant isolation
Each customer is a separate organization with its own users, groups, branding and data rules.
Certifications and infrastructure
EmbedPortal does not currently hold SOC 2, ISO 27001 or HIPAA certifications. If your organization needs a security questionnaire answered, email security@atspark.com.
The service runs on AWS. Subprocessors are AWS (hosting), Cloudflare (DNS and edge), Stripe (billing), Postmark (email) and Sentry (error monitoring). We post an update at least 30 days before adding a subprocessor that handles personal data.
Enterprise customers can choose a dedicated instance or self-host on AWS.
Found a vulnerability?
Email security@atspark.com with the details. Please do not test against other tenants or access data that is not yours.
Security questions
Does EmbedPortal store our dashboard data?
No. The rows, columns and cells inside your dashboards are served by your BI tool to the viewer's browser. EmbedPortal stores account, configuration, audit and basic operational data.
Is EmbedPortal SOC 2 or ISO 27001 certified?
Not yet. EmbedPortal does not currently hold SOC 2, ISO 27001 or HIPAA certifications. We will say so on this page if that changes.
Where is EmbedPortal hosted?
On AWS, with Cloudflare for DNS and edge protection. The full list of subprocessors is in the privacy policy.
Can we run EmbedPortal in our own environment?
Enterprise plans include a dedicated instance and a self-hosted option on AWS.
How do I report a security issue?
Email security@atspark.com with the details. Please follow responsible disclosure and do not test against other tenants.
Questions about your requirements?
Talk to us before you share sensitive data.