Embedded analytics, distilled

Every dashboard,
one portal.

Embedportal is the glass your customers look through to see the dashboards you’ve already built in Tableau, Power BI, QuickSight and Metabase. White-labeled, row-level secure, SSO-ready — in under an hour.

BI vendors
5+
Tenants / org
Time to first embed
≤ 1 hr
White-label
per tenant
portal.acme.io / revenue
RLSSSO
Power BI Ops · Latency by region
QuickSight CS · Retention cohort
Tableau Revenue · Q3’26 RLS: org_acme_◦_emea
ARR $4.28M ▲ 12.4%
NRR 117% ▲ 4.1%
Churn 1.8% ▼ 0.3%
jwt · iat=2026-04-17T09:14Z rows=1,284 · scoped
01tenant: acme
02source: tableau
03theme: custom
Embeds from
  • Tableau
  • Power BI
  • QuickSight
  • Metabase

The thesis

A portal.
Not a pipeline.

Your data is already where it lives — BigQuery, Snowflake, Redshift, Postgres. Your dashboards are already where they’re built — Tableau, Power BI, QuickSight. We don’t move any of that.

Embedportal is the glass in between. The one surface where every customer-facing dashboard shows up, themed to your brand, scoped to the right rows, behind your auth.

See what’s inside →
SPEC / embedportal v2.14 · 2026-04
Embeds
✓ every major BI vendor
Branding
✓ colors, logo, typography
RLS
✓ by tenant, region, role, custom
Auth
✓ JWT SSO · anonymous · OAuth
Audit
✓ every view, every filter

Features

Everything an embed
needs. Nothing it doesn’t.

Security

Scoped at the row.
Signed at the edge.

Every embed is served behind a short-lived JWT signed by your backend. Row filters are forwarded into the BI vendor’s native RLS — so Tableau enforces Tableau’s rules, Power BI enforces Power BI’s, and we just make sure the right claims reach them.

  • Short-lived signed tokens (≤ 5 min)
  • Tenant isolation per organization
  • TLS 1.3 in transit, AES-256 at rest
  • Immutable audit log, streamable to your stack
  • SSO via SAML, OIDC, JWT
  • Content Security Policy + frame-ancestors pinning
embed.ts backend / api
// one token. the right rows. every vendor.
const token = sign({
  tenant:  session.orgId,
  user:    session.userId,
  rls: {
    region: session.region,      // → Tableau UserFilter
    role:   session.role,        // → Power BI EffectiveIdentity
    plan:   session.plan,        // → QuickSight TagSession
  },
  exp: now() + 300,         // 5-minute ceiling
}, process.env.EMBED_SECRET)

return { url: `https://portal.acme.io/d/revenue?t=${token}` }

How it works

Under an hour,
front to back.

  1. 01

    Connect your BI

    Paste the service-account credentials for Tableau, Power BI or QuickSight. We verify the link, we never copy the data.

    ≈ 4 min

  2. 02

    Define tenants & RLS

    One JSON: tenants, roles, filter attributes. Embedportal routes each attribute into the right vendor-side rule automatically.

    ≈ 20 min

  3. 03

    Drop in the component

    One React component or iframe. Pass dashboardId and tenantId. Ship.

    ≈ 8 min

White-label

Looks like
yours.

A palette, a font, a logo — and every dashboard in the portal adopts your brand. Each organization keeps its own theme; users switch tenants without ever seeing ours.

acme.yourdomain.com

Dashboards / Revenue

Revenue

MRR$348k
Customers1,284
NRR117%

Use cases

Built for the teams
doing the hard part.

FOR

SaaS products

Ship a customer-facing analytics surface without rebuilding your BI in React. Keep the charts your analysts already trust.

→ case study: Fintech with 400 tenants
FOR

Data & analytics teams

Own the model in dbt, own the viz in Tableau, own the distribution in Embedportal. No duplicated dashboards, no duplicated truth.

→ reference: atSpark + Embedportal
FOR

Internal portals

One URL for every dashboard across every vendor. Your ops team stops hunting through bookmarks, your security team stops hunting through accounts.

→ guide: Migrating from shared logins
FOR

Agencies & consultancies

Deliver reporting portals per client, themed per client, scoped per client — from a single Embedportal workspace.

Pricing

Priced by plan.
Not by seat.

Every plan — Starter to Enterprise — includes unlimited dashboards, unlimited users, and unlimited viewers.

Starter

Basic embedding.

$249/mo
  • 1 BI integration
  • Unlimited dashboards
  • Unlimited users & viewers
  • Row-level security
  • AES-256-GCM encryption
  • Custom branding
Start with Starter

Enterprise

Fully managed.

Custom
  • Everything in Professional
  • Dedicated instance
  • Metabase hosting included
  • Self-hosted (AWS / Azure / GCP)
  • API access
  • Custom SLA & dedicated support
Contact sales

Feature comparison

Every feature, plan by plan.

Features Starter $249/mo Professional $499/mo Popular Enterprise Custom
BI integrations
Power BI, Tableau, Metabase, QuickSight…
1 Unlimited Unlimited
Dashboards / users / viewers Unlimited Unlimited Unlimited
Row-level security (RLS)
AES-256-GCM encryption
Custom branding (logo, domain, email)
2FA authentication
Audit trails & login history
SSO / SAML + API access
Dedicated instance + Metabase hosting
Self-hosted (AWS / Azure / GCP)

FAQ

Reasonable
questions.

Do you store or move my data?

No. Your data stays inside your BI vendor’s stack (and, behind that, your warehouse). Embedportal only routes signed tokens and renders the vendor’s embed.

Which BI vendors do you support today?

Tableau (Server, Cloud, Public), Power BI, QuickSight and Metabase. Additional vendors are on the roadmap — ask us.

Can we host it ourselves?

On the Enterprise plan, yes — single-tenant deployments into your VPC, in your region. Everyone else gets the managed cloud.

How does row-level security actually work?

You define rules in one place. We translate them into Tableau User Filters, Power BI Effective Identities, or QuickSight session tags — whichever vendor the dashboard lives in. Every request is scoped, logged, and time-bound.

Is there a free trial?

Yes — a 14-day free trial on the Professional plan, no credit card required. Existing atSpark customers can upgrade to Embedportal at no additional cost.

How is this different from atSpark?

atSpark is the full analytics platform: connectors (Airbyte), modeling (dbt), warehouse (BigQuery) and embedded viz. Embedportal is just the embedding and distribution layer, pointed at BI tools you already own.

Ship embedded analytics.
This week.

Fourteen days, no card. Bring a dashboard, leave with a portal your customers actually want to visit.

no card · cancel any time · atSpark customers: free upgrade