A proof of concept that renders a chart has proved that a chart renders. In our experience the four things that kill embedded analytics in production stay invisible in a demo dataset, and reaching them is the job.
Tenant scoping, the identity handoff, first render at real row counts, and theming. A vendor demo answers all four in the affirmative, which is what a demo is built to do.
One Published POC Repository, and Most of It Sits Around the Reports
Searching for this topic returns mostly vendor landing pages and definitions. One result is an actual artefact: a public repository of an embedded analytics proof of concept, MIT licensed, built against Power BI.
The inventory below is observable fact: two application modules, four separate report files, two datasets and a contents page that covers licensing twice. The repository does not record what those items were for, so the readings that follow are ours. (robinrizvi/embedded-analytics-poc on GitHub, read 20 August 2026.)
Three details are worth pausing on. There is a backend, described in the README as Java and Spring using MSAL and the Power BI administration REST APIs, so this proof of concept was not a browser-only exercise. There are four report files rather than one, and their names distinguish a plain sales report, a by-tenant report, a MongoDB report and a REST report.
There are also two spreadsheets, one of them named for tenancy. Why a second file exists is not recorded anywhere in the repository. The documented fact is narrower: the tenant case has a dataset of its own.
Test One: Break the Tenant Boundary on Purpose
The first test is not whether the right rows appear. It is whether the wrong ones can be made to appear.
Write a query that omits the tenant filter and run it through the same path your product will use. Then pass a token scoped to tenant A and request a resource belonging to tenant B. The pass condition is that the platform refuses both, on its own, without your application code catching it first.
If the answer is that your developers must remember to add a filter, you have learned the most important thing this POC can teach you, and you have learned it in week one rather than after a customer finds it. Our fuller treatment of the paths involved is in embedded analytics security, and row-level security defines the mechanism.
Test Two: Mint the Token From Your Own Backend
Take the sample application out of the picture and issue the token from the service that will actually issue it in production.
The questions that matter are unglamorous, and there are four of them.
Token lifetime. Refresh behaviour when a user leaves a dashboard open over lunch. Expiry mid-interaction, and which of your services needs credentials it does not currently hold.
The published repository is a useful reality check here: its backend module lists MSAL and administration APIs among its technologies. A proof of concept that ran entirely in the browser would carry none of that and could still produce a working chart.
Test Three: Load the Real Row Count, Not the Sample
Demo datasets are small, low in cardinality and single-tenant. Each property hides a failure of its own.
Load a copy of production volume, or the volume you expect in eighteen months, whichever is larger. Measure first render cold, then measure the same view after the cache is warm, and record both numbers separately because your customers will experience both.
Then check what a high-cardinality filter does. A dropdown with a handful of options in the demo can become a dropdown with thousands in your largest account, and past some threshold that is a different component. Take the threshold from your own data rather than from ours, because we have not measured yours.
Test Four: Make It Look Like Your Product, Not Like Theirs
Theming is treated as a finishing task and it is a POC task, because the ceiling is set by the platform rather than by effort.
Try to change the things you will certainly want to change: the type scale, the border radius, the empty state, the loading state and the error state. The last three are where most platforms stop, and an error state carrying a vendor's name reaches your customer as a support ticket about a product they believe is yours.
Write down which of your brand decisions you could not reach. That list is the honest output of this test, and it does not get shorter after purchase.
Timebox It, and Write the Exit Condition Before You Start
A POC that cannot end in a no is a demo you paid for with your own engineering time.
Decide up front what result would stop you: a tenant boundary that leaks, a token flow your platform cannot host, a first render past a number you name now, or a theming ceiling you can point at. Write those four thresholds down before the first commit, because after two weeks of work the temptation to move them is real and nobody in the room will object.
The published repository's history is an anchor for scale rather than a rule: five commits between 24 February and 1 March 2025, in a repository that contains a backend, four report files and a licensing section. How much work happened outside those commits is not visible.
Evaluating a Vendor Is a Different Job From Running a POC
These two get merged and they answer different questions.
Evaluation asks whether a named product fits, and it is mostly document work: developer documentation, the pricing page, the security documentation, the named case studies. It narrows a long list to a short one, and it does not require any code.
A POC asks whether a shortlisted product survives your data, your identity model and your interface. Run the evaluation first, on paper, using the procedure in the embedded analytics guide, then spend the engineering time on the one or two survivors.
The output of a good POC is not a working demo. It is four written answers, two of which you would rather not have received, and a list of the brand decisions the platform would not let you make. Take that list into any embedded analytics product conversation and it will be a shorter conversation.
Where to go next
- Embedded analytics security: the paths to the data, which is what test one probes.
- Embedded analytics build cost: what the published estimates price, and the seven components behind any honest total.
- Embedded analytics guide: the routes to shipping it, and the vendor evaluation procedure this page defers to.
- Embedded Analytics articles: the full cluster index.
Ready to launch customer-facing analytics?
Stop losing customers to competitors with better analytics. Sumboard's customer-facing analytics platform lets you launch self-service dashboards in days, not months.
