Keep control of your data and access.
Connect to your existing data sources. Set customer-specific access in your backend. Data travels over SSL/TLS, and caching stays off unless you enable it.
No second copy of your data
We read your sources at request time. The only thing we ever hold is the cache, and it is off until you switch it on.
Every query is scoped by a token you sign
The filter comes from your backend, signed into the token. The browser cannot widen it.
Cache is off by default, with a TTL you set
Turn it on and a result lives exactly as long as the TTL you set, then we read your source again.
Read-only, over SSL/TLS
SSL/TLS between us and your database, and the documented setup is a user that holds read rights only.
How your data is protected.
- 01Your data is not stored on our servers
- Sumboard queries your data sources in real time rather than copying them. The one exception is the cache, which is off by default; cached data is removed when the TTL you set runs out. There is no second copy of your database on our side.
- 02Token filters are generated in your backend
- Your backend creates the filter server-side when it signs the embed token, and the documentation says plainly that the filter must never come from the frontend. A viewer cannot hand us a different value than the one your backend signed.
- 03One dashboard, scoped per viewer
- The same dashboard serves many users, and the filter carried by the token is applied automatically when that token is used. You maintain one definition rather than one copy per customer.
- 04Access is role-based, authenticated by token
- Role-based access controls decide what a person may reach, and embed access is authenticated by a JWT signed with your company secret key. We have no visibility into your dashboards unless you explicitly share them with us.
- 05Encrypted in transit, over SSL/TLS
- All transmission between Sumboard and your data sources uses industry-standard SSL/TLS. The recommended database setup is an SSL or SSH connection with a user that holds read rights only.
- 06European hosting, and the certifications behind it
- Servers are hosted in Europe on OVH infrastructure, and the platform inherits that provider's certifications and standards: ISO 27001 for information security management, SOC 1 and SOC 2, and GDPR for data protection.
Frequently asked questions.
How do you scope a dashboard to one customer?
Your backend signs an embed token that carries that customer’s filter values. We apply the filter on every query that token makes, and a filter placed in the token can only be changed through the token, not from the browser.
Which certifications cover the platform?
Servers are in Europe on OVH. The platform inherits OVH's ISO 27001, SOC 1 and SOC 2 and operates under GDPR.
Where does our data physically sit?
In your own data sources. Sumboard queries them in real time and keeps no copy. The only exception is the cache, which is off by default and expires on the TTL you set. Our own servers are in Europe, on OVH.
Send us your security questionnaire.
We answer it in writing, with a documentation reference behind each response.