[{"data":1,"prerenderedAt":702},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fgovernance":3,"docs-nav":499},{"id":4,"title":5,"body":6,"description":16,"extension":491,"meta":492,"navigation":494,"path":495,"seo":496,"stem":497,"__hash__":498},"docs\u002Fdocs\u002Fgovernance\u002FREADME.md","Security and governance",{"type":7,"value":8,"toc":482},"minimark",[9,13,17,24,36,41,81,85,373,377,448,452],[10,11,5],"h1",{"id":12},"security-and-governance",[14,15,16],"p",{},"How Tabularia decides who may see and do what, what it records, and how it keeps data\nquality and personal data in check. This page is the map, for whoever answers for an\ninstallation to the security team, the data owners or the data protection officer:\none line per topic and the page that covers it.",[14,18,19],{},[20,21],"img",{"alt":22,"src":23},"Folder settings of the folder Finance with two group grants and the list of capabilities","\u002Fmedia\u002Fguide\u002Fgovernance\u002Ffolder-settings-permissions.png",[14,25,26],{},[27,28,29,30,35],"em",{},"Permissions are granted on folders, to groups: ",[31,32,34],"a",{"href":33},"\u002Fdocs\u002Fgovernance\u002Fpermissions","Permissions",".",[37,38,40],"h2",{"id":39},"principles","Principles",[42,43,44,52,58,69,75],"ul",{},[45,46,47,51],"li",{},[48,49,50],"strong",{},"Everything lives in a folder, and the folder carries the permissions."," Flows,\ndatasources, connections, saved views, scripts and flow groups belong to a folder;\na permission granted on a folder holds for everything below it. There are only\ngrants, no deny rules.",[45,53,54,57],{},[48,55,56],{},"Nothing runs with more rights than a person has."," A run, a preview, an export, a\nquestion to the assistant and an API token act with the rights of the person behind\nthem. A schedule acts with the rights of whoever set it, checked again every time it\nfires.",[45,59,60,63,64,68],{},[48,61,62],{},"Credentials stay on the server."," Connection secrets are encrypted at rest with the\ninstallation's key (",[65,66,67],"code",{},"SECURITY__FERNET_KEY",") and never returned by the API; the\ngateway builds what a worker needs, never the browser.",[45,70,71,74],{},[48,72,73],{},"Free SQL reads only what it was given."," The SQL step of a flow, a SQL script and\nthe assistant name tables the gateway resolved and checked, and nothing else.",[45,76,77,80],{},[48,78,79],{},"Every action that matters leaves a trace",", and the trace outlives the account\nthat made it. Personal data in that trace expires on its own.",[37,82,84],{"id":83},"the-map","The map",[86,87,88,104],"table",{},[89,90,91],"thead",{},[92,93,94,98,101],"tr",{},[95,96,97],"th",{},"Topic",[95,99,100],{},"In one line",[95,102,103],{},"Where",[105,106,107,119,132,145,168,182,204,218,245,270,303,320,338,355],"tbody",{},[92,108,109,112,115],{},[110,111,34],"td",{},[110,113,114],{},"Folders, users, groups, the five capabilities (VIEW, RUN, EDIT, CONNECT, MANAGE), administrators and observers, and what each common action needs",[110,116,117],{},[31,118,34],{"href":33},[92,120,121,124,127],{},[110,122,123],{},"Audit log",[110,125,126],{},"One append-only entry per sign-in, change, run, export and permission change, with who, what, when and from where",[110,128,129],{},[31,130,123],{"href":131},"\u002Fdocs\u002Fgovernance\u002Faudit-log",[92,133,134,137,140],{},[110,135,136],{},"Data contracts",[110,138,139],{},"Rules a datasource promises to keep; a blocking rule refuses new data and the datasource keeps serving the last good data",[110,141,142],{},[31,143,136],{"href":144},"\u002Fdocs\u002Fgovernance\u002Fdata-contracts",[92,146,147,150,153],{},[110,148,149],{},"Single sign-on",[110,151,152],{},"Sign in with Keycloak, Microsoft Entra ID or another OpenID Connect provider; its groups become Tabularia groups",[110,154,155,159,160,159,164],{},[31,156,158],{"href":157},"\u002Fdocs\u002Fsso-keycloak","Single sign-on with Keycloak",", ",[31,161,163],{"href":162},"\u002Fdocs\u002Fdesign\u002Fsso-group-mapping","group mapping",[31,165,167],{"href":166},"\u002Fdocs\u002Fexamples\u002Fkeycloak","a Keycloak to try on a laptop",[92,169,170,173,176],{},[110,171,172],{},"SIEM",[110,174,175],{},"Every audit entry forwarded to Splunk through the HTTP Event Collector, in order, none skipped",[110,177,178],{},[31,179,181],{"href":180},"\u002Fdocs\u002Fsiem-splunk","Audit log to Splunk",[92,183,184,187,198],{},[110,185,186],{},"Sessions",[110,188,189,190,193,194,197],{},"One revocable session per browser or script, in an ",[65,191,192],{},"HttpOnly"," cookie; closed by signing out, from ",[48,195,196],{},"Your sessions",", by an administrator, at a password change or when the account is disabled",[110,199,200],{},[31,201,203],{"href":202},"\u002Fdocs\u002Fconfiguration#sign-in-sessions-and-api-tokens","Configuration: sign-in, sessions and API tokens",[92,205,206,209,212],{},[110,207,208],{},"Service accounts and API tokens",[110,210,211],{},"Tokens with a read-only or read-and-write access level and an expiry, personal or of a service account, never more powerful than their account",[110,213,214],{},[31,215,217],{"href":216},"\u002Fdocs\u002Fapi#signing-in-api-tokens","Tabularia API",[92,219,220,223,235],{},[110,221,222],{},"Free SQL, contained",[110,224,225,226,234],{},"The SQL step, SQL scripts and the assistant's queries may read only the tables the gateway resolved for them: an allowlist checked on the parsed query (",[31,227,231],{"href":228,"rel":229},"https:\u002F\u002Fgithub.com\u002FJumpAsAService\u002FTabularia\u002Fblob\u002Fmain\u002Fbackend\u002Fapp\u002Fengine\u002Fsql_guard.py",[230],"nofollow",[65,232,233],{},"sql_guard.py",") on the engines that run on a server; DuckDB and Polars see only the tables they were handed",[110,236,237,159,241],{},[31,238,240],{"href":239},"\u002Fdocs\u002Fsql-scripts","SQL scripts",[31,242,244],{"href":243},"\u002Fdocs\u002Fengines\u002Fclickhouse-ai-user","a ClickHouse user for the assistant",[92,246,247,250,265],{},[110,248,249],{},"Masking for observers",[110,251,252,253,256,257,264],{},"Observers read the administration panels with emails masked (",[65,254,255],{},"a***@example.com","), no IP addresses and no browser strings (",[31,258,261],{"href":259,"rel":260},"https:\u002F\u002Fgithub.com\u002FJumpAsAService\u002FTabularia\u002Fblob\u002Fmain\u002Fgateway\u002Fapp\u002Fservices\u002Fmasking.py",[230],[65,262,263],{},"masking.py",")",[110,266,267],{},[31,268,34],{"href":269},"\u002Fdocs\u002Fgovernance\u002Fpermissions#observers",[92,271,272,275,294],{},[110,273,274],{},"Retention",[110,276,277,278,281,282,285,286,289,290,293],{},"Audit entries kept forever or for ",[65,279,280],{},"AUDIT__RETENTION_MINUTES","; client addresses emptied after ",[65,283,284],{},"AUDIT__IP_RETENTION_DAYS"," (90 by default); run logs emptied after ",[65,287,288],{},"ORCHESTRATOR__LOG_RETENTION_DAYS"," (30 by default); the assistant's conversations deleted after ",[65,291,292],{},"ORCHESTRATOR__AI_CHAT_RETENTION_DAYS"," (90 by default)",[110,295,296,159,299],{},[31,297,123],{"href":298},"\u002Fdocs\u002Fgovernance\u002Faudit-log#retention",[31,300,302],{"href":301},"\u002Fdocs\u002Fconfiguration#webhooks-and-audit-log","configuration",[92,304,305,308,315],{},[110,306,307],{},"Privacy notice",[110,309,310,311,314],{},"A notice shown at the top of every page, written by the administrator in ",[48,312,313],{},"Administration → Privacy",", starting from a text that describes what the installation really collects",[110,316,317],{},[31,318,123],{"href":319},"\u002Fdocs\u002Fgovernance\u002Faudit-log#privacy-notice",[92,321,322,325,332],{},[110,323,324],{},"The assistant's disclosure",[110,326,327,328,331],{},"Before the assistant can be used (the ",[48,329,330],{},"Assistant"," page, the flow and script assistants), a dialog that only «I understand» closes says that an AI model answers, that it can be wrong, that it reads only the datasources the account may read, and that the question goes to the provider of the model chosen, by name",[110,333,334],{},[31,335,337],{"href":336},"\u002Fdocs\u002Fintegrations\u002Fai","AI: where it is used",[92,339,340,343,350],{},[110,341,342],{},"A ClickHouse user for the AI",[110,344,345,346,349],{},"A second barrier on the external ClickHouse: the assistant's queries run as a read-only user that cannot read ",[65,347,348],{},"system"," or any table",[110,351,352],{},[31,353,354],{"href":243},"A dedicated ClickHouse user",[92,356,357,360,363],{},[110,358,359],{},"Users' code, isolated",[110,361,362],{},"Python, R and Docker images run in their own namespaces, with no token of the cluster's API, under a network policy that keeps them away from Tabularia's own pods and the cloud metadata addresses",[110,364,365,159,369],{},[31,366,368],{"href":367},"\u002Fdocs\u002Fscripting#network-policies","Python and R: network policies",[31,370,372],{"href":371},"\u002Fdocs\u002Fcontainer-node#where-it-runs","the Container node",[37,374,376],{"id":375},"who-decides-what","Who decides what",[86,378,379,389],{},[89,380,381],{},[92,382,383,386],{},[95,384,385],{},"Decision",[95,387,388],{},"Who",[105,390,391,402,410,418,425,432,440],{},[92,392,393,396],{},[110,394,395],{},"Users, groups, administrators, observers, service accounts",[110,397,398,399],{},"Administrators, in ",[48,400,401],{},"Administration",[92,403,404,407],{},[110,405,406],{},"Top-level folders",[110,408,409],{},"Administrators",[92,411,412,415],{},[110,413,414],{},"Permissions on a folder and below it",[110,416,417],{},"Whoever has MANAGE on the folder (administrators always)",[92,419,420,423],{},[110,421,422],{},"Which engines may be chosen, which AI models may be used",[110,424,409],{},[92,426,427,430],{},[110,428,429],{},"Which scripting environments and container registries a group may use",[110,431,409],{},[92,433,434,437],{},[110,435,436],{},"A datasource's data contract",[110,438,439],{},"Whoever has EDIT on the datasource's folder",[92,441,442,445],{},[110,443,444],{},"Where an SMTP connection may send",[110,446,447],{},"Whoever has CONNECT on its folder (the connection's allowed domains)",[37,449,451],{"id":450},"related","Related",[42,453,454,461,468,475],{},[45,455,456,460],{},[31,457,459],{"href":458},"\u002Fdocs\u002Fconcepts","Concepts",": folders, flows, datasources and runs in a few lines.",[45,462,463,467],{},[31,464,466],{"href":465},"\u002Fdocs\u002Fconnections","Connections",": who may create and use each kind.",[45,469,470,474],{},[31,471,473],{"href":472},"\u002Fdocs\u002Fcapabilities\u002Fscheduling","Scheduling",": schedules and the rights they run with.",[45,476,477,481],{},[31,478,480],{"href":479},"\u002Fdocs\u002Fconfiguration","Configuration reference",": every variable named on this page.",{"title":483,"searchDepth":484,"depth":485,"links":486},"",2,3,[487,488,489,490],{"id":39,"depth":484,"text":40},{"id":83,"depth":484,"text":84},{"id":375,"depth":484,"text":376},{"id":450,"depth":484,"text":451},"md",{"source":493},"docs\u002Fgovernance\u002FREADME.md",true,"\u002Fdocs\u002Fgovernance",{"title":5,"description":16},"docs\u002Fgovernance\u002FREADME","-h2Altrr-v8rxaUt056efYh6WMxaw0nyb3yod4t-Pjw",[500,517,569,601,631,654,670,694],{"title":501,"icon":502,"intro":503,"items":504},"Getting started","start","Install it on one machine, learn the few ideas everything else is built on, and run a first flow.",[505,507,510,513,514],{"path":506,"title":501},"\u002Fdocs\u002Fgetting-started",{"path":508,"title":509},"\u002Fdocs\u002Fgetting-started-docker-compose","Walkthrough with Docker Compose",{"path":511,"title":512},"\u002Fdocs\u002Fdeploy\u002Fminikube","Try it on your computer (minikube)",{"path":458,"title":459},{"path":515,"title":516},"\u002Fdocs\u002Foverview","Overview (README)",{"title":518,"icon":519,"intro":520,"items":521},"Capabilities","capabilities","What you can build: visual flows, analysis on any step, AI questions, pixel-perfect reports, dashboards, Python, R and SQL scripts, containers and the orchestration that ties them together.",[522,525,528,531,534,537,540,543,546,547,550,553,556,557,560,563,566],{"path":523,"title":524},"\u002Fdocs\u002Fcapabilities","All capabilities",{"path":526,"title":527},"\u002Fdocs\u002Fcapabilities\u002Fflows","Low-code flows",{"path":529,"title":530},"\u002Fdocs\u002Fcapabilities\u002Fpreview-and-analysis","Preview and analysis",{"path":532,"title":533},"\u002Fdocs\u002Fcapabilities\u002Fask-your-data","Ask your data with AI",{"path":535,"title":536},"\u002Fdocs\u002Fcapabilities\u002Freports","Pixel-perfect reports",{"path":538,"title":539},"\u002Fdocs\u002Fcapabilities\u002Freport-functions","Report functions",{"path":541,"title":542},"\u002Fdocs\u002Fcapabilities\u002Fdashboards","Dashboards",{"path":544,"title":545},"\u002Fdocs\u002Fscripting","Python and R",{"path":239,"title":240},{"path":548,"title":549},"\u002Fdocs\u002Fcapabilities\u002Fnotebooks","marimo notebooks as apps",{"path":551,"title":552},"\u002Fdocs\u002Fcontainer-node","Docker images in flows",{"path":554,"title":555},"\u002Fdocs\u002Fcapabilities\u002Fflow-groups","Flow groups: orchestration",{"path":472,"title":473},{"path":558,"title":559},"\u002Fdocs\u002Fpushmail","Pushmail: datasources, reports and dashboards by email",{"path":561,"title":562},"\u002Fdocs\u002Fplaceholders","Dynamic dates",{"path":564,"title":565},"\u002Fdocs\u002Fcapabilities\u002Fengines","Engines",{"path":567,"title":568},"\u002Fdocs\u002Fengines\u002Fengine-differences","Engine differences",{"title":570,"icon":571,"intro":572,"items":573},"Sources","sources","Every way data comes in: files, databases, buckets, SFTP folders, HTTP APIs, SharePoint, Google Sheets, and the results of your own flows.",[574,577,580,583,586,589,592,595,598],{"path":575,"title":576},"\u002Fdocs\u002Fsources","All sources",{"path":578,"title":579},"\u002Fdocs\u002Fsources\u002Ffiles","Uploaded files",{"path":581,"title":582},"\u002Fdocs\u002Fsources\u002Fdatabases","Database tables and queries",{"path":584,"title":585},"\u002Fdocs\u002Fs3-datasource","S3 buckets",{"path":587,"title":588},"\u002Fdocs\u002Fsftp","SFTP folders",{"path":590,"title":591},"\u002Fdocs\u002Fapi-datasource","HTTP APIs",{"path":593,"title":594},"\u002Fdocs\u002Fsources\u002Fsharepoint","Excel on SharePoint",{"path":596,"title":597},"\u002Fdocs\u002Fsources\u002Fgoogle-sheets","Google Sheets",{"path":599,"title":600},"\u002Fdocs\u002Fsources\u002Fflow-outputs","Results of flows and scripts",{"title":466,"icon":602,"intro":603,"items":604},"connections","The systems Tabularia reads from and writes to, how each connection is set up, and who may use it.",[605,607,610,613,616,618,619,621,622,625,628],{"path":465,"title":606},"All connections",{"path":608,"title":609},"\u002Fdocs\u002Fconnections\u002Fdatabases","Databases",{"path":611,"title":612},"\u002Fdocs\u002Fsqlserver","Microsoft SQL Server driver",{"path":614,"title":615},"\u002Fdocs\u002Fconnections\u002Fs3","S3 and compatible storage",{"path":587,"title":617},"SFTP servers",{"path":590,"title":591},{"path":593,"title":620},"SharePoint",{"path":596,"title":597},{"path":623,"title":624},"\u002Fdocs\u002Fconnections\u002Fsmtp","SMTP email",{"path":626,"title":627},"\u002Fdocs\u002Fcontainer-registries","Container registries",{"path":629,"title":630},"\u002Fdocs\u002Fconnections\u002Fdestinations","Writing data out",{"title":632,"icon":633,"intro":634,"items":635},"Integrations","integrations","How Tabularia fits your stack: AI providers, the REST API and webhooks, dbt, OpenLineage, single sign-on, SIEM and monitoring.",[636,639,640,643,646,649,650,651],{"path":637,"title":638},"\u002Fdocs\u002Fintegrations","All integrations",{"path":336,"title":337},{"path":641,"title":642},"\u002Fdocs\u002Fapi","API, tokens and webhooks",{"path":644,"title":645},"\u002Fdocs\u002Fdbt-export","Export to dbt",{"path":647,"title":648},"\u002Fdocs\u002Fopenlineage","OpenLineage",{"path":157,"title":158},{"path":180,"title":181},{"path":652,"title":653},"\u002Fdocs\u002Fintegrations\u002Fmonitoring","Monitoring",{"title":655,"icon":656,"intro":657,"items":658},"Security & governance","governance","Who may see and do what, what is recorded, and how data quality and personal data are kept in check.",[659,661,662,663,664,666,668],{"path":495,"title":660},"Overview",{"path":33,"title":34},{"path":131,"title":123},{"path":144,"title":136},{"path":162,"title":665},"SSO and group mapping",{"path":166,"title":667},"Keycloak example on a laptop",{"path":243,"title":669},"A ClickHouse user for the AI assistant",{"title":671,"icon":672,"intro":673,"items":674},"Install & operate","operate","Run it in production on Kubernetes, configure it, upgrade it and keep it healthy.",[675,678,681,684,687,688,691],{"path":676,"title":677},"\u002Fdocs\u002Fdeploy\u002Fkubernetes","Kubernetes and Helm",{"path":679,"title":680},"\u002Fdocs\u002Fdeploy\u002Fkind","A company-like cluster on one computer (kind)",{"path":682,"title":683},"\u002Fdocs\u002Fdeploy\u002Fupgrading","Upgrading, backups and restore",{"path":685,"title":686},"\u002Fdocs\u002Fdeploy\u002Frelease-checklist","Install and upgrade checklist",{"path":479,"title":480},{"path":689,"title":690},"\u002Fdocs\u002Fengine-settings","Settings from the panel",{"path":692,"title":693},"\u002Fdocs\u002Fdatabase-migrations","Database migrations",{"title":695,"icon":696,"intro":697,"items":698},"Reference","reference","Release process and the remaining reference pages.",[699],{"path":700,"title":701},"\u002Fdocs\u002Frelease-process","Release process",1793656372139]