Bonnard

Security and governance

Read-only from the first query, and a person decides what ships.

Talk to us

Governance

  • Hosted and shared

    Share any chart or dashboard by link, with your team or customers.

  • Edit in Bonnard

    Edit saved dashboards in Bonnard’s web app.

  • A grant per data source

    Anyone without one is refused.

  • Every call, logged

    Who used it, when, which tools, and what failed, per data source and per customer.

  • Draft first

    A change sits in a draft nobody is served.

  • A person publishes

    Publishing from an AI client is off until an admin turns it on.

Security

  • OAuth 2.1, PKCE mandatory

    Tokens are audience-bound per server.

  • Bring your own IdP

    OAuth, API keys or trusted JWTs. SSO supported.

  • AES-256-GCM at rest

    Credentials encrypted. API keys stored only as hashes.

  • Read-only

    SELECT statements only; on SQL Server, the login’s grants enforce it. SSL by default, from a fixed IP.

  • Set per database

    Row-level security, or a dataset or database per tenant.

  • Tenant from the sign-in

    An IdP sign-in maps to the right tenant. Scale and Enterprise plans.

Every call, with who and when

Failed queries show where your data model needs work.

Top toolsCalls
  • sql_query23 err10,612
  • explore_schema4,318
  • render_chart2,904
  • render_dashboard1,207
  • create_export_file391
LogsLast 30 days
  • 1m agosql_queryok61ms
  • SELECT week, channel, SUM(revenue) FROM orders GROUP BY week, channel
  • 1m agorender_chartok38ms
  • 4m agosql_queryerror30,000ms
  • 6m agosql_querydenied22ms
  • 7m agorender_dashboardok112ms

Serve your customers

The tenant comes from the sign-in, never from the agent or the question. Every query runs under that tenant, with row-level security or a separate dataset or database per tenant.

How each engine separates customers
EngineRow-level securityDataset per tenantDatabase per tenant
PostgreSQL
Redshift
SQL Server
Azure SQL Database
BigQuery
MySQL
ClickHouse
MotherDuck
PostHog

Self-hosted

On Enterprise: self-hosting, VPC or on-prem, with dedicated support and an SLA.

  • Helm chart or Docker Compose
  • Your Postgres, your network
  • One organisation, closed sign-up
  • Staff SSO
Get in touch

charts/bonnard/README.md

helm install bonnard ./charts/bonnard \
  --set bootstrap.ownerEmail=you@example.com \
  --set secrets.existingSecret=bonnard-secrets \
  --set imagePullSecrets[0].name=ghcr-pull

Start scaling
accurate data today

Free for your first 3,000 calls. No seat limits.

Talk to us