Embedded / Multi-tenant reference architectureEmbedded Analytics — Multi-tenant SaaS
White-label Apache Superset dashboards inside your SaaS product. Your backend calls the D23 Embed API to issue scoped guest tokens; the D23 React SDK renders charts with your CSS theme. Row-level security is enforced per tenant at the database level — no custom analytics infrastructure required.
Embedded / Multi-tenantRuntime: D23 Embed API + Superset guest tokensEntry point
Your application calls the D23 Embed API to bootstrap a tenant session
SaaS / Embedded
D23 platform
Apache Superset
dashboards · datasets · SQL Lab
D23 Managed Layer
SSO · row-level security · upgrades
Compute & cache
Kubernetes cluster
D23 Embed API + Superset guest tokens
Guest Token Service
managed by D23
Row-Level Security Engine
managed by D23
Theme Injector
managed by D23
Tenant Audit Logger
managed by D23
Data sources
50+ supported databases
Your infrastructure
D23 Embed API (guest tokens)
Superset row-level security engine
Your application database
Your data warehouse
How the deployment works
Starting point: Your application calls the D23 Embed API to bootstrap a tenant session
- 1
Your backend exchanges a tenant ID and permission set for a signed Superset guest token via the D23 Embed API
- 2
The guest token is injected into the D23 React SDK iframe — no Superset credentials are exposed to the browser
- 3
Row-level security filters are applied server-side based on the tenant's attributes, ensuring each user sees only their own data
- 4
Your UI renders the embedded dashboard or chart with your CSS theme — no D23 or Superset branding unless you want it
- 5
D23 manages token rotation, audit logging per tenant, and zero-downtime dashboard updates across all tenants simultaneously
D23 managed services
- Guest Token Service
- Row-Level Security Engine
- Theme Injector
- Tenant Audit Logger
Connected data sources
50+ databases supported — Snowflake, BigQuery, Redshift, Postgres, ClickHouse, and more.
Infrastructure & data
D23 Embed API + Superset guest tokens
D23 Embed API (guest tokens)
Superset row-level security engine
Your application database
Your data warehouse
Security & operational considerations
- Guest tokens are short-lived and scoped to a single tenant — no cross-tenant data leakage
- Row-level security is enforced at the database query level, not just the UI
- SSO and RBAC from your IdP flow through to dashboard-level permissions
- All embedded queries are logged per tenant for billing, audit, and anomaly detection
Embedded / Multi-tenant deployment
Your backend exchanges tenant context for a signed guest token. The D23 React SDK renders the dashboard inside your app with your CSS theme. Row-level security is enforced server-side — no cross-tenant data leakage.
More deployment blueprints
Turn every team into a data team.
Get managed Apache Superset, the dashboards your business needs, and AI on top, without hiring a data team.