Deployment control
Deploy Reveal in your cloud, private cloud, or on-premises environment. The SDK operates within the application architecture and network controls you manage.
Security at Reveal
Embedded analytics that stays inside your security boundary
Reveal is an SDK that runs as part of your application and infrastructure. Your application remains the source of truth for identity, authorization, tenant context, data-source access, and operational controls.
Your identity model
Reveal integrates with your application's authentication and authorization model instead of introducing a parallel user or permission system.
Customer-controlled data access
Your server supplies credentials and user context at runtime. Reveal does not require credentials to be embedded in the browser client.
Supply-chain transparency
Release-specific CycloneDX SBOMs describe the components in supported server and browser client packages. Each downloadable SBOM includes a SHA-256 checksum for verifying the SBOM file.
Shared responsibility
Security responsibilities remain explicit
Reveal provides the embedded analytics components; the host application controls how they are authenticated, authorized, configured, deployed, and monitored.
Reveal responsibilities
- Maintain supported SDK packages and their runtime dependencies.
- Deliver fixes and security updates through supported releases.
- Document security integration points and safe configuration patterns.
- Publish release-specific SBOMs and their file checksums.
Customer responsibilities
- Authenticate users and authorize every analytics request.
- Enforce tenant isolation and least-privilege data access.
- Protect credentials, encryption keys, and application secrets.
- Secure and patch the host OS, runtime, application, and network.
- Monitor activity and keep Reveal packages on a supported release.
Production checklist
Recommended deployment controls
- 1
Protect every endpoint
Require HTTPS, authenticate server endpoints, and apply authorization before processing dashboard or data requests.
- 2
Propagate trusted user and tenant context
Derive identity and tenant information on the server. Do not trust identifiers supplied only by the browser.
- 3
Keep credentials server-side
Store secrets in an appropriate secret store and use least-privilege accounts for each data source.
- 4
Restrict browser and network access
Permit only required CORS origins, headers, and methods. Apply your normal proxy, gateway, firewall, and rate-limiting controls.
- 5
Maintain and monitor the deployment
Keep the SDK and runtime current, retain security-relevant logs, verify downloaded SBOM files using their published checksums, and review SBOM components in the context of your deployment.
Implementation resources
Configure Reveal securely
Responsible disclosure
Report suspected vulnerabilities privately
Email support@revealbi.io with “Security Vulnerability” in the subject. Include the affected product version, platform, architecture, impact, and reproduction steps. Do not include credentials, customer data, or other secrets.
Please do not disclose suspected vulnerabilities in a public GitHub issue before the report has been reviewed. Use the public issue tracker only for non-security defects.