Everyone sees exactly what they should. Nothing more.
Set the rules once — who sees which rows, which columns, which dashboards — and Klayara applies them to every chart, download, report and AI answer. Automatically, every time.
What is row-level security in BI?
Row-level security means each person sees only the rows they are allowed to, such as their own branch, region or customers, while everyone shares the same dashboards. In Klayara you set the rule once and it applies everywhere: charts, downloads, scheduled reports, public links and AI answers. Column masking and custom roles add finer control. These come with the Growth plan and above.
Rules that hold everywhere
One set of permissions covers dashboards, downloads, scheduled reports, shared links, embedded views and AI answers. Set it once — there's no side door.
Down to rows and columns
The sales team sees their region's rows. Finance sees the margin column; nobody else does. Salary data can be hidden completely, or masked so it can't be read.
Roles you design
Build roles from 17 fine-grained permissions — as many roles as your organisation needs. People can only grant what they hold themselves, so power can't quietly escalate.
The same table, three different views.
When the sales lead in Madrid and the CFO open the same dashboard, each sees their own version — the right rows, the right columns, automatically. Nobody exports a spreadsheet “just this once” to work around the tool.
- Rules follow the data, not the chart
- Applied at the moment each person looks
- Changes take effect instantly, everywhere
| Customer | Region | Margin | Amount |
|---|---|---|---|
| Acme Retail | EU | •••• | $4,120 |
| Northwind | EU | •••• | $2,876 |
| Lumen Stores | EU | •••• | $1,904 |
| Other regions hidden · margin masked for this role | |||
Built for ten people or ten thousand.
Big organisations can't share item by item. Give access once, at the right level, and let it look after itself.
- Share a whole base — every dashboard and table in it, including new ones
- End dates — contractor access that stops by itself
- Blocks — keep one person or team out, even when a wider rule lets them in
- Manage access in one place — lock a base so nothing inside is shared one by one
- Bulk changes — invite from a list or CSV, change roles for many, remove all access with a preview
- Builder and Viewer seats — readers cost less, and you see any price change before you save
Know who did what, always.
The activity feed records every meaningful change in plain words — who made it, when, and what it looked like before and after — filtered by person, kind or date. Sensitive values are automatically kept out of the log itself. Something deleted by mistake? Dashboards, charts, calculated columns, automations and saved views can be restored for 30 days.
Email codes, Google sign-in, and two-factor authentication with backup codes — the extra lock for the accounts that matter most.
Every workspace gets its own separate storage with its own keys. Teams and customers are genuinely apart — not sharing one pool behind a filter.
Can someone see data they shouldn’t through a download or a shared link?
No. The same rules apply everywhere — dashboards, downloads, scheduled reports, shared links, embedded views and AI answers. There is no side door around your permissions.
How detailed can the permissions get?
As detailed as you need: whole dashboards, individual tables, specific columns, or individual rows — per person, per role, per team, per region. Hide a column entirely, or mask it so it shows but can’t be read. Row rules, column masking and custom roles are on Growth and above.
How do people sign in?
Email and password, one-time email codes, or sign-in with Google — plus two-factor authentication with backup codes for accounts that need the extra lock. On Growth and Enterprise, your team can also sign in with your company account through single sign-on, and you can make it the only way in. On Enterprise, your company directory (Microsoft Entra ID or Okta) can add and remove people for you: when someone is switched off there, their Klayara access ends too.
Can we see who did what?
Yes. A full activity log records who changed what and when — with before-and-after detail, and sensitive values automatically kept out of the log.
We have hundreds of people. Do we share every dashboard one by one?
No. Share a whole base with a role, a person or everyone in the workspace once, and every dashboard and table in it — including ones added later — follows. Invite a whole team from a pasted list or a CSV file, change roles for many people in one go, and remove all of someone’s access with a preview of who is affected.
Can we give a contractor temporary access, or keep one person out?
Yes. Add an end date and the access stops by itself on that day. Add a person or role as Blocked and they cannot open that base or dashboard, even when a wider rule would let them in. Owners and Admins are never locked out.
Can we stop people changing a finished dashboard?
Yes. Lock a chart so only chosen roles or people can edit it, lock a filter to its default or hide it for some people, and hide a chart from roles that do not need it. One Hidden & locked list shows every such setting in the workspace. Deleted dashboards, charts and automations can be restored for 30 days.
How is customer or team data kept separate?
Each workspace gets its own separate storage with its own keys — real separation, not just a filter. One team can never spill into another, and one team’s heavy usage never slows the others down.
Can each branch manager see only their branch?
Yes. Row-level security, on Growth and above, lets a rule follow each person’s own branch or region, or a mapping table you maintain. One dashboard serves every branch, and each manager’s charts, downloads, scheduled PDFs and AI answers show only their rows. Everyone can start on “nothing until granted”, so a missing grant shows nothing rather than everything.
How do we check what a particular person can see?
Use Check access: pick a member and see a table exactly as they would, with their rows, hidden columns and masked values. The access console explains in plain words why someone can reach something, and on Growth the coverage view lists members who still lack grants.
Which security features are on which plan?
Every plan includes view, edit and admin sharing, two-factor sign-in, the activity log, several roles per person and the access console. Row-level security, column masking, custom roles and public links come with Growth and above. A plan change or billing lapse never switches an existing security rule off.
Bring us your hardest permission puzzle.
Regions, branches, franchises, client accounts — tell us how your organisation is shaped, and we'll show you the rules that fit it.
Prefer to see plans first? See pricing