Security
Governed by design, not by convention
Security in DataCentral is structural: identities are verified by the provider you trust, access is resolved from organizational units, and data is filtered at render time through Power BI’s own row-level security. Nothing depends on people remembering to share carefully.
Principles
Eight properties of the control plane.
- Identity you already trust
- Employees sign in with Microsoft Entra ID and inherit your conditional-access and MFA policies. External users get User Pass, Mobile ID or OTP accounts that live in the tenant — not in your corporate directory. Unused methods can be disabled per tenant.
- Least privilege by structure
- Roles attach to organizational units synced from Entra ID security groups. Access follows the org chart; leavers lose access through the directory sync, not through a ticket. Tenant administrators are few and explicit.
- Data stays where it is
- DataCentral never stores your business data. It stores the metadata needed to enforce access — users, OUs, roles, workspace and item references — and the audit log. Reports render from Power BI through short-lived embed tokens.
- Row-level security on every render
- Each embed token carries the user’s resolved RLS roles, dynamic (USERPRINCIPALNAME) or static. Smart RLS passes many roles in one dynamic role so complex segmentation stays auditable.
- Tenant isolation
- Tenants are isolated environments: a user, role or report in one tenant is invisible to another. The host/tenant model is how ISVs serve many customers from one instance.
- Links and keys that expire
- Item links, report keys and embedding keys carry expirations and are listed and revocable from the administration portal. Treat them like credentials — DataCentral does.
- An audit trail you can export
- Logins, views, exports and role changes are recorded. Export the log to your archival system for SOC 2, GDPR and internal audit requests.
- Secrets under your control
- On Premium and Enterprise tiers you bring your own Power BI, Graph and security-group service principals and rotate their secrets on your schedule. Embedding API credentials are server-side only, by design.
Data boundary
What DataCentral stores — and what it never does.
Stored in DataCentral
- User accounts for the tenant (or references to Entra ID identities)
- Organizational units, roles and their assignments
- Workspace, report, dashboard and app references (IDs)
- Tenant settings and branding
- Item links, report keys and their expirations
- Audit log entries
Never stored in DataCentral
- Rows from your semantic models or warehouse
- Copies of your reports or datasets
- Power BI credentials of your end users
- Anything an Entra ID conditional-access policy would not allow
Shared responsibility
The controls in your hands.
DataCentral enforces the policy; you decide it. These are the practices our documentation recommends for every tenant.
Security best practices in the documentation- 01Enforce Entra ID for employees and partners where possible; keep MFA through conditional access.
- 02Disable User Pass, Mobile ID and OTP in tenants that do not need them.
- 03Assign roles to organizational units, not to individuals; review assignments on a schedule.
- 04Test RLS with a test user before publishing a report; avoid catch-all roles.
- 05Set expirations on every item link and report key; audit active links regularly.
- 06Rotate service-principal secrets before they expire; keep Embedding API credentials out of client code.
- 07Review the audit log for failed logins, unusual export volumes and role changes; export it for compliance.
Questions security teams ask
Straight answers.
Where does my data live when I use DataCentral?
In Power BI and in your data warehouse — exactly where it lives today. DataCentral stores only the metadata required to manage access (users, roles, workspace and item IDs, audit logs) and renders reports through time-limited Power BI embed tokens.
Do external users need Power BI Pro licenses?
No. A configured Power BI service principal generates embed tokens on their behalf (App-owns-data). External users sign in with User Pass, Mobile ID or OTP accounts that exist only in DataCentral.
How is row-level security enforced?
DataCentral resolves the user’s RLS roles from their organizational units and roles, then requests an embed token from Power BI that carries those roles. Power BI filters the data at render time. Smart RLS lets one dynamic role carry many DataCentral roles.
Can we run DataCentral on our own Azure tenant?
Yes. Premium tiers integrate your own Azure tenant and service principals; the Enterprise tier runs a self-hosted instance on a domain of your choice with subdomain management.
Which certifications does DataCentral hold?
Ask us for the current security documentation and questionnaire responses at info@datacentral.ai. DataCentral is hosted on Microsoft Azure, is a Microsoft Solutions Partner, and is distributed through Azure Marketplace.
Bring your security questionnaire.
We answer architecture and security questions with the engineers who built the platform — and can walk your security team through a tenant live.