Prospective enables users to visualize and explore data by connecting directly to a data source from the browser – an architecture that’s unique amongst traditional business intelligence and analytics products.
Architecture
Prospective consists of:
- A browser application to visualize your data quickly and easily.
- Optionally, an app to grant extended privileges to the browser.
- Optionally, a server to manage large datasets more efficiently.
Browser Application
Prospective is a local, in-browser data visualization application. It uses WebAssembly to run in-browser, and everything displayed in-browser is rendered client-side. Accordingly, the data used in that rendering is on the client - i.e. a user’s laptop or phone. In contrast to other data visualization tools, the data, visualizations, and dashboards remain on the client device.
Prospective’s browser application stores metadata about:
- How to construct a visualization.
- How to access the data needed in creating a visualization without storing privileged access information like credentials.
The information about the construction of the visualization contains metadata about the visualization itself (e.g. type of visualization, color schemes, etc.), and metadata about the data being visualized (e.g. which tables and columns are used, what data type each column contains, values for filters, etc.).
👉 Notably, the Prospective browser application does not persist any of the data being visualized.
The metadata about accessing the data depends on the method of access. For example,
- If it is a file on disk, what is the path of the file??
- If it is a database, what is the connection info??
- If it is a data stream, how should the adapter be configured??
👉 Notably: credentials are not stored within the application, they are pointed to, stored in `localStorage`, and browser/device specific.
📓 While Prospective persists metadata, it does not persist the actual data being visualized. That data is stored in the client device’s memory as part of the browser session, and is separate and protected.
Since Prospective is a browser application, there are limitations on how the application can interact with a client device. Certain data connections (e.g. Kafka, Postgres, MS SQL), and certain features of other connections are only available if the client device has the app installed (more below) or if the data is accessed through Prospective Server (more below).
App (optional)
The Prospective browser application runs in-browser and so its data access is limited by the browser's permissions. For access beyond what the browser has been granted, you can install the Prospective App, or use Prospective Server (see below).
The Prospective App is a secure and lightweight application that grants the Prospective Browser Application limited privileges to access data outside the browser. The App connects to the Browser through safe web APIs. It does not extend the browser in any way, and never sends data over the network, only to the local Prospective Application (running in the browser).
It’s completely optional, but allows for access to additional data sources (e.g. Kafka, Postgres, MS SQL) and additional features in some data sources supported by the browser application.
The Prospective App is:
- small → 12 MB
- low permission → does not require administrative access
- single purpose → moving data from the client into the browser for the sole purpose of use by the Prospective Browser Application.
Server (optional)
A Server version of Prospective can be deployed within your network, which combines the Prospective Browser and App functionality, with the control of an on-premise deployment that includes OAuth integration.
Summary of Security Posture
Prospective stores metadata about:
- How to construct a visualization
- How to access the data needed in creating the visualization
Prospective does not store actual data nor credentials for sharing the data.
Q: "When a dashboard is shared, is the recipient given access to the data?"
A: No, Prospective does not grant the recipient access to the data.
➕ If a user has access to data outside of Prospective, they have access to it within Prospective.
🛑 If user doesn’t have access to data outside of Prospective, they don’t have access to data within Prospective.
📓Note: there are other ways of sharing dashboards, for example exporting and sharing (1) a static PDF or (2) a point in time snapshot of the data – but without access to the data sources, the recipient is unable to view the dashboards.
Managing & Configuring Data Access
The easiest way to think about managing access to data in Prospective is as follows:
📓Prospective does not give access to any data → the data systems give Prospective access.
If a user has access to a data source outside of Prospective → they have access to the data source within Prospective.
If a user does not have access to a data source outside of Prospective → they do not have access to the data within Prospective.
If a Prospective dashboard is shared with someone that doesn’t have access to data required to build a dashboard → they cannot view that data.
…instead, Prospective initiates a workflow to allow the person to point the dashboard at the data required to constitute the dashboard.
There are no service accounts to data systems created for Prospective and therefore, no need to manage data access within Prospective.
If you’re enabling customers and teammates to access, reason about and visualize their data across lake houses, data meshes and anywhere else data lives, we’d love to chat with you about how we could simplify and enhance your user experience. We’re always happy to chat @ https://prospective.co/meet-eric
Thanks to Joj for help on this post!
