A complete embedded analytics workspace for Orangescrum. Build dashboards visually with 40+ chart types, drop into SQL Lab when you need custom queries, gate every chart with row-level security at company / project / user level, separate dashboards from reports via tags, schedule snapshots to email or Slack, and embed read-only views in any internal portal — all without your operational database breaking a sweat.
- Rating
- 4.9
- Installs
- 6.4K
- Support
- Vendor Supported
- Trust
- Self-Hosted
198 reviews
Active deployments
Priority response
Your infra, your data
Screenshots
Key Features
Self-Service Dashboards
Drag, drop, and filter — 40+ chart types covering bar, line, area, scatter, heat-map, geo, time series, treemap, sunburst, sankey, and more. No engineering tickets to read your own data.
SQL Lab
Drop into raw SQL with autocomplete, query history, and saved-query libraries. Promote any query to a chart, any chart to a dashboard.
Multi-Tenant Row-Level Security
Every query is automatically rewritten to include the viewer's company filter — tenant A literally cannot see tenant B's rows, even when both render the same dashboard template.
Project & User-Level RLS
Layer project-level and user-level filters on top of company isolation. Show users only the projects they belong to and the data they own — no app-side filtering required.
Tag-Based Menu Separation
Dashboards without a 'report' tag appear under the Dashboard menu. Dashboards tagged 'report' appear under Advanced Reports. One workspace, two audiences, zero confusion.
Drill-Down
Click any data point to drill into the underlying records — same RBAC rules apply, same audit trail captures every drill.
Scheduled Reports
Email or Slack a dashboard snapshot on a cron schedule with PDF, PNG, or CSV attachment. Stakeholders read numbers instead of asking for them.
Embeddable Read-Only Views
Share dashboards in any internal portal via signed JWT URLs — viewer permissions baked in, no extra logins, no leaked data.
Multiple Data Sources
Connect to PostgreSQL, MySQL, Snowflake, BigQuery, Redshift, Athena, ClickHouse, MS SQL Server, Oracle, MariaDB, and more. Join Orangescrum data with external warehouses.
Cross-Filter Dashboards
Filters on one chart cascade to every other chart on the dashboard. Build interactive analytics surfaces non-technical users actually use.
Custom CSS & Theming
Match Orangescrum's branding or your own. Custom CSS per dashboard, theme tokens per company, dark mode support out of the box.
Annotations & Time-Travel
Annotate charts with deployment markers, releases, or incidents. Time-travel datasets to compare current vs historical for any chart.
Caching & Performance
Multi-layer caching (results, query, chart) keeps dashboards snappy. Async query execution and warehouse offload protect your operational database.
Granular RBAC
Owner / Admin / Builder / Viewer roles per dashboard. Per-database, per-schema, per-table, and per-column permissions for true zero-trust analytics.
Audit Log
Every query, drill, export, and dashboard view recorded with user, timestamp, and IP — perfect for SOC 2 and GDPR data-access evidence.
Embedded SDK
Official SDK for embedding dashboards in your own internal apps with full RLS, theme overrides, and event hooks for filter changes.
About this plugin
Why Advanced Reporting for Orangescrum?
Most project tools ship a fixed dashboard and call it analytics. The minute leadership asks a new question, you're exporting CSVs into a spreadsheet at midnight. Advanced Reporting plugs a real BI workspace into the same data your projects already produce — visual and SQL editors side by side, secure to the row, fast at warehouse scale.
Built for multi-tenant deployments
Every query is rewritten with the viewer's company_id filter automatically. Project- and user-level RLS layers on top so a delivery manager sees their projects, an executive sees the portfolio, and a client sees only what's been shared with them — all from the same dashboard template. The engine enforces it; the app never has to.
Dashboards and reports, separated cleanly
Tag-based menu separation puts operational dashboards under one menu and curated executive reports under another. Same engine, same data, two audiences with two completely different homes. Tag a dashboard 'report' and it moves; remove the tag and it moves back.
Connect anything that speaks SQL
PostgreSQL, MySQL, MariaDB, MS SQL Server, Oracle, Snowflake, BigQuery, Redshift, Athena, ClickHouse, Presto, Trino, Druid. Join Orangescrum data with external warehouses, financial systems, or operational databases. The query layer normalises across them — your dashboards don't care.
Stakeholders read numbers instead of asking for them
Schedule any dashboard to email or Slack on cron. Attach as PDF, PNG, or CSV. Embed read-only views in your internal portal via signed JWT URL with viewer permissions baked in. Annotations let you mark deployments, releases, and incidents on the timeline so the chart explains itself.
Performance for the long haul
Multi-layer caching (results, query, chart). Async query execution. Warehouse offload so your operational database is never the bottleneck. Tested with datasets in the tens of millions of rows and dashboards refreshing in under a second.
What's included
- Self-service dashboard builder with 40+ chart types
- SQL Lab with autocomplete, query history, and saved-query libraries
- Multi-tenant row-level security at company / project / user level
- Tag-based menu separation: Dashboards vs Advanced Reports
- Drill-down from any chart to underlying records
- Scheduled email & Slack report delivery (PDF, PNG, CSV)
- Embeddable read-only dashboards via signed JWT URLs
- Cross-filter dashboards with cascading filters
- Custom CSS, theme tokens per company, dark-mode support
- Annotations and time-travel for charts
- Multi-layer caching (results, query, chart) with async execution
- Connectors for PostgreSQL, MySQL, MariaDB, MS SQL, Oracle
- Connectors for Snowflake, BigQuery, Redshift, Athena, ClickHouse, Druid, Presto, Trino
- Audit log of every query, drill, export, and view
- Owner / Admin / Builder / Viewer RBAC per dashboard
- Per-database, per-schema, per-table, per-column permissions
- Embedded SDK for dashboards in third-party apps
- Multi-tenant company-scoped data isolation enforced at query rewrite
- Performance-tuned for datasets in the tens of millions of rows
Compatibility
Compatible with Orangescrum Self-Hosted Core, Business, and Enterprise editions running PHP 8.2+, PostgreSQL 13+, and Python 3.10+ for the analytics service. Designed for multi-tenant deployments — every query is automatically company-scoped at the engine layer (not the app layer). Connectors via SQLAlchemy support 30+ databases.
Installation
A self-hosted install takes a few minutes. Buy the add-on, drop the plugin into your plugins/ directory, run the migrations, and you're live.
- 1
Buy the add-on
Purchase the Advanced Reporting add-on from /self-hosted/pricing — $499/year per company, payable annually.
- 2
Receive your activation token and analytics service image
After purchase, you'll receive a license token and the Docker image for the analytics service that powers dashboards and SQL Lab.
- 3
Drop the plugin into your install
Copy the SuperSet/ plugin folder into plugins/ on your self-hosted Orangescrum server. (Folder name is internal — feature is branded Advanced Reporting.)
- 4
Register and migrate
Register the plugin in src/Application.php, then run `bin/cake migrations migrate --plugin SuperSet` to create the dashboard, instance, user, and menu tables.
- 5
Bring up the analytics service
Run the analytics service container (PostgreSQL 13+, Python 3.10+) and point it at a read replica or warehouse so it never touches your operational DB.
- 6
Configure data sources and RLS
Connect your data sources (Postgres, MySQL, Snowflake, BigQuery, Redshift, etc). Enable company / project / user row-level security. Tag dashboards 'report' to route them to the Advanced Reports menu.
- 7
Build your first dashboard
Open the Dashboards tab, create a new dashboard with the visual builder or jump straight to SQL Lab. Schedule snapshots to email or Slack on cron.
Reviews
Replaced four BI tools we were paying for. Multi-tenant row-level security worked out of the box, which is rare.
SQL Lab is a power-user dream. Our PMO writes their own dashboards now — engineering finally got off the report-treadmill.
Scheduled reports to Slack changed our weekly review. Stakeholders read the numbers before the meeting instead of during it.
Frequently Asked Questions
Does it support custom data sources beyond Orangescrum?
▾
Yes. Connect any SQL data source — PostgreSQL, MySQL, MariaDB, MS SQL Server, Oracle, Snowflake, BigQuery, Redshift, Athena, ClickHouse, Druid, Presto, Trino — and build dashboards that join Orangescrum data with external warehouses, finance systems, or operational databases.
How does row-level security work in a multi-tenant deployment?
▾
Every query is automatically rewritten to include the viewer's company_id filter at the engine layer. Project- and user-level filters layer on top using project_id and user_id columns from your datasets. Tenant A literally cannot see tenant B's rows even when both run the same dashboard template — enforced at the SQL level, not at the app level.
What's the difference between Dashboards and Advanced Reports?
▾
Tag-based separation. Dashboards without a 'report' tag appear under the Dashboard menu — operational, day-to-day analytics. Dashboards tagged 'report' appear under Advanced Reports — curated executive views. Same engine, same data, two audiences, two menus. Tag a dashboard and it moves; remove the tag and it moves back.
Can dashboards be embedded outside the app?
▾
Yes. Read-only dashboards can be embedded in any internal portal via signed JWT URL with the viewer's permissions and RLS rules baked in. The Embedded SDK provides theme overrides and event hooks for filter changes so your portal can react to user interactions.
How are scheduled reports delivered?
▾
Cron-style schedules deliver PDF, PNG, or CSV snapshots of any dashboard to email or Slack. Recipients can be users, role groups, or external addresses (with the latter requiring admin approval). Schedules are RLS-aware so different recipients receive different data.
Will it slow down my main database?
▾
No. The analytics engine runs against a read replica, warehouse, or dedicated analytics database by default. Multi-layer caching (results / query / chart) and async query execution keep dashboards snappy without ever touching the operational write path.
How granular is the access control?
▾
Owner / Admin / Builder / Viewer roles per dashboard, plus per-database, per-schema, per-table, and per-column permissions. Combined with row-level security at company / project / user level, you can build true zero-trust analytics — every byte of data is access-checked at query time.
Is the audit log sufficient for SOC 2 and GDPR?
▾
Yes. Every query, drill, export, and dashboard view is captured with user, timestamp, IP, query text, and row count. Exports to CSV / JSON. The level of evidence GDPR Article 30 records-of-processing and SOC 2 Common Criteria CC6.1 logical-access reviews require.
Ready to deploy Advanced Reporting on your own infrastructure?
Talk to our team about Orangescrum Self-Hosted Enterprise — your data, your servers, full control.