--- title: "Advanced Reporting & BI Plugin for Orangescrum Self-Hosted" description: "Self-service dashboards, custom SQL, row-level security, and scheduled reports on your Orangescrum data. Built for multi-tenant enterprise deployments." canonical: https://www.orangescrum.com/self-hosted/plugins/advanced-reporting --- # Advanced Reporting & BI Plugin for Orangescrum Self-Hosted > For the complete documentation index, see [llms.txt](https://www.orangescrum.com/llms.txt). 1. [Home](/) 2. › 3. [Self-Hosted](/self-hosted) 4. › 5. [Plugins](/self-hosted/plugins) 6. › 7. Advanced Reporting # Advanced Reporting by [Orangescrum](/) · Analytics & BI Self-HostedVerifiedEnterprise A complete embedded analytics workspace for Orangescrum. Build dashboards visually with 40+ chart types, drop into SQL Lab when you need custom queries, gate every chart with row-level security at company / project / user level, separate dashboards from reports via tags, schedule snapshots to email or Slack, and embed read-only views in any internal portal, all without your operational database breaking a sweat. Installs Available Active deployments Support Vendor Supported Priority response Trust Self-Hosted Your infra, your data $499/year Per company • Add-on to any Self-Hosted plan [Buy & See All Plans](/self-hosted/pricing#addons)[Talk to Sales](/contact-sales) - Drag-and-drop dashboards with 40+ chart types - SQL Lab for custom queries on project data - Multi-tenant row-level security (company / project / user) - Tag-based separation: Dashboards vs Advanced Reports menus - Embeddable read-only dashboards via signed URLs - Scheduled email & Slack report delivery - Drill-down from chart to underlying records - Connect any SQL data source (Postgres, MySQL, Snowflake, BigQuery, Redshift) Pairs with [Self-Hosted Core ($1,500/yr) or Business ($2,250/yr)](/self-hosted/pricing) [Overview](#overview)[Features](#features)[About](#about)[Install](#install)[FAQ](#faq) ## Screenshots Drag-and-drop dashboard with 40+ chart types SQL Lab, custom queries with autocomplete Tag-based separation: Dashboards vs Advanced Reports menus ## Key Features ### Self-Service Dashboards Drag, drop, and filter, 40+ chart types covering bar, line, area, scatter, heat-map, geo, time series, treemap, sunburst, sankey, and more. No engineering tickets to read your own data. ### SQL Lab Drop into raw SQL with autocomplete, query history, and saved-query libraries. Promote any query to a chart, any chart to a dashboard. ### Multi-Tenant Row-Level Security Every query is automatically rewritten to include the viewer's company filter, tenant A literally cannot see tenant B's rows, even when both render the same dashboard template. ### Project & User-Level RLS Layer project-level and user-level filters on top of company isolation. Show users only the projects they belong to and the data they own, no app-side filtering required. ### Tag-Based Menu Separation Dashboards without a 'report' tag appear under the Dashboard menu. Dashboards tagged 'report' appear under Advanced Reports. One workspace, two audiences, zero confusion. ### Drill-Down Click any data point to drill into the underlying records, same RBAC rules apply, same audit trail captures every drill. ### Scheduled Reports Email or Slack a dashboard snapshot on a cron schedule with PDF, PNG, or CSV attachment. Stakeholders read numbers instead of asking for them. ### Embeddable Read-Only Views Share dashboards in any internal portal via signed JWT URLs, viewer permissions baked in, no extra logins, no leaked data. ### Multiple Data Sources Connect to PostgreSQL, MySQL, Snowflake, BigQuery, Redshift, Athena, ClickHouse, MS SQL Server, Oracle, MariaDB, and more. Join Orangescrum data with external warehouses. ### Cross-Filter Dashboards Filters on one chart cascade to every other chart on the dashboard. Build interactive analytics surfaces non-technical users actually use. ### Custom CSS & Theming Match Orangescrum's branding or your own. Custom CSS per dashboard, theme tokens per company, dark mode support out of the box. ### Annotations & Time-Travel Annotate charts with deployment markers, releases, or incidents. Time-travel datasets to compare current vs historical for any chart. ### Caching & Performance Multi-layer caching (results, query, chart) keeps dashboards snappy. Async query execution and warehouse offload protect your operational database. ### Granular RBAC Owner / Admin / Builder / Viewer roles per dashboard. Per-database, per-schema, per-table, and per-column permissions for true zero-trust analytics. ### Audit Log Every query, drill, export, and dashboard view recorded with user, timestamp, and IP, perfect for SOC 2 and GDPR data-access evidence. ### Embedded SDK Official SDK for embedding dashboards in your own internal apps with full RLS, theme overrides, and event hooks for filter changes. ## About this plugin ### Why Advanced Reporting for Orangescrum? Most project tools ship a fixed dashboard and call it analytics. The minute leadership asks a new question, you're exporting CSVs into a spreadsheet at midnight. Advanced Reporting plugs a real BI workspace into the same data your projects already produce, visual and SQL editors side by side, secure to the row, fast at warehouse scale. ### Built for multi-tenant deployments Every query is rewritten with the viewer's company\_id filter automatically. Project- and user-level RLS layers on top so a delivery manager sees their projects, an executive sees the portfolio, and a client sees only what's been shared with them, all from the same dashboard template. The engine enforces it; the app never has to. ### Dashboards and reports, separated cleanly Tag-based menu separation puts operational dashboards under one menu and curated executive reports under another. Same engine, same data, two audiences with two completely different homes. Tag a dashboard 'report' and it moves; remove the tag and it moves back. ### Connect anything that speaks SQL PostgreSQL, MySQL, MariaDB, MS SQL Server, Oracle, Snowflake, BigQuery, Redshift, Athena, ClickHouse, Presto, Trino, Druid. Join Orangescrum data with external warehouses, financial systems, or operational databases. The query layer normalises across them, your dashboards don't care. ### Stakeholders read numbers instead of asking for them Schedule any dashboard to email or Slack on cron. Attach as PDF, PNG, or CSV. Embed read-only views in your internal portal via signed JWT URL with viewer permissions baked in. Annotations let you mark deployments, releases, and incidents on the timeline so the chart explains itself. ### Performance for the long haul Multi-layer caching (results, query, chart). Async query execution. Warehouse offload so your operational database is never the bottleneck. Tested with datasets in the tens of millions of rows and dashboards refreshing in under a second. ### What's included - Self-service dashboard builder with 40+ chart types - SQL Lab with autocomplete, query history, and saved-query libraries - Multi-tenant row-level security at company / project / user level - Tag-based menu separation: Dashboards vs Advanced Reports - Drill-down from any chart to underlying records - Scheduled email & Slack report delivery (PDF, PNG, CSV) - Embeddable read-only dashboards via signed JWT URLs - Cross-filter dashboards with cascading filters - Custom CSS, theme tokens per company, dark-mode support - Annotations and time-travel for charts - Multi-layer caching (results, query, chart) with async execution - Connectors for PostgreSQL, MySQL, MariaDB, MS SQL, Oracle - Connectors for Snowflake, BigQuery, Redshift, Athena, ClickHouse, Druid, Presto, Trino - Audit log of every query, drill, export, and view - Owner / Admin / Builder / Viewer RBAC per dashboard - Per-database, per-schema, per-table, per-column permissions - Embedded SDK for dashboards in third-party apps - Multi-tenant company-scoped data isolation enforced at query rewrite - Performance-tuned for datasets in the tens of millions of rows ### Compatibility Compatible with Orangescrum Self-Hosted Core, Business, and Enterprise editions running PHP 8.2+, PostgreSQL 13+, and Python 3.10+ for the analytics service. Designed for multi-tenant deployments, every query is automatically company-scoped at the engine layer (not the app layer). Connectors via SQLAlchemy support 30+ databases. ## Installation A self-hosted install takes a few minutes. Buy the add-on, drop the plugin into your `plugins/` directory, run the migrations, and you're live. 1. 1 ### Buy the add-on Purchase the Advanced Reporting add-on from /self-hosted/pricing, $499/year per company, payable annually. 2. 2 ### Receive your activation token and analytics service image After purchase, you'll receive a license token and the Docker image for the analytics service that powers dashboards and SQL Lab. 3. 3 ### Drop the plugin into your install Copy the SuperSet/ plugin folder into plugins/ on your self-hosted Orangescrum server. (The folder name is internal. The feature is branded Advanced Reporting.) 4. 4 ### Register and migrate Register the plugin in src/Application.php, then run \`bin/cake migrations migrate --plugin SuperSet\` to create the dashboard, instance, user, and menu tables. 5. 5 ### Bring up the analytics service Run the analytics service container (PostgreSQL 13+, Python 3.10+) and point it at a read replica or warehouse so it never touches your operational DB. 6. 6 ### Configure data sources and RLS Connect your data sources (Postgres, MySQL, Snowflake, BigQuery, Redshift, etc). Enable company / project / user row-level security. Tag dashboards 'report' to route them to the Advanced Reports menu. 7. 7 ### Build your first dashboard Open the Dashboards tab, create a new dashboard with the visual builder or jump straight to SQL Lab. Schedule snapshots to email or Slack on cron. ## Frequently Asked Questions ### Does it support custom data sources beyond Orangescrum? ▾ Yes. Connect any SQL data source, PostgreSQL, MySQL, MariaDB, MS SQL Server, Oracle, Snowflake, BigQuery, Redshift, Athena, ClickHouse, Druid, Presto, Trino, and build dashboards that join Orangescrum data with external warehouses, finance systems, or operational databases. ### How does row-level security work in a multi-tenant deployment? ▾ Every query is automatically rewritten to include the viewer's company\_id filter at the engine layer. Project- and user-level filters layer on top using project\_id and user\_id columns from your datasets. Tenant A literally cannot see tenant B's rows even when both run the same dashboard template, enforced at the SQL level, not at the app level. ### What's the difference between Dashboards and Advanced Reports? ▾ Tag-based separation. Dashboards without a 'report' tag appear under the Dashboard menu, operational, day-to-day analytics. Dashboards tagged 'report' appear under Advanced Reports, curated executive views. Same engine, same data, two audiences, two menus. Tag a dashboard and it moves; remove the tag and it moves back. ### Can dashboards be embedded outside the app? ▾ Yes. Read-only dashboards can be embedded in any internal portal via signed JWT URL with the viewer's permissions and RLS rules baked in. The Embedded SDK provides theme overrides and event hooks for filter changes so your portal can react to user interactions. ### How are scheduled reports delivered? ▾ Cron-style schedules deliver PDF, PNG, or CSV snapshots of any dashboard to email or Slack. Recipients can be users, role groups, or external addresses (with the latter requiring admin approval). Schedules are RLS-aware so different recipients receive different data. ### Will it slow down my main database? ▾ No. The analytics engine runs against a read replica, warehouse, or dedicated analytics database by default. Multi-layer caching (results / query / chart) and async query execution keep dashboards snappy without ever touching the operational write path. ### How granular is the access control? ▾ Owner / Admin / Builder / Viewer roles per dashboard, plus per-database, per-schema, per-table, and per-column permissions. Combined with row-level security at company / project / user level, you can build true zero-trust analytics, every byte of data is access-checked at query time. ### Is the audit log sufficient for SOC 2 and GDPR? ▾ Yes. Every query, drill, export, and dashboard view is captured with user, timestamp, IP, query text, and row count. Exports to CSV / JSON. The level of evidence GDPR Article 30 records-of-processing and SOC 2 Common Criteria CC6.1 logical-access reviews require.