Private Preview - features may change without notice
GramSpec
Architecture Spec API Reference Pricing About
Start free

Share it · 17

A board on your customer's own site

The answer to “can our customers see their own numbers without an account with you?” A board is shown inside a page you own, to people who never sign in to us, and what each of them can see is decided on our server, not in their browser.

A board embedded on a customer's own site. One flow makes the link, by hand in Vision or by the customer's server through the GRAM API. The other is a visitor's browser loading the framed board and each tile's query running read-only on the owner's database.YOUR SITEGRAMSPECYOUR DATAYou, the board's ownersigned in to GramSpecYour web serverholds your API keyYour web pageThe framed boarda frame on our addressYour customerno account with usVision: ShareAnyone with a linkGRAM APIa link for one viewerSharesthe link's hash,allowed sites, expiry,pinned rowsThe embed page/embed/p/{link}Tile querylink checked, pinned rowswritten into the SQLYour databaseread-only1233412345 A board embedded on a customer's own site. One flow makes the link, by hand in Vision or by the customer's server through the GRAM API. The other is a visitor's browser loading the framed board and each tile's query running read-only on the owner's database.YOUR SITEGRAMSPECYOUR DATAYou, theboard's ownerYour web serverholds your API keyYour web pageThe framed boarda frame on ouraddressYour customerno account with usVision: ShareAnyone with a linkGRAM APIa link for one viewerSharesthe link's hash,allowed sites, expiry,pinned rowsThe embed page/embed/p/{link}Tile querylink checked, pinnedrows written into theSQLYour databaseread-only1233412345
Blue circles make the link. Green squares are one visitor loading the page.

Making the link

  1. You make the link in Vision. In the Share menu, under “Anyone with a link”, you say who it is for (a customer portal, a figure on a page, a pack to read once, or each viewer their own rows), which sites may show it, when it expires, and any slicer you pin.
  2. Or your server asks for one, for each viewer. When a customer is signed in to your own site, your server calls the GRAM API with your key and gets a link that lasts minutes (ten unless you say otherwise, four hours at most), with that customer's rows pinned.
  3. Only the link's hash is kept. The link is a random token, shown once. We store its hash beside the allowed sites, the expiry and the pinned rows. A pin is checked against every tile on the board at this moment, and refused with the list of tiles it could not hold, so a tile can never show every customer's rows later.
  4. The link goes into your page. As a frame and one script you paste once, for a link you made by hand, or written into the page by your server on each visit.

A visitor opens your page

  1. Your customer opens your page. They never sign in to us and never see the rest of the product.
  2. The frame asks for the board by its link. An unknown, a revoked and an expired link all get the same “not found”, so trying links teaches nobody anything.
  3. The browser is told which sites may show it. The share's allowed sites go out as a header with the page, and the visitor's own browser refuses the frame anywhere else.
  4. Each tile is asked for with the link, never a cookie. The link alone decides what comes back, so someone signed in to GramSpec in another tab sees exactly what a stranger sees. A tile that is not on this board is “not found”.
  5. The query runs on your database, read-only, with the pin inside it. It uses the owner's saved connection. Pinned rows are written into the SQL on our server, and a visitor's own filter on a pinned column is dropped first. A tile the pin cannot reach says it is not available; it never falls back to every row. Each run is logged.

When the frame shows nothing. A frame the browser blocks cannot say why, because it never runs. So the one script on your page listens for the board, and if it hears nothing in four seconds it shows the sentence you wrote for that case.