01 / SSOSingle sign-on for your identity provider
On the Enterprise plan, our team builds a single sign-on connector for the identity provider you already use, to match your requirements. Connectors use standards such as SAML 2.0 and OpenID Connect, and Okta is already supported. Your team then signs in to Draxlr the same way they sign in everywhere else.
- A connector built for your provider
- SAML 2.0 and OpenID Connect
- Okta already supported
Best forCompanies that manage access through an identity provider
02 / AccessRole-based access levels
Every member gets an access level. Admins manage the workspace, members and billing. Full members build databases, queries, dashboards and automations. Read members view and run existing work without changing it, and Dashboard members see only the dashboards assigned to them. The Enterprise plan supports custom access levels.
- Admin and Full
- Read and Dashboard
- RLS members
- Custom levels on Enterprise
Best forTeams where builders and viewers need different rights
03 / RLSRow-level security
A permission sets which tables a member can query and which rows they see, and it's attached to an RLS group. Two members can run the same query and get different results. Row-level security applies across dashboards, saved queries and the AI assistant, and to embedded customers through values your backend sends with the embed token. It's available on the Power plan and above.
- Row rules per permission
- RLS groups and attributes
- Enforced in embeds and AI
Best forMulti-tenant SaaS and teams with data access rules
04 / AuditAudit logs
The Enterprise plan includes audit logs, so security and compliance teams can review activity in your Draxlr workspace. In self-hosted deployments the logs stay on your own servers, and application logs can be shipped to your own AWS CloudWatch.
- Included on Enterprise
- Kept on your servers when self-hosted
- Application logs to AWS CloudWatch
Best forRegulated teams that report on access