Share & Export

Sharing & embeds

The Share button on the dashboard canvas covers every way a dashboard reaches people: public links, embeds in your own apps, scheduled email delivery, and per-user access inside the workspace.

Open a shared link

A person who receives a link opens it without an account. A password-protected link asks for the password first.

Open the link you were sent. If its owner protected it with a password, the page asks for it. You do not need an account.
A wrong password shows Incorrect password. Please try again. Check it with the person who shared the link.
Enter the password. Guide V - Sales explorer opens on its own, without the workspace menus. You can explore what the owner chose to share, but nothing else in the workspace.

The Share dialog has a public link (with password and expiry) and per-person access.

Choose Share in the toolbar. The Share dashboard dialog has tabs for a public Link, Phone, Embed, Schedule and Access.
Access lists the people and groups who can open or edit the dashboard, each with a permission. Add someone here to share with them directly.
For a public link, you can require a password and set an expiration date before you generate it.
Create link creates the address. Copy it to share the dashboard with people who do not have an account. Revoke turns the link off again.

Generate a public link (/s/<token>) — anyone with the link can view. Two protections, both optional:

Password — visitors are prompted before anything renders.
Expiration — pick a date and the link stops working after it.

What a link visitor gets

The dashboard exactly as authored, read-only and live: they can use filter cards, cross-filter by clicking chart points, and set parameters if the author defined them. Drill-through to other dashboards is disabled (the target isn’t shared). Shared reports render read-only with their promptable filters.

A multi-page dashboard keeps its page tabs. The open page is part of the link (/s/<token>?page=<page-id>), so you can send someone straight to one page; a page that is hidden or no longer exists falls back to the first page.

Row-level security. A link’s visitor has no identity to filter rows by. On a public or password link, a card on a data model that a row-level security policy binds is not shown, and a card or a report block that reads a saved query runs as the person who made the link, as they are in the workspace now: it is not shown when a policy on the query’s source applies to them. The card says You don’t have access to this card’s data; a report’s block says This block’s rows are limited by row-level security, so it is not shown on a shared link. When the person who made the link has left the workspace, they hold no role there, so a policy aimed at a role refuses it too.

Within the workspace, sharing is governed by roles plus per-dashboard grants — members see dashboards according to their role, and the Access tab can open a specific dashboard to specific members beyond that.

Both the Link and Embed tabs carry an Ask AI for viewers toggle, off by default — turning it on is an explicit publisher choice, never a side effect of minting a link. As the toggle says, your workspace’s AI credits pay for viewers’ questions. Once enabled, viewers get a floating Ask AI button that opens a small chat panel over the shared view.

The agent is scoped strictly to that one share: it answers only from the cards on that dashboard or report, through token-scoped tools, with no visibility into anything else in the workspace.

The conversation is kept on the server. The panel sends the viewer’s question and the conversation’s id, never the conversation itself. The AI reads back only what the server stored: the last four questions and their answers.
A conversation ends 30 minutes after its last answer. The panel then says “This conversation has ended” and puts the question back in the box; sending it starts a new conversation.
The hourly limit belongs to the share. Every viewer of the share, through its link or its embed, draws on one allowance per clock hour: 20 questions unless you set another limit, from 1 to 1,000, with aiRatePerHour on PUT /api/shares/{id}/ai. It is counted on the server, so a restart doesn’t reset it. A viewer who reaches it sees “reached its Ask AI limit for now” rather than a generic error.
The workspace’s AI controls apply: those of the workspace the shared dashboard or report is in, whichever workspace you are signed in to. While AI, or Ask AI on shares and embeds, is switched off there under Administration → AI, or your role there doesn’t include it, viewers see no Ask AI button and the toggle can’t be turned on (the app says why). A share whose Ask AI was already on keeps its toggle on and says Paused: the AI controls have paused it, and viewers are offered Ask AI again, with nothing to turn back on, once they allow it. You see it under Your links to this dashboard. When the workspace’s monthly AI credit budget is used up, viewers are told Ask AI isn’t available right now, and nothing more.
Viewers’ questions run on your behalf. If your role loses Ask AI on shares and embeds, or you leave the workspace, your shares stop offering Ask AI until it’s back. Their questions count toward the workspace’s AI budget, not your own. See Control AI in a workspace.
If the server has no AI configured, the panel says so plainly instead of hanging. When the server can’t keep the conversation or count the limit, it refuses the question, and the panel asks the viewer to try again later.

Your links to a dashboard

The Link tab lists the links you have made to the dashboard under Your links to this dashboard, newest first: each one’s kind (public or with a password), when you made it, when it expires and how many times it was viewed, with its own Ask AI switch. Show more links reads the next 20. A link whose Ask AI is on but paused by the AI controls says Paused under its switch. The link you have just made shows above the list, with its address, and joins it when you choose Create new link. The list shows your own links only; their addresses are shown only when they are made.

Turning Ask AI on is done in the app: an API key can turn it off, but not on. Through the API, a share (GET /api/shares, POST /api/shares, PUT /api/shares/{id}/ai) carries allow_ai, the switch as its publisher set it, and ai_offered, whether its viewers are offered Ask AI now: allow_ai on with ai_offered false is a share the AI controls have paused.

Embeds

A share link embed shows the same view to everyone who has its token. To show each person of your product their own rows, with their views and Ask AI counted per person and per tenant, use an embed app instead: Embed dashboards for each person.

The Embed tab produces a copyable snippet in two flavors:

iframe — https://<your-host>/embed/<id>?token=<token> with sensible sandbox attributes. Add &page=<page-id> to open a multi-page dashboard on a specific page. Switching pages inside an embed never adds entries to your page’s browser history, so your visitors’ Back button still leaves your page.
React — a <DataSquaresEmbed> component from @digisquares/datasquares-embed-react for React apps. See the React embed SDK guide.

Locking embeds down

Add allowed domains — the embed refuses to render anywhere else (“Domain not allowed”). Badges on the tab summarize the current config: toolbar visible/hidden, export allowed/disabled, domains.

How the check actually works: the content request that loads an embed’s data is issued by JavaScript running inside the iframe, so its Origin is always the DataSquares app itself — first-party, and useless for judging who framed it. The embed resolves its own framing page (via the browser’s ancestor-origin info, falling back to document.referrer) and declares it in a request header; the API checks that against your allowlist instead. A host that can’t be resolved — a hidden referrer, a sandboxed parent — is treated as an unidentified origin and fails closed under a restriction: hiding who you are is never a way through.

The browser enforces the same list too: on DataSquares Cloud every embed page is served with a frame-ancestors policy built from your allowed domains, so a page that isn’t on the list can’t even frame the embed. A bare domain allows it over https and http; *.acme.com covers subdomains only, not acme.com itself. With no allowed domains, embeds can be framed anywhere.

Branding

The Embed settings panel carries a logo shown in every embed on that share, next to the dashboard’s theme and the snippet’s primary color and light/dark mode, so an embedded dashboard fits your product. Every embed also shows a small Powered by DataSquares credit: DataSquares does not offer white-labelling, and embeds do not accept custom CSS.

Usage

The same panel rolls up embed activity per share and per day — views, chart clicks, filter changes and page switches — so you can see which embeds are actually being used rather than merely deployed.

Customizing the embedded view

Query parameters control presentation: toolbar (show/hide), theme (dark), primaryColor, logoUrl (your logo instead of the default), and p_<id>=value to preset parameters. Embedded views keep the interactive toolkit — cross-filters, slicers, parameters — plus Full screen in the toolbar, and prompt for the password when the share is protected.

Full screen on a link or an embed

Full screen (in a link's header, or in an embed's toolbar), or F anywhere outside a text field, shows the dashboard or report alone in your browser's full screen: no menu, no header, no toolbars or panels. Move the pointer, tap the screen or pressTab (the control is the first stop) to show the small Exit full screen control at the top right; it hides again after 2 seconds. Esc or F leaves, and puts you back on theFull screen button. A screen reader hears it go in and out.

In a desktop browser's full screen the browser takes Esc itself: it leaves full screen first, and a card's Expand, a dialog or a list you opened stays open, to close with its own control or a secondEsc. Where the view fills the window instead (below), Esc closes what is open first.

A dashboard’s pages and parameters move into the exit control, and its cross-filters stay listed over the cards; Ask AI is not shown until you leave. A link and an embed keep their Powered by DataSquares line. For the browser’s own full screen, the page that embeds it gives the frame the permission: allowfullscreen on the iframe.

Where the browser doesn't allow full screen (a page embedded without the permission, Safari on an iPhone), the same view fills the window instead, and says so once.

Scheduled delivery

The Schedule tab emails the dashboard on a cadence — the server renders it (through the report export pipeline) and delivers the file, no browser involved.

Frequency & time — daily, weekly (Monday), or monthly (the 1st), at the time you pick, in your timezone.
Format — PDF, Excel, CSV, or PowerPoint.
Recipients — any email addresses; add as many as you need.

A schedule sends the dashboard as the person who created it sees it, with their data permissions, to everyone on it. So only that person or a workspace admin can change its recipients or the filters it sends. Anyone else who can edit the dashboard sees the recipients as they are when editing the schedule, with Email me this dashboard beside them, and can still change the rest of the schedule, such as its timing and format. To get the dashboard yourself, subscribe: your copy shows what you can see.

When someone other than a schedule’s creator or a workspace admin changes what the dashboard shows (its cards or pages, by hand, by restoring a version or through the AI assistant), the schedule pauses for review, and its creator is told in the app. The same happens when they change something its cards read without opening the dashboard: a data model (a field, measure or table added, changed or deleted, a relationship between its tables, a table’s transform steps, a schema sync or table import, or an earlier version restored), a field the filter pane names, even when only query cards use it, the SQL of a saved query a card runs, or the definition of a metric a KPI shows. The tab says why, for example Waiting for its creator: Carol changed the metric “Revenue” on 2026-10-23 14:51. Only the creator or a workspace admin can resume it, after checking what it now sends. Their own edits pause nothing, nor does a new name or theme, and subscriptions never pause this way: they send each person their own view.

A schedule sends the dashboard’s filters (the filter pane’s page and all-pages filters) as they were when its creator made it. The editor saves the filter pane as you use it, so anyone can try other filters without pausing a schedule or changing what it sends. When the dashboard’s filters have changed since, the tab says so, and its creator or a workspace admin can choose Use current filters; resuming a paused schedule also makes it send the filters as they are then, and a paused schedule whose filters have changed says so before you resume it. A schedule made before this release, or made by the AI assistant, keeps the filters it is sending: it takes them as they are at its next send, or just before someone other than its creator or a workspace admin first changes them.

A filter finds its field by the field’s name or id, so a field that a card, the filter pane, a schedule’s filters or a metric still uses can’t be deleted, and a new field can’t take the name of another field of its table, or of a column one reads. Should a filter a schedule sends still come to name a field its data model no longer has, that send is skipped rather than sent without the filter: the schedule’s creator is told in the app, once for each new reason, and the delivery history says which filter to correct.

Existing schedules are listed on the tab with a pause/resume switch and a delete button. Delivery history lives with the rest of the report schedules, which dashboards share under the hood: a new, re-timed or resumed schedule first sends at its next time, and a send that fails is tried again for about an hour before its creator is told in the app.

Anyone who can open a dashboard can also have it emailed to themselves on a schedule, the way report subscriptions work: the email goes only to you, the dashboard is rendered with your own data permissions, and you can re-time, pause or cancel it at any time. If you lose access to the dashboard, the deliveries stop. On the web, open the dashboard and choose More → Email me this dashboard to subscribe, pause, resume or unsubscribe; the Manage this subscription link in every subscription email opens the same place. The mobile app lists your subscriptions too. Author schedules and personal subscriptions never mix — an author can’t see or change yours.

Access (per-user grants)

The Access tab opens this dashboard to specific workspace members. Grants sit on top of roles: a member’s role is the floor, and a grant elevates their access to one dashboard only — it never takes anything away.

Viewer — the member can open this dashboard even if their role can’t view dashboards at all. Their dashboard list shows the ones shared with them.
Editor — the member can also edit this dashboard (layout, cards, settings) even if their role can’t edit dashboards.

Search members by email or name, pick the permission, and Grant. Granting someone who already has access updates their permission — that’s how you move a viewer to editor (or back). Revoke removes the grant; the member’s role-based access, if any, is untouched.

Managing access requires the same right as editing the dashboard: an editor role or an editor grant on it. Grants apply to workspace members only — for people outside the workspace, use a share link instead.

Exports — PDF/PPTX/PNG instead of a live link.
Reports — paginated reports with scheduled delivery.
Users & roles — role-based (workspace-wide) access.
AI chat — the same governed agent, unscoped, for signed-in workspace members.