Reveal BI
Architecture and Security
Abstract
This document describes architecture and security for Reveal BI Server, Reveal BI Applications and Reveal BIEmbedded.

Table of Contents
Reveal Architecture and Security ........................................................................................... 2
Reveal Cloud (SaaS) Server ................................................................................................................. 2
Reveal Cloud Architecture .................................................................................................................. 2
Multi-tenancy....................................................................................................................................................... 3
Authentication ..................................................................................................................................................... 3
Data Retrieval....................................................................................................................................................... 4
Data Sources Authentication ............................................................................................................................... 5
Data Caching ........................................................................................................................................................ 7
Dashboards Storage ............................................................................................................................................. 7

Reveal Client Applications: iOS, Android and Windows...................................................................... 7
Data Security ........................................................................................................................................................ 8

Reveal Embedded – Architecture........................................................................................................ 9
Reveal SDK for Native Applications (Windows, iOS and Android) ....................................................................... 9
Reveal SDK for Web Applications....................................................................................................................... 101

Reveal Architecture and Security
Reveal Cloud (SaaS) Server
Reveal Cloud is an online service that allows you to create BI (Business Intelligence) dashboards
and visualizations by pulling data from different data sources. These dashboards can later beshared with other users (inside or outside your company).
This document describes the Reveal Cloud architecture. It’s also focused on security anddescribes how users are authenticated, how data is retrieved from data sources and what
information is stored in the cloud platform, including how authentication is handled and stored.

Reveal Cloud Architecture
The following diagram shows the architecture of Reveal Cloud Server:

For clarity, the diagram shows a single container and a single instance for each service, but thearchitecture is actually based on Microservices, which means that at a given moment there
might be multiple instances of any of the services, based on the current system load andconfiguration.

2•Reveal uses the Identity Service for authenticating users, as it will be described later it
supports authentication against multiple providers like Google or Microsoft Office 365.

•Dashboards, Teams and Organizations are the services that handle information stored
in a JSON database. These services provide storage for dashboards documents as well as
membership, permissions and sharing for teams and organizations.

•Query Service is the core data transformation component, used to retrieve data fromdata sources, cache it and transform it according to the visualizations defined indashboards.

Data and files are cached to improve performance and to implement some of the datatransformation features (like joining data form multiple data sources through the Data Blendingfeature).

Multi-tenancy
The server has the ability to separate data and services based on tenants. A given Organization,for example, might be configured to use a separate storage area, which means all data (Teams,Dashboards and even cached data) will be stored on a dedicated storage and even services atruntime might be isolated. This ensures that performance for that Organization will not beaffected by the load of the rest of the system.

Authentication
Reveal Cloud authentication is performed using the OpenID Connect (OIDC) standard. The
Identity Service component displayed in the previous diagram provides secure authentication
against multiple authentication sources: Google, Office 365 and Infragistics accounts.

Authentication Flow
Reveal authentication follows the standard flow for OIDC authentication as you can see in thefollowing diagram:3

It’s important to note Reveal never has access to the user’s credentials as they are entered in apage provided by the authentication provider (Google, Microsoft or Infragistics), theauthentication provider then redirects the user to Reveal with an access code (step number 4).
Reveal then uses this code to get user information (such as e-mail address that is used toidentify the user in Reveal) and tokens that will be used to access some other services (likeGoogle Drive for Google accounts or SharePoint and OneDrive for Microsoft O365 accounts).

Data Retrieval
Reveal supports multiple data sources, such as:• Relational databases (MS SQL Server, MySQL, and others)• Data files (CSV, Excel, and JSON from Google Drive, Dropbox, etc.)• Cloud services (Salesforce, Dynamics CRM, and more)
Reveal takes advantage of the processing capabilities from each provider, for example when
getting data from SQL Server filters are applied in the SQL query used to retrieve data, but inthe case of Excel files data is filtered as part of Reveal data transformations.
For providers like SSAS (Microsoft Analysis Services) that provides a rich querying andaggregation language most of the data processing is performed in the data source, and only
some transformations like calculated fields are performed as Reveal data transformations.

4

Data Access Flow
The next diagram shows how data is processed for a sample request (a CSV file downloaded
from a file provider like Dropbox).
As you can see data flows through a processing pipeline, this pipeline is configured according tothe data source in use (CSV in this case) and the transformations applied to it (filtering,aggregation, etc.).

Data Access Restrictions
As a SaaS solution, Reveal Cloud Server is running on a cloud platform and thus might not haveaccess to data sources located inside your company, like a database server.
You can still access data on those servers using the client applications (Windows, iOS a ndAndroid platforms). When trying to open dashboards using “in-house” data in the Web version
you’ll see a connection error because the server cannot access data behind your corporate
firewall.
In the future, Reveal will include a data agent service that can be installed inside your corporate
network and will provide access to your data even when using the cloud platform. In themeantime, if you need to open dashboards in the Web version using data from relational
databases (or other in-house data sources) you’ll need to publish them to be accessed from theInternet.

Data Sources Authentication

5

Each data source provider requires a different authentication method. Reveal supports fourtypes of authentication:• Anonymous• User/password• NTLM: user, password, and domain• OAuth v2
For those providers requiring user/password authentication (like a Web Resource using
Basic/NTLM authentication, etc.) credentials are stored in a secure storage, used only in thecloud platform and never sent to client applications.

OAuth Data Sources
For those providers supporting OAuth (like Google Drive, Dropbox, OneDrive, and others)
Reveal will redirect the user to the authentication page provided by the data provider
requesting permissions to access its data.
Once the authentication is complete, Reveal will store the authentication tokens to access thedata on behalf of the user across all supported platforms.
Please note for OAuth providers Reveal never has access to the credentials entered by the user.
Credentials are entered only in the page served by the provider (Google for example) andReveal receives only a token, that will be securely stored in the cloud platform. This token
might be revoked by the user in case the access from Reveal needs to be disabled.

6Data Caching
For performance reasons, and to support some of the advanced data transformation features,data retrieved from external data sources will be temporarily stored securely in our cloud
platform. This applies to both data retrieved from databases or online services and files, such as
CSV, Excel, and others, or downloaded from content providers including Google Drive, Dropbox,and more.
This data is automatically cleaned up based on expiration settings configured in the dashboard
using this data.

Dashboards Storage
Dashboards are JSON documents describing where to get the data from, how to transform itand what visualization to use.
No sensitive data like credentials is stored in dashboards, only data identifying the data source(like URL, host name, etc.), metadata information (like table or field names) and filters (like thelist of selected countries) is stored in this JSON document.

Reveal Client Applications: iOS, Android and Windows
In addition to using Reveal within a web browser you can also install native apps for the mostpopular platforms: Windows, iOS and Android.
• Authentication on these apps is performed using the Reveal Cloud platform, with thesame OIDC authentication protocol.
•Dashboards, Teams and Organizations are also retrieved from the Reveal Cloudplatform, granting the user access to the same dashboards used in the Web platform.

•Data is directly accessed from data sources and not retrieved from the cloud platform.
This means you can access data in your local network, even when that data is notaccessible to Reveal Cloud.

If you’re on the go and need to open dashboards accessing data from your corporate network,
you’ll need to use a VPN solution.
As data is directly accessed from these native apps, there is no need for a server component to
be installed in advance for you to use Reveal on your device, you just need to install the app on
your device and log in using the same credentials you use to access Reveal Web.

7

Data Security
To improve performance, Reveal stores cached data locally in the device to minimize thenumber of queries sent to the server or database.
Credentials to access data sources are also stored in the device as they are requested only
when the data source is configured or used for the first time. This means that sensitive
information is stored in the device.
Reveal, therefore, takes advantage of the security capabilities available on each device.

iOSIn iOS devices, the passwords are stored in the device’s Keychain. As long as a passcode is set
on the device, cached data and the local database is stored using iOS Data Protection, whichmeans all files will be encrypted as soon as the device is locked. This feature is provided by iOS
itself and ensures the best performance.

Desktop and Android
In Desktop and Android, all passwords are encrypted before being stored.
Cached data stored in local databases is also encrypted.

8Cache files are not encrypted as there is no feature similar to iOS’ “Data Protection.” For theseplatforms, we recommend using MDM platforms, which will help keep data secure.

Reveal Embedded – Architecture
Reveal Embedded allows developers to embed Reveal into their applications, and dashboards
can be displayed and even modified by end users. Reveal SDK can be used to integrate Reveal
into applications developed in multiple platforms and technologies: Web, Windows WPF andWindows Forms, iOS and Android.
The containing app can use Reveal SDK to:•••••

Provide in-memory data to dashboards. If data is already loaded in the containing
app there is no need to store it before opening the dashboard, Reveal can use thebuilt-in In-Memory data provider to use that data as the input for the dashboard.
Configure the dashboard before it gets rendered, for example changing the name ofthe database or table to use to get the data based on the current user.
Change dashboard filters before the dashboard gets rendered or even while it’svisible. The containing app can use this feature to synchronize filters or selections in
the app with the data visualized in the dashboard.
Get notified when a data point is selected in the dashboard (like a bar in a chart isclicked), for example to display additional information or trigger an action in the app
like navigating to a page with more details.
And much more features you can read about in the Reveal Embedded Dev Guide.

Reveal SDK for Native Applications (Windows, iOS and Android)
When Reveal is embedded in an application (Windows Forms, WPF, Windows Forms, iOS orAndroid), the Reveal SDK is provided as a library or framework that is integrated into the app(the integration steps are different for each platform, for more details check the Reveal
Embedded Dev Guide). The containing app creates a RevealView object configured with thedashboard to render, this view is displayed in the containing app and then a set of callbacks canbe used to customize how the dashboard is rendered and what data is used.
RevealView component provides rendering and data transformation capabilities(automatically through the Reveal Engine), but it does not handle the storage of dashboards orcredentials. The binary contents (.rdash file, which is a ZIP file format) that contains thedefinition of the dashboard must be provided by the containing app. This allows the container
app to handle how dashboards are used and shared by end users (for example they can bedownloaded from an internal server, bundled as resources in the app’s binary, stored in filesystem, etc.).

9

Regarding credentials, when getting data from databases or other data sources requiring
authentication usually the containing app already handles these credentials by loading themfrom configuration files or storing them in a secure storage. Reveal delegates the storage andhandling of these credentials to the container. The app might decide to return internal
credentials or to prompt the user for them, if needed.

Reveal SDK for Web Applications
When embedding Reveal into web applications, the architecture is a little bit more complex as
two components are involved:•Reveal Client SDK: a set of JavaScript libraries and CSS files that needs to be
integrated into the web application. The frameworks supported today aredistributed as a Web Component with support for jQuery, Angular and React client
libraries / frameworks.

•Reveal Server SDK: the server-side component that you integrate into your serverapplication. This currently ships for both ASP.NET Core (.NET 4.6.1 or later) and Java.

In the following diagram you can see what’s the architecture for a web application embedding
Reveal Web SDK.

10

As you can see it works pretty much the same way as it works for native apps with thedifference that some of the callbacks are invoked in the client side (like the event sent when adata point is clicked) and some others server side (like the callback to load the dashboard or toprovide in-memory data).

Deployment
The SDK server-side component is a set of ASP.NET Core libraries (supporting both .NETFramework, ASP.NET Core and Java), this allows the deployment into both on-premises or cloudapplications.
For cloud applications, it can be deployed to multiple cloud containers like AWS, Azure, etc. andmultiple platforms like Windows or Linux.
Reveal SDK can also be easily integrated into multi-tenant applications where multiple instancesof the SDK component might be running at the same time, each of them configured with its
own resources such as cache storage, credentials management, and dashboard processing.

11