Viewer role
Some of the people who need your numbers have no business writing SQL: a sales manager, someone in operations, an executive who reads one dashboard a week. A viewer can open the reports your team has shared, change their filters and run them. That is all they can do.
What a viewer sees
Signing in takes a viewer straight to their list of reports, not to the workspace. They open one, fill in its filters, read the table and export it as CSV, Excel or JSON. There is no editor to switch to, and no tab strip, schema browser or connection list waiting behind a menu.
The list itself is built for reading rather than for writing: reports sit in the folders their authors filed them under, each one shows its description under its title, and the search box matches both. Folders with nothing shared in them do not appear, so a viewer never opens an empty one.
A viewer never sees the SQL behind a report, not even the report they just ran. Their settings page is their own name, password and two-factor authentication.
What a viewer cannot do
- Open the SQL editor or run SQL of their own
- Read the SQL of any query, including the reports they can run
- Browse your schema, tables or columns
- Create, edit, share, import or export queries
- See or change database connections, including hostnames and credentials
- Set up scheduled exports to Google Sheets or Slack
- Reach users, company settings, billing or API keys
This is enforced on our servers, not just hidden in the interface, and the role is checked on every single request. Change someone's role and it takes effect on their next action rather than the next time they sign in.
Which reports a viewer gets
Every report your team has shared with the company, and nothing else. Private queries stay invisible to a viewer, exactly as they are to any other member. A report only reaches the list once its author has shared the query and marked it as a report, so nothing becomes visible by accident.
Making someone a viewer
An admin does this in Settings → Users. Add the person the usual way, described in inviting team members, then change their role from Member to Viewer in the list. You can move someone back to Member at any time.
The last admin in a company cannot be turned into a viewer, for the same reason they cannot be demoted to a member: somebody has to be able to let people in.
What a viewer costs
A viewer is a normal seat today, at the same price as any other member. See pricing for the current rate.
Viewers and read-only databases
These solve different problems and work well together. The viewer role limits what a person can do in SaturnSQL. A read-only database user limits what SaturnSQL itself can do to your database. If a report should never be able to write anything, do both.