Enterprise Launch Guide

How to Use this Guide

This guide is for admins and leaders at larger organizations. It covers best practices for implementing Row Zero at scale and the necessary actions to configure your account, connect your data, and launch to end users.

Overview: What is Row Zero?

Row Zero is a modern spreadsheet built for enterprises. It’s fast, secure, and connects directly to your data. Unlike conventional spreadsheets, Row Zero runs in the cloud instead of on employee laptops. This has two advantages:

Compute can be scaled up to handle large data sets.
Sensitive data is trapped securely in the cloud.

Row Zero combines the security and governance of an enterprise data platform with the flexibility of a spreadsheet, giving teams the familiar interface they want while keeping data protected, auditable, and integrated with your organization’s existing controls.

Key Concepts

Row Zero is structured around a few entities that define how data is organized and shared. Understanding these first will help you align Row Zero with your existing data infrastructure and apply your organization’s governance model consistently.

Workspaces are a security feature that allow admins to isolate sensitive data. Each workspace has its own membership, security policies, and connections that are isolated from other workspaces in an organization. Every workbook belongs to a single workspace, though users can belong to multiple. By default, all Enterprise customers begin with a single, enterprise-wide workspace.

Connections are integrations with external databases, data warehouses, or cloud storage. They can be configured to allow querying, writeback, or both. Connections handle authentication and permissions. Row Zero supports common authentication methods, including OAuth.

Workbooks are spreadsheets that contain data, formulas, and/or visualizations. All workbooks are private when created, but can be shared according to your organization’s policies. You can import data from connections into your workbooks by directly querying connections or inserting data from a data source.

Data Sources are published queries that can be shared with other Row Zero users. They are used to manage governed “source of truth” datasets or to give less technical users direct access to live data without writing SQL.

Set Up Your Account

Setup is quick, and can typically be done over a few short sessions between Row Zero’s customer success team and your database and IT admins.

User Authentication and Provisioning (SSO & SCIM)

Like other apps in your productivity suite (e.g. Office, Google Workspace, Slack), Row Zero works best when everyone in your organization has access. Broad adoption makes collaboration seamless and keeps your data secure, so we recommend enabling SSO and SCIM for all potential users at setup.

Row Zero uses just-in-time account provisioning for Business and Enterprise accounts. Users are automatically created when they log in for the first time. If your organization syncs groups with SCIM, new users automatically inherit access to any workbooks, connections, or data sources shared with their assigned groups within Row Zero.

Row Zero has two user roles:

Users: This is the default role in Row Zero. Users can create workbooks and data sources, and can also collaborate with others, within the bounds of a workspace’s sharing policies.
Admins: Admins have additional privileges, including managing membership, configuring security and sharing policies, and creating workspaces.

Action: For secure, streamlined user management at enterprise scale, schedule an integration call to:

Enable Single Sign-On via SAML or OIDC. For seamless sharing and secure data control, we recommend enabling access to your full organization.
Sync users and groups via SCIM for automated user provisioning and to manage group sharing, ensuring access within Row Zero remains in sync with your IdP.
Assign your Admin(s).

Private Storage

Row Zero is a stateful service. Unlike BI tools that issue queries to your data warehouse and present the results, Row Zero workbooks allow users to perform data entry, upload files, and import data from databases and APIs. Workbook data is encrypted and saved in cloud storage.

Configuration options:

Row Zero storage (default): Workbook data is securely saved in Row Zero-managed cloud storage.
Private storage (optional): Enterprise customers may elect to use their own cloud storage to satisfy security requirements. In this mode, customer data exists in memory on Row Zero servers when a workbook is active, but it’s only persisted to your cloud storage account. For optimal performance, it is important to set up cloud storage in every region where your users are located (e.g. US West, US East, and Europe). At minimum, you should set up cloud storage for Row Zero in at least two regions for redundancy.

Action: Decide whether to use Row Zero-managed storage or your own storage. If you choose private storage, schedule a call with your customer success team to complete setup.

Row Zero is built with enterprise security concerns in mind. The following policies can be configured for your workspace:

Sharing policies for connections, data sources, and workbooks
Export policies for downloads and copy/paste
Workbook lifecycle policies
Network isolation policy
Region lock to satisfy data residency requirements

These policies can be viewed and modified by workspace admins on the Workspace Settings page in Row Zero. Our default policies are designed to balance security needs with business needs, and are appropriate for most security-conscious organizations.

Action: Work with your customer success team to review our default policies and, if needed, update your workspace policies to align with your organization's business needs and security posture.

Additional Workspaces

By default, all Enterprise customers begin with a single, enterprise-wide workspace. Enterprise customers can optionally configure additional workspaces if they need to organize data or projects into secure, isolated environments within their account. Each workspace has its own membership, security settings, and connections that are isolated from other workspaces in an account. Each workbook, connection, and data source belongs to a single workspace, but users can belong to multiple. Common use cases:

Workspaces for different business units in a large company
Workspaces with different security settings (like share settings, export restrictions, region lock, or data retention)
Client-specific workspaces when collaborating with external partners

Action: Work with your customer success team to configure additional workspaces, if needed.

Connect Your Data and Publish Data Sources

Connections

Connections make it easy to import and analyze big datasets, automate updates, and write back to your data warehouse. Row Zero supports connections for all major data warehouses, including Databricks, Snowflake, Redshift, and BigQuery. There are a variety of options to connect to your data warehouse securely, including via AWS PrivateLink.

Recommended setup pattern:

OAuth connection: For users with individual database credentials. Any queries using OAuth connections respect the database permissions of the person who runs the query.
Service account connection: For shared credentials across groups. Queries using service account connections use the same database user and permissions for anyone running a query. Service account connections support common authentication methods: password, key pair, access token, IAM authentication, etc.

Links to integration documentation:

Action: To get immediate value out of Row Zero, configure all of your connections before launch.

Create an OAuth connection for all users who have their own database credentials. This can be done on an integration call with your Row Zero customer success team.
Create one or more service account connections for users who don’t have their own database credentials. Share these connections with your entire workspace, with groups synced via SCIM, or with individuals.

Data Sources

Data sources are reusable, published queries. They’re the foundation of governed, self-service access to data, enabling you to expose live datasets to business users without writing SQL or copying results between tools. If you publish an update to a data source, any workbook using that data source will automatically update, ensuring everyone works from the same source of truth.

Data sources can be backed by either OAuth connections or service account connections.

If the intended data source users have their own accounts to your data warehouse, your data source should use an OAuth connection. In this case, the data source will run using the credentials for the end user (whoever clicks “Run”) and any data access control mechanisms will be enforced, including row level security (RLS) and role-based access control (RBAC).
If your intended data source users do not have their own accounts to your data warehouse, you should use a connection backed by a service account. In this case, the data source will run using the service account credentials.