SQL
A governed workbench for writing and running analytical queries.
Customer-controlled governed analytics
One governed path from sign-in to storage.
Clarté provides governed analytical SQL over customer-controlled object storage with clear policy, execution, and deployment boundaries — one platform instead of a bundle of controls that drift apart.
BUILT ON DUCKDB · DUCKLAKE · POSTGRESQL · KUBERNETES · S3-COMPATIBLE STORAGE
The governed session
What actually happens when someone runs a query.
Six steps, one chain. Each step hands verified context to the next — break any link and the session fails closed instead of falling back.
- 01Authenticate against your OIDC issuer
Every session starts at the identity provider you already run. Groups and claims map to Clarté roles — there is no separate user database to keep in sync.
- 02Policy is compiled for the session
Row filters, column masks, and dataset grants are resolved before a single statement runs. The policy that applies is the policy that executes.
- 03A scoped storage credential is minted
The control plane issues a short-lived object-storage credential — 15-minute maximum lifetime — limited to the prefixes the session's roles permit.
- 04SQL executes on DuckDB and DuckLake
One deliberate analytical runtime plans and runs the query through policy-shaped views. No cluster of engines to babysit.
- 05Storage reads stay inside the credential's scope
The engine can only reach what the credential allows. Your object store's own access control is the final boundary — not a string check in the SQL layer.
- 06The attempt becomes a durable audit record
Identity, policy version, credential ID, and outcome land in one correlated record. Allowed and denied attempts both leave evidence.
Five governed surfaces
The whole platform in the browser.
Analysts, platform owners, and auditors work in the same place — five surfaces over the same governed path, not five products with five access models.
Catalog
Datasets, schemas, and the access rules attached to them.
Queries
Execution history with status, ownership, and runtime context.
Audit
Identity, policy decision, and storage scope in one record per attempt.
Admin
Platform health, governance state, and configuration.
03 / Connections
Speaks the protocols your tools already use.
Clarté exposes the Postgres wire protocol alongside HTTP and Arrow Flight, so existing BI and SQL tooling connects the way it connects to Postgres. Compatibility is documented in tiers — Apache Superset ships as the bundled reference fixture (Apache-2.0), and protocol behaviour is the tested contract.
- pg-wire:5432
- The Postgres wire protocol used by common BI and SQL tools.
- HTTP:8080
- Lightweight programmatic access for services and applications.
- Arrow Flight:8815
- High-throughput result transfer for data-science clients.
Narrow by design
What Clarté deliberately is not.
A platform you can trust is one that states its boundary. These are decisions, not gaps.
Not a distributed query engine
One query runs on one node, scaled vertically. Shuffle-heavy, petabyte-wide workloads belong on a distributed engine — and the evaluation will say so.
WHY — most bounded workloads never need a shuffle, but every team pays to operate the machinery for one.Not a streaming platform
Ingestion latency is seconds to minutes, by design. If sub-second delivery is the requirement, put a streaming system upstream.
WHY — pretending batch is streaming produces platforms that do neither well.Not a governance suite
No lineage UI, no data-quality engine, no catalog of catalogs. Clarté governs access on its own query path and does that completely.
WHY — enforcement you can prove beats dashboards you have to trust.Not a managed SaaS
You run Clarté in your own Kubernetes environment. There is no vendor-hosted control plane and no third party in the data path.
WHY — deployment control is the point, not an inconvenience to abstract away.Next step
Check it against a workload you actually run.
The fastest way to evaluate Clarté is with your own query shapes, roles, and deployment constraints — not a generic demo.