ATX AnalyticsTable Overview | Every Module, with Screenshots

ATX AnalyticsTable overviewTwenty-two chapters covering every module: the workspace and project model, connections and the credential vault, data ingestion, the SQL workbench and semantic layer, transformation and data quality, pipelines, the scheduler and parameters, dashboards, reports and PDF distribution, export and distribution, PII masking and privacy, security, deployment and licensing, Ask Greg — the AI designer and analyst, the Table Queries library with its visual query builder and SQL editor, Git integration and version control, the complete settings reference, mailbox integration for reading and sending email, the AI_PROMPT formula that answers a question about a cell or a range in the cell itself, forecasting with backtested methods and scenarios, histograms with specification limits, and data alerts — threshold, any-row, new-period and change conditions, standalone alert rules and suppression that stops repeat messages.

ATX AnalyticsTable in action — what the film shows

Ask Greg: Ask your data a question — Greg writes the SQL, runs it on your data, and shows its working.
Dashboards: Dashboards on live data — KPIs, filters and charts bound to the database, not to a copy.
Visual queries: Build queries by clicking — pick columns, group and sum, and the SQL writes itself.
SQL · DuckDB · Pinned queries: Write SQL and pin the answer to the grid — every DuckDB table a click away, results kept fresh.
Design · Pivot tables: Make it look like your company — data bars, heat maps and live pivots, a click each.
Pipelines · Scheduling: Turn routine into a recipe — rehearse every step, apply it, and let the scheduler run it at six.
Privacy: Mask personal data before it leaves — scanned column by column, one way and repeatable.
Anomalies · Outliers: Find what doesn't belong — hidden junk in text, numbers that do not fit.
Text to columns · Lists: Reshape text and lock down inputs — split a column in one move, and give cells a dropdown fed by SQL.
Filters · Conditional formatting: See only what matters — funnels on the header row, and rules that paint the rows worth a look.
Connections · E-mail: Connect once, send from anywhere — databases, files and cloud storage, plus mail profiles your pipelines can use.
Parameters · PDF automation: One value, everywhere — parameters drive the SQL and the file name, and the PDF report goes out on schedule.
SQL functions · AI functions: Formulas that reach the database and a model — SUM_SQL asks DuckDB, AI_PROMPT asks a model about your table.
Query monitor · Background jobs: Nothing runs in the dark — every refresh is a job you can watch, inspect and stop.

The handbook chapters

01 — The workspace & project model. How the ribbon, sheets, query tabs and folder-based projects fit together — and the three kinds of data a cell can hold.
02 — Connections & the credential vault. DuckDB, SQLite, PostgreSQL, SQL Server, Oracle, BigQuery, Snowflake, Databricks, Amazon Redshift, Microsoft Fabric / Azure Synapse, MySQL / MariaDB and cloud object storage — with credentials held in an encrypted vault behind the OS keychain, or no stored secret at all where the platform offers an identity.
03 — Get Data — ingestion & bindings. Pinned tables and queries, workbook/CSV/JSON imports that remember their source, and direct cloud ingestion that bypasses the application window.
04 — SQL workbench & the semantic layer. Write SQL beside the sheet it feeds, save queries the whole project can point at, and layer friendly business definitions over raw tables.
05 — Transform & data quality. Durable sorting and filtering on pinned data, value mapping and dedupe, plus anomaly and outlier detection built for real extracts.
06 — Pipelines — repeatable preparation. An ordered, versioned recipe bound to a dataset, re-applied automatically whenever that dataset refreshes.
07 — Scheduler, parameters & unattended operation. Refresh, import, export and back up on a schedule — in a guaranteed order, with parameters resolved at run time.
08 — Dashboards. As many dashboards per project as needed, with widgets that query their source directly rather than depending on what is pinned — from a single KPI to a backtested forecast.
09 — Reports & PDF distribution. Build the report on the sheet where the numbers are — any chart from column to forecast — annotate it so it survives editing, and schedule the PDF.
10 — Export & distribution. Workbooks, flat files, cloud storage or a database table, with multi-sheet composition and parameters in the path.
11 — PII masking & privacy. Redact, partial, hash and synthetic masking for grid data, static pins and pipelines — one-way, repeatable and keyed per project.
12 — Security, deployment & licensing. Encryption at rest and in transit, project trust, roles and single sign-on (Entra ID, OIDC or SAML), a hash-chained audit trail with SIEM forwarding, Group Policy and Intune control, a hardened desktop shell, signed releases and offline licensing.
13 — Ask Greg — the AI designer and analyst. An AI analyst and designer that works across the whole project: it answers with queries it actually ran, proposes charts, pivots, KPIs and dashboards — and now automation too: one-time transforms, saved pipelines, a new step in an existing pipeline, PDF reports, e-mail alerts and schedules. Every proposal is dry-run against your data before you see it, and nothing lands until you place it.
14 — Table Queries — the library, the visual builder & the SQL editor. The saved-query library beside the grid, the visual builder that writes SQL as you click, the SQL editor bound to a named connection, parameters, pinning, and the monitor that shows what is running.
15 — Git integration & version control. Initialise a repository on the project folder, commit from the sidebar, push and pull against GitHub, GitLab or Bitbucket, and restore a single file from an earlier revision.
16 — Settings — the complete reference. Every settings section in order — appearance and locale, connections, email, semantic objects, sync, query and grid, export, logging, Git, identity, licence, network, advanced, backup, access, data access, catalog and usage, MCP servers, audit log and about — with what each decides and where it is kept.
17 — Mailbox — reading and sending email. Mail profiles for SMTP, IMAP, Outlook, Microsoft Graph, MailerSend and Azure Communication Services; a mailbox as a data source; templated sends with attachments; and alerts with cooldown, suppression and recovery.
18 — AI formulas — AI_PROMPT, a model's answer in a cell. The second, separate way the product puts a model to work: a function that asks a configured model a question about a cell or a range and writes the answer into the cell — with answer reuse, a call ceiling per recalculation, and the same egress policy, masking and audit as the chat panel.
19 — Forecasting — where the numbers are heading. The Forecast widget and chart type: eleven methods with an automatic, backtested choice, seasonality, prediction intervals, one forecast per region or product, scenarios and a management overlay, accuracy printed under the chart — every option shown on the Showcase project.
20 — Histograms — the shape of a column. The Histogram widget and chart type: bin rules and custom edges, a range of interest with overflow bars, tail trimming, normal and density curves, a cumulative line, percentile markers, specification limits with Cp and Cpk, splits by category, weighted bars, and counting in the database for tables of any size — every option shown on the Showcase project.
21 — The semantic model — one definition per business number. The semantic model in depth: the seven object types and every field they carry, stable URNs, how a widget's measures and dimensions become one SELECT with joins, typed parameters and fan-out warnings, validation of dangling references and cycles, lineage and impact before a delete, unused-object detection, JSON bundles for moving a model between machines, and the roles, licence and audit rules around it.
22 — Alerts — conditions, suppression and alert rules. Data alerts in depth: the six conditions (every run, row count, an aggregate threshold, any single row breaching, a new period, the data changing), standalone alert rules that watch a SQL query, a saved query, a pipeline's data or a sheet range, rising-edge suppression, cooldown, daily caps and recovery messages, message templates and attachments, Check now, scheduling, machine-local alert memory, Ask Greg proposals and licensing.
23 — Row- and column-level security, roles and groups. Row- and column-level security in ATX AnalyticsTable: roles from Entra ID groups, per-user row filters, column masking and pseudonyms, persona preview and audit.
24 — Single sign-on, SCIM provisioning and revoking access. Single sign-on for ATX AnalyticsTable server installations with Microsoft Entra ID, any OpenID Connect provider (Okta, Auth0, Keycloak, Ping, Google) or any SAML 2.0 identity provider (ADFS, Shibboleth), SCIM 2.0 user and group provisioning, and immediate revocation of a person's access.
25 — REST API, headless metrics and MCP servers. The public REST API (/api/v1, OpenAPI 3.1, RFC 9457 errors, rate limits, idempotency and cursor paging), headless metrics that serve the governed semantic layer over HTTP, and MCP servers for BigQuery, PostgreSQL, Jira, Confluence and any other — read-only by default, with secrets in the vault, circuit breakers, and Ask Greg able to use them when policy allows.
26 — Clusters, key drivers and insight questions. Cluster charts that find k-means segments in several numeric columns at once, key-driver charts that rank what explains a number or a yes/no outcome by its Shapley share of R², and Ask Greg's tools for anomalies, forecasts and period-over-period change — all reproducible, cross-filtering and privacy-aware.
27 — Governed analytics — certified numbers everywhere. Governed metrics as the source of charts, pivots and widgets; the METRIC() formula; a publish gate that serves only certified definitions, with one-click restore; insight watches; data stories whose every figure is checked; ATX AnalyticsTable as an MCP server; embedded dashboards scoped per customer; dbt and OSI import; and a content catalog with lineage, four-eyes certification and a usage report.

What it is for

An AI analyst that shows its work — Ask Greg answers with queries it actually ran against your own database, and proposes charts, dashboards, pipelines, PDF reports, e-mail alerts and schedules as objects you place — every one dry-run against your data and certified before you see it.
Unattended by design — Sequenced schedules refresh, recalculate, export and back up before the business day starts — with formulas guaranteed to settle before the next step reads them.
Cleaning that survives the refresh — Pipelines turn a morning routine into a bound, versioned recipe that re-applies automatically every time its source reloads.
Privacy built into the extract — Four masking methods — redact, partial, hash and synthetic — applied one-way to columns or ranges, and repeatable inside a scheduled pipeline.
Git-native governance — Pipelines, schedules, filters and export definitions are small JSON files in the project folder. Every change to a production report is a reviewable diff.
Credentials that never travel — An AES-256-GCM vault behind the OS keychain, or your own AWS, Azure, GCP or HashiCorp secret manager. Project files carry references, never values.
Data quality that finds the invisible — Nine outlier detectors plus an anomaly scan for zero-width characters, smart quotes, control codes and markup left behind by a paste.
Dashboards bound to the source — KPI, filter, pivot and chart widgets query their connection directly, so a dashboard never depends on what happens to be pinned in a sheet.
Seven interface languages — English, German, Spanish, French, Polish, Portuguese and Simplified Chinese — the ribbon, the dialogs, the settings and the in-app manual, switched without a restart. An eighth is a JSON file you drop in, not a release you wait for.
An audit trail that proves itself — Every credential reveal, sign-in, query, export, e-mail and AI action lands in an append-only, hash-chained log. A changed byte or a missing record is found by the app, the API or an auditor's own script — and it streams to your SIEM.
Nothing runs until it is trusted — A project from another computer or person opens paused: no startup schedules, refreshes, exports or e-mails until someone chooses to trust it. Administrators pre-trust the folders approved reports live on.
Deploys the way you already deploy — A per-machine MSI with Group Policy and Intune templates, silent Linux packages, Entra ID, OIDC and SAML sign-in with SCIM provisioning for server mode, a Docker image and a Helm chart with cloud overlays — every feature switch enforced by the backend.

Who it is for

Controllers & financial analysts: The morning pack builds itself — refreshed, recalculated, formatted and exported before anyone opens a laptop.
Data & platform teams: Reporting logic leaves personal drives and enters version control, with connections standardised across the fleet from one JSON bundle.
Risk, audit & compliance: Every configuration change is a diff, every pipeline run is a log line, and every extract can be masked before it leaves the machine.
Business intelligence developers: SQL, a semantic layer, parameters and a scriptable pipeline engine — without giving up the grid the business already reads.

What it connects to

Databases & warehouses: PostgreSQL, Microsoft SQL Server, Oracle, MySQL / MariaDB, Google BigQuery, Snowflake, Databricks, Amazon Redshift, Microsoft Fabric / Azure Synapse, DuckDB, SQLite
Cloud storage: Azure Blob Storage, Google Cloud Storage, S3-compatible object storage
Files: Workbooks (.xlsx), CSV / TSV, JSON / NDJSON, Parquet, .duckdb databases
Secret managers: OS keychain, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, HashiCorp Vault

Questions and answers

Does ATX AnalyticsTable require a cloud account? No. The application runs on the operator's machine with its backend bound to the loopback interface. There is no telemetry and no cloud account. The only automatic outbound calls are the optional licence status check and an update check that downloads the public release list; neither carries anything from a project, and administrators can turn both off.
Can it run fully air-gapped? Yes. A licence is a signed file verified against a public key compiled into the build, so an air-gapped installation validates its own licence with no network at all. The optional licence server only ever answers whether a licence has been revoked, and an unreachable server changes nothing.
Can we prove who did what, and that the record has not been altered? Yes. Every installation keeps an append-only audit trail of credential reveals and exports, connection changes, sign-ins and rejected tokens, query runs (as a hash of the SQL, with rows and duration), exports, e-mails, backups, project opens and saves, licence and policy changes, AI actions and every refused action. Each record carries the hash of the one before it, so a changed byte, a missing record or a truncated file is detected — in the app, through the API, or with a stand-alone verifier an auditor runs on a copy. It cannot be switched off from inside the application, keeps 400 days by default, and forwards to a SIEM as RFC 5424 syslog over UDP, TCP or TLS.
What happens when someone opens a project they were sent? It opens paused. A project from another computer or person cannot run startup schedules, catch-ups, refreshes, imports, exports or e-mails until the user chooses “Trust this project”, after reading it if they wish. Projects created and saved on the machine are trusted automatically, and administrators can pre-trust the folders where approved reports live — including UNC shares — through Group Policy, a policy file or config.ini.
How are access rights controlled in a server deployment? Through three roles — Viewer, Analyst and Admin — taken from the roles or groups of your identity provider — Microsoft Entra ID, any OpenID Connect provider or any SAML 2.0 identity provider, optionally provisioned with SCIM — and enforced by the server on every request. Viewers run read-only queries and download their own view; analysts do everything a desktop user can; only administrators manage stored credentials, shared connections, policies, the licence and the audit trail. Sign-in can be made compulsory, an administrator can revoke a person at once, automation uses scoped service tokens stored as hashes, and project paths can be confined to approved, per-user folders.
Can IT switch features off centrally? Yes. ADMX and ADML templates for Group Policy and Intune — or a policy file on Linux and macOS — turn off AI, e-mail, cloud storage, Git integration, the update check or individual connector types, restrict file exports to approved folders, set a minimum database TLS level and forward the audit trail. Every switch is enforced by the backend, applies to schedules saved before it, and each refusal is recorded in the audit trail.
Which languages is the interface available in? Seven: English, German (Deutsch), Spanish (Español), French (Français), Polish (Polski), Portuguese (Português) and Simplified Chinese (简体中文). English is built into the application and the other six ship with it as complete translations of the ribbon, the dialogs, the settings and the in-app manual — including the documentation the AI answers from. The language is switched in Settings → Appearance and applies immediately, with no restart. An eighth language does not need a new build: a translation is a JSON file dropped into a user-writable folder, picked up by Rescan while the application is running.
How is it deployed across a large estate? Silent Windows and Linux installers accept an install directory, ports, a user-data path, a bind host and a licence file or token. A machine-wide policy file ships the AI model configuration to the fleet, and is re-read when it changes without asking anyone to restart. Server mode adds a Docker image, a Compose stack and a Helm chart with AWS, GCP and Azure overlays.
What stops an AI feature from seeing data it should not? Each configured model carries an egress class, and that class selects the ceiling the data policy applies: on-prem permits full data, private-cloud permits schema and samples, public-cloud permits schema and aggregates only. The endpoint list in a managed policy cannot be edited from inside the application, so an installation cannot be quietly repointed.
Is masked data anonymous? No, and the product says so plainly. Re-identification works on combinations of columns, not on one column, so masking a name while leaving branch, product, amount and date can still identify a person. Masking reduces risk; it is not encryption, not deletion, and not a legal basis on its own.
What happens to a project with a million rows? Large static pins are not stored inside the saved project — above roughly twenty thousand rows the cached rows are dropped and only the query that rebuilds them is kept. Projects stay small, save in seconds, and reopen by re-running their queries in the background with a monitor that can stop a long load.

Platform status

Windows desktop — Shipping. The primary packaged platform, with NSIS, MSI and portable builds and a silent-install wrapper that verifies the result.
Linux desktop — Shipping. .deb, .rpm and AppImage packages build and install today, with a service-mode installer for headless hosts.
Server & container — Deployable. The same backend and web bundle run headless in Docker or Kubernetes, with Entra ID, OIDC or SAML sign-in, SCIM provisioning, Viewer, Analyst and Admin roles, per-user project folders and the audit trail; full multi-tenant isolation is a later phase.
macOS desktop — In development. Runs in development; packaged installers are not yet wired up.

Glossary terms on this page

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.