# How does private data hosting work for teams? **URL:** \ **Category:** Help\ **Created:** [April 5, 2019, 8:21am UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853 "2019-04-05T08:21:13Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![dwl285](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/dwl285/32/1632_2.png) [@dwl285](https://talk.observablehq.com/u/dwl285)\ **Post date:** [April 5, 2019, 8:21am UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/1 "2019-04-05T08:21:13Z")
I’m interested in Observable for teams, but first want to understand more clearly how Observable interacts with private data. Thanks! ---
**Author:** ![jashkenas](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/jashkenas/32/1778_2.png) [@jashkenas](https://talk.observablehq.com/u/jashkenas)\ **Post date:** [April 5, 2019, 3:12pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/2 "2019-04-05T15:12:23Z")
Good morning! Currently, Observable does not directly host private data. We host the code in your team notebooks, which can securely connect to private data sources over HTTPS with proper CORS headers, using Observable [Secrets](https://observablehq.com/@observablehq/secrets), or OAuth, or other preexisting web authentication, or even [local files](https://observablehq.com/@mbostock/reading-local-files). In this way, your code, data analysis and visualizations run directly in your team members’ browsers, with the private data never touching Observable servers (unless you choose to paste small amounts of private data directly into the notebooks themselves). For example, let’s say that your Observable team is called `the-a-team`, and you already have a private API you’d like to connect to, using [Secrets](https://observablehq.com/@observablehq/secrets). First, you would add a secret token from your team’s settings page: ![image](https://canada1.discourse-cdn.com/flex030/uploads/observablehq/original/2X/3/33aa6846ece5e1e9149b57e1a9cfdb982ead3989.png) You would then tell your private API to reject any request that didn’t include that token as a parameter. You would also need to add a [CORS header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin) to responses from your private API, allowing access from your team’s Observable notebooks. In this case: ``` Access-Control-Allow-Origin: https://the-a-team.static.observableusercontent.com/ ``` With those two pieces in place, your team can issue requests for data to the private API from any team notebook: ```auto data = fetch("https://api.the-a-team.com/data", { method: "POST", body: JSON.stringify({query, token: Secret("PRIVATE_API")}), headers: {"Content-Type": "application/json"}, credentials: "include" }) ``` If you prefer to use an OAuth-style setup, with individual accounts instead of a shared team secret, [that works just as well](https://observablehq.com/@mbostock/authentication-simulator). In the future, we’re working on both hosted file attachments (a little less exciting), and hosted database connectors (very exciting) to make all of this much more convenient. With a secure database connector with the proper permissions set, notebooks truly become an exploratory tool for interactively designing queries and reactively connecting the (potentially streaming) results to tables, maps and visualizations. We have an early prototype of this, and it’s pretty neat. If there’s any further explanation we can provide, please don’t hesitate to ask. (And with apologies if that was all overlong, and you just wanted a brief reply.) ---
**Author:** ![dwl285](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/dwl285/32/1632_2.png) [@dwl285](https://talk.observablehq.com/u/dwl285)\ **Post date:** [April 5, 2019, 3:30pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/3 "2019-04-05T15:30:19Z")
OK, no thanks for the long reply. My team has all of our data in BigQuery, so would ideally like to be able to connect to BigQuery to read the data in a really simple way. It sounds like that might be something in the pipeline? ---
**Author:** ![shastabolicious](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/shastabolicious/32/194_2.png) [@shastabolicious](https://talk.observablehq.com/u/shastabolicious)\ **Post date:** [June 13, 2019, 8:07pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/4 "2019-06-13T20:07:12Z")
What if I need data to be nonpublic but my org doesn’t have an API? Does anybody have a trick for this? I could do a secret gist, but that’s probably not good enough for my org. ---
**Author:** ![jashkenas](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/jashkenas/32/1778_2.png) [@jashkenas](https://talk.observablehq.com/u/jashkenas)\ **Post date:** [June 13, 2019, 8:17pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/5 "2019-06-13T20:17:06Z")
@shastabolicious — What format (or database) is your private data in currently? We’re getting ready to start beta testing a new feature that may help with your use case… ---
**Author:** ![shastabolicious](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/shastabolicious/32/194_2.png) [@shastabolicious](https://talk.observablehq.com/u/shastabolicious)\ **Post date:** [June 13, 2019, 8:32pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/6 "2019-06-13T20:32:10Z")
Plain old .csv’s ---
**Author:** ![jashkenas](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/jashkenas/32/1778_2.png) [@jashkenas](https://talk.observablehq.com/u/jashkenas)\ **Post date:** [June 13, 2019, 9:11pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/7 "2019-06-13T21:11:43Z")
I’m afraid in that case you’re going to have to wait a bit longer for us to release a CSV upload feature — this upcoming one focuses on MySQL and Postgres databases to start… Some of your current options are: - Paste the CSV contents into an Observable cell (only if the data is very small) - Serve via your own secure API (if you can host one) - Upload as a Secret Github Gist (only if you don’t mind the security implications of that URL being public) - Upload as a Google Sheet, and access via the Google Sheets OAuth API — using Observable Secrets to store your OAuth key. Out of those, I’d favor the last one. It’s a bit of a bear to set up, but it means that the data loading is secured with your Google login, and that the spreadsheet can be edited, with the data updates reflected live in your Observable notebook. If you need any help with getting it set up, let me know. I just put one together the other day, and would be happy to turn it into an example notebook. ---
**Author:** ![mootari](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/mootari/32/581_2.png) [@mootari](https://talk.observablehq.com/u/mootari)\ **Post date:** [June 13, 2019, 9:29pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/8 "2019-06-13T21:29:06Z")
[Glitch projects](https://glitch.com/) can be private, and even public glitch projects can contain [private data](https://glitch.com/help/env/) that will never be shown or shared. A glitch-hosted server could either expose the data via a heavily restricted API, or in combination with ObservableHQ secrets require an access key (or both). Don’t be fooled by the playful appearance, they’re actually an incredibly easy way to set up hosted services, and [rate limits/restrictions](https://glitch.com/help/restrictions/) are generous for a free service. ---
**Author:** ![Evan](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/evan/32/276_2.png) [@Evan](https://talk.observablehq.com/u/Evan)\ **Post date:** [June 14, 2019, 1:37pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/9 "2019-06-14T13:37:57Z")
I’d be interested in seeing an example notebook on the google sheet option. Thanks, Evan ---
**Author:** ![jashkenas](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/jashkenas/32/1778_2.png) [@jashkenas](https://talk.observablehq.com/u/jashkenas)\ **Post date:** [June 18, 2019, 5:10pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/10 "2019-06-18T17:10:42Z")
Hi Evan, I put together an example notebook — but the steps involved in getting a private Google OAuth connection set up are so complicated and unfriendly that it’s not going to be a method that we want to officially recommend to anyone. We’re going to work on a real Observable / Google Sheets connector that can handle the connection elegantly. In the meantime, if you still want to see the walkthrough, email me, and I can share the link with you in private. ---
**Author:** ![visnup](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/visnup/32/305_2.png) [@visnup](https://talk.observablehq.com/u/visnup)\ **Post date:** [June 20, 2019, 11:29pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/11 "2019-06-20T23:29:28Z")
We’re definitely working on this type of feature (see my latest post in announcements). We currently only have support for PostgreSQL and MySQL, but BigQuery is on the list already. ---
**Author:** ![Evan](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/evan/32/276_2.png) [@Evan](https://talk.observablehq.com/u/Evan)\ **Post date:** [June 26, 2019, 12:35pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/12 "2019-06-26T12:35:05Z")
Thanks. I don’t need it urgently, so I’ll wait for the official connectors. Best, Evan ---
**Author:** ![visnup](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/visnup/32/305_2.png) [@visnup](https://talk.observablehq.com/u/visnup)\ **Post date:** [July 1, 2019, 6:20pm UTC](https://talk.observablehq.com/t/how-does-private-data-hosting-work-for-teams/1853/13 "2019-07-01T18:20:11Z")
We just deployed BigQuery support within our database client beta feature! If you want, I can add you (and your team?) to the beta so you can try it out. It’s a very convenient setup to connect to BigQuery now.