Amberhold

Enterprise

Industrial inspection dashboards. Excel, Power BI, Fabric — the tools your plant already owns.

Operator rounds and routine inspections, reported in the tools your business already runs. Your directory decides who signs in, your reporting tools read the record directly on a schedule, and there is nothing new to install or maintain.

Inspection dashboards, from the round your operator walked this morning

No exporting by hand. No copying between systems. A dashboard refreshes on a schedule with nobody signed in — and reads the same record an auditor would be shown.

  • Any system (REST)Verified in productionA real Entra service principal read a live production site's evidence unattended: 12 pages, 36 rows, one attributable pull — then 403 on the same token, one second after the membership was revoked.
  • Microsoft Power BISetup guide available
  • Microsoft FabricSetup guide available
  • Excel for WindowsSetup guide available
  • Power Automate / Logic AppsAvailable via the API
  • SharePoint / TeamsAvailable via the API
  • SAP PMAvailable via the API
  • IBM MaximoAvailable via the API
  • AVEVA PIAvailable via the API
  • Excel for MacNot supportedPower Query on macOS cannot send an Authorization header, so no version of the recipe works. Stated on the tile rather than in a footnote.

No second copy of your data. Every one of these — the dashboard, the spreadsheet, the API call, the CSV an auditor is handed — reads the same versioned projection of the same record. There is no reporting database to fall behind, and no way for two of them to disagree about a reading.

What it works with

Amberhold never holds your Microsoft credentials. The secret belongs to the application in your tenant — you create it, you rotate it, you revoke it. We never see it, we never store it, and we cannot leak what we do not have.

Identity — Microsoft Entra ID

Single sign-on with your work accounts

People sign in with the Microsoft account they already have. Your Conditional Access, MFA and device policies apply unchanged, because the sign-in happens in your tenant, not ours. No local passwords, no shared logins, no separate account list for IT to maintain.

A leaver stops here too

Disable somebody in your directory and they stop signing in to Amberhold. Signing in never grants access on its own — a membership on the site does — so access can also be ended in Amberhold immediately, and it takes effect on the next request rather than when a token expires.

Reporting — Excel, Power BI, Microsoft Fabric

Excel

A workbook that refreshes itself from live plant evidence instead of somebody re-exporting a spreadsheet every Monday. The column names are the same ones in the CSV export, so sheets built on exports keep working. Windows Excel; on macOS, use Power BI or Fabric.

Power BI

Scheduled refresh with nobody signed in, authenticated by an application identity from your own tenant. Dashboards read the same versioned projection as the export — so a report, a spreadsheet and an auditor's pack cannot disagree about a reading.

Microsoft Fabric

The same query in a Dataflow Gen2, landing in a Lakehouse for Direct Lake reporting. Browser only — no Windows machine needed to set it up.

Power Automate and Logic Apps

A scheduled flow can read evidence and act on it: file a weekly report, raise a ticket when a limit is crossed, push a summary into Teams. The HTTP action authenticates with Active Directory OAuth, so there is no token handling to write.

Integration — REST, OpenAPI, OAuth

A read-only REST API

GET /api/v1/sites/{siteId}/readings returns reading evidence as JSON, with filtering, paging and a stable identifier on every row so anything can be traced back to the record it came from.

OpenAPI, published and unauthenticated

The machine-readable contract sits at /api/v1/openapi.json and needs no account to read. Your integration team can size the work up before anyone signs anything, and generate a client from it if they prefer.

Application identities rather than API keys

A system authenticates as itself using OAuth 2.0 client credentials from your Entra tenant, holding an application permission you grant. The secret stays in your tenant — you create, rotate and revoke it, and Amberhold never sees or stores it.

Every unattended read is logged

Which system, which site, when, what scope, how many rows — written to an append-only ledger the database will not let anybody edit. A refresh that took nine requests is recorded as one pull, because that is what it was.

Where this leaves your IT department

Nothing to install, nothing inbound

Amberhold runs in the browser on the tablets and phones people already carry. All traffic is outbound HTTPS — no agents, no VPN changes, no firewall inbound rules, no on-premise components.

Hosted in the UK, and your data comes back on demand

Primary infrastructure sits in the London region, with daily backups, point-in-time recovery and a rehearsed restore. A site administrator can export the complete site record from inside the product on any day, without asking us.

The practical version: a site running Microsoft 365 can be signed in, reporting and integrated without adding a single new supplier relationship for identity, reporting or hosting.

A question this page didn't answer?

Ask it directly — supplier questionnaires and security reviews are answered promptly, by the people who built the platform.