Google BigQuery

Google BigQuery connects warehouse data to Twelfth. It sits in the Data
warehouse category and is reached from Settings → Integrations → Google
BigQuery. Every model is configuration only — there is no secret to upload
and none is stored. Access rides a dedicated Google service account governed
by IAM grants in your project, which you control and can revoke at any time.

Early access

BigQuery is being rolled out gradually. If you don’t see it under Settings →
Integrations, ask your Twelfth contact to enable it for your workspace — the
connect surface stays hidden until it’s turned on. Only workspace owners and
admins can connect, validate, or change a warehouse connection.

Two connection models

Your workspace uses one of two operating models:

  • Twelfth-managed — Twelfth operates the warehouse connection and import. The
    page shows connection health and freshness, with no credentials or
    infrastructure settings for members to change. Use Contact Twelfth on the
    page to request a mapping change or report a freshness issue.
  • Customer-managed — your team owns the GCP project and dataset and grants
    Twelfth read-only access.

Twelfth-managed workspaces cannot create or replace this with a customer-managed
connection. Contact Twelfth if the model needs to change.

Three ways to connect BigQuery

BigQuery supports three approaches — pick the one that matches how your data
should flow:

  • Customer-managed (your BigQuery) —
    you keep the data in your own GCP project and grant Twelfth read-only access to
    a fixed webapp_* serving contract. Read-only, least-privilege, self-serve
    validation.
  • Transaction inbound —
    land raw transaction and customer data in a BigQuery dataset and have Twelfth
    read it in, for cases where you don’t already produce the serving contract.
  • Outbound sync (inquiry only) —
    push Twelfth’s outputs (recommendations, decisions, tracked pricing) out to a
    destination dataset so your own BI and downstream systems can consume them.

Security at a glance

The connection holds no secret

Twelfth stores only your project, dataset and location — non-secret
configuration. There is no token, key, or password to leak. Access is governed
by the IAM grant in your project, which you control and can revoke at any time.

  • Read-only inbound. Customer-managed and transaction-inbound connections run
    single-statement SELECT only, enforced before a query reaches BigQuery.
  • Inquiry-only outbound. The outbound sync writes only to a destination you
    nominate — it never writes back into your operational systems.
  • Your identity, your revocation. Remove the IAM grant and Twelfth loses
    access instantly, with no Twelfth-side step.
  • Location pinned, one connection per workspace.
Previous Google Search Console Next Customer-managed