Retool

Retool Security Best Practices

Secure your Retool internal tools with these essential practices. From access control to query security.

Verify your app follows these best practices automatically.

Retool builds internal tools that often access sensitive data. These practices help you secure your Retool applications properly.

Quick Wins

Enable SSO authentication
Review group permissions
Audit resource access per group
Check queries for SQL injection
Enable audit logging

Security Best Practices

#1Use SSO for Authentication

critical

Enable Single Sign-On with your identity provider instead of separate Retool logins.

Implementation

Configure SSO in Settings → Authentication with your IdP

#2Implement Role-Based Access Control

critical

Create roles with minimal permissions. Not everyone needs access to all resources.

Implementation

Create groups with specific permissions, assign users to appropriate groups

#3Use Resource-Level Permissions

critical

Restrict which users can access which database connections and APIs.

Implementation

Configure resource permissions per group, limit access to production data

#4Parameterize All Queries

high

Never concatenate user input into SQL queries. Use Retool's parameter system.

Implementation

Use {{ }} syntax for parameters, never build dynamic SQL strings

Don't do this
SELECT * FROM users WHERE id = '" + textInput.value + "'
Do this instead
SELECT * FROM users WHERE id = {{ textInput.value }}

#5Enable Audit Logs

high

Track who accesses what data and when. Required for compliance and incident response.

Implementation

Enable audit logging in Settings, review logs regularly

#6Use Read Replicas for Queries

medium

Connect queries to read replicas instead of primary databases when possible.

Implementation

Create separate read-only resource connections for dashboards

Common Mistakes to Avoid

All users have admin access

Why it's dangerous:

Over-privileged access increases breach impact

How to fix:

Create roles with minimal required permissions

Dynamic SQL with user input

Why it's dangerous:

Enables SQL injection through internal tools

How to fix:

Always use Retool's parameterized query syntax

Production database for development

Why it's dangerous:

Developers can accidentally modify production data

How to fix:

Use separate resource connections for dev/staging/prod

Verify Your Retool App Security

Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.

Get Starter Scan

Frequently Asked Questions

Is Retool secure for production use?

Yes, Retool is used by large enterprises. Security depends on configuration: enable SSO, use RBAC, parameterize queries, and enable audit logging.

How do I prevent SQL injection in Retool?

Use Retool's {{ }} parameter syntax for all user input. Never concatenate variables into SQL strings. Retool automatically escapes parameterized values.

Should I use Retool Cloud or self-hosted?

Retool Cloud is secure for most use cases. Self-hosted gives you more control for regulated industries or air-gapped environments.

Last updated: January 2026