It reads to me like their first version (sharing the output html) essentially skipped their permission layer. That seems like a dangerous decision if someone can share the sales data analysis openly with users not allowed to see such data?