What ext·host can and can't see

Plain English, written from the actual database schema rather than from what we'd like to be true. If you're evaluating whether to put a workbook in front of an extension hosted here, this is the page.

Your workbook data never reaches our servers. Tableau hands data to an extension inside the browser, over the Extensions API's postMessage channel. It does not route that data through the server hosting the extension. We serve HTML, JavaScript and CSS files; we hold no Tableau credentials and cannot connect to your data sources. There is nothing on our side to look at.

That is an architectural fact, not a promise about our conduct, it's how Tableau extensions work, and it would be true of any host. It is also only half the answer, and the other half matters more.

The thing you're trusting is the extension's code, not us. A network-enabled extension has full web access by definition. Once its JavaScript is holding your rows, it is technically able to send them anywhere: to the author's API, to a third party, anywhere. That is true of every network-enabled Tableau extension from every vendor, and it is exactly what your Tableau admin's safe list exists to control. We scan every extension we serve and publish what we find (the hosts it can reach, the Tableau APIs it calls, a fingerprint of every file) on a security brief you can hand straight to your admin. What we cannot do is stop an extension from calling out. Read the brief before you approve one.

What we store

Thing	Detail
Your email & username	That's the whole account. Sign-in is a 6-digit emailed code; we store only a hash of it, it expires in 10 minutes, and it's deleted within a day.
Your extension's files	The HTML, JavaScript, CSS and images you upload, stored in our database. If you turn on code protection we also store the minified or obfuscated build we serve. We can read these. They are not encrypted from us, and we won't pretend otherwise.
Share links & licences	The token in each .trex, and any licence payload you set for a subscriber.
Where your extension loads	When Tableau loads an extension, the browser tells us which Tableau site embedded it. We record that hostname, a count, and a timestamp, per share, so an author can see their extension being used, and spot a share link that's been passed around. It is a server name (acme.online.tableau.com), never workbook content. Tableau Desktop reports nothing at all, so we see nothing there.
.trex downloads	Each time a .trex manifest is downloaded we record which extension it was, when, and which of the three routes it came through: signed in, a share link, or a public URL. A download made while signed in is recorded against your account; the other two are bearer links with nobody behind them, so those are a count and nothing more. We keep the referring hostname where the browser sends one, the same server name described above. No IP address, no device or browser fingerprint. Records are deleted after 180 days.
AI builder sessions	If the builder beta is enabled on your account, we store your prompts, the generated code, which theme and chart type you used, and whether you kept the result, that history is what tailors future generations to you. When you upload a CSV to preview against, it is parsed in your browser: only field names and types reach us. Your data values are never uploaded, stored, or sent to the AI model.
Product analytics	Our own pages (the front door, the guide, the app) load PostHog, which records page views and in-app actions like creating an extension or downloading a manifest. Once you sign in these are tied to your account. The extensions we host for you carry none of this: the files served to your Tableau are yours alone, and we add nothing to them.

Two things that surprise people

Everything in your extension's files is public to anyone with the link. They are served to a browser, that is the entire point of them. An API key, a password or a connection string in your JavaScript is published, not hidden, and code protection does not change that: it makes code harder to read, not harder to obtain. Never put a secret in an extension file. The same goes for a licence payload: it is delivered to your subscriber's browser, so treat it as something they can see, because they can.

Anyone you share an extension with can read its code. A Tableau extension is JavaScript running in a browser on their own machine, they can open developer tools and look at it, and nothing we or anyone else builds can prevent that. Our code protection raises the cost of copying your work. It does not, and we will not claim it does, make your source secret.

This is early software

ext·host is in testing. Don't host anything you can't afford to lose, and don't point it at a workbook whose data you couldn't explain to your security team. If you're deploying to Tableau Cloud or Server, send your admin the security brief (every extension has one) and let them make the call.

Not a contract

This page is a factual description of what the software does, so that you can decide with your eyes open. It is not a Terms of Service, a privacy policy, or a data processing agreement, and it wasn't written by a lawyer. If you're putting regulated or customer data anywhere near this, you want all three, and you want them from someone qualified to write them.

Version — · Questions: eric.summers@vizyourdata.com