For Tableau Server and Tableau Cloud administrators and security teams.
Antichaos extensions run entirely in the viewer’s browser, inside the frame Tableau gives them. They read only what the Tableau Extensions API hands them and never send your data to us or to anyone else. This page lists everything that does leave the browser.
At a glance
- Your data stays in the browser. Worksheet data, field names, filter and parameter values are never sent – except by the few extensions below that connect to a service by design.
- One domain to allow-list:
extensions.byantichaos.com. No requests to any other host. - No full data access needed. The extensions read summary data only.
- Hosted in the EU: Amazon Web Services, Frankfurt. HTTPS only, TLS 1.2 or higher.
- No accounts, passwords or cookies.
What leaves the browser
| What | Contains | Can it be switched off? |
|---|---|---|
| Loading the extension | Its own files, like opening any web page | No – it is the extension |
| Anonymous usage statistics, once per load | Extension name, a random id kept in the browser, Tableau’s anonymous user id, Desktop / Server / Cloud, Tableau version. Some extensions also report which display option is used. | On by default in every extension. Some extensions let an author turn it off with “Share anonymous usage statistics” in the dialog; in the others it stays on. A self-hosted copy sends nothing. |
| Licence check | The licence key – only when one was entered | Runs only with a key |
| Your data | Never sent | – |
Extensions that connect to a service by design
- Google Analytics and Search Console extensions fetch your Google data through our proxy, with read access you grant. No Tableau data goes out.
- Baton (remote control, paid mode) sends the names and values of the controls a remote may change through our relay. Rooms are deleted 6 hours after last use.
- Vitals shows a number your own system sends to us.
- Tripwire calls a webhook you configure, with the KPI name and value.
- Segue, Atlas and Aside load images from addresses the author enters.
All other extensions make no requests beyond the table above.
Logs and privacy
- Like any website, our content delivery network logs each request, including the IP address. The logs are private, stored in Frankfurt, kept without a fixed end date, and used only to run and secure the service and to count downloads.
- Usage statistics hold no IP address and are deleted after about 13 months.
- We collect no names, e-mail addresses or Tableau user names.
- Sub-processors: Amazon Web Services (hosting); for the Google extensions, Google, for the data you already keep there.
Allow-listing in Tableau
- Settings → Extensions: enable dashboard and viz extensions for the site.
- Add
https://extensions.byantichaos.com/to the safe list, with “Allow full data access” off. - Optional: turn “Show prompts” off – the extensions cannot see viewer data, so the prompt adds little.
See the Allow-list Extension tutorial for a step-by-step howto.
Prefer to serve the files yourself? A self-hosted copy is available on request.
Questions or a security issue
Questions, doubts or found something that looks wrong? Write to extensions@antichaosdata.com. We read every message, we are happy to talk it through, and we take security reports seriously.