Responsible Disclosure
We welcome security researchers and the broader community to help keep Dataskera safe. If you believe you have discovered a vulnerability in our services, please report it privately so we can address it before any public disclosure.
- Contact: support@dataskera.com
- Please include reproduction steps, affected endpoints, and the impact of the issue.
- We commit to acknowledging your report within 3 business days and keeping you informed about remediation.
- Please do not exploit the vulnerability beyond what is strictly necessary to demonstrate it, and do not access or modify data that is not yours.
Infrastructure
- Hosting: Google Cloud Platform, region europe-west9 (Paris, France).
- Transport security: HTTPS / TLS 1.2+ enforced on all endpoints.
- Secrets and credentials are stored as environment variables (not in source control) and rotated on access changes.
- Backups: daily encrypted database backups to a separate storage bucket (30-day retention) plus daily disk snapshots (7-day retention); restores are tested.
Customer Data
Dataskera viz extensions run entirely inside the Tableau sandbox. We do not collect, store or transmit any Tableau data (rows, column values, workbook content, filters, parameters). The backend only handles account information (email, username, licence metadata).
For full details, see our Privacy Policy.
Authentication & Licensing
- Passwords are hashed with bcrypt (cost ≥ 10).
- Licence tokens are short-lived JWTs signed with a dedicated secret, rotated on a rolling basis.
- Viz extensions verify licenses locally and cache them for up to 24 hours, so viewers are never interrupted if the backend is temporarily unreachable.
PGP Key
A PGP public key for encrypted security communication will be published here. In the meantime, please use support@dataskera.com and mention if you need a secure channel.
Scope
In-scope assets for responsible disclosure:
- *.dataskera.com
- Dataskera viz extensions published on the Tableau Exchange
- The Dataskera backend API (api.dataskera.com)