Our security department is requiring this information before allowing online mapping to be enabled on Tableau Server. They want to make sure that no data is passed other than map coordinates. I've filed a case with Tableau Support but they won't help me and there is no documentation I can find on this. Any help would be appreciated!
@Megan Knies Please let me know if the information below from our Maps team helps...
-Sarah
Tableau Research
A component of maps in Tableau are provided by a third party called Mapbox. Tableau maps can call an external service provided by Mapbox. This service is responsible for delivering the background map tiles that portray streets, places (such as parks and buildings), and place names that provide geographic context to the marks overlaid on top. The background map tiles come in several styles, such as light/dark versions and views that visually emphasize specific concepts such as roadways and green space.
Tableau calls the Mapbox service automatically to render the map viz, across all zoom levels. The call occurs by default unless the map viz’s background is set to “Offline”, “None”, or a WMS server is in use in lieu of Mapbox. Tableau users are not notified of this call.
To retrieve the background map tiles, Tableau sends a tile address defining the currently viewed area to Mapbox’s service. This tile address is expressed in the form of three numbers that indicate the zoom level, and the row/column information of the requested tile (e.g. “15/9875/3453”). The Mapbox service then returns map tiles corresponding to the requested location. The connection with Mapbox’s service is secured by HTTPS. Tableau does not send any customer-imported data from data connections or extracts to Mapbox’s service, nor does it send any other information of the map viz (such as tooltip contents or which marks are selected). When a connection with Mapbox’s service occurs, Tableau will also send the customer’s IP address as part of the request, so that the requested map tiles can be returned to the proper user. If the HTTPS protection was stripped by a man-in-the-middle attack, the attacker would be able to infer the generalized area being viewed, but likely not any other aspects of the map viz.
