Terms of Service: Self-Service Analytics (Tableau Server)

1. Purpose

The purpose of this Terms of Service (TOS) is to outline the appropriate use, responsibilities, and governance expectations associated with departmental tenant spaces on the enterprise Tableau Server. Tableau Server, centrally managed by Enterprise Data Services, provides institutional departments with a secure, governed environment for developing, sharing, and consuming analytical content in support of self-service analytics. Exceptions require a documented risk review and time-boxed waiver approved by EDS and the relevant Data Steward.

2. Definitions

Enterprise Data Services (EDS)

Enterprise Data Services refers collectively to the teams within the OIT/EADI – Enterprise Data Services and OIT/EADI – Data Platforms & Databases departments. Together, these teams are responsible for the centralized delivery, governance, and administration of Tableau Server. This includes tenant onboarding, licensing, access management, and platform maintenance. Owns enterprise-level reporting and certified data sources; provides training and governance; mediates and approves cross-unit/enterprise reporting needs.

Leading Insight Through Empowerment (LITE)

The Leading Insight Through Empowerment (LITE) is a platform providing trusted, consistent, and accurate data and reports for decision making at Georgia Tech. Through LITE, data and reports are accessed from a single Enterprise Data Warehouse where accuracy and consistency is assured.

Tenant Department

A Tenant Department is any institutional academic, administrative, or operational unit that has been provisioned a tenant space on Tableau Server. Each Tenant Department is responsible for managing its own content (data sources, workbooks, and dashboards) within the boundaries defined by this TOS.

Report Developers

Report Developers are departmental staff authorized to build and publish Tableau Server content within their project space. Developers are identified by the tenant department and assigned permissions by Enterprise Data Services.

Viewers

Viewers are institutional users granted read-only access to published Tableau Server content. Viewer access is managed by EDS via centrally maintained project-level security groups. By default, viewer membership is limited to members of the Tenant Department; cross-department access requires EDS approval and central placement. Tenant report developers may request changes to viewer groups, but they cannot directly grant or remove viewer permissions.

LITE Shared Data Sources

LITE Shared Data Sources are curated, enterprise-approved Tableau data sources published and maintained by Enterprise Data Services for broad institutional use. These sources provide a consistent foundation for reporting and analytics and are the preferred starting point for departmental report development.

3. Architecture Overview

Each Tenant Department is provisioned a top-level project in Tableau Server, structured to include:

  • A Data Sources project: for publishing departmental data sources.
  • A SANDBOX project: for developer experimentation; no viewer access is permitted.
  • QA / LIVE Project Pairs: QA projects support internal testing; LIVE projects serve approved end-user reporting.

Creation of and access to these projects is centrally administered by EDS to ensure consistency, compliance, and security.

4. Authorized Use

Tenant Departments are authorized to use their Tableau Server project spaces for the following purposes:

  • Developing dashboards and reports that support departmental decision-making.
  • Publishing departmental data sources to the Data Sources project for reuse by departmental developers.
  • Testing content within QA projects prior to promoting to LIVE.
  • Sharing reports with viewers in accordance with approved group structures and scope rules.

All use of Tableau Server must comply with applicable institutional policies and external regulations (e.g., FERPA, HIPAA, GDPR as applicable).

4.1 Acceptable Practices

  • Publish dashboards only within authorized projects aligned to the department’s tenant.
  • For cross-unit or enterprise reporting needs, collaborate with EDS for governance review and placement.

5. Prohibited Use

The following activities are prohibited to ensure Tableau Server remains a secure, governed platform for analytics and visualization, and is not misused as a data integration, storage, or operational system. These prohibited activities span Security & Compliance, Operational as well as Governance controls.

5.1 Data Exfiltration

Using Tableau Server as a mechanism to extract or redistribute enterprise data outside of approved reporting purposes is prohibited. Access to LITE Shared Data Sources is provisioned strictly for in-platform analytics and visualization. Developers must not create dashboards that enable users to bypass data security controls.

5.2 Unauthorized Data Export

Downloading, exporting, or copying sensitive or restricted data (e.g., PII, PHI, FERPA-protected data, financial information) to local devices, personal storage, or non-approved cloud services is strictly prohibited. This includes programmatic scraping or bulk extraction of data from Tableau Server dashboards or data sources.

5.3 Circumventing Security Controls

Users may not attempt to bypass row-level security, permissions, filters, or other restrictions applied within Tableau Server. This includes creating alternate dashboards or data sources designed to expose data beyond the scope of approved access.

5.4 Feeding Downstream Systems

Tableau Server must not be used as a data integration or system-of-record platform. Content published in Tableau (workbooks, dashboards, or data sources) may not be used to feed downstream transactional, operational, or reporting systems (e.g., ERP, SIS, CRM, external analytics tools). Tableau Server is for visualization and analytics only.

5.5 Tableau Prep Restrictions

Using LITE Shared Data Sources with Tableau Prep is not permitted. Flows created in Tableau Prep do not retain the original source permissions, which can result in inappropriate access to restricted data.

5.6 Publishing Non-Compliant Content

Publishing data sources or reports that contain unvalidated, misleading, or non-compliant content is prohibited. Tableau Server must not be used to store or distribute personal files, non-business documents, or other content unrelated to institutional analytics.

5.7 Performance and Resource Abuse

Users may not run excessive, unoptimized, or automated queries that impair system performance, nor upload oversized or inappropriate extracts that violate storage limits or impact shared server resources.

5.8 Nested AD Groups

Departmentally managed Active Directory (AD) groups may not be nested inside Tableau Server viewer groups. All viewer groups are created and maintained exclusively by Enterprise Data Services.

5.9 Excessive QA Viewer Groups

QA projects are intended for limited testing. Viewer groups in QA are restricted to a maximum of 15 users. Temporary increases may be requested for defined testing periods but must be approved by Enterprise Data Services.

5.10 Cross-Departmental Sharing

Viewer group scope is limited to members of the Tenant Department. Reports intended for audiences outside the department must be reviewed by Enterprise Data Services. If approved, the reports will be migrated to a centrally managed project for broader access. The full guide can be found here .

5.11 External Sharing Without Approval

Sharing dashboards or data externally (outside the institution) without explicit approval is prohibited.

6. Security and Access Control

All permissions and access control are centrally managed by Enterprise Data Services in cooperation with Data Stewards.

Tenant Departments may request changes to developer or viewer groups through the designated point of contact.

Viewer access is strictly read-only. Report developers are responsible for ensuring that the content they publish is appropriate for the intended audience and does not expose data at a level of detail beyond what end users should reasonably access, based on the security and restrictions of the source systems. Data retains the same level of confidentiality on Tableau Server as in its source systems (e.g., Banner, Workday, Data Warehouse).

Access Requests: Submitted via ServiceNow; routed to department head or data steward; EDS reviews for compliance; OIT/EADI – Data Platforms & Databases Team provisions or denies; requestors notified via ServiceNow.

6.1 Security Controls

  • RBAC & Least Privilege: Role-based access is applied to minimize exposure.
  • RLS: Row-level security is enforced for enterprise datasets where applicable.
  • Compliance: FERPA, HIPAA, GDPR and relevant privacy statutes must be observed.

7. Development and Reporting Strategy

LITE Shared Data Sources, maintained by Enterprise Data Services, should be the primary source of truth for institutional data.

Tenant Departments may publish departmental data sources. Departmental data sources are for Tableau Server consumption only; they may not be used to feed external transactional or analytics platforms.

SANDBOX projects should be used for experimentation and development only; LIVE projects are for production-ready reports.

QA projects should be used to test content with limited viewer groups before promotion to LIVE.

7.1 Development Best Practices

  • Use certified/enterprise-approved data sources (e.g., LITE) when available.
  • Departments are strongly encouraged to maintain version control (GT Enterprise GIT) to enable rollbacks, documentation, and continuity.
  • Optimize performance (limit unnecessary extracts, reduce query complexity).
  • To learn more about good design and standards please reference this document 

8. Monitoring and Auditing

All user activities on Tableau Server, including logins, data access, report modifications, and exports, are logged and subject to review. Enterprise Data Services may audit usage to ensure compliance with institutional policies and this TOS. Non-compliant content may be archived, removed, or remediated in consultation with the Tenant Department.

8.1 Audit Cadence (Supplemental)

  • EDS conducts periodic reviews; at minimum, quarterly audits of Tableau Server usage and logs will be performed to validate compliance and identify issues.

9. Consequences of Non-Compliance

Failure to adhere to this TOS may result in actions including, but not limited to:

  • Revocation or restriction of developer or viewer access.
  • Removal of non-compliant content from Tableau Server.
  • Escalation to institutional data governance, cybersecurity, or department leadership.
  • Suspension of future onboarding or cross-departmental sharing requests.

9.1 Enforcement Ladder

  • 1st violation: Warning and required retraining.
  • 2nd violation: Temporary suspension of publishing privileges.
  • 3rd violation: Revocation of publishing rights and leadership escalation.

10. Acknowledgment

By accepting access to Tableau Server, the Tenant Department and its designated developers agree to abide by this Terms of Service document.

Changes to Terms

We reserve the right to modify these terms at any time. Your continued use of the service after any changes constitutes acceptance of the new terms.