← Boreon TabTotal GRC suite
Comply Anthropic Claude · optional

TabTable

Audit-grade Tableau evidence converter

Turns any Tableau workbook into reproducible, content-hashed audit evidence — every field, formula and connection extracted by our own XML reader, past where Tableau’s API stops. Same bytes in, byte-identical evidence out — the reproducible, timestamped class of artifact SOC 2 Type 2 and SOX ITGC reviewers ask for.

What TabTable does

Built deep. Delivered governed.

Multi-tab styled .xlsx evidence pack — Cover, Overview, Data Sources, Fields, Calculations & Findings, each a filterable banded table with a frozen header, plus json/ndjson for downstream tooling

SHA-256 evidence seal with a deterministic .xlsx writer — zip member dates flattened to a fixed epoch and the cover stamp derived from the source hash, so the same workbook always re-serializes byte-identical and tampering is detectable

Caption≠name field fidelity — display caption and internal id travel together with datatype, role and aggregation, and every calculation carries its full formula text plus the [field] references it uses

Secrets redacted in the parser, before the model exists — embedded usernames, passwords and tokens never reach an export, so every downloadable artifact is secrets-free by construction and the leak is recorded as a finding

Hardened, read-only ingest — .twbx zip-bomb (ratio & size cap) and zip-slip path-traversal rejection, XXE/DTD disabled in our reader, and no write path back to Tableau, ever

Who it's for

For audit, risk and Tableau-platform teams who must reconcile a number or evidence a change with a faithful, tamper-evident extract of what a workbook actually contains.

On AI

AI writes only an advisory cover narrative and calculation glossary in a separately watermarked "AI Notes" lane (bring-your-own Claude, local model default, deterministic fallback) — ingest, parse, redact, serialize and SHA-256 seal are 100% deterministic, and AI never touches the hash-sealed evidence or any write path, because there is no write path back to Tableau.

41
test functions green · byte-identical evidence guard
The rest of the suite

Better together.

TabMigrate

Claude
Governed Server → Cloud migration

Moves Tableau content from Server to Cloud on the official Migration SDK — but wraps it in a workflow a human can actually trust: see the real project tree, tick exactly what migrates, map the users and projects that always snag a move, then dry-run, preview risk, and approve before a single byte is published. Every run ends with a downloadable compliance audit you can attach to a change ticket.

Explore TabMigrate

TabOffboard

Claude
Governed offboarding & licence reclamation

Offboards a departing Tableau user the way a careful administrator would — discovering every object they own read-only, drafting a reassignment plan to a chosen steward, and gating the writes behind explicit human approval. Content is always reassigned before the seat is reclaimed, and every run lands a secrets-free audit you can attach to a change ticket.

Explore TabOffboard

TabLineage

Claude Ultracode
Cross-server lineage & blast radius

Point TabLineage at up to four Tableau reference points — workbooks, published data sources, or Prep flows — across the same or different servers, and it merges their end-to-end lineage into one deterministic graph where the shared tables and data sources reveal the blast radius. Then it drops you into a WCAG-AA node-link Explorer to walk the whole landscape — point, click, pan, zoom — and download the lineage as evidence.

Explore TabLineage

TabRisk

Claude
Read-only PII/PHI exposure scanner

Scans your Tableau estate the way a privacy reviewer would — reading the metadata surface read-only, running a deterministic floor of regex, checksum and dictionary detectors, and fusing each hit into a transparent risk score. Every finding is stamped "possible PII/PHI — requires human verification," and the output is audit-ready evidence you can attach to a review — never a legal certification, never de-identification.

Explore TabRisk

TabGuard

Claude
Read-only estate security & threat scan

Connect once, then sweep an entire Tableau estate the way a security reviewer would — enumerating every workbook, data source and flow, unpacking the packaged files read-only, and running a deterministic battery of scanners for embedded secrets and injectable SQL. Each finding lands with a rule ID, redacted evidence, a severity, and a pre-attached CIS Controls v8.1 Safeguard and NIST CSF 2.0 function — audit-ready evidence you can drop straight into a SOC 2 or ISO 27001 ticket.

Explore TabGuard

TabQuality

Claude
UAT → PROD workbook QA & promotion

Reads a Tableau workbook the way a careful reviewer would — running deterministic quality checks, comparing a UAT candidate against live PROD with a true semantic diff, and producing a client-ready audit you can attach to a change ticket. When the candidate passes clean, it gates PROD promotion behind a typed, dual-signed approval and writes an immutable record of who promoted what, when.

Explore TabQuality

TabTranslate

Claude
Governed workbook localization & republish

Localizes a Tableau workbook the safe way — translating only the author-written display text and leaving every internal name, calculation, and packaged data source untouched, so a translation can’t break the workbook. It auto-detects the source language, localizes into any of Tableau’s 10 official display languages, and publishes to a project you choose — with the translated file always available as a download.

Explore TabTranslate

TabRender

Claude Ultracode
Data-safe workbook recolour & render

Recolours a Tableau workbook to a governed brand or accessibility palette by rewriting only its visual style XML — never a single data, calc, or connection byte — and hands back a polished file with a SHA-256 data-safety manifest you can attach to a change ticket. Tableau’s own VizQL engine renders the final pixels on open; the recolour stays 100% deterministic and AI never touches the write path.

Explore TabRender

Make TabTable part of your governance.

License TabTable on its own, link it with others, or unlock the whole Boreon TabTotal suite.