Looker vs Tableau: Security & Compliance Comparison
Summary
- Looker holds 12 certifications. Tableau holds 7 certifications.
- Both are certified for: SOC 2, ISO 27001, GDPR, UK GDPR, EU-US DPF, Swiss-US DPF.
- Looker has but Tableau doesn't: SOC 3, SOC 1, ISO 27017, ISO 27018, CSA STAR, FedRAMP.
- Tableau has but Looker doesn't: HIPAA.
Side-by-side: all 32 frameworks
| Framework | Looker | Tableau |
|---|---|---|
| Security & General Standards | ||
| SOC 2 | ✓Google Cloud SOC 1/2/3 reports cover Looker (Google Cloud core) per services-in-scope list | ✓SOC 2 report for Tableau listed on Salesforce Compliance Site (compliance.salesforce.com) |
| SOC 3 | ✓SOC 3 included in Google Cloud SOC reports covering Looker | ?Not explicitly documented for Tableau on Salesforce Compliance Site |
| SOC 1 | ✓SOC 1 included in Google Cloud SOC reports covering Looker | ?Not explicitly documented for Tableau |
| ISO 27001 | ✓Covered by Google Cloud ISO 27001/27017/27018 certifications per services-in-scope list | ✓ISO 27001 certification category on Salesforce Compliance Site covering Tableau services |
| ISO 27017 | ✓Covered by Google Cloud ISO 27017 certification | ?Not explicitly documented for Tableau |
| ISO 27018 | ✓Covered by Google Cloud ISO 27018 certification | ?Not explicitly documented for Tableau |
| ISO 27701 | ?Not documented in Google Cloud compliance scope | ?Not documented on Salesforce Compliance Site |
| ISO 42001 | ?Not documented in Google Cloud compliance scope | ?Not documented on Salesforce Compliance Site |
| ISO 9001 | ?Not documented in Google Cloud compliance scope | ?Not documented on Salesforce Compliance Site |
| CSA STAR | ✓Google Cloud holds CSA STAR certification at platform level | ?Not documented on Salesforce Compliance Site |
| HITRUST | ?Not documented in Google Cloud compliance scope | ?Not documented on Salesforce Compliance Site |
| BSI C5 | ~Google Cloud C5 attestation covers platform; explicit Looker coverage not confirmed | ?Not documented on Salesforce Compliance Site |
| Privacy & Data Transfer | ||
| GDPR | ✓Google Cloud GDPR compliance with Data Processing Amendment available | ✓GDPR support via Salesforce data processing addendum covering Tableau Cloud |
| CCPA | ?Not explicitly documented on Google Cloud compliance pages | ~Salesforce privacy program addresses CCPA; Tableau-specific certification not broken out |
| UK GDPR | ✓UK GDPR addressed via Google Cloud DPA and regional data protections | ✓Not explicitly documented |
| LGPD | ?Not explicitly documented | ?Not documented on Salesforce Compliance Site |
| PIPEDA | ?Not documented on Google Cloud compliance pages | ?Not documented on Salesforce Compliance Site |
| DPDP Act | ?Not documented on Google Cloud compliance pages | ?Not documented on Salesforce Compliance Site |
| PIPL | ?Not documented on Google Cloud compliance pages | ?Not documented on Salesforce Compliance Site |
| EU-US DPF | ✓Google certified under EU-US Data Privacy Framework | ✓Salesforce self-certifies under EU-US Data Privacy Framework, covering Tableau Cloud |
| Swiss-US DPF | ✓Google certified under Swiss-US Data Privacy Framework | ✓Salesforce self-certification covers Swiss-US Data Privacy Framework |
| Global CBPR | ?Not documented | ?Not documented on Salesforce Compliance Site |
| Global PRP | ?Not documented | ?Not documented on Salesforce Compliance Site |
| Industry & Government | ||
| HIPAA | ~Google Cloud supports HIPAA with BAA; explicit Looker coverage in BAA not confirmed publicly | ✓HIPAA Compliance Documentation for Tableau Cloud published on Salesforce Help |
| PCI DSS | ~PCI DSS certification at Google Cloud platform level; cardholder-data use case support not confirmed | ?Not documented for Tableau |
| FedRAMP | ✓Looker (Google Cloud core) received FedRAMP High authorization per Google Cloud blog | ~Salesforce Government Cloud Plus is FedRAMP High authorized; Tableau-specific FedRAMP listing not separately documented on FedRAMP Marketplace |
| StateRAMP | ?Not documented | ?Not documented on Salesforce Compliance Site |
| DORA | ?Not documented | ?Not documented on Salesforce Compliance Site |
| CJIS | ?Not documented for Looker | ?Not documented for Tableau |
| FINRA | ?Not documented | ?Not documented for Tableau |
| IRAP | ~Google Cloud IRAP covers platform; explicit Looker coverage not confirmed | ?Not documented for Tableau |
| Emerging & Strategic | ||
| NIST CSF | ?Not explicitly documented | ?Not explicitly documented |
✓ Certified~ Partial / conditional— Not certified? Not publicly documented
Need help choosing?
Join our waitlist for compliance alerts and expert comparisons.
Join the waitlist →