Hi Sam -
Published extracts are stored on the server. Based upon your schedule, the Tableau Bridge will create the full or incremental extract, and publish it to tableau Online.
This article is a bit dated but it briefly mentions the process: Introducing the Tableau Bridge: live queries to on-premises data from Tableau Online | Tableau Software
Thanks, Mark. That's what I figured, but I just wanted to verify I was understanding it correctly. Our IT group is balking at enterprise adoption of Tableau Online because they have security concerns about data extracts published to Online's servers not being encrypted at rest (apparently it's only encrypted in transit). My thought was that if the extract is being refreshed locally via Bridge, maybe that extract is also being stored on-premises as well, in which case that concern could be resolved. I guess we'll just use live connections.