Tableau doesn't recommend hosting the extensions on the Tableau Server (which would from security perspective might be the best option). I would assume the reason would be not to overload the Tableau Server itself with additional tasks.
Then, aside of that option, what would be the best place to host an extension which should use company's sensitive data? Did you had a similar scenario? Did Tableau itself gave additional recommendations (aside of using SSL, etc)?