Security / trust page — Metabase

Cited by

Facts read from this source

• SOC 2 Report an error

  “Our SOC 2 Type II report attests to the controls Metabase has in place governing the security of customer data.”

• Soc1 Report an error

  “Our SOC 1 Type II report provides assurances that Metabase has internal control over financial reporting.”

• GDPR Report an error

  “At Metabase, we’ve worked to make our products, processes, and procedures GDPR-compliant.”

• CCPA Report an error

  “Metabase acts as a service provider to customers under the California Consumer Privacy Act (CCPA), and we support our customers’ compliance with the CCPA.”

• Self hosted data Report an error

  “Your data stays on your servers—and in your control. We never look at or copy your data. Period.”

• Air gapped deployments Report an error

  “On-site or air-gapped deployments aren’t an afterthought.”

• Anonymized usage data opt Report an error

  “Although we offer (clearly marked and completely optional) ways to share anonymized usage data, most people’s open-source instances never need to call into us at all”

• Regions Report an error

  “You can even keep it in the neighborhood, with cloud-hosting options in the US, Europe, Latin America, and Asia-Pacific.”

• Isolation Report an error

  “Each of our hosting customers has their own containers, with no shared clusters.”

• Data storage Report an error

  “unless you enable results caching, none of the data returned by your database is stored on our end”

• SSO Report an error

  “We’ve also built detailed privacy and security features to secure data access within your organization, including finely-grained permissions controls and support for SSO.”

• Deletion Report an error

  “As a customer, you can request buyer-related data deletion at any time.”

• Inactivity removal Report an error

  “Instance-related data is removed automatically after a period of inactivity.”

• Oversight Report an error

  “Metabase monitors these sub-processing vendors by conducting reviews of their controls before use and at least annually.”

• Security center Report an error

  “Self-hosted instances running v56 and later include Security Center, an admin tool that monitors your instance against the Metabase security advisory database.”

• Pentests Report an error

  “Metabase engages independent entities to conduct yearly application-level and infrastructure-level penetration tests.”

• Vulnerability disclosure Report an error

  “We publish our security advisories on GitHub.”

• Access management Report an error

  “Metabase adheres to the principles of least privilege and role-based permissions when provisioning access”

• Encryption transit Report an error

  “Data in transit is encrypted using TLS 1.2 or higher.”

• Encryption at rest Report an error

  “Sensitive data, like connection strings and settings, is encrypted at row-level with AES256 + SHA512.”

• Endpoint security Report an error

  “Metabase’s default configuration sets up workstations to encrypt data at rest, have strong passwords, and lock when idle.”

• Server hardening Report an error

  “All servers within our production fleet are hardened according to industry standard CIS benchmarks.”

• Monitoring Report an error

  “Administrative access, use of privileged commands, and system calls on all servers in Metabase’s production network are logged and monitored.”

• Availability zones Report an error

  “Metabase utilizes services deployed by its hosting provider to distribute production operations across separate availability zones.”

• Backups Report an error

  “Full backups are saved at least once per day and transactions are saved continuously.”

• Dr testing Report an error

  “Metabase tests backup and restore capabilities annually to ensure successful disaster recovery.”

• Incident response Report an error

  “In the event of an incident, affected customers will be informed via email from our customer success team. Incident response procedures are tested and updated at least annually.”

Scores citing this record

• The Data Analyst European sovereignty
• The Finance Controller European sovereignty
• The IT Administrator European sovereignty
• The Managing Director European sovereignty
• The SaaS Product Lead European sovereignty
• The Skeptic European sovereignty