# Metabase — Business Intelligence & Dashboards

Metabase by Metabase, Inc. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Metabase, Inc. (https://www.metabase.com)
- Category: [Business Intelligence & Dashboards](https://whats-best.ai/software/business-intelligence.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-intelligence/metabase
- Alternatives: https://whats-best.ai/software/business-intelligence/metabase/alternatives ([markdown](https://whats-best.ai/software/business-intelligence/metabase/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Metabase, Inc.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 1 Nov 2026
- Starting price: “Starter $100 / month” (vendor’s words) [S7]

## The panel's verdict

Metabase is a business intelligence product that queries 18 official database and warehouse connectors live, with a no-SQL query builder and a SQL editor. It scored highest on sharing and embedding (7 to 9), where server-signed embeds, locked parameters for per-viewer data isolation and a React SDK are documented, and on governance and portability (7 to 8), where permissions reach row and column level alongside an audit log, a REST API and an AGPL self-hosted edition. Self-service and modelling held at 7 to 7 on a semantic layer whose metric edits propagate to every question. The splits are data connectivity (4 to 7) and sovereignty (5 to 8). Connectivity divided on the same fact: judges with database stacks saw 18 official connectors; judges needing ERP, CRM or accounting connections found only tool-by-tool guides for Stripe, HubSpot and Shopify. Sovereignty divided between self-hosting with an air-gapped option and a Europe (Frankfurt) cloud region on one side, and the Metabase, Inc. contracting entity under California law, with no public information on subprocessors or a data processing agreement, on the other.

**Speaks for it:**
- Sharing and embedding drew the bench's highest scores (7 to 9) on server-signed embeds, locked parameters for per-viewer isolation and a React SDK, with embedding "From $575 / month" on Pro and Enterprise.
- Self-service and modelling scored 7 to 7, with metric edits propagating immediately to every question that uses them.
- Governance and portability scored 7 to 8, with permissions to row and column level, an audit log and a documented REST API with a downloadable OpenAPI 3.1.0 specification.
- Pricing transparency scored 7 to 8, with Starter at $100 / month, Pro at $575 / month and every user who signs in counted for billing.

**Held against it:**
- Data connectivity drew the bench's lowest score (4 to 7), as the catalog covers databases and warehouses while Stripe, HubSpot and Shopify appear as tool-by-tool guides.
- Sovereignty scored 5 to 8 against a Californian contracting entity, with no public information on subprocessors or a data processing agreement.
- We found no public information on pivot tables, mobile or TV display, print-ready output or chart accessibility.
- Metrics work only in the query builder and are not available in joins or nested questions.
- Enterprise is a $20,000 / year floor and the air-gapped edition carries an unspecified additional fee.

**Best for:**
- You embed customer-facing analytics in your own product and need each customer to see only their own rows.
- Your data sits in mainstream databases and warehouses and you want live queries rather than ingestion.
- You need one official definition per metric, applied everywhere it is used and updated in place when it changes.
- You want to budget Starter or Pro from the published pricing page before talking to sales.

**Avoid if:**
- Your data sources are business applications such as CRM, accounting or ERP systems rather than databases and warehouses.
- You need metrics to work inside joins or nested questions rather than single-source query-builder questions.
- Your access rules must also govern native SQL access, which the documented limits state bypasses row and column security.
- You require a European contracting entity; the terms of use name Metabase, Inc. under California law.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Finance Controller | The Managing Director | The Data Analyst | The IT Administrator | The SaaS Product Lead | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Data sources, connectors & refresh | 3/5 | 2/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 |
| Dashboards, charts & interactivity | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| Self-service analysis & shared metrics | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Sharing, scheduled reports & embedding | 3.5/5 | 4/5 | 4/5 | 4/5 | 4.5/5 | 3.5/5 |
| Access control, administration & portability | 3.5/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| European sovereignty | 3.5/5 | 2.5/5 | 4/5 | 3.5/5 | 3/5 | 3/5 |
| Pricing transparency | 3.5/5 | 4/5 | 4/5 | 4/5 | 3.5/5 | 3.5/5 |
| **Weighted verdict** | **3.5/5** | **3/5** | **4/5** | **4/5** | **3.5/5** | **3.5/5** |

### The judges

- **The Finance Controller** (v1.0): Head of controlling at a 250-person machine builder in Baden-Württemberg. Closes the month from DATEV, the ERP, the CRM and a dozen Excel files that colleagues still mail around, and spends two days a month copying numbers into the management report. Wants the sources connected and refreshed on a schedule, one definition of contribution margin on every page, a report that prints cleanly for the advisory board, and data that stays where the auditors expect it.
- **The Managing Director** (v1.0): Runs a 40-person service company with HubSpot, an online accounting tool, a help desk and a project management app, and no one whose job is data. Wants revenue, pipeline, utilisation and open tickets on one screen in the office and on their phone, set up in an afternoon from ready-made connectors, a weekly summary in the inbox on Monday morning, and a price that does not double when the whole team wants to look.
- **The Data Analyst** (v1.0): The first data hire at a Hamburg e-commerce scale-up, with orders, marketing spend and customer data landing in a PostgreSQL warehouse every night. Answers the same question three times a week because every department computes revenue differently. Wants a SQL editor and a query builder for colleagues, metrics defined once in a model that lives in Git, natural-language questions that show the query they ran, and a way out that does not mean rebuilding every dashboard.
- **The IT Administrator** (v1.0): IT lead at a mid-sized healthcare supplier whose reports touch customer, pricing and employee data. Is asked to approve a BI tool after a department has already started a trial. Reads where extracts and caches are stored, whether the tool reaches the ERP database through a gateway or wants it opened to the internet, whether sales sees only its own region, and whether single sign-on and an audit log come with the plan or behind a sales call. Prefers an edition they can run themselves.
- **The SaaS Product Lead** (v1.0): Product lead at a Vienna software company selling fleet management to 600 business customers, each of whom asks for reports the team keeps building by hand. Wants dashboards embedded in the product under its own brand, every customer seeing only their own rows, customers building their own views without a ticket, and an embedding licence whose cost they can put into the product's price before signing.
- **The Skeptic** (v1.0): Has seen "connect any data source" on a tool with eight connectors and a CSV upload, "self-service" that ends with every department defining revenue its own way, "free viewers" that need a paid licence to open a shared link, and "AI insights" that never show the query. Asks where the extracts are stored, whether dashboards and definitions can be exported in a format another tool reads — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Access management: yes · yes [S11]
- Alert branding removal: Metabase branding can be removed from alerts (via exports docs) [S21]
- CCPA: yes [S11]
- Certifications: GDPR · CCPA · SOC1 · SOC2 [S1]
- Certifications: SOC2 Type II · GDPR · CCPA [S5]
- Certifications: GDPR · CCPA · SOC 2 Type II · SOC 1 [S7]
- Encryption at rest: row-level for connection strings and settings · AES256 + SHA512 [S11]
- Encryption transit: 1.2 [S11]
- Endpoint security: yes · yes [S11]
- GDPR: yes [S11]
- Incident response: yes · email · yes [S11]
- Monitoring: yes · yes [S11]
- Required 2FA: Metabase 64 announcement mentions required 2FA and security hardening [S4]
- Server hardening: CIS benchmarks · yes [S11]
- Soc1: SOC 1 Type II [S11]
- SOC 2: SOC 2 Type II · Sensiba LLP · yes [S11]
- Vulnerability disclosure: GitHub security advisories · yes [S11]

**Data**
- Backups: continuous · daily [S11]
- Deletion: yes [S11]
- Dr testing: yes [S11]
- Inactivity removal: yes [S11]

**Hosting**
- Air gap: Enterprise · yes [S7]
- Availability zones: yes [S11]
- Cloud: yes [S7]
- Cloud trial: yes · yes [S8]
- Custom domain cname update: Custom domains require updating CNAMES when changing region [S9]
- Custom domain switch downtime: Custom domain region change may take up to 24 hours due to DNS propagation [S9]
- Data storage: results caching · no [S11]
- Docker: yes · yes [S8]
- Isolation: no · yes [S11]
- Jar self hosting: yes [S8]
- Region change backups: help@metabase.com · yes [S9]
- Region change method: Region changed via Metabase Store account > Instances > Settings > Hosting region > Change region [S9]
- Region change whitelist: Add relevant IP addresses to whitelist if using security group or firewall rules [S9]
- Region switch downtime: Most region switches take less than 30 minutes; instance offline during switch [S9]
- Regions: US · Europe · Latin America · Asia-Pacific [S11]
- Regions available: US West (Oregon) · Europe (Frankfurt) [S9]
- Self hosted: yes [S7]

**Integrations**
- Action endpoints: 10 · yes · yes [S10]
- Action list endpoint: model-id · type · archived · implicit · query [S10]
- API changelog: yes [S10]
- API docs generation: clojure -M:ee:doc api-documentation [S10]
- API documentation: yes [S10]
- API key management: yes [S10]
- API self hosted docs: yes [S10]
- API stability: no [S10]
- API tutorial: yes [S10]
- API versioning: no [S10]
- Aws marketplace: no · no [S8]
- Client libraries: Shell · Ruby · Node.js · PHP · Python [S10]
- Community apache pinot: Apache Pinot [S6]
- Community cube: Cube [S6]
- Community dremio: Dremio [S6]
- Community duckdb: DuckDB [S6]
- Community exasol: Exasol [S6]
- Community firebolt: Firebolt [S6]
- Community hydra: Hydra [S6]
- Community materialize: Materialize [S6]
- Community ocient: Ocient [S6]
- Community starrocks: StarRocks [S6]
- Community teradata: Teradata [S6]
- Helm chart: no [S8]
- Official amazon athena: Amazon Athena [S6]
- Official amazon redshift: Amazon Redshift [S6]
- Official bigquery: BigQuery [S6]
- Official clickhouse: ClickHouse [S6]
- Official databricks: Databricks [S6]
- Official druid: Druid [S6]
- Official mariadb: MariaDB [S6]
- Official microsoft sql server: Microsoft SQL Server [S6]
- Official mongodb: MongoDB [S6]
- Official mysql: MySQL [S6]
- Official oracle database: Oracle Database [S6]
- Official postgresql: PostgreSQL [S6]
- Official presto: Presto [S6]
- Official snowflake: Snowflake [S6]
- Official spark: Spark [S6]
- Official sqlite: SQLite [S6]
- Official starburst: Starburst [S6]
- Official vertica: Vertica [S6]
- Openapi client UI: Scalar [S10]
- Openapi spec download: 3.1.0 · yes [S10]
- Openapi spec standard: 3.1.0 [S10]
- Status page: yes [S1]

**Legal**
- Account deletion destructive: yes [S13]
- App license: Application licensed under AGPL or a commercial license; these ToS cover only the website/store [S13]
- Applicant privacy policy: Applicant Privacy Policy applies to Metabase job applicants [S12]
- Coppa: no [S13]
- Dmca policy: yes [S13]
- Effective date: 2015-10-01 [S13]
- Entity name: Metabase, Inc. [S13]
- Governing law: California [S13]
- Hosting privacy policy: Hosting Privacy Policy applies to Metabase Cloud product [S12]
- Liability cap: 100 · greater of $100 or amounts paid in preceding 12 months [S13]
- Self hosted policy: Self Hosted product, including Open Source, covered by separate linked policies [S12]
- Terms change rights: yes [S13]
- Website privacy policy: Website Privacy Policy applies to use of the website [S12]

**Pricing**
- Advanced transforms: 0.02 · 1000 [S7]
- AI tokens: 1000000 · 3.75 [S7]
- Auth provider plans: Pro · Enterprise · yes [S15]
- Enterprise min year: 20000 [S7]
- Metric caching plans: Pro · Enterprise · metric result caching · self-hosted · Metabase Cloud [S18]
- Plans: Starter and Open Source · Pro · Enterprise [S2]
- Plans: Starter and Open Source · Pro · Enterprise [S1]
- Pro price: 575 [S7]
- Pro user cost: 10 · 12 [S7]
- Prorated billing: yes [S7]
- Query builder availability: Pro or Enterprise · yes [S3]
- Starter price: 100 [S7]
- Starter user cost: 5 · 6 [S7]
- Storage: 1000000 · 2 [S7]
- Tax note: yes [S7]
- Transforms: 0.01 · 1000 [S7]
- Trial: 14 · yes [S1]
- Trial: yes · 14 [S4]
- Trial: 14 · yes [S7]
- Trial days: 14 [S3]
- User definition: yes [S7]
- Yearly discount: 10 [S7]

**Product**
- AI all plans: AI on all plans [S1]
- Air gapped deployments: yes [S11]
- Air gapped edition: yes [S8]
- Alerts admin bulk management: yes · yes [S21]
- Alerts admin permissions: any alert · yes [S21]
- Alerts admin visibility location: Usage analytics collection [S21]
- Alerts creator deactivation: yes [S21]
- Alerts custom visualization fallback: yes [S21]
- Alerts delivery channels: email · slack · webhook [S21]
- Alerts editing permissions: own alerts only [S21]
- Alerts email notifications: alert set up · unsubscribed from alert · alert stopped working · you unsubscribed · admin added you to alert [S21]
- Alerts embedded exclude links: yes [S21]
- Alerts goal line removal fallback: changes to Results alert [S21]
- Alerts goal line requirements: bar · line · area [S21]
- Alerts in embeds: withAlerts · with-alerts · yes [S20]
- Alerts one time: sends once then deletes alert · yes [S21]
- Alerts prerequisite: email · slack · webhooks · yes [S21]
- Alerts progress bar: progress bar visualization · yes [S21]
- Alerts question deletion: alerts deleted [S21]
- Alerts questions only: questions only [S21]
- Alerts requirements: requires email setup, SSO embed, Subscriptions and alerts permission, collection permissions [S20]
- Alerts scheduling: minute · hourly · daily · weekly · monthly · custom Quartz cron [S21]
- Alerts slack channel rename: yes [S21]
- Alerts test: yes [S21]
- Alerts trigger types: any result · goal line · progress bar goal [S21]
- Alerts unsubscribe: yes [S21]
- Alerts webhook permission: admins and people with settings access [S21]
- Anonymized usage data opt: yes [S11]
- App controlled parameters no restriction: app-set parameters are browser-side and do not restrict queries [S20]
- Application permissions: Pro · Enterprise · yes [S4]
- Audit log: yes · yes [S5]
- Auth providers supported: Azure Managed Identity · Oauth · IAM authentication for AWS RDS [S15]
- Auto apply filters: yes [S16]
- Auto apply toggle: Auto-apply filters can be toggled off; Apply button then refreshes [S16]
- Auto connect filters: yes [S16]
- Automatic insights xrays: yes [S17]
- Azure web apps: yes [S8]
- Boolean filter: yes [S16]
- Build from source: yes [S8]
- Caching: yes [S1]
- Cloud deployment: self-host · Metabase Cloud [S1]
- Collection permissions: Group-level view/edit permissions on collection items [S4]
- Column security edited column schema: no · yes [S22]
- Column security parameters must be required: no [S22]
- Column security prerequisites: yes · yes · yes [S22]
- Column security question must be sql: yes [S22]
- Community connectors count: 11 [S6]
- Community connectors hosting constraint: yes · no [S6]
- Content license: perpetual, irrevocable, worldwide, royalty-free, non-exclusive [S13]
- Cross filtering: yes [S17]
- CSV upload: CSV upload [S2]
- CSV upload: yes [S6]
- Custom click actions sdk only: yes [S20]
- Custom click behavior targets: another question · dashboard · external URL · update a filter on the current dashboard [S17]
- Custom expressions: yes [S3]
- Customers count: 100,000+ [S1]
- Dashboard filters: Dashboards support filter and parameter widgets to filter or parameterize displayed data [S16]
- Dashboard widget scope: individual card · same tab · all tabs [S16]
- Dashboards: Analytics dashboard: bring together charts and questions on live dashboards [S2]
- Dashboards: yes [S1]
- Data actions: yes · yes [S15]
- Data segregation: Data segregation / multi-tenant support [S2]
- Data sources count: 20 [S5]
- Database managed row permissions: Impersonated access via database-defined roles and user attributes [S4]
- Database routing: yes [S15]
- Database routing mention: Database routing exists as an alternative for switching connections by logged-in user [S23]
- Date picker operators: Month and Year · Quarter and Year · Single Date · Date Range · Relative Date · All Options [S16]
- Discussion forum tos: https://discourse.metabase.com/tos [S13]
- Docker deployment: deployable via docker run command [S1]
- Docs version: v0.65 [S16]

**Subprocessors**
- Oversight: before use and at least annually · yes [S11]

**Support**
- Channel email: email · no [S5]
- Embedding plans support: technical expert support available on Pro and Enterprise embedding plans [S5]
- Legal contact: legal@metabase.com · (415) 688-4151 · 9740 Campo Rd. Suite 1029, Spring Valley, CA 91977 [S13]
- Metabase experts: yes [S8]

231 more facts on the canonical page: https://whats-best.ai/software/business-intelligence/metabase

## Questions

### Is Metabase European?

No. whats-best.ai classifies Metabase as Rest of world.

### Where does Metabase store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Metabase have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

### What are the best alternatives to Metabase?

As of 1 Nov 2026, the panel rates [Preset (Apache Superset) (3.5/5)](https://whats-best.ai/software/business-intelligence/preset), [Holistics (3/5)](https://whats-best.ai/software/business-intelligence/holistics) and [Luzmo (3/5)](https://whats-best.ai/software/business-intelligence/luzmo) highest among the other 15 Business Intelligence & Dashboards products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Luzmo](https://whats-best.ai/software/business-intelligence/luzmo) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Metabase alternatives](https://whats-best.ai/software/business-intelligence/metabase/alternatives).

## Head-to-head

- [Metabase vs Cluvio](https://whats-best.ai/compare/cluvio-vs-metabase.md)

## What this page leaves out

- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 9 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.metabase.com/ (checked 2026-11-01)
- [S2] Features page: https://www.metabase.com/features (checked 2026-11-01)
- [S3] Features page (query builder): https://www.metabase.com/features/query-builder (checked 2026-11-01)
- [S4] Features page (permissions): https://www.metabase.com/features/permissions (checked 2026-11-01)
- [S5] Features page (embedded analytics): https://www.metabase.com/product/embedded-analytics (checked 2026-11-01)
- [S6] Integrations page (data sources): https://www.metabase.com/data-sources (checked 2026-11-01)
- [S7] Pricing page: https://www.metabase.com/pricing (checked 2026-11-01)
- [S8] Documentation (self-hosting): https://www.metabase.com/docs/latest/installation-and-operation/installing-metabase (checked 2026-11-01)
- [S9] Documentation (cloud region): https://www.metabase.com/docs/latest/cloud/change-region (checked 2026-11-01)
- [S10] API documentation: https://www.metabase.com/docs/latest/api (checked 2026-11-01)
- [S11] Security / trust page: https://www.metabase.com/security (checked 2026-11-01)
- [S12] Privacy policy: https://www.metabase.com/privacy-policies (checked 2026-11-01)
- [S13] Terms of service: https://www.metabase.com/terms (checked 2026-11-01)
- [S14] Data sources, connectors & refresh — found from sitemap: https://www.metabase.com/docs/latest/databases/connecting (checked 2026-11-01)
- [S15] Data sources, connectors & refresh — found from sitemap: https://www.metabase.com/docs/latest/databases/connections/postgresql (checked 2026-11-01)
- [S16] Dashboards, charts & interactivity — found from sitemap: https://www.metabase.com/docs/latest/dashboards/filters (checked 2026-11-01)
- [S17] Dashboards, charts & interactivity — found from sitemap: https://www.metabase.com/docs/latest/questions/visualizations/drill-through (checked 2026-11-01)
- [S18] Self-service analysis & shared metrics — found from sitemap: https://www.metabase.com/docs/latest/data-modeling/semantic-layer/metrics (checked 2026-11-01)
- [S19] Self-service analysis & shared metrics — found from sitemap: https://www.metabase.com/docs/latest/data-modeling/semantic-layer/measures (checked 2026-11-01)
- [S20] Sharing, scheduled reports & embedding — found from sitemap: https://www.metabase.com/docs/latest/embedding/chart (checked 2026-11-01)
- [S21] Sharing, scheduled reports & embedding — found from sitemap: https://www.metabase.com/docs/latest/questions/alerts (checked 2026-11-01)
- [S22] Access control, administration & portability — found from sitemap: https://www.metabase.com/docs/latest/permissions/row-and-column-security (checked 2026-11-01)
- [S23] Access control, administration & portability — found from sitemap: https://www.metabase.com/docs/latest/permissions/impersonation (checked 2026-11-01)
- [S24] Code repository (open-source licence) — found from the homepage: https://github.com/metabase/metabase (checked 2026-11-01)

---

Cite as: whats-best.ai, "Metabase — Business Intelligence & Dashboards", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-intelligence/metabase

Corrections: https://whats-best.ai/correct/1261?target=page