Metabase
Metabase declares 30 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Sep 22, 2026. 42 tracked vendors name Metabase as a subprocessor, including Resend, Hyperdoc (a.k.a. Recall.ai) and LiveKit.
Not loaded by any published homepage.
Subprocessors CSV of Metabase's subprocessors · Atom feed of Metabase's subprocessors DORA draft CSV of Metabase's subprocessors as declared by Metabase what's this? ·
30 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services | Hosting for Metabase Cloud accounts, data warehouse for analytics. | United States | |
| Anthropic AI | AI and semantic processing. | United States | |
| Apollo.io | Enrichment of customer data. | United States | |
| Census | Data transfer from internal tools to hosted applications. | United States | |
| Clickhouse | Data warehouse for Metabase Storage option. | United States | |
| Common Room | Community engagement. | United States | |
| Contrast | Webinars. | United States | |
| Customer.io | Email communications. | United States | |
| Docusign | E-signatures for contracts. | United States | |
| Fillout | Forms used for marketing and product research purposes. | United States | |
| Fivetran | Data ingestion for analytics purposes. | United States | |
| Google Analytics | Anonymous url and product usage analytics. | United States | |
| Grain | Summarization and analysis of calls. | United States | |
| HotJar | Understanding website visitor behavior. | United States | |
| Inkeep | AI-backed documentation search and assistant. | United States | |
| Mailchimp | Email communications. | United States | |
| OpenAI AI | Semantic processing. | United States | |
| PandaDoc | Document management and e-signatures. | United States | |
| Pylon | Customer support. | United States | |
| Salesforce | CRM and sales pipeline management. | United States | |
| Scratchpad | Sales workspace and productivity. | United States | |
| Sentry | Application error logging. | United States | |
| Snowcat | Anonymous url and product usage analytics. | United States | |
| StitchData | Data ingestion for analytics purposes. | United States | |
| Stripe | Customer payments. | United States | |
| Unify | Visitor signal collection. | United States | |
| Vercel | Hosting for parts of metabase.com and internal tools. | United States | |
| VWO | Website experimentation. | United States | |
| Zapier | Internal business process automation. | United States | |
| Zoom | Video conferencing. | United States |
Web TechnologiesCSV of Metabase's web technologies · Atom feed of Metabase's web technologies
Metabase's homepage made 110 requests to 23 domains, 12 services controlled by another company, and 3 domains not identified.
12 third parties by category: Analytics 6Advertising 4Other 2
dka575ofm4ao0.cloudfront.netdtrgbxembnbwlmpvhhms.supabase.cozencdn.net
4 tracked companies loaded by the homepage are not in Metabase's subprocessor list. A website can use a service without it processing customer data.
Subprocessor of (42)CSV of the companies listing Metabase · Atom feed of the companies listing Metabase
Ably ably.com Business Intelligence and Analytics Platform
Alloy alloy.app Product Analytics
Amplemarket amplemarket.com Data Analytics; Used internally for business inteligence and data visualization.
Arcade arcade.software Data and analytics; Internal business intelligence and reporting over analytics datasets that may include customer account, usage, viewer, or content-derived information.
Betterworks betterworks.com Cloud-based platform used to provide open-source analytics and business intelligence.
Cal.com cal.com
CallHippo callhippo.com Data Analytics
Cavalry cavalry.ai
ControlHippo controlhippo.com Data Analytics
Cypress cypress.io
Day AI day.ai Data analytics
Dotfile dotfile.com Analytics Dashboard; Data analytics
Employment Hero employmenthero.com Data analytics; Processing Activity: Querying and visualisation of company data for insights and reporting GDPR Transfer Mechanism: Standard Contractual Clauses
groundcover groundcover.com Business analytics and reporting service
Highwire highwire.com Business intelligence and data visualization platform used for internal reporting, dashboards, and operational analytics
Hyperdoc (a.k.a. Recall.ai) recall.ai Data Analytics
KnoCommerce knocommerce.com Internal reporting
Krisp krisp.ai Business analytics; Metabase is a business intelligence (BI) and analytics platform that enables organizations to explore, visualize, and share data insights without requiring advanced technical expertise.
Kudoboard kudoboard.com for site analytics [Headquartered at 660 4th Street #557, San Francisco, CA]
LiveKit livekit.com Product analytics
Magic School magicschool.ai Event logging for analytics
Nango nango.dev Business intelligence
NimbleRx nimblerx.com
Ona ona.com Business Analytics and Reporting Service
Orderful orderful.com Reporting and Analytics
- PandaDoc pandadoc.com Product Analytics and Business Intelligence
Parabola parabola.io Product analytics
PartnerStack partnerstack.com Data Analytics
Perceptyx go.perceptyx.com Data analytics and visualization
Privy privy.io
Recruit CRM recruitcrm.io Advanced analytics partner for custom reporting and business intelligence.
Relay Commerce relaycommerce.io
Replicate replicate.com Data analysis
Resend resend.com Product analytics
Riipen riipen.com Data administration (USA)
Rootly rootly.com Business intelligence. Rootly personnel run read-only queries against production application data to support customer accounts, troubleshoot issues, and analyze product usage.
SocialPilot socialpilot.co Business intelligence designed to analyze and interpret service usage data.
Spellbook spellbook.com Business Intelligence and Reporting; Provides business intelligence, visualizations and reporting.
Spline spline.design Data analytics
SuprSend suprsend.com Analytics
Vendr vendr.com Data Analytics
Warp warp.dev
Security recordCSV of Metabase's security record · Atom feed of Metabase's security record
What public security catalogs list for Metabase, in their words.
Known exploited vulnerabilities
2 vulnerabilities in Metabase's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2026-72898 | Metabase | Metabase SQL Injection Vulnerability | |
| CVE-2021-41277 | Metabase | Metabase GeoJSON API Local File Inclusion Vulnerability |
Source: CISA Known Exploited Vulnerabilities catalog (evidence)
Service statusCSV of Metabase's status page incidents · Atom feed of Metabase's status page incidents
90 days agotoday
- 0 incidents in 90 days
- 0 major or critical
| Began | Incident | Impact | Lasted |
|---|---|---|---|
| Metabase Store is unavailable | critical | 1 h 39 min | |
| Some Metabase functionality unavailable | major | 27 min |
Incidents per month
critical major minor no impact stated
As Metabase's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)
Incidents reported by Metabase's subprocessorsCSV of incidents reported by vendors Metabase lists · Atom feed of incidents reported by vendors Metabase lists
117 reported incidents in the last 30 days, by 13 of the vendors Metabase lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that Metabase was involved.
And 92 more. All of them: CSV · Who is around them.
ChangesCSV of Metabase's changes · Atom feed of Metabase's changes
See the list as we read it on any date: Time machine
None since tracking began.