Metabase

metabase.com

Metabase declares 30 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Sep 22, 2026. 42 tracked vendors name Metabase as a subprocessor, including Resend, Hyperdoc (a.k.a. Recall.ai) and LiveKit.

Subprocessors CSV of Metabase's subprocessors · Atom feed of Metabase's subprocessors DORA draft CSV of Metabase's subprocessors as declared by Metabase what's this? · 

30 third parties.

NamePurposeLocationListed since
Amazon Web Services Hosting for Metabase Cloud accounts, data warehouse for analytics.United States
Anthropic AIAI and semantic processing.United States
Apollo.io Enrichment of customer data.United States
Census Data transfer from internal tools to hosted applications.United States
Clickhouse Data warehouse for Metabase Storage option.United States
Common Room Community engagement.United States
Contrast Webinars.United States
Customer.io Email communications.United States
Docusign E-signatures for contracts.United States
Fillout Forms used for marketing and product research purposes.United States
Fivetran Data ingestion for analytics purposes.United States
Google Analytics Anonymous url and product usage analytics.United States
Grain Summarization and analysis of calls.United States
HotJar Understanding website visitor behavior.United States
Inkeep AI-backed documentation search and assistant.United States
Mailchimp Email communications.United States
OpenAI AISemantic processing.United States
PandaDoc Document management and e-signatures.United States
Pylon Customer support.United States
Salesforce CRM and sales pipeline management.United States
Scratchpad Sales workspace and productivity.United States
Sentry Application error logging.United States
Snowcat Anonymous url and product usage analytics.United States
StitchData Data ingestion for analytics purposes.United States
Stripe Customer payments.United States
Unify Visitor signal collection.United States
Vercel Hosting for parts of metabase.com and internal tools.United States
VWO Website experimentation.United States
Zapier Internal business process automation.United States
Zoom Video conferencing.United States

Web TechnologiesCSV of Metabase's web technologies · Atom feed of Metabase's web technologies

Metabase's homepage made 110 requests to 23 domains, 12 services controlled by another company, and 3 domains not identified.

Analytics (6): Hotjar, LinkedIn, Cortex Analytics (Bellaso), jsDelivr; usually detected as Analytics: Wingify, CloudflareAdvertising (4): Google Cloud, Microsoft, OpenAI, Reddit, Inc.Other (2): Geolocation: GeoJS; Issue trackers: Sentry

12 third parties by category: Analytics 6Advertising 4Other 2

Third parties 12 · 61 requests
Google Cloudsubprocessor DoubleClick Floodlight Google Analytics Google Tag Manager 32% of the page's requests 35
Hotjarsubprocessor Hotjar 5% of the page's requests 6
LinkedIn Linkedin Insight Tag 4% of the page's requests 4
Microsoft Microsoft Advertising 4% of the page's requests 4
OpenAIsubprocessor ChatGPT Ads Measurement Pixel 3% of the page's requests 3
Reddit, Inc. Reddit Ads 2% of the page's requests 2
Wingifysubprocessor visualwebsiteoptimizer.com 2% of the page's requests 2
Cloudflare cloudflare.com <1% of the page's requests 1
Cortex Analytics (Bellaso) Bellaso <1% of the page's requests 1
GeoJS GeoJS <1% of the page's requests 1
Sentrysubprocessor Sentry <1% of the page's requests 1
jsDelivr Snowplow Analytics jsDelivr <1% of the page's requests 1
Unknown 3 · 8 requests

dka575ofm4ao0.cloudfront.netdtrgbxembnbwlmpvhhms.supabase.cozencdn.net

First party 1 · 41 requests
Metabase Astro Contentsquare Google Font API HSTS Open Graph Priority Hints RSS Vercel cdnjs 37% of the page's requests 41

4 tracked companies loaded by the homepage are not in Metabase's subprocessor list. A website can use a service without it processing customer data.

Subprocessor of (42)CSV of the companies listing Metabase · Atom feed of the companies listing Metabase

42 companies
  • Ably ably.com Business Intelligence and Analytics Platform
  • Alloy alloy.app Product Analytics
  • Amplemarket amplemarket.com Data Analytics; Used internally for business inteligence and data visualization.
  • Arcade arcade.software Data and analytics; Internal business intelligence and reporting over analytics datasets that may include customer account, usage, viewer, or content-derived information.
  • Betterworks betterworks.com Cloud-based platform used to provide open-source analytics and business intelligence.
  • Cal.com cal.com
  • CallHippo callhippo.com Data Analytics
  • Cavalry cavalry.ai
  • ControlHippo controlhippo.com Data Analytics
  • Cypress cypress.io
  • Day AI day.ai Data analytics
  • Dotfile dotfile.com Analytics Dashboard; Data analytics
  • Employment Hero employmenthero.com Data analytics; Processing Activity: Querying and visualisation of company data for insights and reporting GDPR Transfer Mechanism: Standard Contractual Clauses
  • groundcover groundcover.com Business analytics and reporting service
  • Highwire highwire.com Business intelligence and data visualization platform used for internal reporting, dashboards, and operational analytics
  • Hyperdoc (a.k.a. Recall.ai) recall.ai Data Analytics
  • KnoCommerce knocommerce.com Internal reporting
  • Krisp krisp.ai Business analytics; Metabase is a business intelligence (BI) and analytics platform that enables organizations to explore, visualize, and share data insights without requiring advanced technical expertise.
  • Kudoboard kudoboard.com for site analytics [Headquartered at 660 4th Street #557, San Francisco, CA]
  • LiveKit livekit.com Product analytics
  • Magic School magicschool.ai Event logging for analytics
  • Nango nango.dev Business intelligence
  • NimbleRx nimblerx.com
  • Ona ona.com Business Analytics and Reporting Service
  • Orderful orderful.com Reporting and Analytics
  • PandaDoc pandadoc.com Product Analytics and Business Intelligence
  • Parabola parabola.io Product analytics
  • PartnerStack partnerstack.com Data Analytics
  • Perceptyx go.perceptyx.com Data analytics and visualization
  • Privy privy.io
  • Recruit CRM recruitcrm.io Advanced analytics partner for custom reporting and business intelligence.
  • Relay Commerce relaycommerce.io
  • Replicate replicate.com Data analysis
  • Resend resend.com Product analytics
  • Riipen riipen.com Data administration (USA)
  • Rootly rootly.com Business intelligence. Rootly personnel run read-only queries against production application data to support customer accounts, troubleshoot issues, and analyze product usage.
  • SocialPilot socialpilot.co Business intelligence designed to analyze and interpret service usage data.
  • Spellbook spellbook.com Business Intelligence and Reporting; Provides business intelligence, visualizations and reporting.
  • Spline spline.design Data analytics
  • SuprSend suprsend.com Analytics
  • Vendr vendr.com Data Analytics
  • Warp warp.dev

Security recordCSV of Metabase's security record · Atom feed of Metabase's security record

What public security catalogs list for Metabase, in their words.

Known exploited vulnerabilities

2 vulnerabilities in Metabase's software that CISA lists as exploited in the wild.

CVEProductVulnerabilityListed
CVE-2026-72898MetabaseMetabase SQL Injection Vulnerability
CVE-2021-41277MetabaseMetabase GeoJSON API Local File Inclusion Vulnerability

Source: CISA Known Exploited Vulnerabilities catalog (evidence)

Service statusCSV of Metabase's status page incidents · Atom feed of Metabase's status page incidents

Aug 15: no incident reportedAug 16: no incident reportedAug 17: no incident reportedAug 18: no incident reportedAug 19: no incident reportedAug 20: no incident reportedAug 21: no incident reportedAug 22: no incident reportedAug 23: no incident reportedAug 24: no incident reportedAug 25: no incident reportedAug 26: no incident reportedAug 27: no incident reportedAug 28: no incident reportedAug 29: no incident reportedAug 30: no incident reportedAug 31: no incident reportedSep 1: no incident reportedSep 2: no incident reportedSep 3: no incident reportedSep 4: no incident reportedSep 5: no incident reportedSep 6: no incident reportedSep 7: no incident reportedSep 8: no incident reportedSep 9: no incident reportedSep 10: no incident reportedSep 11: no incident reportedSep 12: no incident reportedSep 13: no incident reportedSep 14: no incident reportedSep 15: no incident reportedSep 16: no incident reportedSep 17: no incident reportedSep 18: no incident reportedSep 19: no incident reportedSep 20: no incident reportedSep 21: no incident reportedSep 22: no incident reportedSep 23: no incident reportedSep 24: no incident reportedSep 25: no incident reportedSep 26: no incident reportedSep 27: no incident reportedSep 28: no incident reportedSep 29: no incident reportedSep 30: no incident reportedOct 1: no incident reportedOct 2: no incident reportedOct 3: no incident reportedOct 4: no incident reportedOct 5: no incident reportedOct 6: no incident reportedOct 7: no incident reportedOct 8: no incident reportedOct 9: no incident reportedOct 10: no incident reportedOct 11: no incident reportedOct 12: no incident reportedOct 13: no incident reportedOct 14: no incident reportedOct 15: no incident reportedOct 16: no incident reportedOct 17: no incident reportedOct 18: no incident reportedOct 19: no incident reportedOct 20: no incident reportedOct 21: no incident reportedOct 22: no incident reportedOct 23: no incident reportedOct 24: no incident reportedOct 25: no incident reportedOct 26: no incident reportedOct 27: no incident reportedOct 28: no incident reportedOct 29: no incident reportedOct 30: no incident reportedOct 31: no incident reportedNov 1: no incident reportedNov 2: no incident reportedNov 3: no incident reportedNov 4: no incident reportedNov 5: no incident reportedNov 6: no incident reportedNov 7: no incident reportedNov 8: no incident reportedNov 9: no incident reportedNov 10: no incident reportedNov 11: no incident reportedNov 12: no incident reported

90 days agotoday

  • 0 incidents in 90 days
  • 0 major or critical
BeganIncidentImpactLasted
Metabase Store is unavailablecritical1 h 39 min
Some Metabase functionality unavailablemajor27 min

Incidents per month

0 2 4 Dec 2025: 0 incidents Jan 2026: 0 incidents Feb 2026: 1 incident (1 major) · typical time to resolve 27 min Mar 2026: 0 incidents Apr 2026: 0 incidents May 2026: 0 incidents Jun 2026: 0 incidents Jul 2026: 0 incidents Aug 2026: 1 incident (1 critical) · typical time to resolve 1 h 39 min Sep 2026: 0 incidents Oct 2026: 0 incidents Nov 2026: 0 incidents Dec 2025Jan 2026Feb Mar Apr May Jun Jul Aug Sep Oct Nov

critical major minor no impact stated

As Metabase's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)

Incidents reported by Metabase's subprocessorsCSV of incidents reported by vendors Metabase lists · Atom feed of incidents reported by vendors Metabase lists

117 reported incidents in the last 30 days, by 13 of the vendors Metabase lists as subprocessors.

A subprocessor list names a company, not the service an incident touched. This does not show that Metabase was involved.

DateCompanyIncidentImpactLasted
FilloutSlowness making changes to Zite apps minor2 h 22 min
OpenAIUnable to start new Workspace Agent runs criticalongoing
OpenAIElevated errors affecting logins, sign-ups, and ChatGPT features minor8 min
SentryUS issues feed throwing intermittent errors minor51 min
ClickHouseProvisioning and scaling operations may take longer in AWS ap-northeast-1 Tokyo minor7 h 38 min
PylonSlack Integration Connection Issues major3 h 13 min
SentryAccount emails not being delivered major42 min
AnthropicElevated errors on Fable 52 and Mythos 52 no impact stated1 min
SentryEU region replay ingestion latency minor48 min
VercelElevated Sandbox and Blob request latency and errors minor1 min
ZoomService Degradation Affecting Zoom Conference Room Connector Services Endpoints in the AMS region. minor2 h 35 min
FilloutZite app editor issues minor53 min
OpenAIIncorrect cost data in Costs API exports no impact stated2 h 20 min
ZoomService Degradation Affecting a subset of users with ZVA and ZoomMate no impact stated1 min
OpenAIElevated Errors On API minor42 min
OpenAIElevated ChatGPT Conversation Errors minor52 min
ZoomService Degradation Affecting Zoom Inbound SMS Service in the AU region minor1 h
OpenAIElevated errors with image generation minor1 h 49 min
AnthropicDegraded performance for Claude Fable 5.1 minor26 min
Customer.ioCustomers are Unable to add new Email Sending Domains major30 min
OpenAIElevated error rates with some U.S. business Mastercards no impact stated3 days
ZoomService Degradation Affecting Zoom Mail, Calendar and Scheduler. minor1 h 37 min
VercelBuild delays and degraded Vercel Dashboard performance minor25 min
PylonDelay in Analytics Data minor3 h 16 min
OpenAIChatGPT Work and Dots Errors minor13 h 6 min

And 92 more. All of them: CSV · Who is around them.

ChangesCSV of Metabase's changes · Atom feed of Metabase's changes

See the list as we read it on any date: Time machine

None since tracking began.

Rating badge for Metabase's site

Metabase transparency rating

It updates with the rating.

<a href="https://thirdpartyindex.com/vendors/metabase"><img src="https://thirdpartyindex.com/badge/metabase.svg" alt="Metabase transparency rating on Third Party Index" height="20"></a>
[![Metabase transparency rating on Third Party Index](https://thirdpartyindex.com/badge/metabase.svg)](https://thirdpartyindex.com/vendors/metabase)