Metabase
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | not found | 0 / 12 |
| Trust center | not found | 0 / 8 |
| Privacy policy | 6 / 6 | |
| security.txt | not found | 0 / 6 |
| Security page | 5 / 5 | |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 69 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Metabase's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/metabase"><img src="https://thirdpartyindex.com/badge/metabase.svg" alt="Metabase transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/metabase)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Subprocessor list | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Security page | snapshot | ||
| Status page statuspage | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services | Hosting for Metabase Cloud accounts, data warehouse for analytics. | United States | |
| Anthropic | AI and semantic processing. | United States | |
| Apollo.io | Enrichment of customer data. | United States | |
| Census | Data transfer from internal tools to hosted applications. | United States | |
| Clickhouse | Data warehouse for Metabase Storage option. | United States | |
| Common Room | Community engagement. | United States | |
| Contrast | Webinars. | United States | |
| Customer.io | Email communications. | United States | |
| Docusign | E-signatures for contracts. | United States | |
| Fillout | Forms used for marketing and product research purposes. | United States | |
| Fivetran | Data ingestion for analytics purposes. | United States | |
| Google Analytics | Anonymous url and product usage analytics. | United States | |
| Grain | Summarization and analysis of calls. | United States | |
| HotJar | Understanding website visitor behavior. | United States | |
| Inkeep | AI-backed documentation search and assistant. | United States | |
| Mailchimp | Email communications. | United States | |
| OpenAI | Semantic processing. | United States | |
| PandaDoc | Document management and e-signatures. | United States | |
| Pylon | Customer support. | United States | |
| Salesforce | CRM and sales pipeline management. | United States | |
| Scratchpad | Sales workspace and productivity. | United States | |
| Sentry | Application error logging. | United States | |
| Snowcat | Anonymous url and product usage analytics. | United States | |
| StitchData | Data ingestion for analytics purposes. | United States | |
| Stripe | Customer payments. | United States | |
| Unify | Visitor signal collection. | United States | |
| Vercel | Hosting for parts of metabase.com and internal tools. | United States | |
| VWO | Website experimentation. | United States | |
| Zapier | Internal business process automation. | United States | |
| Zoom | Video conferencing. | United States |
Listed as a subprocessor by (14)
Purposes as each company states them.
Ably ably.com Business Intelligence and Analytics Platform
Alloy alloy.app Product Analytics
Employment Hero employmenthero.com Data analytics; Processing Activity: Querying and visualisation of company data for insights and reporting GDPR Transfer Mechanism: Standard Contractual Clauses
Krisp krisp.ai Business analytics; Metabase is a business intelligence (BI) and analytics platform that enables organizations to explore, visualize, and share data insights without requiring advanced technical expertise.
LiveKit livekit.com Product analytics
NimbleRx nimblerx.com
Ona ona.com Business Analytics and Reporting Service
Orderful orderful.com Reporting and Analytics
- PandaDoc pandadoc.com Product Analytics and Business Intelligence
PartnerStack partnerstack.com Data Analytics
Resend resend.com Product analytics
Rootly rootly.com Business intelligence. Rootly personnel run read-only queries against production application data to support customer accounts, troubleshoot issues, and analyze product usage.
SuprSend suprsend.com Analytics
Vendr vendr.com Data Analytics
Security record
What public security catalogs list for Metabase, in their words.
Known exploited vulnerabilities
2 vulnerabilities in Metabase's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2026-72898 | Metabase | Metabase SQL Injection Vulnerability | evidence |
| CVE-2021-41277 | Metabase | Metabase GeoJSON API Local File Inclusion Vulnerability | evidence |
Changes
None since tracking began.