Metabase vs Apache Superset (2026): self-hosting, row-level security, embedding, and AI compared

Metabase is the better choice for small teams whose dashboard users don’t write SQL and who want one container to run: its query builder, built-in AI chat (Metabot), and guest embeds are all in the free open source edition. Apache Superset is the better choice for data teams with engineers to run it: row-level security is free, it connects to almost any SQL database, and it scales out with Celery workers on Kubernetes. The catch with Metabase is that row-level security, SAML, and SCIM start on the Pro plan at $575 a month. The catch with Superset is that it has no built-in chat, and SAML login only arrives with version 7.0. Every price and feature below was checked on official Metabase, Apache Superset, and Preset pages on October 27, 2026.

If neither fits, Preset (managed Superset), Lightdash, and Basedash are covered near the end.

Metabase vs Superset at a glance

Which is easier for people who don’t write SQL?

Metabase is built around the idea that most dashboard users never open a SQL editor. Its query builder lets someone pick a table, filter it, summarize by a column, and join another table through menus. Metabot adds a chat on top: it creates charts from natural language, generates SQL, fixes query errors, and explains existing charts.

Superset is built around datasets. An analyst defines a dataset from a table or a SQL query, adds virtual metrics and calculated columns in what the docs call “a thin semantic layer,” and then anyone with access can build charts on it in the no-code chart builder. The gap is the step before the chart: someone has to create the dataset, usually by writing SQL in SQL Lab.

For a small engineering team that needs self-service dashboards without a dedicated analyst, Metabase usually wins: engineers set up the connection, and the rest of the company explores without filing requests. Superset suits teams where analysts own the datasets and business users mainly view and filter dashboards.

Metabase’s own comparison page says Superset “requires a good amount of technical expertise and resources to deploy and manage.” That is a vendor’s view, but the installation requirements below support it.

Which is easier to self-host in production?

Metabase runs as one service. The installation docs recommend Docker for self-hosting, or a JAR file on Java 25. For production you point it at a PostgreSQL or MySQL application database instead of the default H2 file. There is no officially supported Helm chart, so Kubernetes is your own work.

Superset is a set of services. Its architecture docs list the application, a metadata database (PostgreSQL or MySQL; SQLite is “not recommended for production”), a caching layer, and a Celery worker and beat. Redis is the recommended cache. Alerts and reports are off by default and need a feature flag, a Celery beat schedule, and a headless browser. Superset’s own Docker Compose docs warn that the compose setup “is not production-ready out of the box.” Version 6.1 documents a Helm chart for Kubernetes; the next version’s docs deprecate it in favor of a Kubernetes Operator.

In practice, Metabase is one service to keep running. Superset is a small platform, which is fine if a data platform team already runs Python services, Redis, and Celery, and a real cost if nobody does.

Which has row-level security, and does it hold in SQL?

Superset includes row-level security for free. You create a filter clause, assign it to datasets and roles, and Superset adds it to the WHERE clause of the generated SQL. Regular filters apply to the listed roles; base filters apply to everyone except them. The limit is SQL Lab: RLS is only enforced there when the RLS_IN_SQLLAB feature flag is on, and the 6.1 config ships it off with the warning “May break queries or allow RLS bypass. Use with care!” Anyone with SQL Lab access can read unfiltered rows unless you restrict it.

Metabase calls the feature row and column security, and it is only on Pro and Enterprise. It filters rows by user attributes, which can come from SAML, JWT, or LDAP. It has a similar SQL gap: Metabase says row and column security “is limited to the query builder,” and groups with native query permissions can bypass it. For SQL questions, Metabase points to impersonation, which maps Metabase groups to database roles and is also Pro and Enterprise only.

If you need RLS on a $0 budget, Superset is the only one of the two that offers it. If business users must never see other teams’ rows even when writing SQL, plan on database-level policies with either tool. Our row-level security comparison covers how other BI tools handle this.

How do SSO and SCIM compare?

Metabase’s pricing page lists Google Sign-In on every plan and LDAP with basic authentication on the open source edition and Starter. SAML, JWT, OIDC, LDAP attribute sync, and SCIM provisioning are Pro and Enterprise only.

Superset inherits authentication from Flask AppBuilder. The Superset configuration docs cover OAuth and LDAP, and Flask AppBuilder also supports database login and REMOTE_USER. SAML is newer: Flask AppBuilder supports it with python3-saml installed, but Superset’s login page only learned to handle SAML in pull request #38606, merged in March 2026. That change is not in 6.1.0 and ships with 7.0, which is still a release candidate as of October 2026. Superset does not document SCIM. On Preset, SAML SSO and SCIM are Enterprise only.

If your company requires Okta or Entra ID over SAML today, Metabase Pro is the shorter path. Superset can use OAuth providers now, or SAML after upgrading to 7.0.

Which is better for embedding dashboards in a product?

Metabase has two embedding families. Guest embeds (the replacement for static embedding) use signed tokens, need no login, and don’t count as billed users. On the open source edition and Starter they show a “Powered by Metabase” badge. Modular embedding, including the React SDK, and full app embedding let viewers interact and drill in, but they are Pro and Enterprise only and each viewer is billed as a user. The license page also matters: embedding the open source edition means complying with the AGPL or with Metabase’s embedding license, which keeps the logo.

Superset embeds through the @superset-ui/embedded-sdk package, which inserts an iframe. You enable the EMBEDDED_SUPERSET feature flag, configure allowed domains, and have your backend request a guest token from /api/v1/security/guest_token/ (embedding docs). Guest tokens can carry RLS clauses, so each customer sees only their rows, and the Apache 2.0 license adds no badge or per-viewer fee. On Preset, embedding is an add-on for Professional and Enterprise that starts at $500 a month for 50 viewer licenses.

For multi-tenant customer-facing analytics on a free license, Superset’s guest tokens with RLS are the stronger base. For a read-only chart in a customer portal, Metabase guest embeds are simpler. For a wider view, see our embedded analytics platforms comparison.

What AI features do Metabase and Superset have?

Metabase has built-in AI. Metabot creates charts from natural language, generates and fixes SQL, and analyzes charts. You can bring your own key from Anthropic, OpenAI, AWS Bedrock, or Microsoft Azure on every plan, including the open source edition. On Metabase Cloud Starter and Pro, the managed AI service gives the first 1 million tokens free, then charges $3.75 per million tokens, as of October 2026. Every plan also includes an MCP server.

Superset has no built-in chat or text-to-SQL. Version 6.1 added an opt-in MCP server that runs as a separate process and lets external AI assistants list dashboards, query datasets, run SQL, and create charts. On Preset, AI Assist generates SQL from English on Professional and Enterprise for BigQuery, PostgreSQL, and Snowflake, and the AI Chatbot is an Enterprise add-on, with a limited token allowance for trials and Professional teams.

If plain-English questions for business users matter, Metabase includes them today. Superset expects you to bring your own AI client through MCP.

How much do Metabase and Superset cost?

Both are free to self-host. Costs start when you want managed hosting or features outside the free build.

Metabase’s pricing page lists, as of October 2026: the open source edition, free with unlimited users; Starter at $100 a month for 5 users plus $6 per extra user, cloud only, with no row-level security or SAML; Pro at $575 a month for 10 users plus $12 per extra user, cloud or self-hosted, which adds row and column security, SAML, JWT, OIDC, SCIM, usage analytics, the React SDK, and white-labeling; and Enterprise from $20,000 a year. Annual billing saves about 10%, and Starter and Pro have a 14-day trial.

Apache Superset is free under Apache 2.0. Preset charges, as of October 2026: Starter free for up to 5 users, with no alerts, embedding, API access, or SSO; Professional at $20 per user per month billed annually ($25 monthly) with unlimited users, role-based access, and scheduled reports, plus a 14-day trial; and Enterprise by quote, which adds SAML SSO and SCIM.

A worked example: 30 internal users who need SAML and row-level security. On Metabase Pro, that is $575 plus 20 extra users at $12, or $815 a month on monthly billing. On Preset, Professional would be $600 a month billed annually, but SAML requires Enterprise, so you need a quote. On self-hosted Superset, the license is $0, the cost is servers and engineering time, and SAML waits for 7.0.

Fact cards

Fact card: Metabase

• Pricing (as of October 2026): open source free; Starter $100/month for 5 users; Pro $575/month for 10 users; Enterprise from $20,000/year (pricing). 14-day trial of Starter and Pro.
• Deployment: self-hosted (Docker or JAR) or Metabase Cloud. Starter is cloud only.
• Databases and warehouses: official drivers for PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, Snowflake, BigQuery, Redshift, Databricks, ClickHouse, Druid, MongoDB, Athena, Presto, Starburst, SparkSQL, SQLite, and Vertica. Community drivers such as DuckDB work on self-hosted only.
• Query model: live queries; adaptive result caching on every plan, duration and schedule policies on Pro (caching); email and Slack alerts on every plan.
• Security: row and column security and impersonation on Pro and Enterprise; SAML, JWT, OIDC, and SCIM on Pro and Enterprise; Google Sign-In and basic LDAP on every plan.
• AI: Metabot chat, chart creation, and SQL generation; bring your own key on every plan; managed AI on Cloud; MCP server on every plan.
• Embedding: guest embeds free with a badge; modular embedding (React SDK) and full app embedding on Pro and Enterprise.
• Best for: small and midsize teams that want business users to explore data without SQL.
• Not ideal for: teams that need RLS or SAML without paying for Pro, or that want the widest database and chart coverage.

Fact card: Apache Superset

• Pricing (as of October 2026): free under Apache 2.0; Preset Starter free for 5 users, Professional $20/user/month annual, Enterprise custom.
• Deployment: self-hosted (application, metadata database, Redis, Celery workers; Helm chart in 6.1 docs) or Preset cloud.
• Databases and warehouses: any engine with a SQLAlchemy dialect and Python driver; the database docs list 96, including PostgreSQL, MySQL, Snowflake, BigQuery, Redshift, ClickHouse, Databricks, Druid, and Trino.
• Query model: live queries; Flask-Caching with Redis; async queries, alerts, and reports through Celery.
• Security: RLS filters by dataset and role, free; not enforced in SQL Lab by default; database, LDAP, OAuth, and REMOTE_USER login; SAML in 7.0; SCIM not documented.
• AI: no built-in chat; opt-in MCP server since 6.1; AI Assist and AI Chatbot on Preset paid plans.
• Embedding: Embedded SDK with guest tokens that carry RLS clauses; on Preset, an add-on from $500/month for 50 viewers.
• Best for: engineering-led data teams that need free RLS, many databases, and custom charts at scale.
• Not ideal for: small teams without someone to run Python services, or business users who need to ask questions in plain English.

What if neither Metabase nor Superset fits?

Our open source BI tools comparison covers eight self-hosted options, and the Metabase alternatives page covers paid replacements. Three common next steps:

• Preset: managed Superset without the operations work. Pick it if you like Superset but not running Celery and Redis.
• Lightdash: open source BI that reads metrics from a dbt project.
• Basedash: a hosted AI data analyst that answers questions in chat and builds dashboards on a live database. Pick it if most of your users want answers in plain English rather than a query builder.

Fact card: Basedash

• Pricing (as of October 2026): Startup is $1,000 a month plus AI usage for up to 25 users, with $1,000 a month in AI credits; Enterprise is custom (pricing). 14-day free trial, no credit card. No free plan and no open source edition.
• Deployment: cloud, or self-hosted with Docker Compose or Kubernetes on Enterprise (self-hosting docs).
• Databases and warehouses: direct connections to PostgreSQL, MySQL, SQL Server, Snowflake, BigQuery, Redshift, Databricks, ClickHouse, and others, plus a managed warehouse for SaaS sources.
• Query model: live queries against your database.
• Security: row-level security through Postgres and Supabase policies only; SSO with SAML 2.0 or OIDC and SCIM on Enterprise.
• AI: an AI data analyst that answers in chat with tables and charts and builds dashboards; MCP server on every plan.
• Embedding: @basedash/embed React SDK or iframe, Enterprise only (embedding).
• Best for: teams that want business users to get answers by asking questions, without building a semantic layer first.
• Not ideal for: teams that need open source, a free tier, RLS on databases other than Postgres, or self-hosting below Enterprise.

For a direct comparison, see Basedash vs Metabase.

Metabase vs Superset: which should you choose?

• Your dashboard users don’t write SQL and you have no dedicated analyst: Metabase. The query builder and Metabot cover most self-service questions.
• You need row-level security without paying a license fee: Superset. Keep SQL Lab access restricted, because RLS is off there by default.
• Your company requires SAML SSO today: Metabase Pro, or Preset Enterprise. Self-hosted Superset gets SAML with 7.0.
• You want one container and minimal maintenance: Metabase. If a platform team already runs Python, Redis, and Celery, Superset scales out with more workers.
• You embed dashboards for many customers on a free license: Superset guest tokens with RLS, with no badge. Metabase interactive embedding needs Pro and bills each viewer.
• Your database is less common (Trino, Druid, or another engine with a SQLAlchemy dialect): Superset, which lists 96 databases.
• Business users want to ask questions in plain English: Metabase with Metabot, or an AI-first tool such as Basedash.

Frequently asked questions

Is Metabase or Superset better for a small team without a data analyst?

Metabase is usually better for a small team without a dedicated analyst. Its graphical query builder lets non-technical users filter, summarize, and join tables without SQL, and Metabot can turn plain-English questions into charts on the free edition if you supply an AI provider key. Superset expects someone to build datasets in SQL before business users can make charts, and it needs Redis and Celery workers for caching and scheduled reports. Choose Superset when an engineer will own the deployment.

What are the disadvantages of Apache Superset?

A production deployment needs a metadata database, Redis, Celery workers, and a headless browser for reports, and the project says its Docker Compose setup is not production-ready. Row-level security is not enforced in SQL Lab unless you turn on a flag marked as testing. Native SAML login arrives only with version 7.0, SCIM is not documented, and there is no built-in AI chat, only an opt-in MCP server for external AI clients.

What are the drawbacks of Metabase?

The biggest drawback of Metabase is how much sits behind the Pro plan, which costs $575 a month for 10 users as of October 2026. Row and column security, impersonation, SAML, JWT, OIDC, SCIM, usage analytics, the React embedding SDK, and white-labeling are all Pro or Enterprise only. Even on Pro, row-level rules apply to query builder questions, and users with SQL access can bypass them. Free-edition embeds carry a “Powered by Metabase” badge, and there is no officially supported Helm chart.

Does Superset row-level security apply to SQL Lab queries?

Not by default. Superset adds row-level security filters to the SQL that charts and dashboards generate from datasets, but in SQL Lab they are enforced only when the RLS_IN_SQLLAB feature flag is enabled. In Superset 6.1 that flag defaults to off and is labeled as testing, with a warning that it may break queries or allow RLS bypass. To keep row-level rules airtight, limit SQL Lab to trusted roles or enforce the rules in the database itself, such as PostgreSQL row security policies.

Can I use Metabase for free in production?

Yes. The Metabase open source edition is free under the AGPL, has no user limit, and runs on your own servers. It includes the query builder, SQL editor, dashboards, email and Slack alerts, guest embeds with a badge, and Metabot with your own AI provider key. For production, run it in Docker with a PostgreSQL or MySQL application database rather than the default H2 file. You pay only if you need Pro features such as row-level security, SAML, or SCIM, or if you want Metabase to host it.

Is Preset the same as Apache Superset?

Preset is a managed cloud service built on Apache Superset, and its team includes Maxime Beauchemin, Superset’s original creator. It runs Superset for you and adds paid features on top: AI Assist for text-to-SQL, an AI Chatbot add-on, SAML SSO and SCIM on Enterprise, and embedded dashboards priced from $500 a month for 50 viewers. Preset Starter is free for up to 5 users, and Professional costs $20 per user per month billed annually as of October 2026. Choose Preset to skip running Redis, Celery, and upgrades.

What are the open source alternatives to Superset and Metabase?

The main open source alternatives are Lightdash, Redash, Grafana, Evidence, and Rill. Lightdash fits teams whose metrics already live in dbt, and its free build includes row-level security. Redash is a lightweight SQL editor with shareable dashboards. Grafana suits time-series metrics and teams that already use it for monitoring. Evidence builds reports from SQL and Markdown in Git, and Rill builds fast metrics dashboards on DuckDB or ClickHouse.