Metabase vs
Embedportal.

TL;DR

Metabase is the only major embedded-analytics tool with a genuinely free self-hosted edition. Static embedding — JWT-signed URLs with locked parameters — is included in Open Source, Cloud, and Enterprise alike. You wire it up by enabling embedding in admin settings, copying a 64-character secret key, and signing short-lived JWTs on your backend that specify which dashboard to render and which parameters to lock. Simple, cheap, effective.

What you still build yourself: per-tenant branding, multi-tenant locked-parameter mapping, token refresh, audit logs, multi-vendor support if you add Tableau or Power BI later. The embed primitive is simple; the distribution layer isn’t.

Embedportal is the distribution layer. You keep using Metabase for authoring questions and dashboards. Embedportal signs the JWTs, forwards the locked parameters per viewer, and wraps everything in a branded multi-tenant shell. One configuration in Embedportal, one iframe in your app.

If you’re shipping Metabase to multiple customer tenants, Embedportal typically saves 1–2 engineer-months of distribution-layer work. If you have one internal dashboard and one team, native Metabase static embedding is enough on its own.

Outcomes compared

Setup effort

Metabase native static. Metabase gives you the JWT-signed embed primitive with locked parameters. Taking that to a multi-tenant SaaS release requires work in four distinct areas: viewer identity and per-viewer parameter forwarding, branded portal shell, compliance and audit, and token lifecycle. Teams typically budget 1–2 engineer-months for a production multi-tenant release. None of that work is Metabase-specific — you’d redo it if you later added a second BI vendor.

Embedportal. Follow the two-field Metabase setup — enable static embedding in Metabase, paste the secret key and site URL into Embedportal. Under 10 minutes, and multi-tenant distribution, branding, audit and SSO all work on day one.

Multi-tenant scale

Metabase’s static-embedding JWT flow scales cleanly for multi-tenant SaaS because the JWT itself carries the locked parameters — Metabase doesn’t need to know about your tenants. One Metabase instance, one secret key, one JWT per viewer with their tenant’s locked parameter values.

The hard part is the mapping layer: your viewer’s profile needs to deterministically produce the right set of locked parameter values on every embed request. Miss one and you leak data across tenants. Mis-spell a parameter name and the dashboard shows all rows. That layer is what most teams spend the real engineering time on.

Embedportal treats the mapping layer as a first-class feature. Declare your attributes once; Embedportal forwards them as locked parameters on every JWT with the correct names and fallback behaviour. You don’t write parameter-forwarding code.

Row-level security

Metabase’s RLS is arguably the simplest in embedded analytics: locked parameters. You create a dashboard parameter, make it a filter in your question, and when signing the JWT you lock the parameter to a specific value the viewer cannot override. No DAX, no calculated fields, no USERATTRIBUTE — just a signed parameter.

That simplicity is a feature for multi-tenant SaaS. What Metabase static embedding doesn’t give you is the attribute-definition surface on the viewer side. You decide what attributes to pass, how to derive them from your user profile, how to default them, and how to override them per dashboard — and write that yourself.

Embedportal exposes a rule-definition UI. Declare attributes like organization_id, region, role, and Embedportal forwards them as locked parameters on every JWT with per-dashboard overrides. The Metabase side is unchanged. See the RLS guide for the full setup.

White-label branding

Metabase’s embed frame can be parameterised to hide its own toolbar, and CSS can restyle the iframe shell. That’s the native limit. To deliver a genuinely white-labeled portal — per-tenant logo, palette, custom domain, themed dashboard list — you build the whole shell yourself.

Embedportal ships the shell. Each tenant gets their own logo, palette, custom domain, and themed portal UI. The Metabase iframe drops into that shell and your customers see their brand, not Metabase’s.

Multi-vendor future

Metabase is the most cost-efficient way to start shipping embedded analytics, which is why a lot of companies begin there. The common upgrade path is adding Tableau for richer visualisation or Power BI because a large enterprise customer demands it. Teams that built directly on Metabase’s static-embedding SDK face a rebuild of the embedding layer to add a second vendor.

Embedportal is vendor-neutral by construction. Swap Metabase for Tableau or QuickSight by changing the integration source on the dashboard — no change in your product’s frontend, no change for your customers. You can also run multiple vendors side-by-side in the same portal.

Pricing

Metabase native. Metabase Open Source is free, self-hosted. A typical small SaaS runs it on a $50/month VM and embeds statically for effectively zero extra Metabase cost. Metabase Cloud Starter is ~$85/month for 5 users; Metabase Pro is ~$500/month with SSO and audit; Enterprise is custom. See the 2026 embedded-analytics pricing breakdown for the full math.

Embedportal. Flat pricing independent of your Metabase tier. $249/month Starter (one BI integration), $499/month Professional (unlimited integrations, branding, SSO, audit, SLA), custom Enterprise. See full pricing.

Break-even on native Metabase + Embedportal is narrower than on paid BI tools because Metabase OSS is free — but the engineering saved on multi-tenant plumbing still makes Embedportal’s flat fee cheaper than a single engineer-month of distribution-layer work.

When to pick which

Pick native Metabase static embedding if

• You’re running a single internal dashboard for a single team and the embed is genuinely a one-off.
• You’re comfortable writing and maintaining the JWT-signing, token-refresh, parameter-forwarding layer yourself, and you have no plan to add a second BI tool.
• You’re trialling embedded analytics as a product bet and want to prove demand before spending a dollar.

Pick Embedportal if

• You have two or more customer tenants embedding the same Metabase dashboards, or you plan to.
• You need per-tenant branding, white-label, or custom-domain portals.
• You don’t want to maintain the JWT signing and locked-parameter forwarding code yourself.
• You might add Tableau, Power BI, or QuickSight content in the next 24 months — Metabase is commonly the starting point and rarely the endpoint.
• You need SOC 2 audit evidence without building the audit trail yourself.

Switching from native Metabase embedding

If you’ve already built a Metabase static-embedding integration and want to move to Embedportal, the Metabase side stays identical — same questions, same dashboards, same embedding secret key, same locked parameters. On the Embedportal side you paste the secret key and site URL, enable embedding on each dashboard you want to surface, and map your viewer attributes to the locked-parameter model. Typical switchover is under 10 minutes on the Metabase side and under a day on the frontend cut-over.

Existing dashboards, questions, parameters and filters all embed through Embedportal without modification.