Open-source alternative to Domo external and embedded analytics

Embedding Metabase or Apache Superset for customers and partners moves per-external-user cost onto your own infrastructure, but the host application must enforce tenant isolation. This page maps the options and the work involved.

On this page

Open-source alternative to Domo external analytics: the short answer

If you pay Domo credits for every external user account and want dashboards shown to customers or partners, you can embed either self-hosted Metabase or self-hosted Apache Superset in your own application. Both can run inside your infrastructure, so your cost follows the servers, databases and staff you run rather than a per-account credit charge. The isolation between one customer and another is not something either tool hands you for free: your host application has to enforce who sees which rows, and that design is the first decision to make.

Metabase's embedding and access controls depend on plan. Its free Open Source edition is self-hosted with unlimited users and dashboards, but according to Metabase's pricing page, SSO, row and column level permissions, multi-tenant data segregation and usage analytics and auditing are included only in the Pro and Enterprise plans. Check the current plan table before you design tenant isolation around a feature, and confirm with Metabase which embedding options your chosen plan includes, because the answer changes what you build yourself.

Apache Superset is licensed under Apache-2.0 and maintained at the Apache Software Foundation, and the project has no paid edition. That makes the licensing question simpler, but it moves more of the work to you: authentication through Flask AppBuilder, role mapping, and tenant-scoped data access all need to be configured and tested in your environment. Ask your team to confirm which embedding approach fits your application before you commit, and budget for the engineering time that building isolation will require.

Which embedded analytics capabilities map to Metabase and Apache Superset

This table maps the embedded analytics needs behind a Domo external user model to Metabase and Apache Superset, and flags where each needs extra components or a paid plan. Read each row as a question to confirm against current vendor documentation before you size the platform, because embedding features change between releases.

CapabilityMetabaseApache Superset
External-user dashboard deliveryEmbedding is available, but confirm which embedding options your plan includes and how viewers are provisioned in your host appDashboards can be embedded in a host application, but confirm the embedding setup and guest access pattern for your version
Single sign-on for embedded usersGoogle sign-in and LDAP are in Open Source and Starter; JWT, OIDC and SAML require Pro or EnterpriseDatabase, LDAP and OAuth2 authentication through Flask-AppBuilder; confirm how your identity provider maps to embedded viewers
Row-level data restriction per customerRow and column level permissions and multi-tenant data segregation are included only in Pro and Enterprise plansConfirm how row-level security filters are applied to embedded guest sessions in your version and host app
White-labeling and brandingConfirm which branding and styling options each plan allows for embedded contentConfirm theming options and whether custom branding requires code changes in your deployment
Scheduled reports and alertsConfirm availability and delivery options for your plan and editionAlerts, reports, async queries and dashboard thumbnails need the caching layer and Celery worker components, typically Redis and Celery
Admin tenancy and usage auditingUsage analytics and auditing are included only in Pro and Enterprise plansTenancy is usually modeled with separate instances or roles; confirm isolation options and audit logging for your version

Choosing between Metabase and Apache Superset for embedding

Both tools can serve dashboards to customers and partners on infrastructure you control, but they differ in licensing, authentication depth and operational footprint. The cards below set out where each fits and what to verify before you choose, and they include two adjacent options for narrower needs.

Metabase for embedded dashboards

Metabase is open core: the open source edition is AGPL-3.0 and the enterprise directory is under the Metabase Commercial License, with separate Docker images for each. Its free edition allows unlimited users and dashboards, but SSO, row and column level permissions and multi-tenant data segregation are reserved for the Pro and Enterprise plans. For external users, confirm that the edition you pick covers tenant isolation and that your legal team accepts the license split before committing.

Apache Superset for SQL-first teams

Superset is Apache-2.0 with no paid edition, and it authenticates through Flask-AppBuilder with database, LDAP and OAuth2 options, including mapping groups to roles with AUTH_ROLES_MAPPING. Its builder is SQL-first, which suits engineering teams that want to shape queries and metrics directly. Plan for separate components: a metadata database, plus a caching layer and Celery workers if you need alerts, async queries or thumbnails, and the pipeline that loads your data.

Where Metabase fits best

Metabase suits business teams that want a guided question builder and a quick path to customer-facing dashboards, and it is simpler to operate for a small platform team. Its main trade-off for embedding is that tenant-level controls require a paid plan, so the cost of ownership shifts toward licensing as the number of tenants grows. Ask for a written list of which embedding and permission features each plan includes before you size the deployment.

Where Superset fits best

Superset suits data teams that already run a warehouse, want full control over SQL and have engineers to operate the metadata database, caching and workers. Its main trade-off is operational: you own more moving parts and must test each upgrade in staging using the upgrade guide and UPDATING.md. Confirm how your chosen authentication flow maps tenant identity to data access before you rely on it for external users.

Adjacent options for narrower needs

Lightdash is open core, with the backend ee directory under a separate license and the rest under MIT, and it suits teams whose analysis lives in dbt models. Grafana was relicensed to AGPL-3.0-only starting with Grafana 8.0, and it fits time-series and operational dashboards more than business reporting. Consider both only if your embedded use case is narrower than general-purpose BI, and confirm their embedding and tenant controls against your requirements.

How Domo external user credits compare with self-hosted infrastructure cost

Domo bills external accounts through consumption credits, so the bill grows with how many outside users sign in and how often they load content. Your Domo quote should state the credit rate per external account per day, any included allowance, and which activities consume credits. Self-hosted Metabase and Apache Superset have no per-viewer meter, so the recurring question becomes how much compute and storage your viewers consume.

  • Daily active external accounts: Count partners and customers who open content each day, not only the accounts that exist. Ask Domo how inactive accounts are billed.
  • Refresh and query activity: Confirm whether data refreshes, exports or scheduled deliveries draw from the same credit pool.
  • Tenant growth: Each new tenant adds a meter line in Domo, while in a self-hosted stack it adds query load, cache use and database storage in your own environment.
  • Dashboard design: Heavy dashboards cost more in warehouse compute under either model, so caching and aggregation choices matter.

Check whether your contract defines the credit rate and the base allowance in writing, and model your daily external account count against it.

What the host application must enforce for customer isolation

The host application owns customer isolation, not the BI tool. Before any dashboard loads, your application must authenticate the external user, decide which tenant that user belongs to, and sign the embed or SSO token that carries that decision. Metabase and Superset will only enforce what they are told, so the signing secret, the token claims and the tenant-to-filter mapping all stay in your code and your key management. Keep the signing key out of the browser, rotate it on a schedule you can document, and make the token short-lived. Confirm the exact embedding flow, token format and expiry behavior for your chosen version in the Metabase embedding introduction and in the Superset documentation before you design around them.

The tool-side controls differ in what they cost and how they are configured. In Metabase, row and column level permissions and multi-tenant data segregation are included only in the Pro and Enterprise plans on the pricing page, so an open source deployment cannot rely on them for tenant separation. In Apache Superset, isolation depends on your own role design and row-level security rules, combined with the authentication mapping that assigns users to roles through AUTH_ROLES_MAPPING in the configuration. Decide which layer is authoritative for each tenant, and make sure a viewer cannot change a filter value in the URL or in the embedded session to read another tenant's rows. Filters passed from the browser are not a security boundary.

Test isolation as an attack, not as a demo. Create at least two test tenants with distinct data, then attempt cross-tenant access with a valid session for tenant A that requests tenant B's dashboards, questions, saved queries, filter values and exported CSV files. Repeat the test with altered tokens, missing claims and expired tokens, and check the application database and cached results for leakage. Record the results and retest after every BI version upgrade. Ask your security testing provider or internal team to own this test plan, and treat any failed case as a release blocker.

Running embedded BI beside the rest of the Domo suite

Most teams do not switch off Domo in one step. Internal dashboards, external customer analytics and the data that feeds both need separate decisions, and each one changes cost and risk. The cards below set out what to settle before any embedded instance goes live.

Keep Domo for internal dashboards

Decide which internal dashboards stay in Domo while embedded analytics for external users moves to Metabase or Apache Superset. Splitting the estate this way means Domo credits still cover internal use, so the question is whether that split is cheaper or simply more to operate. Inventory every Domo card, page and alert by audience, then mark each one as stay, move or retire. Confirm current Domo credit terms with your Domo account team before you assume any savings.

Move datasets to a shared warehouse

Both tools need to read the same governed tables, or the two copies of each metric will drift apart. Choose a warehouse or database that Superset or Metabase can query directly, and decide who owns the transformations that currently run as Domo dataflows. Check which connectors your sources need, because Domo's bundled connectors do not carry over automatically. Ask your data team to confirm refresh schedules and row-level data ownership before cutover.

Separate internal and external identities

Internal employees and external customers should authenticate through different paths with different roles. For Apache Superset, map LDAP or OAuth groups to roles with AUTH_ROLES_MAPPING so external accounts never receive internal roles. For Metabase, row and column level permissions and SSO sit on the Pro and Enterprise plans, so confirm which plan your external tenancy model requires before you commit. Test that a customer account cannot reach another customer's dataset.

Set branding and domain boundaries

Customers should see your product, not a Domo or open-source login screen, so decide which domain hosts the embedded analytics and how the host application signs users in. Embedded sessions usually need a separate hostname, TLS certificate and cookie scope from internal tools. Confirm with the vendor which embedding method and signing approach your chosen version supports before you design the login flow. Record who owns certificate renewal and DNS changes.

Run both platforms during cutover

Parallel running lets you compare numbers from Domo and the new stack before customers depend on them. Agree in writing which dashboards are validated, who signs off on each figure and how long both systems stay live. Keep Domo read access for reconciliation until the new stack has matched on your agreed checks. Before any major upgrade, back up the application database, as Metabase's upgrade documentation recommends, and test in staging first.

Moving external dashboards and their data to embedded open source

This sequence moves each external account's dashboards onto a tenant-aware embedded setup in your own infrastructure, with isolation proven before any customer sees it. The output is a tested cutover plan that replaces per-account Domo credit charges with infrastructure you operate.

  1. Inventory external accounts and their dashboards

    The product or customer success team lists every external account, the tenant or customer identifier it maps to, and the cards, pages and filters each account sees today. Export the card definitions and dataset lists from Domo so you know exactly what each external user relies on. Done means a spreadsheet where every external account maps to a tenant ID and a named set of dashboards, with owners confirmed for each.

  2. Map datasets to queryable warehouse tables

    The data engineering team confirms where each dataset lives and whether the source can be queried directly from a warehouse or database that Metabase or Superset can reach. Datasets that exist only inside Domo's storage or dataflows need a pipeline tool and a destination schema before any dashboard can be rebuilt. Done means each dataset has a named source table, a refresh owner and a documented tenant column that the dashboards can filter on.

  3. Stand up the application database

    The platform team deploys the metadata store in your environment. For Metabase production, PostgreSQL is the recommended application database, and MySQL 8.4.0 or MariaDB 10.6.0 and later with utf8mb4 is also supported. For Superset, PostgreSQL or MySQL is the supported metadata database, and the SQLite default is not for production. If you are moving an existing Metabase instance that still uses the embedded H2 database, plan the one-time load-from-h2 step with the same Metabase version that last wrote the H2 file. Done means the application database is backed up, restore has been tested, and the service starts against it.

  4. Build the embed and authentication flow

    The application engineering team decides how your host application requests a signed embed session for each customer and how the BI tool learns the tenant identity. For Superset, configure SECRET_KEY, which must be set before startup, and use its OAuth or LDAP integration with AUTH_ROLES_MAPPING where group-based access is needed. For Metabase, confirm which signed embedding and SSO options your plan includes, because JWT, OIDC and SAML provisioning are limited to Pro and Enterprise. Done means a test customer can open only their own dashboards from inside the host app, and the signing keys are stored in your secrets manager.

  5. Rebuild the charts as tenant-filtered dashboards

    The analytics engineers rebuild each card as a Superset chart or Metabase question on the queryable tables, then assemble them into dashboards that take the tenant filter as a parameter. Replace Domo Beast Mode calculations with SQL or dataset metrics and check every figure against the Domo original using the same date range. Done means each rebuilt dashboard reconciles with its Domo source for a sample of accounts, and the discrepancies are logged and resolved.

  6. Run a cross-tenant isolation test

    The security team attempts to read one tenant's data from another tenant's session, through direct URLs, saved filters, shared links, exports, cached results and API calls. Test with the row-level or dataset-level restrictions your edition supports, and record which controls you relied on. Done means every attempted cross-tenant access fails, the results are written up as evidence, and any gap is either fixed or accepted by the risk owner in writing. This test is the gate for the pilot.

  7. Pilot with a small customer group

    Product management selects a small set of external accounts that agree to use the rebuilt dashboards alongside the Domo versions for a defined period. Monitor query performance, refresh timing, support tickets and any data differences, and keep Domo running until the pilot group confirms the results. Done means the pilot group signs off on accuracy and usability, and the issues list is closed or assigned.

  8. Cut over and retire Domo access

    The operations team switches each external account's embed link to the new environment in batches, notifies customers, and revokes Domo access once each batch is confirmed. Keep a rollback path and the final Domo export until the retention period set by your contracts and policies has passed. Done means every external account reaches its dashboards through the self-hosted platform, Domo credit usage for external users has stopped, and the cutover record is signed off.

Questions buyers ask before embedding open-source analytics

What drives the cost of embedding open-source analytics compared with Domo credits?

Domo's embedded cost is metered by credits consumed per day for each external end user account, so it grows with the number of external accounts and their usage. With self-hosted Metabase or Apache Superset, the software itself carries no per-user license fee in the open-source editions, and cost follows the infrastructure you run: application servers, the metadata database, caching and workers if you enable alerts or async queries, and the warehouse that serves queries. Ongoing costs also include staff time for upgrades and backups. Ask any quote to separate one-time build work from recurring hosting, support and upkeep, and to state which assumptions about external user volume and query load it depends on. Note that Metabase's Starter and Pro plans price per user, and that row-level permissions and multi-tenant data segregation sit in the Pro and Enterprise plans, so check those before you assume the open-source edition covers your isolation needs.

Can our own team build and run embedded analytics without outside help?

Yes, many teams can, provided they already operate containers, a relational database and a web application stack. Superset needs a user-specified SECRET_KEY, a PostgreSQL or MySQL metadata database and, for alerts, reports, async queries and thumbnails, a caching layer and Celery workers. Metabase needs a production application database and an upgrade routine. The harder parts are tenant isolation, authentication wiring between your app and the analytics tool, and a repeatable upgrade and backup process. Ask yourself whether you have engineers who can own those for the life of the product, not only for the first release. An outside implementation partner can scope and build the initial setup, hardening and documentation, and then hand over a runbook your team operates.

What does the host application team and security team need to provide?

The host application team owns how a customer's session reaches the dashboard. For Metabase, the open-source edition and Starter plan support Google sign-in and LDAP, while JWT, OIDC and SAML single sign-on need Pro or Enterprise. For Superset, authentication runs through Flask-AppBuilder with database, LDAP or OAuth providers, and LDAP or OAuth groups map to roles with AUTH_ROLES_MAPPING. The security team should define the isolation model before build: which data each external account can see, how row-level rules are enforced in the database or the tool, and how embedding tokens are issued and expire. Also agree on logging, secret rotation (Superset supports PREVIOUS_SECRET_KEY for rotation), and network paths between the host app, the analytics service and the data source.

How do upgrades and backups recur after the embedded analytics go live?

Both tools need a recurring upgrade routine, and they differ in mechanics. Metabase runs application database migrations automatically on upgrade, so the documented practice is to back up the application database first, reduce a cluster to a single node for major upgrades because of a migration lock, and upgrade one release at a time from versions older than 40. Metabase LTS versions are supported for 14 months, while non-LTS versions usually reach end of life after 2 months, so plan a cadence around the LTS line. For Superset, the upgrade documentation says to back up the metadata database, run superset db upgrade and superset init, test in staging first, and check UPDATING.md for breaking changes. Write both steps into a runbook and test restores, not just backups.

How long does an embedded analytics implementation take?

Duration depends on scope: the number of dashboards and data sources, the isolation model you require, the single sign-on path, whether you need alerts or scheduled reports, and how much of your data platform must be prepared first. No fixed duration applies across these cases, so ask for a timeline tied to a written scope rather than a generic estimate. Useful questions for a provider include which phases are planned (design, build, hardening, cutover), which items sit on the critical path such as identity integration or security review, and what your team must do in parallel. A fixed-scope engagement agrees these in writing before work starts, which makes it easier to compare proposals.

What does a fixed-scope DeployOpen engagement for embedded analytics include?

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and DeployOpen does not publish a price list, so a quote follows from that written scope. For embedded analytics, a scope typically covers deployment of the chosen tool, authentication integration with your host app, the tenant isolation design, backup and upgrade runbooks, and handover documentation. Ongoing support, upgrades and continuous security testing are available as retainers. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications.

Which embedding features need a paid tier or extra components?

Check this before you choose a tool, because the open-source edition may not cover every requirement. Metabase's open-source edition is free and self-hosted with unlimited users and dashboards, but SSO, row and column level permissions, multi-tenant data segregation and usage analytics and auditing are included only in the Pro and Enterprise plans. Air-gapped deployment is listed for the Enterprise plan. Superset has no paid edition and is licensed under Apache-2.0, but alerts, reports, async queries and thumbnails need the caching layer and worker components, usually Redis and Celery. Confirm current plan contents on the vendor pricing page, since plan details change.

Where to confirm embedding and licensing details

Before you commit to Metabase or Apache Superset for customer-facing dashboards, confirm the embedding terms and plan limits directly with each vendor. Pricing pages, licence files and configuration references change between releases, and the answers decide whether your embedded model is affordable and permitted. Start with the Metabase pricing page, which lists the Open Source, Starter, Pro and Enterprise plans and shows which features, such as SSO, row and column level permissions, and multi-tenant data segregation, sit only in the Pro and Enterprise tiers. Ask the vendor to confirm whether those features apply to your external user model before you count on them.

Next, read the Metabase embedding introduction and the Metabase people and groups documentation together. The first explains how embedded content is authenticated and scoped, and the second shows which identity methods (JWT, OIDC, SAML, SCIM) belong to which plan. Your host application must still enforce tenant isolation at the data layer, so write down which plan, which identity method and which permission controls carry that load. For Apache Superset, review the Apache Superset LICENSE.txt to confirm the Apache-2.0 terms for your intended redistribution, and the Superset configuration documentation for the authentication, role mapping and SECRET_KEY settings that govern embedded access.

Finally, put the answers in writing. Ask each vendor, and any implementation partner, to state in writing which edition covers your use case, whether embedding by external users requires a commercial licence, and what support and SSO obligations follow. Record your legal and procurement review as part of the decision, since licence interpretation for redistribution to customers is a matter for your counsel. Treat these confirmations as a gate before scoping a migration, not as an afterthought.

How DeployOpen scopes and delivers embedded analytics

DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so embedded dashboards for external users run where your data and tenant controls already live. Engagements start with a written scope that fixes what is embedded, who sees what, and how the host application enforces isolation.

How we scope

  • Inventory the Domo external users, dashboards and datasets that must move, and which customers or partners see each one.
  • Decide between Metabase and Apache Superset per use case, with the features each plan or edition requires written down.
  • Define the tenant isolation model, including where row-level rules are enforced and who approves the embedding design.
  • Agree deliverables, timelines and responsibilities in writing before work starts; engagements are fixed-scope.

How we build

  • Deploy the chosen BI platform and its application database in your cloud account, data center or air-gapped network.
  • Connect the analytics layer to your warehouse with read-only service accounts and tested per-tenant access rules.
  • Integrate single sign-on and signed embedding tokens with your host application, then test cross-tenant access paths.
  • Run security testing against the embedded surface, including broken access control and parameter tampering checks.

How we hand over

  • Document the architecture, identity mapping, embedding configuration and secret rotation procedures for your team.
  • Prepare the backup and restore procedure for the application database, with a tested restore before cutover.
  • Provide upgrade runbooks covering staging tests and each platform's breaking-change notes before every version change.
  • Deliver evidence of access controls and configuration for your own compliance assessors, who issue any audit opinion.

How we support

  • Offer ongoing support, upgrades and continuous testing as a retainer, scoped separately from the build.
  • Monitor dependency and release changes and schedule upgrades with your change management process.
  • Re-run isolation tests after each change to the host application, identity provider or tenant data model.
  • Confirm with your team which support tier, response expectations and hours apply before signing the retainer.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.