Metabase + PostgreSQL

Both work identically with Metabase's query builder. PostgreSQL is the more common default for new analytical databases; MySQL is the right call mainly when the data already lives in a MySQL-based application.

For most teams, yes; it has no caps on the core dashboarding and question-building features. The paid tiers add managed hosting, SSO, and audit logging, which mostly matter at larger organizations with compliance requirements.

It can, which is why the Cons section flags it. A dashboard that scans a large table on every load competes with the application for the same database. The standard protections: connect Metabase to a read replica rather than the primary once one exists; give it a dedicated read-only database user with a statement timeout, so a runaway query is cancelled instead of running for minutes; and back the heaviest dashboards with PostgreSQL materialized views refreshed on a schedule, so Metabase reads small precomputed tables. Without a replica, schedule report emails outside peak hours.

In its application database, which is separate from the data you analyze. Out of the box that is an embedded H2 file, which is fine for a trial but not for production: it can corrupt and is hard to back up or upgrade. Before real users build dashboards, point Metabase at its own PostgreSQL database. It can live on the same PostgreSQL server as your data, just as a separate database with its own user. Back it up like any other database, since every question, dashboard, and user account lives there.

On the free Open Source edition, work at the table and database level. Metabase's data permissions let you choose, per group, which databases and tables people can query, and you can hide specific tables or columns from the query builder in the table metadata settings. Row- and column-level permissions for the same table (showing each person only their own rows or masking a column for some groups) are a Pro feature. The dependable free approach is on the PostgreSQL side: create views that leave out sensitive columns, and connect Metabase with a user that can read only those views.