—
— Not assessed — Not assessed — Not assessed
German privacy-first mobile + web app analytics with on-device anonymisation, EN/DE DPA, and a transparent sub-processors list.
Public DPA: Yes
Sub-processors: Yes
Open source: No
Gunzenhausen · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
This listing
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
—
Freemium
€9/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
This listing
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
German cookieless server-side web analytics on Hetzner Gunzenhausen with bilingual public DPA and Schrems II-aligned posture.
Public DPA: Yes
Sub-processors: Yes
Open source: No
Gunzenhausen · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
This listing
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
—
Paid
$6/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
This listing
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
Open-source web analytics (NZ-incorporated InnoCraft) with EU-hosted Matomo Cloud on AWS and full self-hosted option.
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
This listing
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
self-host EU-Based
ISO/IEC 27001
Freemium
€29/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
This listing
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
Estonian-incorporated privacy-first Google Analytics alternative, bootstrapped, hosted on Hetzner Falkenstein, open source.
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
Falkenstein · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
This listing
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
—
Paid
€8/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
This listing
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
Berlin-based privacy-first web analytics on a European (OVHcloud Open Trusted Cloud) stack with strict GDPR posture.
Public DPA: Yes
Sub-processors: Yes
Open source: No
FR
France
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
This listing
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
—
Paid
€10/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
This listing
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
London-based open-source product analytics (PostHog, 2020, Y Combinator W20), US + EU Frankfurt cloud regions, MIT-licensed self-host.
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
This listing
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
self-host EU-Based
—
Freemium
€0/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
This listing
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
Dutch privacy-first web analytics on Worldstream + Leaseweb (NL) and Bunny CDN (SI), zero-knowledge encryption, cookieless tracking.
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
NL
Netherlands
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-Sovereign
This listing
EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-Based
EU-operated, with at most minor or transient US exposure.
EU-Hosted
EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-Linked
Operated by a US-incorporated entity, directly subject to US jurisdiction.
—
Freemium
€20/mo
CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
None
This listing
EU operator, no US parent, no US sub-processors of note.
Minor
A transient US sub-processor (CDN, maps); data at rest stays in the EU.
Material
US parent, or a core sub-processor is a US-owned hyperscaler.
Direct
The operator itself is US-incorporated.
