Matomo (formerly Piwik, renamed in 2018) is a long-running open-source web analytics platform operated by InnoCraft Limited, a New Zealand company at 7 Waterloo Quay, Wellington (NZBN 6106769). It is one of the only Schrems-friendly Google Analytics alternatives that ships in two clearly separated forms: Matomo On-Premise — fully free and self-hostable on the customer's own infrastructure with unlimited hits, websites, and team members — and Matomo Cloud, the managed SaaS offering. The product reports more than one million tracked websites across 190+ countries, including the European Commission and the United Nations.
For EU buyers the operational story has two sides. On the positive side: the company is ISO 27001:2022 certified, the privacy policy is public, the GDPR Manager built into Matomo helps with Art. 30 records and consent capture, and Matomo Cloud commits that 100% of customer Cloud data and backups are stored in Europe rather than in the US. On the strict-CLOUD-Act side: InnoCraft is New Zealand–incorporated (NZ has an EU adequacy decision, so transfers are legally clean), and Matomo Cloud is operated on Amazon Web Services — meaning customer analytics data at rest sits with a US-owned hyperscaler even when the AWS region is European. Per our parent-jurisdiction stance (Schrems II, Microsoft Ireland v US), this counts as material CLOUD Act exposure regardless of region for the Cloud product. Buyers who self-host the on-premise edition on EU infrastructure (e.g. Hetzner) sidestep this entirely.
Pricing for Matomo Cloud Business starts at €29/month (€348/year, 50,000 hits/month, 30 sites, 30 users) with a 21-day free trial. Anthropic Claude and OpenAI are used to analyse aggregated, non-PII Matomo data for product features; Cognism is used for B2B marketing data enrichment on the matomo.org site. Best fit: organisations who want a long-running open-source GA alternative with a credible European-data-residency Cloud offering, or who can run the open-source build on their own EU-hosted infrastructure for a fully sovereign posture with no CLOUD Act exposure.