GoatCounter
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Solo-developer open-source web analytics on Hetzner DE/FI; no IP storage, no trackers, free for reasonable public use, source on GitHub.
GoatCounter is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Web analytics.
Assessment notes
Solo-developer open-source web analytics (Martin Tournoij, Ireland-based) running on Hetzner servers in Germany and Finland with no third-party sharing, no IP storage, no User-Agent storage, no trackers, and no US sub-processors anywhere on the customer-data path; EU-hosted with no CLOUD Act exposure, but no formal DPA artefact or unified named sub-processors annex, adequate for indie/SMB buyers but not for procurement-grade buyers requiring contract-level transparency.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About GoatCounter
GoatCounter is a minimalist open-source web analytics tool developed and operated by solo developer Martin Tournoij (GitHub: arp242). The hosted service goatcounter.com runs on Hetzner Online GmbH servers in Finland and Germany; the operator is currently based in Ireland. The project is fully open source on GitHub and self-hostable, making it a credible "no SaaS lock-in, no CLOUD Act exposure" answer for indie publishers, NGO sites, and small EU teams.
The privacy posture is exceptionally clean: GoatCounter does not store IP addresses, does not store the full User-Agent header, does not use cookies for visitor tracking, and stores only aggregate-table data per hour rather than individual pageviews (with the option to opt into pageview-level data collection if the customer enables it). The vendor's own GDPR page is hedged rather than absolute on consent: it says GoatCounter "probably doesn't require a GDPR consent notice" because no personally identifiable data is collected, likens the processing to counting foot traffic in a shop, and explicitly recommends consulting a lawyer. Account login uses cookies for session persistence; no third-party sharing of account data; backups retained up to 30 days after account deletion.
Pricing is simple because there are no paid tiers: the homepage and the terms both state that GoatCounter.com is offered for free for reasonable public usage, which covers personal sites and small to medium businesses but not millions of pageviews a day, and the service is funded by NLnet NGI0 and GitHub Sponsors donations. Best fit: indie devs, bloggers, small e-commerce shops, and EU NGOs who want a no-cookie analytics stack on Hetzner with the option to self-host the open-source build. Procurement-grade enterprise buyers who require a formal DPA, named sub-processors annex, and a corporate legal entity should look at Plausible (also Hetzner DE) or Pirsch (also Hetzner DE) instead. GoatCounter is structurally a one-person shop and does not produce those artefacts today.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of GoatCounter
Integration & access
Compliance & governance
Public documents
Alternatives in this category
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Estonia · €8/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |
Plausible Analytics
Estonia
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€8/mo |