Matomo
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Open-source web analytics (NZ-incorporated InnoCraft) with EU-hosted Matomo Cloud on AWS and full self-hosted option.
Matomo offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Web analytics.
Assessment notes
Open-source veteran with ISO 27001:2022 and customer Cloud data 100% stored in Europe, but the controlling legal entity is InnoCraft Limited in New Zealand and Matomo Cloud runs on AWS, meaning customer data at rest sits with a US-owned hyperscaler in the EU region; NZ holds an EU adequacy decision so transfers are legally clean, but the AWS dependency is material CLOUD Act exposure for procurement-grade buyers despite the strong open-source / on-premise alternative.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: No
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Matomo
Matomo (formerly Piwik, renamed in 2018) is a long-running open-source web analytics platform operated by InnoCraft Limited, a New Zealand company at 7 Waterloo Quay, Wellington (NZBN 6106769). It is one of the only Schrems-friendly Google Analytics alternatives that ships in two clearly separated forms: Matomo On-Premise (fully free and self-hostable on the customer's own infrastructure with unlimited hits, websites, and team members) and Matomo Cloud, the managed SaaS offering. The product reports more than one million tracked websites across 190+ countries, including the European Commission and the United Nations.
For EU buyers the operational story has two sides. On the positive side: the company is ISO 27001:2022 certified, the privacy policy is public, the GDPR Manager built into Matomo helps with Art. 30 records and consent capture, and Matomo Cloud commits that 100% of customer Cloud data and backups are stored in Europe rather than in the US. On the strict-CLOUD-Act side: InnoCraft is New Zealand-incorporated (NZ has an EU adequacy decision, so transfers are legally clean), and Matomo Cloud is operated on Amazon Web Services, meaning customer analytics data at rest sits with a US-owned hyperscaler even when the AWS region is European. Per our parent-jurisdiction stance (Schrems II, Microsoft Ireland v US), this counts as material CLOUD Act exposure regardless of region for the Cloud product. Buyers who self-host the on-premise edition on EU infrastructure (e.g. Hetzner) sidestep this entirely.
Pricing for Matomo Cloud Business starts at €29/month (50,000 hits/month, 30 sites, 30 users) with a free trial that requires no credit card, and annual billing gives two months free. Anthropic Claude and OpenAI are used to analyse aggregated, non-PII Matomo data for product features; Cognism is used for B2B marketing data enrichment on the matomo.org site. Best fit: organisations who want a long-running open-source GA alternative with a credible European-data-residency Cloud offering, or who can run the open-source build on their own EU-hosted infrastructure for a fully sovereign posture with no CLOUD Act exposure.
Sub-processor map · 3
-
Amazon Web Services EMEA SARL USLuxembourg
Hosting (servers, databases, logs; Frankfurt with Dublin backups) and CDN for JavaScript files
-
Oblivion Cloud Control B.V. (Xebia Group B.V.) EUNetherlands
AWS solution provider: infrastructure management, IT consulting and support
-
Tideways GmbH EUGermany
Application performance monitoring (APM)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg | Hosting (servers, databases, logs; Frankfurt with Dublin backups) and CDN for JavaScript files | US |
| Oblivion Cloud Control B.V. (Xebia Group B.V.) | Netherlands | AWS solution provider: infrastructure management, IT consulting and support | EU |
| Tideways GmbH | Germany | Application performance monitoring (APM) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Matomo
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Estonia · €8/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |
Plausible Analytics
Estonia
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€8/mo |