Plausible Analytics
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Estonian-incorporated privacy-first Google Analytics alternative, bootstrapped, hosted on Hetzner Falkenstein, open source.
Plausible Analytics is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Web analytics.
Assessment notes
Estonian OÜ, bootstrapped and self-funded, runs the entire customer analytics stack on EU-incorporated infrastructure (Hetzner Falkenstein DE, Bunny SI, UpCloud FI) with no customer data at rest on a US-owned cloud; the publicly-linked DPA, AGPL open-source codebase, and self-hosting option round out a strong EU-owned, EU-hosted posture with no CLOUD Act exposure on the customer-data path. The only always-on US-owned sub-processor (Postmark for transactional email) is ancillary, transient and SCC-covered and never touches analytics data at rest; the registration captcha moved from hCaptcha (US) to Friendly Captcha (DE) and Algolia is now opt-in on the docs site only, so under a data-at-rest definition CLOUD Act exposure is none.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 2 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Plausible Analytics
Plausible Analytics is the textbook procurement-friendly Google Analytics alternative: an Estonian-incorporated, bootstrapped, profitable team-of-ten that runs the entire product on European infrastructure and publishes a clean, public DPA. The legal entity is Plausible Insights OÜ in Tartu, Estonia. Uku Taht launched the project in December 2018 and Marko Saric joined as co-founder in 2020. The company is self-funded, has more than 17,000 paying subscribers, and explicitly rejects outside investment, keeping the cap table firmly EU-owned.
The product is a lightweight, cookieless analytics script (~1 KB, ~54× smaller than GA4) that does not use persistent identifiers; daily salts are rotated and deleted, raw IPs and User-Agents are never stored, and no cookie banner is required for visitor analytics. Customer analytics data is "kept fully secured, encrypted and hosted on 100% renewable-energy-powered servers in Falkenstein, Germany"; Hetzner is the named hosting provider. Other product sub-processors are EU-only as well: Bunny CDN (Slovenia) and UpCloud (Finland). The small set of non-EU sub-processors is scoped to ancillary functions and covered by Standard Contractual Clauses: Paddle for billing (UK) and Postmark for transactional email (US), which is the only always-on US-owned processor in the chain. Algolia for documentation search and Anthropic for support-reply drafting (both US) are opt-in only, the registration and login captcha is Friendly Captcha (Germany), and optional integrations (Google, Help Scout) only engage if a customer turns them on.
Pricing starts at €8/month (billed in USD at $9) for the Starter plan with 10k pageviews and three years of data retention; a 30-day free trial requires no credit card. Plausible is also fully open source (AGPL on GitHub) and self-hostable, making it a credible answer for buyers who want the option to escape SaaS entirely. Best fit: privacy-first websites, EU agencies, regulated SMBs, and open-source-friendly engineering teams replacing GA4, and the strongest baseline reference point on this directory for how a "no CLOUD Act drama" web analytics stack actually looks.
Sub-processor map · 7
-
Algolia, Inc. USUnited States
Documentation search (ancillary, opt-in since the August 2026 policy: engaged only when the docs search is used, SCC-covered)
-
Postmark (ActiveCampaign, LLC) USUnited States
Transactional emails and scheduled reports (ancillary, SCC-covered)
-
BunnyWay (Bunny.net) EUSlovenia
Content delivery network (CDN), DNS, DDoS protection
-
Friendly Captcha GmbH EUGermany
Spam protection on registration and login (replaced hCaptcha / Intuition Machines, US, in the August 2026 policy)
-
Hetzner Online GmbH EUGermany
Server hosting and storage of visitor analytics data (Falkenstein, Germany)
-
Paddle.com Market Ltd non-USUnited Kingdom
Payment processing / merchant of record
-
UpCloud EUFinland
Database hosting and storage of data exports
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Algolia, Inc. | United States | Documentation search (ancillary, opt-in since the August 2026 policy: engaged only when the docs search is used, SCC-covered) | US |
| Postmark (ActiveCampaign, LLC) | United States | Transactional emails and scheduled reports (ancillary, SCC-covered) | US |
| BunnyWay (Bunny.net) | Slovenia | Content delivery network (CDN), DNS, DDoS protection | EU |
| Friendly Captcha GmbH | Germany | Spam protection on registration and login (replaced hCaptcha / Intuition Machines, US, in the August 2026 policy) | EU |
| Hetzner Online GmbH | Germany | Server hosting and storage of visitor analytics data (Falkenstein, Germany) | EU |
| Paddle.com Market Ltd | United Kingdom | Payment processing / merchant of record | non-US |
| UpCloud | Finland | Database hosting and storage of data exports | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Plausible Analytics
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |