Simple Analytics
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch privacy-first web analytics on Worldstream + Leaseweb (NL) and Bunny CDN (SI), zero-knowledge encryption, cookieless tracking.
Simple Analytics is an EU-owned service hosted in the Netherlands, with no identified CLOUD Act exposure. It is listed under Web analytics.
Assessment notes
Dutch B.V. founded by Adriaan van Rossum running a fully EU-incorporated infrastructure stack (Worldstream and Leaseweb in the Netherlands plus Bunny CDN in Slovenia) with zero-knowledge encryption (only Simple Analytics holds the decryption keys), no cookies, no IP collection, and no US-owned cloud anywhere on the customer-data path; EU-owned and EU-hosted with no CLOUD Act exposure, and a named sub-processors annex is now published at /subprocessors, but there is still no signable DPA artefact — the vendor's /data-processing-agreement page argues a DPA is not required because it processes no personal data and offers instead to counter-sign customer-supplied DPAs on request.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 6 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Simple Analytics
Simple Analytics is a Dutch privacy-first web analytics product operated by Simple Analytics B.V. (registered in Bussum, Netherlands; KVK 60978856) and founded by Adriaan van Rossum in 2018. It is one of the cleanest "no-CLOUD-Act-exposure" picks in the web-analytics category: customer analytics data is stored on bare-metal infrastructure at Worldstream and Leaseweb in the Netherlands, the CDN runs through Bunny (Slovenia), and the company explicitly states that "only Simple Analytics holds the decryption keys", meaning even the hosting providers cannot read unencrypted customer data. The reference customer list is unusually strong for a small vendor: the Bank of England, Michelin, Hyundai, and the UK Government all appear on the homepage.
Compliance positioning is built on a "no personal data" principle: no cookies, no IP collection, no device fingerprinting, no persistent identifiers, which lets the product claim GDPR, UK PECR, German TTDSG, CCPA, and even HIPAA fitness without a Business Associate Agreement. The company publishes documentation of its compliance posture at docs.simpleanalytics.com (compliance, compliance-faq, data-security-and-ownership) and includes correspondence from the UK ICO confirming that no consent banner is required when analytics providers neither read nor write to user devices. Where Simple Analytics is weaker for procurement-grade buyers is the DPA itself. A named sub-processors annex is now published at /subprocessors (last updated 1 May 2026) and lists six processors, Worldstream (NL), Leaseweb (NL), Hetzner (DE), Intention (NL), Bunny (SI) and Hyperping (FR), with no US-owned entity among them. The /data-processing-agreement page resolves as well, but it is a position statement rather than a signable artefact: the vendor argues that no DPA is required because it processes no personal data, and offers instead to review and counter-sign a customer-supplied DPA on request.
Pricing is freemium and EU-buyer-friendly: the free tier covers one user, five websites and unlimited pageviews but only one month of history, and now requires a Simple Analytics badge on the site; the entry paid plan is €20/month (one user, ten websites, three years of retention); Team is €40/month plus €20 per additional user; Enterprise is custom-priced with SLA and priority support. EUR/USD/GBP currency switching, bank transfer accepted on invoices €500+, plus Bitcoin/Apple Pay/Google Pay. Best fit: privacy-conscious EU companies, public-sector buyers, and indie publishers who want a no-cookie, no-CLOUD-Act analytics stack with named Dutch hosting and a credible reference list, and don't yet need a unified DPA download.
Sub-processor map · 6
-
Bunny EUSlovenia
CDN, DNS
-
Hetzner EUGermany
Infrastructure hosting
-
Hyperping EUFrance
Uptime monitoring
-
Intention EUNetherlands
Domain name provider
-
Leaseweb EUNetherlands
Infrastructure hosting
-
Worldstream EUNetherlands
Infrastructure hosting
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Bunny | Slovenia | CDN, DNS | EU |
| Hetzner | Germany | Infrastructure hosting | EU |
| Hyperping | France | Uptime monitoring | EU |
| Intention | Netherlands | Domain name provider | EU |
| Leaseweb | Netherlands | Infrastructure hosting | EU |
| Worldstream | Netherlands | Infrastructure hosting | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Simple Analytics
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |