Statable is a cookieless web-analytics service operated by Key Arg B.V., a self-funded Dutch company (KvK 89388496, Herckenrathstraat 1, Monster, South Holland) whose filings in the register go back to 2023. The tracking script is about 2 KB and sets no cookies and writes nothing to the visitor's device. Unique visitors are counted with a keyed SipHash of site ID, IP address, user agent and the calendar date: the IP and user agent are discarded once the hash is computed, the identifier changes every day, and it is scoped to one site, so nothing links a visitor across days or across customers. City-level location comes from a local GeoIP database rather than an external lookup. The script checks Do Not Track and Global Privacy Control before sending anything and, when either is set, sends nothing at all. The DPA treats the result honestly as pseudonymised personal data, not anonymous data. Beyond pageviews the product covers goals, custom events, funnels, filters and saved segments, engagement time and scroll depth, error tracking, public shareable dashboards, embeddable map and counter widgets, a Stats API, a command-line tool and a remote MCP server for AI assistants. GA4 history is imported as aggregated daily reports through Google's read-only Analytics Data API, and Search Console can be connected the same way.
The infrastructure is the part to look at. Statable owns its servers and houses them in a NorthC colocation facility; NorthC supplies the building, power and physical security and has no access to the machines. The vendor's legal pages say Oude Meer, while the RIPE geofeed Key Arg publishes for its own address block names NorthC Amsterdam 1 on Kabelweg, so the servers are in the Amsterdam area either way (hosting country: Netherlands). Key Arg holds its own autonomous system (AS219411) and a /24 address block announced at AMS-IX, which is what a company running its own hardware looks like, not one renting cloud servers. bunny.net, a Slovenian CDN, sits in front of the website, the first-party tracking script at statable.com/js/ and the event endpoint at statable.com/api/event, so a visitor's request reaches only a Slovenian edge and Key Arg's own servers (CLOUD Act rating: None). The US-owned services sit on the account side: Stripe for payments and optional Google or GitHub sign-in, which the DPA describes, plus Resend for transactional email including the one-time sign-in codes and Google Workspace for company mail, which no Statable document names. The marketing site also loads an OpenAI advertising pixel on its pages, on the sign-up form and on public shared dashboards, setting a cookie without a consent prompt, although the privacy policy says the website sets no tracking cookies and uses no data for advertising. None of these touch the analytics data, but they are why the score is 4 and not 5.
Pricing is in USD, excluding VAT, by monthly pageviews plus custom events across all sites in the account: from $9 a month for 10,000 to 169 USD for 10 million, with annual billing about 20 percent cheaper (7 USD a month on the smallest tier). Every paid tier carries the same feature set, unlimited websites and unlimited data retention; the one exception is site-member seats, which the documentation says scale with the plan, although the number per tier is not published. There is a 30-day trial without a card, and sites on .edu, .github.io and .gitlab.io domains get permanent free use through a public widget that carries a "Powered by Statable" link. There is no self-hosted edition and the interface is English only. Best fit: small and mid-sized sites replacing Google Analytics that want a GDPR-friendly default, their GA4 history kept, and a processing chain they can explain to a data-protection officer in two lines.