Umami
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked This listing Operated by a US-incorporated entity, directly subject to US jurisdiction.
MIT-licensed open-source web analytics (Umami Software Inc., US); EU region on managed cloud, self-host on any EU infrastructure.
Umami is operated by a US-incorporated entity and remains directly subject to the CLOUD Act. It is listed under Web analytics.
Assessment notes
Umami Software, Inc. (Delaware C-Corp, San Francisco, USA) maintains the MIT-licensed open-source web-analytics platform with EU (Germany) hosting region available on the managed Umami Cloud tier; vendor-level CLOUD Act exposure is direct (US-incorporated company), but the MIT-licensed self-host path lets EU buyers deploy on EU infrastructure for full sovereignty, included because the self-host path on EU infrastructure removes US-vendor exposure entirely.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned This listing The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: No
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Umami
Umami is the open-source web-analytics platform built and maintained by Umami Software, Inc., a Delaware C-Corporation headquartered in San Francisco, USA. The codebase is licensed under the MIT License (one of the most permissive open-source licences available) with the full server stack on GitHub, deployable as a single Docker container backed by PostgreSQL or MySQL, or to Vercel / any Node.js-compatible serverless platform in under ten minutes. The product is positioned as the lightweight Google Analytics alternative with no cookies, no personal data collection, and a clean dashboard UX.
For an EU-sovereignty audit Umami is in the same structural position as Outline (also US-incorporated): the managed Umami Cloud tier has both US and EU (Germany) hosting regions and customers can pick at signup, but the operating entity (Umami Software Inc., Delaware/San Francisco) is directly subject to the US CLOUD Act and FISA Section 702 regardless of which region the customer picks, making the vendor-level CLOUD Act flag direct for the managed cloud. The MIT-licensed self-host edition is the EU-sovereignty path: deploy on Hetzner / OVHcloud / Scaleway / STACKIT / private EU DC and the customer becomes the sole data controller. The directory includes Umami specifically because the self-host path is well-supported, MIT-permissive, and the operational footprint is small (one container + one database).
Pricing on the managed cloud: free tier with limited views/sites; paid tiers from approximately $9/month (~€8) scaling by event volume. Self-host: free under MIT. Best fit: engineering teams that already operate EU infrastructure and want a Plausible-class GA replacement under permissive licensing, or organisations that need the EU-region managed cloud and accept the US-vendor jurisdiction risk. Buyers needing a fully EU-incorporated vendor should prefer Plausible (EE) or Simple Analytics (NL) in the same category.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Umami
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |