Compare Alceris Analytics and Piwik PRO on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Google Analytics, Matomo, Mixpanel
Germany· Web Analytics
Needs review
Shortlist when you need German-operated, cookieless pageview/event analytics with a free monthly allowance and one-line install. Skip when you need self-hosting, open-source core, enterprise cert packs, or deep product analytics—consider Plausible, Simple Analytics, Pirsch, or Matomo instead.
Poland· Web Analytics
Needs review
Shortlist Piwik PRO when you need a managed European analytics controller with integrated consent, tagging, and real-time data activation—and you can accept cloud residency on Azure and/or Elastx. Skip when you require open-source self-hosting (consider Matomo or Friendly Analytics) or only need a minimal cookieless counter (Plausible, Simple Analytics).
Highlighted rows differ between the two products.
| Feature | Alceris Analytics | Piwik PRO |
|---|---|---|
| Country of origin | Germany | Poland |
| Category | Web Analytics | Web Analytics |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | Poland |
| Legal entity | Manuel Bauer, Innere Passauer Str. 45, 94315 Straubing, Germany (VAT DE353601960) | Piwik PRO SA (Wrocław); affiliates Piwik PRO LLC (New York), Piwik PRO GmbH (Berlin) |
| Governing law | Germany | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Vendor claims analytics data is stored and served only on European servers and aggregated on arrival. Named external paths: Paddle (paid billing MoR) and optional Google Search Console. No official named infrastructure/subprocessor inventory beyond those; public site IP/ASN currently associated with netcup GmbH (Germany). DNS nameservers observed on Hetzner. | Customer-selectable regions: Microsoft Azure public cloud (US, Netherlands, Germany, Hong Kong) and Elastx (Sweden, EU-operated). Enterprise private cloud: 60+ Azure regions plus Elastx. Business plan marketing highlights Swedish EU-operated hosting. No classic customer self-host. |
| Summary | German cookieless website analytics SaaS: aggregate pageviews, events, and UTM campaigns without cookies or IP logs, operated from Straubing with EU-oriented hosting claims. | Polish privacy-first analytics suite combining web and mobile analytics, tag management, consent management, and real-time data activation for regulated teams. |
| Tags |
| At a glance | Alceris Analytics | Piwik PRO |
|---|---|---|
| HQ | Straubing, Germany | Wrocław, Poland (Piwik PRO SA) |
| Legal entity | Manuel Bauer (sole operator) | Not listed |
| Deployment | Hosted SaaS only | Not listed |
| Open source | Product SaaS closed; WP plugin on WordPress.org | No (closed source since split from Matomo lineage) |
| Commercial model | Free volume-capped tier; paid via Paddle | Business subscription + trial; Enterprise custom |
| Governing law | Germany (per terms) | Not listed |
| Product type | Not listed | Commercial analytics suite (SaaS / private cloud) |
| Self-host | Not listed | No classic on-prem; public or private cloud only |
| Hosting (public) | Not listed | Azure US/NL/DE/HK; Elastx Sweden |
| Modules | Not listed | Analytics, Tag Manager, Consent Manager, Data Activation |
| Key capabilities | Alceris Analytics | Piwik PRO |
|---|---|---|
| Cookieless by design | Yes | Not listed |
| EU-operated (Germany) | Yes | Not listed |
| Realtime dashboard | Yes | Not listed |
| Free tier (volume-capped) | Yes | Not listed |
| SaaS only (no self-host) | Yes | Not listed |
| EU HQ (Poland) | Not listed | Yes |
| Analytics + tags + consent | Not listed | Yes |
| Data activation | Not listed | Yes |
| EU hosting options | Not listed | Yes |
| ISO 27001 / SOC 2 (claimed) | Not listed | Yes |
| HIPAA BAA (Enterprise) | Not listed | Yes |
Cookieless aggregation without IP storage
Per the privacy policy, Alceris does not set cookies, session IDs, or similar client storage; IPs are not logged; the full User-Agent is not stored. Only aggregated fields such as page URL, referrer, parsed browser/OS, language, and timezone-based country are retained—aimed at sites that want stats without an analytics cookie banner.
One-line async script, deferred events, WordPress plugin
Install via a single async script from alceris.com with your site data-id (docs include a deferred alceris() queue so early events are not lost). WordPress operators can use the official plugin and paste the dashboard site ID. SaaS-only—there is no self-hosted server package.
Realtime pageviews and custom events with metadata
Pageviews and events are processed immediately into the dashboard. Custom events are sent with alceris('event', name, { ...metadata }), useful for button clicks, form steps, or content attributes without building a full product-analytics stack.
UTM campaigns, outbound links, and cross-domain flows
UTM parameters are extracted for campaign reporting; outbound link clicks are tracked automatically; cross-domain tracking follows visitors across owned domains. Scope is web traffic measurement—not session replay or heatmaps.
Optional Google Search Console and first-party proxy
Connect Search Console to import query impressions, clicks, and terms (data removed on unlink). Docs also describe reverse-proxying script.js and the img.alceris.com data endpoint through your own domain so ad-blockers are less likely to drop hits—at the cost of operating that proxy yourself.
ClickHouse-backed web & mobile analytics
Session-level web and app analytics with custom reports, funnels, user flows, multi-channel attribution, and calculated metrics. Vendor positions unsampled collection by default with optional sampling for extreme volumes, plus raw export via API, files, and BigQuery—aimed at teams that outgrew pre-aggregated MySQL-style tools.
Anonymous tracking when cookies are declined
Collect privacy-safe behavioral signals without identifiers when visitors refuse cookies or when you configure limited measurement modes. Marketing can still see channels and journeys; personal identifiers and full attribution wait for a valid lawful basis—useful under GDPR/ePrivacy friction.
Integrated Consent Manager and Tag Manager
Capture and store consent, drive tag firing from preferences, and handle visitor data requests in-product. Optional Cookie Information CMP and server-side tagging paths reduce the usual glue code between a separate CMP, GTM, and analytics.
Data Activation for real-time personalization
Segment audiences from live behavior and trigger on-site or outbound actions without exporting every event to a second CDP first. Suited to regulated marketers who want activation on first-party data they control.
Selectable cloud residency (Azure + Elastx)
Public cloud regions include Azure US, NL, DE, and HK plus Elastx Sweden; Enterprise private cloud spans 60+ Azure regions and Elastx. Business plan marketing highlights EU-operated Swedish hosting—pick region in procurement, not after go-live.
Regulated-industry packaging (GDPR tooling, HIPAA BAA path)
DPA available on Business signup; Enterprise adds private cloud, higher action volumes, SLAs, and HIPAA Business Associate Agreements for healthcare marketing analytics. Vendor also claims ISO 27001 and SOC 2—request current certificates in diligence.
| Assurance & compliance | Alceris Analytics | Piwik PRO |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit of cookieless/no-IP claims found | Partial Vendor states regular external security audits and SOC 2/ISO programs; no public third-party no-logs-style audit PDF reviewed for this draft. Request reports under NDA. |
| ISO 27001 | Not found No ISO 27001 claim on public site/security pages (none published) | Vendor claimed Asserted on privacy-security and platform pages; certificate not independently re-verified against a public registry for this entry. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report referenced publicly | Vendor claimed Vendor claims SOC 2 (comparison content references type II) and SOC 2-certified infrastructure; obtain current report in diligence. |
| GDPR / EU data protection | Vendor claimed German controller; cookieless/no-IP design claims on privacy policy (last updated 2022). Not legal advice—confirm with counsel and DPA. | Vendor claimed EU legal entity, residency options, consent tooling, anonymization, and DPA. Compliance depends on customer configuration and purposes. |
| US CLOUD Act exposure (indicative) | Partial EU sole proprietor, no known US parent; vendor EU-hosting claims and DE-associated hosting for the public site. Optional Google Search Console involves Google; Paddle handles payments; infrastructure subprocessors not fully named. Indicative only—not legal advice. | Partial No known US parent (Polish SA). Medium exposure due to Microsoft Azure as public/private cloud subprocessor and optional US region; Elastx Sweden is EU-operated alternative. Not legal advice. |
| Data processing agreement (B2B) | Not found No public DPA page or in-product DPA download found; ask vendor before production use | Vendor claimed Business DPA linked from Business plan signup (piwik.pro/business-dpa/); Enterprise contracts expand terms. |
| EU AI Act | Not applicable Web analytics measurement product; not marketed as an AI system | Not applicable Analytics/activation platform; not marketed as an AI system provider. Customer AI use of exported data is out of product scope. |
| HIPAA / BAA | Not listed | Vendor claimed HIPAA-oriented offering with BAA on Enterprise path per vendor; not available on all plan tiers. |
| Considerations & known limitations | Alceris Analytics | Piwik PRO |
|---|---|---|
| Solo / small-operator continuity | Medium Imprint shows an individual operator in Straubing. Terms provide service as-is with email support on reasonable effort and reserve the right to modify or discontinue the service. Practical impact: backup exports and an exit plan matter more than with a large SaaS vendor. | Not listed |
| Thin public compliance packaging | Medium No ISO/SOC claims, no independent audit, no public DPA template, and no named infrastructure subprocessor list despite terms referring to third-party hardware/storage vendors. Practical impact: slower security review for regulated buyers. | Not listed |
| Optional Google Search Console path | Low Connecting Search Console pulls query metrics from Google into Alceris. Leave it disconnected if US providers are out of policy for any analytics-adjacent data. | Not listed |
| Billing via Paddle MoR | Low Paid plans are contracted with Paddle, not Alceris directly. Review Paddle's terms and data role for finance/procurement. | Not listed |
| WordPress plugin maintenance signal | Low WordPress.org lists the plugin as not tested with the latest major WP releases and few active installs. Prefer manual script install or re-test thoroughly on your WP version. | Not listed |
| US-group cloud (Azure) in hosting path | Not listed | Medium Even with EU region selection, Azure introduces US-group infrastructure risk. Pin region, review SCCs/subprocessors, and escalate if policy forbids US cloud groups entirely. |
| Closed source and no classic self-host | Not listed | Medium Cannot independently audit full source or run fully air-gapped on customer iron. Private cloud still involves vendor-managed stack on Azure/Elastx. |
| Certifications not independently verified here | Not listed | Low ISO 27001, SOC 2, and HIPAA are vendor-claimed. Request certificates/reports and BAA text before treating them as assured. |
| Paid plans only after Core sunset | Not listed | Low Free Core has been discontinued; evaluation relies on trials and paid Business/Enterprise metering by actions/domains. |
| Compliance depends on configuration | Not listed | Medium Anonymous modes and CNIL exemption require correct setup and purpose limitation. Misconfiguration can recreate the same legal exposure teams left GA to avoid. |
When: You want a more established cookieless SaaS brand with stronger public compliance packaging
Consider: Plausible Analytics or Simple Analytics
Similar lightweight privacy analytics category; different ownership and documentation maturity
When: You need self-hosted or on-prem control of the analytics stack
Consider: Matomo (self-hosted) or catalog Matomo hosting variants
Alceris is cloud-only; proxying the script still sends data to Alceris
When: You need German-hosted open-source cookieless analytics with a different product surface
Consider: Pirsch Analytics
Peer German privacy-analytics option for side-by-side evaluation
When: You need full GA4-class product and marketing analytics depth
Consider: Google Analytics (accept its data model) or a heavier EU suite
Alceris intentionally stays narrow
When: You need open-source code and true on-premises control
Consider: Matomo (self-host) or Friendly Analytics / Matomo by Stackhero for managed Matomo
Piwik PRO is proprietary cloud/private-cloud only.
When: You want minimal, cookieless EU analytics without enterprise suite complexity
Consider: Plausible Analytics or Simple Analytics
Far smaller feature surface; no HIPAA/CDP-style activation packaging.
When: You need a German enterprise analytics vendor with long public-sector presence
Consider: etracker
Different product depth and packaging—compare consent tooling and activation needs.