Compare Analyzati and Trackboxx on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo
Spain· Web Analytics
Needs review
Shortlist when you want Spanish/EU-legal SaaS web analytics with cookie-free daily uniques, city geo, AI referral views, and a public DPA—without self-hosting. Skip when you need open source, on-prem, multi-day retention/cohorts, or certified ISO/SOC evidence; consider Plausible Analytics or Matomo instead.
Germany· Web Analytics
Needs review
Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.
Highlighted rows differ between the two products.
| Feature | Analyzati | Trackboxx |
|---|---|---|
| Country of origin | Spain | Germany |
| Category | Web Analytics | Web Analytics |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Spain | Germany |
| Legal entity | Incorporated in Barcelona, Spain (exact legal name not published on pages reviewed) | Trackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch) |
| Governing law | Spain / EU (GDPR referenced; confirm governing law clause in Terms) | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Visitor/app data: AWS in Paris (vendor). Marketing site: Namecheap in Amsterdam. Backups described as EU. Other subprocessors named in privacy materials: Stripe (payments), AWS (email), Freshworks (support), hCaptcha (registration). | Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany). |
| Summary | Spanish cookie-free web analytics SaaS: real-time traffic, city-level geo, AI referral sources, and event tracking without cookies, stored IPs, or fingerprints. | German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA. |
| Tags |
| At a glance | Analyzati | Trackboxx |
|---|---|---|
| HQ / entity | Barcelona, Spain (EU entity claimed; exact registry name not on public pages reviewed) | Not listed |
| Product type | Hosted web analytics SaaS | Managed web analytics SaaS |
| Open source | No | No |
| Self-host | No | No |
| App hosting | AWS, Paris (vendor claim) | Not listed |
| Commercial model | Freemium + pageview / site-count tiers | Pageview packages; free tier + trial; Paddle checkout |
| DPA | Public; accepted via Terms of Service | Not listed |
| HQ | Not listed | Halberstadt / Grönwohld, Germany |
| Legal entity | Not listed | Trackboxx / Christian Pust (imprint) |
| Analytics hosting | Not listed | First Colo, Frankfurt (via TK Enterprises Ltd) |
| Key capabilities | Analyzati | Trackboxx |
|---|---|---|
| Cookie-free tracking | Yes | Yes |
| EU entity (Spain) | Yes | Not listed |
| App on AWS Paris | Yes | Not listed |
| Public DPA | Yes | Not listed |
| AI referral insights | Yes | Not listed |
| SaaS only | Yes | Yes |
| Germany-operated | Not listed | Yes |
| Frankfurt analytics hosting | Not listed | Yes |
| E-commerce analytics | Not listed | Yes |
| B2B DPA available | Not listed | Yes |
Cookie-free uniques with daily rotating salt
Counts daily unique visitors by hashing IP + User-Agent + domain with a salt that is destroyed every 24 hours. No cookies, localStorage, or device-persistent IDs; raw IP and full UA are not stored. Trade-off: no multi-day retention or new-vs-returning series.
City-level geo without retained IPs
Derives continent, country, region, and city for maps and rankings from the request IP, then discards the IP. Useful for market mix reporting when you do not need ISP- or coordinate-level precision.
AI referral and channel acquisition views
Breaks down how visitors arrive—search, referring sites, and AI assistants such as ChatGPT, Perplexity, Gemini, and Claude—so content teams can see discovery outside classic SEO referrers.
Real-time dashboard, events, export, and API
Live visitor activity, page performance, device/browser/OS stats, custom events and campaigns, weekly email reports, data export, and API access on published plans. Integrations include a WordPress plugin and Google Tag Manager snippet placement.
Public B2B DPA with processor role
A published Data Processing Agreement (effective August 2022) treats Analyzati as processor and the customer as controller for visitor measurement. Acceptance is tied to product use under the Terms of Service rather than a bespoke countersignature workflow.
Cookie-free day-hash session tracking
No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.
Traffic, channel, and live visitor dashboards
Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.
E-commerce funnels and revenue breakdowns
Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.
UTM, goals, GSC keywords, and public reports
Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.
CMS and shop plugins plus GA import
Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.
| Assurance & compliance | Analyzati | Trackboxx |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party audit PDF or no-logs attestation found on official pages reviewed. | Not found No public third-party audit PDF or cert registry entry found on primary pages. |
| ISO 27001 | Not found No ISO 27001 certificate claim located on homepage, privacy, or DPA pages. | Not found No ISO 27001 claim found on imprint, help center, or DPA materials reviewed. |
| SOC 2 / SOC 3 | Not found No SOC 2/3 report claim found on public trust materials. | Not found No SOC 2/3 report referenced on public trust materials reviewed. |
| GDPR / EU data protection | Vendor claimed EU entity (Barcelona); public GDPR/PECR/CCPA compliance pages; anonymisation design documented; controller/processor roles in DPA. | Vendor claimed German controller imprint; cookie-free hash model; public DPA; processing described as EU/EEA. Vendor asserts DSGVO fitness—confirm with counsel for your site stack. |
| US CLOUD Act exposure (indicative) | Partial Spanish/EU vendor with no known US parent, but application hosting on AWS (Paris) and US-group subprocessors (Stripe, Freshworks, AWS email, hCaptcha). Residency ≠ ownership. Not legal advice. | Partial EU sole-trader operator, no known US parent; analytics hosting claimed in Frankfurt. Partial/medium because privacy policy names Amazon SES (AWS) for email with possible US transfers; payments via UK Paddle. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Public DPA effective 18 Aug 2022; vendor says acceptance is automatic via product use / ToS—no separate signature required. | Vendor claimed Free AV/DPA offered at order and as PDF; annex lists hosting, Paddle, BunnyWay. |
| EU AI Act | Not applicable Product reports AI *referral traffic*; it is not marketed as a high-risk AI system provider. | Not applicable Web analytics SaaS; not an AI system product for AI Act high-risk classification purposes. |
| Considerations & known limitations | Analyzati | Trackboxx |
|---|---|---|
| AWS and US-group subprocessors | Medium Measurement app is on AWS Paris; account path also uses Stripe, Freshworks, AWS email, and hCaptcha. EU regions reduce some transfer friction but do not erase US-group provider diligence for many public-sector and bank questionnaires. | Not listed |
| No public ISO/SOC or independent audit | Medium Security claims rely on vendor documentation (HTTPS, hashing, firewalls, backups). Organisations with mandatory cert evidence will need vendor outreach or a different shortlist. | Not listed |
| No multi-day visitor identity | Low Daily salt rotation blocks persistent uniques. Expect gaps vs Google Analytics for returning users, frequency, and retention—by design. | Not listed |
| SaaS lock-in / no self-host | Low No self-host edition found. Exit requires export/API migration to another tool; confirm export completeness in a trial. | Low Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product. |
| Exact registry name not on marketing pages | Low Vendor states Barcelona incorporation but public pages reviewed did not display a full Spanish company registration string—collect CIF/NIF and full legal name during contracting. | Not listed |
| Consent banner claim is vendor legal opinion | Not listed | Medium Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate. |
| Amazon SES on email path | Not listed | Medium Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications. |
| No public ISO/SOC/independent audit | Not listed | Medium Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site. |
| Same-day hash limits multi-day user journeys | Not listed | Low By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit. |
When: You need open-source analytics you can self-host and audit
Consider: Plausible Analytics (self-host option) or Matomo
Analyzati is SaaS-only with no public source release found.
When: You want a comparable cookie-free European SaaS peer for side-by-side trials
Consider: Plausible Analytics or Simple Analytics
Compare AI-referrer and geo depth, DPA wording, and hosting/subprocessor lists in each trial.
When: You need full-stack product analytics and advertising linkage
Consider: Google Analytics (incumbent) or a dedicated product analytics suite
Analyzati deliberately collects a minimal metric set and does not sell ad-tech profiles.
When: You need cookieless EU analytics with an official self-host path
Consider: Plausible Analytics (Cloud or Community Edition)
Trade Trackboxx ecommerce/plugin depth for open-source deployability.
When: You want maximal privacy minimalism and a very small surface area
Consider: Simple Analytics
Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.
When: You need deep self-hosted analytics or on-prem control
Consider: Matomo or Piwik PRO-class platforms
Heavier ops and UI; stronger fit for full data residency under your infrastructure.
When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale
Consider: Google Analytics
Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.