AskGSC vs Offen Fair Web Analytics

Compare AskGSC and Offen Fair Web Analytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

AskGSC

France· Web Analytics

Needs review

Shortlist AskGSC when a French-operated, hosted MCP layer is enough to query authorized Google Search Console data inside ChatGPT, Claude, or similar assistants. Skip when you need self-hosted control, write access, a site crawler, or first-party web analytics. Consider Plausible Analytics or Piwik PRO for on-site analytics, or a self-hosted GSC MCP when infrastructure ownership is the requirement.

EU-operatedHosted GSC MCPRead-only Google OAuthNo local MCP serverMulti-assistant MCP

View listing Visit Website

Offen Fair Web Analytics

Germany· Web Analytics

Needs review

Shortlist when you want self-hosted, Apache-2.0 analytics that only measures after opt-in, encrypts events in the browser, and lets visitors open their own data in the Auditorium. Skip when you need cookieless full-coverage metrics, session replay/heatmaps, or zero-ops managed EU hosting—consider Plausible, Pirsch, or Friendly Analytics instead.

Opt-in onlyBrowser E2E encryptionSelf-hostedApache-2.0Visitor data accessBerlin-based project

View listing Visit Website

Highlighted rows differ between the two products.

AskGSC vs Offen Fair Web Analytics: Snapshot
Feature	AskGSC	Offen Fair Web Analytics
Country of origin	France	Germany
Category	Web Analytics	Web Analytics
Open source	No	Yes
Self-hosted	No	Yes
Headquarters	France	Germany
Legal entity	KALYVOX SASU	Public legal notice lists Frederik Ring, Berlin (offen.software); product authors Frederik Ring and Hendrik Niefeld—no separate GmbH name verified on imprint
Governing law	Not listed	Germany (indicative from Berlin imprint)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
EU-hosted status	Partial	Not listed
Hosting / residency	French operator; public providers include Lovable (web app hosting), Supabase (auth/DB/backend), Google APIs, Stripe for payments, and Cloudflare in front of the MCP host (mcp.askgsc.app CNAME to askgsc.pages.dev). Exact DB/hosting regions are not disclosed on AskGSC pages.	Product is operator self-hosted (your VPS/cloud/on-prem). No Offen multi-tenant analytics SaaS or vendor subprocessor list for visitor events. Related marketing site (offen.software) names Hetzner Online GmbH (Germany) as host—not the analytics data path. Optional community deploys include Heroku (operator choice).
Summary	French hosted MCP connector that gives ChatGPT, Claude, and other assistants read-only Google Search Console analytics for SEO decisions without CSV exports.	Open-source, self-hosted web analytics with opt-in consent, browser-side end-to-end encryption, and a shared Auditorium so visitors can see and control their own usage data.
Tags	SEO Google Search Console MCP AI assistants developer tools France	analytics open-source privacy self-hosted opt-in gdpr e2e-encryption

At a glance: AskGSC vs Offen Fair Web Analytics
At a glance	AskGSC	Offen Fair Web Analytics
HQ	Toulouse, France	Not listed
Legal entity	KALYVOX SASU (SIREN 999 458 409)	Not listed
Product type	Hosted MCP connector for Google Search Console	Not listed
Google scope	webmasters.readonly	Not listed
Self-host	No (hosted SaaS)	Not listed
Open source	Not claimed	Not listed
HQ / authors	Not listed	Berlin, Germany (Frederik Ring & Hendrik Niefeld)
License	Not listed	Apache-2.0 (code/docs); logo CC-BY-NC-ND-4.0
Delivery	Not listed	Self-host only (binary, Docker, community deploys)
Consent model	Not listed	Opt-in only; first-party cookies
Default retention	Not listed	6 months (configurable shorter)
Funding note	Not listed	NLnet NGI support (project-stated)
Cookieless tracking	Not a site tracker; reads GSC via Google OAuth/API	Not listed
Data residency regions	Not published; privacy policy allows non-EEA processing by providers/assistants	Not listed

Key capabilities: AskGSC vs Offen Fair Web Analytics
Key capabilities	AskGSC	Offen Fair Web Analytics
EU-operated	Yes	Yes
Hosted GSC MCP	Yes	Not listed
Read-only Google OAuth	Yes	Not listed
No local MCP server	Yes	Not listed
Multi-assistant MCP	Yes	Not listed
Opt-in only	Not listed	Yes
Browser E2E encryption	Not listed	Yes
Self-hosted	Not listed	Yes
Apache-2.0	Not listed	Yes
Visitor data access	Not listed	Yes

AskGSC

Hosted remote MCP for Search Console
Provides a remote MCP URL (mcp.askgsc.app) that compatible assistants call on demand. No local MCP server, Google Cloud project, or CSV export is required for the standard flow.
Eleven read-only GSC analysis tools
Tools cover overview trends, query/page/country/device search analytics, period comparisons, opportunity signals, URL inspection (last-known indexing), and sitemap checks. None can modify Search Console or the website.
Read-only Google OAuth scope
Uses https://www.googleapis.com/auth/webmasters.readonly plus identity scopes for sign-in. Users can revoke access from Google account connections; AskGSC states it does not sell Google user data or train its own models on it.
Works across multiple MCP clients
Documented integrations include ChatGPT, Claude, Notion AI, Cursor, Claude Code, and Codex using one hosted MCP server rather than a separate connector per assistant.
Trial then limited free access, optional Pro
A card-free trial starts when Search Console is connected. After the trial the account can remain on a limited free allowance; Pro is an express paid subscription for fuller tool access. Plan figures belong on the vendor pricing page.

Offen Fair Web Analytics

Opt-in only collection with first-party cookies
No analytics events are recorded until the visitor actively consents. Cookies are first-party and the tracker is meant to run on a same-site subdomain so third-party cookie restrictions and cross-site tracking models do not apply. Visitors who never opt in leave no usage trail—expect lower absolute volumes than cookieless tools that measure by default.
Browser-side end-to-end encryption of usage events
Clients encrypt usage data before it leaves the browser; the server stores ciphertext and cannot decrypt events alone. Only the visitor (via their cookie) and the matching operator account can open that visitor's data in the Auditorium. Practical impact: a compromised database or overly broad ops access does not yield plaintext browsing histories the way a typical self-hosted analytics DB would.
Auditorium for both operators and visitors
Operators see aggregates across pages where the installation is active (unique users/sessions, top pages, filters). Each opted-in visitor can open the same style of UI for their own data only, with plain-language metric explanations, and can delete data or fully opt out later. This is the fair design point: measurement is not a one-way glass.
Essential metrics without IP or User-Agent capture
Dashboards cover real-time activity, page views, unique users and sessions, bounce rate, returning users, top pages, referrers, UTM campaign/source, landing and exit pages, weekly retention, and load time. Location is country-level from timezone mapping; mobile share uses orientation capability—not IP geolocation or UA parsing. No heatmaps, session replay, or warehouse-grade product analytics.
Lightweight self-host: binary, Docker, SQLite or SQL
Production installs use a single binary (Linux/Windows/macOS) or the offen/offen image; docs also cover Heroku, Uberspace, and YunoHost. Default store is SQLite; MySQL and Postgres are supported. AutoTLS can request Let's Encrypt certificates. Config is environment variables or offen.env. You own uptime, backups, SMTP for password reset, and the subdomain layout.
Multi-site accounts, teams, and short retention
One installation can cover multiple websites with shared team access. Default retention is six months with automatic deletion; operators can shorten retention (e.g. 12 weeks, 30 days, 7 days) knowing shorter values purge older events on startup. Consent banner appearance is customizable; UI locales include EN, DE, FR, ES, PT, and VI.

Assurance & compliance: AskGSC vs Offen Fair Web Analytics
Assurance & compliance	AskGSC	Offen Fair Web Analytics
Independent security / no-logs audit	Not found No public independent audit PDF or report linked from the site.	Not found No public third-party audit PDF found; coordinated disclosure via SECURITY.md email only.
ISO 27001	Not found	Not found No public ISO 27001 certification claim found on official site or docs.
SOC 2 / SOC 3	Not found	Not found No public SOC 2/3 report found.
GDPR / EU data protection	Vendor claimed French controller; GDPR rights section and CNIL reference on privacy policy. Confirm DPA for B2B.	Vendor claimed EU authors; opt-in, data minimization (no IP/UA), visitor access/erasure, short default retention, Datensparsamkeit framing. Self-host means operator remains controller—confirm your legal basis and notice.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but Google, Supabase, Stripe, Cloudflare/Lovable, and user-selected US AI assistants appear in the public data path. Not legal advice.	Partial EuropeanStack assessment: no known US parent; product not delivered as US-hosted vendor SaaS. Operator-chosen infrastructure (including optional Heroku/US cloud) can still create CLOUD Act paths for stored ciphertext/metadata. Not legal advice.
Data processing agreement (B2B)	Not found No public DPA download found; ask vendor.	Not applicable No multi-tenant vendor analytics processing relationship documented; operator self-hosts and is typically controller. Custom development/support via offen.software is separate from a standard SaaS DPA.
EU AI Act	Partial AskGSC is an MCP data gateway to user-selected AI assistants rather than a published generative model. AI Act obligations may still matter for how connected assistants are used; confirm with counsel.	Not applicable Web analytics metrics product; not an AI system product.

Considerations & known limitations: AskGSC vs Offen Fair Web Analytics
Considerations & known limitations	AskGSC	Offen Fair Web Analytics
US-group cloud and SaaS in the data path	Medium Privacy policy names Google, Supabase, Lovable, and Stripe; MCP DNS uses Cloudflare Pages. Search Console results also flow to the AI client you connect. Teams with strict EU-only subprocessor rules need a written region and subprocessor schedule.	Not listed
No public independent audit or cert package	Medium ISO 27001, SOC 2, and independent security audits were not found on public pages. Security claims rest on vendor documentation (encrypted refresh tokens, read-only scope).	Not listed
Depends on Google Search Console data quality	Low Vendor docs note GSC data may be delayed, aggregated, or incomplete, and average position is not a real-time ranking. AI interpretations remain the user's responsibility.	Not listed
Very new legal entity	Low KALYVOX appears in the French registry as created in January 2026. Expect limited public operating history and incomplete legal placeholders (retention periods, mediator contact) on some policy pages.	Not listed
Opt-in undercounts absolute traffic	Not listed	High Visitors who never consent generate no events. Growth and content KPIs will not match cookieless tools or GA-style default measurement—treat as design, not a misconfiguration.
You own uptime, backups, and secrets	Not listed	Medium No managed Offen cloud. Operators must run HTTPS/subdomain layout, set OFFEN_SECRET for stable sessions, configure SMTP for resets, and back up SQLite/SQL—plus avoid reverse proxies that log IPs if minimization is a goal.
E2E crypto is vendor-claimed architecture	Not listed	Medium Browser-side encryption and server inability to decrypt are core claims from project docs/README, not independently audited in public materials found. Security-sensitive orgs should review source or commission assessment.
Hosting choice reintroduces cloud jurisdiction	Not listed	Medium Self-host on US-group cloud or Heroku means CLOUD Act/subprocessor analysis shifts to your host even though Offen itself is Berlin-based OSS without a vendor SaaS region map.
No public ISO/SOC or audit pack	Not listed	Low Procurement checklists that require vendor ISO 27001/SOC 2 will stall; evidence is open source and design docs, not cert registry entries.
Essential metrics only	Not listed	Medium No heatmaps, session replay, advanced funnels, or product-analytics warehouse features. Wrong tool if the shortlist criterion is UX research depth rather than fair traffic statistics.

Fit

AskGSC

Best fit when

Founders and SEO operators who already decide inside ChatGPT, Claude, Notion AI, or coding agents
Teams that need recurring GSC questions (period compare, losing pages, low CTR) without CSV exports
Buyers who want read-only Google access and a hosted MCP URL rather than running their own server
Organizations that prefer a French contracting entity for a lightweight SEO analysis connector

Poor fit when

Needs to write to Search Console, request indexing, or edit the website through the connector
Requires self-hosted MCP, custom tool code, or fully controlled token storage and regions
Looking for cookieless first-party web analytics instead of Google search performance data
Procurement blocked without a public DPA, ISO 27001, or independent audit package

Consider instead when

When: You need first-party site analytics rather than Google Search Console metrics
Consider: Plausible Analytics or Piwik PRO
Different data source: on-site collection vs Google search reports
When: You must operate the MCP stack and credentials yourself
Consider: Self-hosted Google Search Console MCP
AskGSC's own compare pages frame this as higher setup for more control
When: Manual one-off analysis is enough
Consider: Google Search Console UI and CSV exports
No third-party MCP or assistant data path

Offen Fair Web Analytics

Best fit when

Public-sector, media, NGO, or mission-driven sites that need visitor-visible transparency and strict opt-in
EU teams that must keep analytics off third-party trackers and can run a small always-on instance
Operators who want first-party subdomain cookies, CSP-aware embedding, and no IP/User-Agent collection
Organisations evaluating fair-processing design over maximum measurement coverage
Teams comfortable with SQLite or SQL self-host ops (binary or Docker) and publishing their own privacy notice

Poor fit when

Product or growth teams that require near-complete traffic measurement without consent friction
Needs for heatmaps, session replay, funnels, or ad-ecosystem attribution comparable to Hotjar/Mixpanel/GA
Buyers seeking a vendor-managed multi-tenant analytics cloud with SLAs and a signed vendor DPA as processor
Large enterprises that require public ISO 27001/SOC 2 or third-party security audit packs before shortlist

Consider instead when

When: You want privacy-oriented analytics with managed EU hosting and lower consent friction
Consider: Plausible Analytics or Pirsch Analytics
Typically optimised for simpler cookieless or low-friction models and hosted plans; less radical visitor Auditorium design than Offen.
When: You need EU hosted privacy analytics with operator support and less self-host burden
Consider: Friendly Analytics
European catalog peer oriented to hosted privacy analytics; compare consent model and feature depth to Offen’s opt-in + E2E approach.
When: You need deep product analytics, funnels, or session UX tooling rather than fair traffic metrics
Consider: Hotjar, Mixpanel, or a full GA4 stack (with legal review)
Different category: richer product/UX analytics, different jurisdiction and subprocessor profile.

Open questions for due diligence

AskGSC

Will KALYVOX sign a B2B DPA and publish an authoritative subprocessor list with regions?
Which Supabase and Lovable regions host AskGSC production data today?
Are ISO 27001, SOC 2, or independent penetration-test reports available under NDA?
What exact retention applies to technical logs and backups (privacy page still has placeholders)?

Offen Fair Web Analytics

Will your traffic and KPI model tolerate opt-in-only measurement after a pilot on a non-critical property?
Where will you host the instance (EU on-prem/VPS vs US-group cloud), and who holds OFFEN_SECRET and DB backups?
Do procurement rules require third-party audits or ISO/SOC that Offen does not publish?
Do you need a signed vendor DPA as processor, or is controller-only self-host acceptable to counsel?
Is subdomain + CSP (script-src/frame-src + unsafe-inline styles for the banner) feasible on your main site?