Commanders Act vs Friendly Analytics

Compare Commanders Act and Friendly Analytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

Commanders Act

France· Web Analytics

Needs review

Shortlist when you need an EU-headquartered enterprise stack combining server-side tag management, consent, real-time CDP activation, and independent media attribution (Adloop). Skip when you only need lightweight privacy analytics or open-source self-hosting—consider etracker or fusedeck for narrower EU measurement/tagging scopes, or Matomo-class tools for self-host analytics.

EU-operated (FR)Server-side TMSReal-time CDPIntegrated CMPAdloop attributionSaaS only

View listing Visit Website

Friendly Analytics

Switzerland· Web Analytics

Needs review

Shortlist when you need full Matomo depth (heatmaps, funnels, ecommerce, API) with Swiss product hosting and managed privacy defaults—especially regulated CH/EU orgs leaving Google Analytics. Skip when you only want a minimal pageview counter, a free self-serve tier, or pure DIY Matomo ops—consider Plausible, etracker, or self-hosted Matomo instead.

Matomo-as-a-ServiceCookieless by defaultSwiss product hostingISO 27001 (claimed)DPA availableEU / on-prem option

View listing Visit Website

Highlighted rows differ between the two products.

Commanders Act vs Friendly Analytics: Snapshot
Feature	Commanders Act	Friendly Analytics
Country of origin	France	Switzerland
Category	Web Analytics	Web Analytics
Open source	No	Yes
Self-hosted	No	Yes
Headquarters	France	Switzerland
Legal entity	Fjord Technologies SAS (trading name Commanders Act), SIREN 527 730 782, Paris	Friendly LLC (Friendly GmbH on DPA), Werkhofstrasse 5, 6052 Hergiswil, Switzerland
Governing law	Not listed	Swiss law (per customer principal agreement / DPA framework)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor: EU/France data centers for platform hosting; privacy policy: site data stored in EU. Public DNS: app/platform behind Cloudflare CDN. Hosting provider certs (ISO 27001, SOC 1/2, etc.) claimed on Security product sheet. Full customer-data subprocessor list not published on marketing site.	Analytics product: Infomaniak (CH) primary hosting; Netstream and Hosttech (CH) backups. AWS listed only for Friendly Automate email, not Analytics. Enterprise marketing also offers EU or on-premise hosting. Company ops: US SaaS including Google Workspace, HelpScout, Stripe, Notion, Calendly, Cloudflare (help docs).
Summary	French PlatformX MarTech suite from Fjord Technologies: enterprise server-side tag management, integrated consent, real-time CDP, and Adloop media attribution for multi-channel marketing teams.	Swiss Matomo-as-a-Service: cookieless-by-default web analytics with heatmaps, funnels, and ecommerce, product data hosted in Switzerland, plus enterprise DPA and on-prem options.
Tags	gdpr martech tag-management cdp server-side-tracking consent-management france first-party-data	gdpr analytics matomo privacy open-source switzerland nfadp enterprise self-hosted

At a glance: Commanders Act vs Friendly Analytics
At a glance	Commanders Act	Friendly Analytics
HQ	Paris, France (Fjord Technologies SAS)	Hergiswil, Switzerland
SIREN	527 730 782	Not listed
Founded	2010 (as TagCommander / Fjord Technologies)	Not listed
Deployment	Managed SaaS (not self-hosted)	Not listed
Core suite	TMS + CMP + CDP + Adloop	Not listed
Commercial model	Demo / enterprise quote (no public list price)	Hit-based SaaS; enterprise custom; no free trial
Legal entity	Not listed	Friendly LLC / Friendly GmbH
Stack	Not listed	Matomo (unmodified + premium plugins)
Product hosts	Not listed	Infomaniak; backups Netstream & Hosttech (CH)
Open source base	Not listed	Matomo; portable to other Matomo hosts

Key capabilities: Commanders Act vs Friendly Analytics
Key capabilities	Commanders Act	Friendly Analytics
EU-operated (FR)	Yes	Not listed
Server-side TMS	Yes	Not listed
Real-time CDP	Yes	Not listed
Integrated CMP	Yes	Not listed
Adloop attribution	Yes	Not listed
SaaS only	Yes	Not listed
Matomo-as-a-Service	Not listed	Yes
Cookieless by default	Not listed	Yes
Swiss product hosting	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
DPA available	Not listed	Yes
EU / on-prem option	Not listed	Yes

Commanders Act

Enterprise Tag Manager with server-side destinations and CAPIs
Collect first-party and omnichannel events, transform/enrich without code, and deliver to 1,200+ destinations including 100+ server-side paths and major CAPIs (Google, Meta, Amazon, TikTok, Snapchat per vendor). GTM-ready server-side integration supports hybrid Google Tag Manager workflows.
Integrated consent and privacy governance tooling
Native CMP/consent features (TrustCommander lineage) with Google Consent Mode support and Google CMP partner listing. Privacy monitoring, data-quality dashboards, filters before partner delivery, and cookie-related scanners help marketing ops control what leaves the property.
Real-time CDP: identity resolution, segments, activation
Unify profiles across sources (including CRM enrichment), build no-code audiences with many filter criteria, push dynamic segment updates into ad and personalization destinations, and support cross-device experience consistency under consent rules.
Adloop media optimization and data-driven attribution
After the 2023 Adloop acquisition, centralize campaign data via API connectors, run behaviour-based attribution as an independent measurement layer versus ad-platform KPIs, set spend/anomaly alerts, and use AI-assisted ad-level recommendations.
Operational QA for tagging teams
No-code QA tooling (live event inspector, debug mode), continuous data-quality monitoring, and role/IP-restricted platform access claims reduce reliance on pure developer debugging when tags and server-side pipelines change.

Friendly Analytics

Matomo-as-a-Service with privacy defaults
Runs unmodified Matomo plus selected premium plugins, preconfigured for cookieless tracking, IP truncation, and nFADP/GDPR-oriented defaults so teams avoid operating Matomo themselves while keeping exit paths to another Matomo host.
Heatmaps, funnels, session recording, and ecommerce
Beyond pageviews: heatmaps, privacy-oriented session replays, conversion funnels, form analytics, A/B tests, and ecommerce reporting for UX and revenue analysis without bolting on a separate US product suite.
Swiss product hosting with EU or on-prem options
Visitor analytics hosted with Infomaniak in Switzerland; backups via Netstream and Hosttech (CH). Enterprise can contract Swiss, EU, or on-premise placement—confirm region in the order form rather than assuming SaaS-only CH.
Ads conversion export without third-party pixels
Advertising Conversion Export sends conversions to Google or Bing via API so campaigns can be optimized without placing those vendors' tracking codes on your site—useful when privacy policy bans extra ad tags.
GA import, reporting API, and Matomo portability
Historical Google Analytics data can be imported (manual, effort-billed). Reporting API and live export links feed BI tools; data can move to another Matomo instance, limiting classic SaaS lock-in.
Enterprise contracts, SSO, and dedicated instances
Enterprise tier adds custom DPA/DORA/NDA/SLA paperwork, dedicated account management, SSO, custom domain, dedicated instance, and phone/video support for banks, insurers, and public bodies.

Assurance & compliance: Commanders Act vs Friendly Analytics
Assurance & compliance	Commanders Act	Friendly Analytics
Independent security / no-logs audit	Not applicable Not a no-logs VPN/analytics product; marketing data platform processes customer event/profile data by design.	Not found Vendor describes anonymization defaults and mentions external pen tests in ISO materials; no public independent no-logs audit report found.
Independent security / pentest program	Vendor claimed Security product sheet claims external pentests (black/grey box) every six months and customer audit rights; no public audit PDF reviewed.	Not listed
ISO 27001	Partial Security sheet attributes ISO 27001 (and related) compliance to the hosting provider in France; not verified as Commanders Act's own current certificate.	Vendor claimed Vendor publishes ISO/IEC 27001:2022 certification covering the company/products with a certificate PDF; not independently re-verified against the cert body registry in this draft.
SOC 2 / SOC 3	Partial Security sheet states hosting provider complies with SOC Type 1 and 2; not verified as vendor-owned SOC 2 report.	Not found No SOC 2/3 claim found on security/about pages reviewed.
GDPR / EU data protection	Vendor claimed French controller/processor entity; public privacy policy, named DPO, EU storage claim for site data, integrated consent tooling. Customer DPA terms not fully public on marketing pages.	Vendor claimed Swiss entity; public materials assert nFADP and GDPR alignment; cookieless defaults and CH processing described in DPA.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but Cloudflare CDN on public app/platform hostnames and incomplete public subprocessor list for customer data path. Not legal advice.	Partial Swiss entity, no known US parent; Analytics product hosts are Swiss (Infomaniak/Netstream/Hosttech). Medium/partial because company subprocessors include US SaaS (e.g. Google Workspace, HelpScout, Stripe, Cloudflare). AWS not used for Analytics per vendor list. Indicative only—not legal advice.
Data processing agreement (B2B)	Unknown Website privacy policy covers visitor/site processing; standard B2B DPA / Art. 28 package not located as a public self-serve download—request in procurement.	Vendor claimed Public DPA text for Friendly GmbH; customers asked to contact to sign. Enterprise also references DORA/NDA/SLA packs.
EU AI Act	Not applicable Includes AI-assisted ad recommendations; not assessed here as a high-risk AI system product category.	Not applicable Web analytics SaaS; not positioned as an AI system product.
ISO 9001	Not listed	Vendor claimed Vendor publishes ISO 9001 certification materials alongside ISO 27001.

Considerations & known limitations: Commanders Act vs Friendly Analytics
Considerations & known limitations	Commanders Act	Friendly Analytics
Limited public subprocessor inventory	Medium Marketing site does not publish a clear list of subprocessors for customer event/CDP data. Cloudflare is observable on public hostnames; backend host is described generically as a French data center. Request written subprocessors, regions, and SCCs before relying on 'EU-only' narratives.	Not listed
ISO/SOC claims tied to hosting provider	Medium Security sheet language credits the data-center provider for ISO 27001 and SOC Type 1/2. Do not treat footer logos as proof of Commanders Act's own certifications without certificate IDs.	Not listed
Enterprise SaaS scope and switching cost	Medium PlatformX spans TMS, CMP, CDP, and media optimization. Implementation (server-side migration, consent redesign, CAPI mapping) is non-trivial; not a drop-in free GTM replacement for all teams.	Not listed
No self-host option	Low Fully managed SaaS only. Organizations with hard on-prem or open-source requirements need different tools.	Not listed
US company-operation subprocessors	Not listed	Medium Support, email/calendar, payments, CRM/docs, and help-docs edge use US-headquartered SaaS even though Analytics visitor data hosts are Swiss. Material for DPIAs that demand zero US processors in any vendor process.
Cookie features can reintroduce consent needs	Not listed	Low Default is cookieless, but enabling cookie-based Matomo capabilities may require banners for EU visitors—configuration discipline required.
Small Swiss operator dependency	Not listed	Low Seven-person-scale Open Startup; mitigations include Matomo portability and open financial transparency, but capacity and roadmap still depend on a small firm.
Certifications vendor-published	Not listed	Low ISO 27001/9001 are claimed with PDFs on the vendor site; procurement should verify certificate validity with the issuing body.
Do not conflate with Friendly Automate	Not listed	Medium Automate uses AWS for email sending. Scope assessments to Analytics-only subprocessors unless you also buy Automate.

Fit

Commanders Act

Best fit when

Marketing ops teams replacing or complementing GTM with governed server-side destinations and CAPIs
Enterprises that want tag management, consent, CDP segments, and activation under one French SaaS contract
Performance teams needing independent multi-channel attribution and campaign data hub after Adloop
Organizations prioritizing an EU legal entity and EU data-center marketing claims for MarTech collection tooling
Teams that need no-code QA, data-quality monitoring, and consent-aware partner delivery controls

Poor fit when

Solo sites or SMBs that only need free/client-side GTM or lightweight privacy page analytics
Buyers requiring open-source or fully self-hosted tag/CDP infrastructure
Procurement that must prove vendor-owned ISO 27001/SOC 2 from public certificate registries before RFP (provider-level claims need clarification)
Use cases limited to pure product analytics without marketing destination/CAPI complexity

Consider instead when

When: You mainly need EU web analytics with lighter tag/consent tooling, not a full CDP + media stack
Consider: etracker
German analytics + tag/consent oriented stack; smaller surface than PlatformX
When: You want Swiss cookieless analytics plus server-side tagging/activation without a French enterprise CDP suite
Consider: fusedeck
Narrower product; different jurisdiction (CH)
When: You need free client-side tagging and Google-native defaults, and can accept US hyperscaler jurisdiction
Consider: Google Tag Manager (and Google marketing stack)
Often retained in hybrid with Commanders Act server-side
When: Self-host open analytics is a hard requirement
Consider: Matomo (self-host or EU Matomo hosting peers such as Friendly Analytics)
Not a CDP/CAPI replacement

Friendly Analytics

Best fit when

Teams that want Matomo's full feature set without self-hosting ops burden
Swiss and EU organizations prioritizing CH product residency (Infomaniak + CH backups)
Sites aiming for cookieless measurement under default privacy configuration
Marketing teams needing heatmaps, funnels, ecommerce, and ad conversion export without Google Analytics
Enterprises needing DPA/DORA/SLA paperwork, SSO, or dedicated instances

Poor fit when

Buyers who only need lightweight pageview analytics and prefer a free tier (see Plausible-class tools)
Teams that must self-operate every component with no SaaS operator in the path
Orgs that require zero US-headquartered tools anywhere in the vendor's company stack (support/billing SaaS is disclosed)
Use cases outside web/app analytics (Friendly Automate is a different product with different subprocessors)

Consider instead when

When: You want a minimal, open-source, cookieless counter with simpler SaaS UX
Consider: Plausible Analytics
Less Matomo plugin depth; different hosting/operator story (Estonia).
When: You need German enterprise analytics with long public-sector track record
Consider: etracker
Different stack (not Matomo); compare cookieless claims and contracts directly.
When: You prefer a modern EU analytics product with open-source core and lean UI
Consider: Pirsch Analytics
Germany-based; trade Matomo feature breadth for a different product surface.
When: You already run Matomo well and only need software, not a Swiss operator
Consider: Self-hosted Matomo
Maximum control; you own privacy config, updates, and hosting risk.

Open questions for due diligence

Commanders Act

Will Fjord Technologies provide a current Art. 28 DPA, subprocessor list, and data-flow diagram for PlatformX customer event data?
Which legal entity and cloud region process production customer data today, and are backups/DR in the same jurisdiction?
Does Commanders Act hold its own ISO 27001 or SOC 2 (certificate number/date), or only rely on hosting-provider attestations?
What is the minimum commercial package if the buyer only needs TMS + CMP versus full CDP + Adloop?
How are US ad-platform CAPIs and optional Google/Meta connections handled for transfer impact assessments?

Friendly Analytics

Will the signed DPA and order form pin hosting to Switzerland only, or allow EU/on-prem variants?
Which company subprocessors (HelpScout, Google Workspace, Stripe, etc.) receive which categories of customer personal data in practice?
Can the current ISO 27001 certificate be validated against the certification body's public register (scope, dates, sites)?
For enterprise: what is the RPO/RTO and whether backups remain exclusively in Switzerland?
If both Analytics and Automate are purchased, how are subprocessors and data paths segmented contractually?