Commanders Act vs Hotjar

Not a no-logs VPN/analytics product; marketing data platform processes customer event/profile data by design.

Vendor claims annual external penetration tests and publishes a Trust Portal with pentest reports behind access. No public independent no-logs audit (this is a recorder, not a no-logs VPN).

Security product sheet claims external pentests (black/grey box) every six months and customer audit rights; no public audit PDF reviewed.

Security sheet attributes ISO 27001 (and related) compliance to the hosting provider in France; not verified as Commanders Act's own current certificate.

Contentsquare states it is ISO 27001 certified (also claims ISO 27017, 27018, 27701). Certificates are on the Trust Portal; not independently downloaded for this draft.

Security sheet states hosting provider complies with SOC Type 1 and 2; not verified as vendor-owned SOC 2 report.

Trust portal and security pages claim a SOC 2 Type II report. Report not independently downloaded.

French controller/processor entity; public privacy policy, named DPO, EU storage claim for site data, integrated consent tooling. Customer DPA terms not fully public on marketing pages.

EU parent and contracting entity for non-Americas Hotjar Services. Public DPA, SCCs, and GDPR language. Customer is controller and must supply a lawful basis for visitor capture.

EU entity / no known US parent, but Cloudflare CDN on public app/platform hostnames and incomplete public subprocessor list for customer data path. Not legal advice.

Assessment, not a vendor slogan. French parent and no known US parent, but AWS and Azure host visitor data, Content Square, Inc. and Zendesk process support data, and US regions exist. Not legal advice.

Website privacy policy covers visitor/site processing; standard B2B DPA / Art. 28 package not located as a public self-serve download—request in procurement.

Public Contentsquare DPA incorporated by the MSA. Execution of the MSA or an order form is treated as execution of the DPA and SCCs.

Includes AI-assisted ad recommendations; not assessed here as a high-risk AI system product category.

Core product is analytics and replay, not an AI system sold as such. Sense AI and survey LLMs exist as optional features. Confirm AI Act role if you enable those modules.

Security page displays a STAR badge. Scope and level not independently verified.

Marketing site does not publish a clear list of subprocessors for customer event/CDP data. Cloudflare is observable on public hostnames; backend host is described generically as a French data center. Request written subprocessors, regions, and SCCs before relying on 'EU-only' narratives.

Security sheet language credits the data-center provider for ISO 27001 and SOC Type 1/2. Do not treat footer logos as proof of Commanders Act's own certifications without certificate IDs.

PlatformX spans TMS, CMP, CDP, and media optimization. Implementation (server-side migration, consent redesign, CAPI mapping) is non-trivial; not a drop-in free GTM replacement for all teams.

Fully managed SaaS only. Organizations with hard on-prem or open-source requirements need different tools.

Acquired in 2021 and described as merged into Contentsquare on 1 July 2025. New contracts are Contentsquare entities. A scheduled DXA transition from 18 August 2026 can move data and retire the old UI unless you elect to stay. Practical impact: vendor risk, product roadmap, and DPA counterparty are the French group, not Hotjar Ltd.

Visitor data sits on AWS and Azure. Zendesk (USA) and Content Square, Inc. handle support. US regions are default for some geographies. Practical impact: an Ireland region does not remove US-group infrastructure from a CLOUD Act discussion.

The vendor asks customers to block non-permitted personal data and claims card masking. Misconfigured tags still record inputs or on-screen PII. Practical impact: you need a suppressions review and a consent story before go-live.

No official self-hosted or open-source edition. Practical impact: skip this product if residency rules require your own servers.

Sense AI and survey AI use AWS Bedrock and Azure OpenAI. Practical impact: disable those features or map their regions if procurement treats LLMs as a separate transfer.