Commanders Act vs nilly

Compare Commanders Act and nilly on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Adobe Analytics, Google Analytics

Commanders Act

France· Web Analytics

Needs review

Shortlist when you need an EU-headquartered enterprise stack combining server-side tag management, consent, real-time CDP activation, and independent media attribution (Adloop). Skip when you only need lightweight privacy analytics or open-source self-hosting—consider etracker or fusedeck for narrower EU measurement/tagging scopes, or Matomo-class tools for self-host analytics.

EU-operated (FR)Server-side TMSReal-time CDPIntegrated CMPAdloop attributionSaaS only

View listing Visit Website

nilly

Switzerland· Web Analytics

Needs review

Shortlist nilly when you want Swiss-entity, cookieless, ultra-light site analytics with realtime dashboards, city geo, custom events, unlimited sites, and an API—without GA4 consent weight. Skip when you need self-host/open source, enterprise audit packs, or deep marketing-suite analytics; consider Plausible Analytics, Simple Analytics, or etracker instead.

Cookieless trackingSwiss-hosted (claimed)Swiss entitySub-1 kB scriptREST APISaaS only

View listing Visit Website

Highlighted rows differ between the two products.

Commanders Act vs nilly: Snapshot
Feature	Commanders Act	nilly
Country of origin	France	Switzerland
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	France	Switzerland
Legal entity	Fjord Technologies SAS (trading name Commanders Act), SIREN 527 730 782, Paris	Lyo GmbH, Europaallee 41, 8004 Zürich (CHE-417.675.763)
Governing law	Not listed	Switzerland (terms)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor: EU/France data centers for platform hosting; privacy policy: site data stored in EU. Public DNS: app/platform behind Cloudflare CDN. Hosting provider certs (ISO 27001, SOC 1/2, etc.) claimed on Security product sheet. Full customer-data subprocessor list not published on marketing site.	Vendor FAQ: analytics servers in Switzerland (multiple locations). Public site reverse-DNS: KreativMedia/METANET Zürich. Customer-account subprocessors named in privacy policy: Stripe (US payments), Mailerlite (email). Avatars via Gravatar. No full public subprocessor list for backups/monitoring/CDN.
Summary	French PlatformX MarTech suite from Fjord Technologies: enterprise server-side tag management, integrated consent, real-time CDP, and Adloop media attribution for multi-channel marketing teams.	Swiss privacy-first web analytics (Lyo GmbH): cookieless, sub-1kB tracking with realtime dashboards, city-level geo, custom events, unlimited sites, and a REST API as a lightweight Google Analytics alternative.
Tags	gdpr martech tag-management cdp server-side-tracking consent-management france first-party-data	gdpr analytics privacy cookie-free swiss saas api

At a glance: Commanders Act vs nilly
At a glance	Commanders Act	nilly
HQ	Paris, France (Fjord Technologies SAS)	Zürich, Switzerland (Lyo GmbH)
SIREN	527 730 782	Not listed
Founded	2010 (as TagCommander / Fjord Technologies)	Not listed
Deployment	Managed SaaS (not self-hosted)	Not listed
Core suite	TMS + CMP + CDP + Adloop	Not listed
Commercial model	Demo / enterprise quote (no public list price)	Traffic-based plans; trial; no permanent free tier
Legal entity	Not listed	Lyo GmbH (CHE-417.675.763)
Product model	Not listed	SaaS web analytics (not self-hosted)
Tracking	Not listed	Cookieless; no IP/fingerprint claims
Hosting (claimed)	Not listed	Switzerland (multi-site)
Live site note	Not listed	kandur.one (nilly branding; nilly.io DNS failed at research)

Key capabilities: Commanders Act vs nilly
Key capabilities	Commanders Act	nilly
EU-operated (FR)	Yes	Not listed
Server-side TMS	Yes	Not listed
Real-time CDP	Yes	Not listed
Integrated CMP	Yes	Not listed
Adloop attribution	Yes	Not listed
SaaS only	Yes	Yes
Cookieless tracking	Not listed	Yes
Swiss-hosted (claimed)	Not listed	Yes
Swiss entity	Not listed	Yes
Sub-1 kB script	Not listed	Yes
REST API	Not listed	Yes

Commanders Act

Enterprise Tag Manager with server-side destinations and CAPIs
Collect first-party and omnichannel events, transform/enrich without code, and deliver to 1,200+ destinations including 100+ server-side paths and major CAPIs (Google, Meta, Amazon, TikTok, Snapchat per vendor). GTM-ready server-side integration supports hybrid Google Tag Manager workflows.
Integrated consent and privacy governance tooling
Native CMP/consent features (TrustCommander lineage) with Google Consent Mode support and Google CMP partner listing. Privacy monitoring, data-quality dashboards, filters before partner delivery, and cookie-related scanners help marketing ops control what leaves the property.
Real-time CDP: identity resolution, segments, activation
Unify profiles across sources (including CRM enrichment), build no-code audiences with many filter criteria, push dynamic segment updates into ad and personalization destinations, and support cross-device experience consistency under consent rules.
Adloop media optimization and data-driven attribution
After the 2023 Adloop acquisition, centralize campaign data via API connectors, run behaviour-based attribution as an independent measurement layer versus ad-platform KPIs, set spend/anomaly alerts, and use AI-assisted ad-level recommendations.
Operational QA for tagging teams
No-code QA tooling (live event inspector, debug mode), continuous data-quality monitoring, and role/IP-restricted platform access claims reduce reliance on pure developer debugging when tags and server-side pipelines change.

nilly

Sub-1 kB cookieless tracking script
Vendor documents a client script under 1 kB with no cookies, no IP tracking, and no fingerprinting for site visitors. Suited to teams that want aggregate traffic metrics without analytics cookie banners; still get counsel for your jurisdiction and CMP setup.
Realtime dashboard with geo, tech, and campaigns
Dashboards cover live visitors, overview metrics, top pages, referrers, UTM campaigns, geography from continent to city, and device/browser/OS breakdowns—enough for content and acquisition decisions without a full product-analytics suite.
Custom events, CSV export, and email reports
Define custom events for conversion-style actions, export statistics as CSV, and receive email reports. Fits operators who need lightweight conversion signals and offline analysis rather than session replay or multi-step funnels.
REST API for stats, websites, and account
Documented API endpoints (Bearer API key) manage stats queries (pageviews, visitors, referrers, events, geo, devices, and more), websites, and account objects—useful for internal dashboards or automations on traffic-based plans that include API access.
Unlimited websites on traffic-based plans
Public pricing model is pageview-tier SaaS with unlimited websites per account and a short free trial—not a permanent free tier. Good for agencies or multi-brand operators who outgrow per-site free plans elsewhere; confirm current tiers on the vendor site.

Assurance & compliance: Commanders Act vs nilly
Assurance & compliance	Commanders Act	nilly
Independent security / no-logs audit	Not applicable Not a no-logs VPN/analytics product; marketing data platform processes customer event/profile data by design.	Not found No public third-party audit report found for tracking claims.
Independent security / pentest program	Vendor claimed Security product sheet claims external pentests (black/grey box) every six months and customer audit rights; no public audit PDF reviewed.	Not listed
ISO 27001	Partial Security sheet attributes ISO 27001 (and related) compliance to the hosting provider in France; not verified as Commanders Act's own current certificate.	Not found No vendor ISO 27001 certificate published on product site (underlying Swiss host DCs may be certified separately).
SOC 2 / SOC 3	Partial Security sheet states hosting provider complies with SOC Type 1 and 2; not verified as vendor-owned SOC 2 report.	Not found
GDPR / EU data protection	Vendor claimed French controller/processor entity; public privacy policy, named DPO, EU storage claim for site data, integrated consent tooling. Customer DPA terms not fully public on marketing pages.	Vendor claimed Swiss entity; privacy policy includes GDPR rights language; cookieless visitor tracking claimed. Confirm DPA for B2B.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but Cloudflare CDN on public app/platform hostnames and incomplete public subprocessor list for customer data path. Not legal advice.	Partial Swiss operator, no known US parent, Swiss-claimed analytics hosting; US SaaS subprocessors Stripe (payments) and Gravatar (avatars) on customer path. Not legal advice.
Data processing agreement (B2B)	Unknown Website privacy policy covers visitor/site processing; standard B2B DPA / Art. 28 package not located as a public self-serve download—request in procurement.	Not found No public DPA download found; request from vendor.
EU AI Act	Not applicable Includes AI-assisted ad recommendations; not assessed here as a high-risk AI system product category.	Not applicable Web analytics product; not marketed as an AI system.
Swiss Made Software / Swiss Web labels	Not listed	Vendor claimed Cited on About and Swiss Union member page as recognition/labels—not a security audit.

Considerations & known limitations: Commanders Act vs nilly
Considerations & known limitations	Commanders Act	nilly
Limited public subprocessor inventory	Medium Marketing site does not publish a clear list of subprocessors for customer event/CDP data. Cloudflare is observable on public hostnames; backend host is described generically as a French data center. Request written subprocessors, regions, and SCCs before relying on 'EU-only' narratives.	Not listed
ISO/SOC claims tied to hosting provider	Medium Security sheet language credits the data-center provider for ISO 27001 and SOC Type 1/2. Do not treat footer logos as proof of Commanders Act's own certifications without certificate IDs.	Not listed
Enterprise SaaS scope and switching cost	Medium PlatformX spans TMS, CMP, CDP, and media optimization. Implementation (server-side migration, consent redesign, CAPI mapping) is non-trivial; not a drop-in free GTM replacement for all teams.	Not listed
No self-host option	Low Fully managed SaaS only. Organizations with hard on-prem or open-source requirements need different tools.	Not listed
Brand/domain transition (nilly.io vs kandur.one)	Not listed	Medium Product still branded nilly, but the live marketing/API host is kandur.one; nilly.io did not resolve in DNS during research. Verify tracking domains, docs, and status before production cutover.
US SaaS on customer account path	Not listed	Medium Stripe (payments) and Gravatar (avatars) are US-group services. Visitor metrics are claimed Swiss-hosted and non-personal, but account/billing data is not Switzerland-only end-to-end.
Thin public assurance pack	Not listed	Medium No public ISO 27001/SOC 2, independent security audit, or DPA page found. Fine for many SMB shortlists; friction for regulated enterprise questionnaires.
No self-host or open-source edition	Not listed	Low Cannot run on your own infra or audit server code from a public repo. Hard limit for sovereignty programs that require self-host.
Small independent operator	Not listed	Low Founder-owned Swiss GmbH without VC narrative—positive for independence, but buyers should assess support SLAs, roadmap continuity, and single-vendor concentration.

Fit

Commanders Act

Best fit when

Marketing ops teams replacing or complementing GTM with governed server-side destinations and CAPIs
Enterprises that want tag management, consent, CDP segments, and activation under one French SaaS contract
Performance teams needing independent multi-channel attribution and campaign data hub after Adloop
Organizations prioritizing an EU legal entity and EU data-center marketing claims for MarTech collection tooling
Teams that need no-code QA, data-quality monitoring, and consent-aware partner delivery controls

Poor fit when

Solo sites or SMBs that only need free/client-side GTM or lightweight privacy page analytics
Buyers requiring open-source or fully self-hosted tag/CDP infrastructure
Procurement that must prove vendor-owned ISO 27001/SOC 2 from public certificate registries before RFP (provider-level claims need clarification)
Use cases limited to pure product analytics without marketing destination/CAPI complexity

Consider instead when

When: You mainly need EU web analytics with lighter tag/consent tooling, not a full CDP + media stack
Consider: etracker
German analytics + tag/consent oriented stack; smaller surface than PlatformX
When: You want Swiss cookieless analytics plus server-side tagging/activation without a French enterprise CDP suite
Consider: fusedeck
Narrower product; different jurisdiction (CH)
When: You need free client-side tagging and Google-native defaults, and can accept US hyperscaler jurisdiction
Consider: Google Tag Manager (and Google marketing stack)
Often retained in hybrid with Commanders Act server-side
When: Self-host open analytics is a hard requirement
Consider: Matomo (self-host or EU Matomo hosting peers such as Friendly Analytics)
Not a CDP/CAPI replacement

nilly

Best fit when

Privacy-conscious SMBs and indie sites replacing GA4 with aggregate metrics only
Teams that want Swiss legal entity and Swiss-located analytics servers
Operators running many sites who benefit from unlimited websites on traffic tiers
Builders who need a simple REST API for pageviews, referrers, geo, and events
Sites prioritizing minimal JS weight and fewer analytics consent prompts

Poor fit when

Organizations that must self-host or review open-source analytics code
Buyers needing published ISO 27001/SOC 2 or a full public DPA/subprocessor pack
Marketing teams requiring session replay, heatmaps, or advanced e-commerce/ad sync suites
Enterprises that need SSO/SCIM, formal SLAs, and large-vendor assurance paperwork as table stakes

Consider instead when

When: You want open-source and/or self-host privacy analytics with a larger community
Consider: Plausible Analytics or Pirsch Analytics
nilly is proprietary SaaS only.
When: You want another European cookieless SaaS with a simple product story
Consider: Simple Analytics
Dutch peer; compare geo depth, API, and residency claims side by side.
When: You need deeper marketing, shop, and tag/consent analytics for EU enterprises
Consider: etracker
German suite-oriented alternative; heavier than nilly's lightweight dashboard.
When: You depend on free unlimited scale and Google ads/ecosystem integration
Consider: Google Analytics (GA4)
Different privacy and residency tradeoffs; not a sovereignty shortlist.

Open questions for due diligence

Commanders Act

Will Fjord Technologies provide a current Art. 28 DPA, subprocessor list, and data-flow diagram for PlatformX customer event data?
Which legal entity and cloud region process production customer data today, and are backups/DR in the same jurisdiction?
Does Commanders Act hold its own ISO 27001 or SOC 2 (certificate number/date), or only rely on hosting-provider attestations?
What is the minimum commercial package if the buyer only needs TMS + CMP versus full CDP + Adloop?
How are US ad-platform CAPIs and optional Google/Meta connections handled for transfer impact assessments?

nilly

Will Lyo GmbH sign a B2B DPA and provide a current full subprocessor list (including backups, monitoring, CDN)?
Is analytics data retained only on Swiss hosts, or are any DR/replicas outside Switzerland?
What is the durable public domain for tracking scripts and API (kandur.one vs nilly.io) for the next 12 months?
Are there enterprise features (SSO, roles, retention controls, MSA/SLA) beyond self-serve traffic plans?
Can the vendor provide any independent security assessment under NDA?