Commanders Act vs Stormly

Compare Commanders Act and Stormly on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

Commanders Act

France· Web Analytics

Needs review

Shortlist when you need an EU-headquartered enterprise stack combining server-side tag management, consent, real-time CDP activation, and independent media attribution (Adloop). Skip when you only need lightweight privacy analytics or open-source self-hosting—consider etracker or fusedeck for narrower EU measurement/tagging scopes, or Matomo-class tools for self-host analytics.

EU-operated (FR)Server-side TMSReal-time CDPIntegrated CMPAdloop attributionSaaS only

View listing Visit Website

Stormly

Netherlands· Web Analytics

Needs review

Shortlist Stormly when you need Dutch-contracted, e-commerce-first product analytics: SKU-aware report packs, Shopify/Adobe-oriented setup, inbox-style AI anomaly narratives, and a public DPA. Skip when you need cookieless privacy web stats only (consider Plausible, Simple Analytics, or Pirsch), open-source self-hosting, verified ISO/SOC on a public cert page, or a subprocessor chain free of US-group cloud and Azure OpenAI.

E-commerce product analyticsSKU-aware reportsAI anomaly insightsShopify / Adobe CommerceNL entity + public DPASaaS (not self-host)

View listing Visit Website

Highlighted rows differ between the two products.

Commanders Act vs Stormly: Snapshot
Feature	Commanders Act	Stormly
Country of origin	France	Netherlands
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	France	Netherlands
Legal entity	Fjord Technologies SAS (trading name Commanders Act), SIREN 527 730 782, Paris	Monon B.V. (Lutmastraat 1-3, 1072 JL Amsterdam; KvK 76248747 per Terms)
Governing law	Not listed	Netherlands (Dutch law; Amsterdam courts)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Vendor: EU/France data centers for platform hosting; privacy policy: site data stored in EU. Public DNS: app/platform behind Cloudflare CDN. Hosting provider certs (ISO 27001, SOC 1/2, etc.) claimed on Security product sheet. Full customer-data subprocessor list not published on marketing site.	Client analytics subprocessors (Security Architecture): Hetzner (EU); Amazon AWS (US company, vendor states EU regions only for encrypted analytics backups); Vultr (US company); Microsoft Azure OpenAI (US company, vendor states EU Azure region). Plans market EU data residency. Controller privacy policy also references Vultr/AWS for account data, AuthSMTP EU + Amazon SES USA for email, Stripe for payments; marketing site uses Google Analytics and Hotjar.
Summary	French PlatformX MarTech suite from Fjord Technologies: enterprise server-side tag management, integrated consent, real-time CDP, and Adloop media attribution for multi-channel marketing teams.	Dutch SaaS product analytics for e-commerce teams: SKU-aware reports, AI-assisted anomaly and root-cause insights, and Shopify/Adobe Commerce/Segment/GTM-oriented connections under Monon B.V. (Amsterdam).
Tags	gdpr martech tag-management cdp server-side-tracking consent-management france first-party-data	gdpr analytics e-commerce product-analytics ai shopify

At a glance: Commanders Act vs Stormly
At a glance	Commanders Act	Stormly
HQ	Paris, France (Fjord Technologies SAS)	Not listed
SIREN	527 730 782	Not listed
Founded	2010 (as TagCommander / Fjord Technologies)	Not listed
Deployment	Managed SaaS (not self-hosted)	Not listed
Core suite	TMS + CMP + CDP + Adloop	Not listed
Commercial model	Demo / enterprise quote (no public list price)	Free tier + monthly plan + custom; trial path on paid
HQ / entity	Not listed	Monon B.V., Amsterdam, Netherlands
Category	Not listed	E-commerce product analytics (SaaS)
Hosting (public)	Not listed	Hetzner; AWS EU-region backups; Vultr; Azure OpenAI EU region (vendor docs)
Open source	Not listed	No
Self-host	Not listed	No
Governing law	Not listed	Dutch law; Amsterdam courts

Key capabilities: Commanders Act vs Stormly
Key capabilities	Commanders Act	Stormly
EU-operated (FR)	Yes	Not listed
Server-side TMS	Yes	Not listed
Real-time CDP	Yes	Not listed
Integrated CMP	Yes	Not listed
Adloop attribution	Yes	Not listed
SaaS only	Yes	Yes
E-commerce product analytics	Not listed	Yes
SKU-aware reports	Not listed	Yes
AI anomaly insights	Not listed	Yes
Shopify / Adobe Commerce	Not listed	Yes
NL entity + public DPA	Not listed	Yes

Commanders Act

Enterprise Tag Manager with server-side destinations and CAPIs
Collect first-party and omnichannel events, transform/enrich without code, and deliver to 1,200+ destinations including 100+ server-side paths and major CAPIs (Google, Meta, Amazon, TikTok, Snapchat per vendor). GTM-ready server-side integration supports hybrid Google Tag Manager workflows.
Integrated consent and privacy governance tooling
Native CMP/consent features (TrustCommander lineage) with Google Consent Mode support and Google CMP partner listing. Privacy monitoring, data-quality dashboards, filters before partner delivery, and cookie-related scanners help marketing ops control what leaves the property.
Real-time CDP: identity resolution, segments, activation
Unify profiles across sources (including CRM enrichment), build no-code audiences with many filter criteria, push dynamic segment updates into ad and personalization destinations, and support cross-device experience consistency under consent rules.
Adloop media optimization and data-driven attribution
After the 2023 Adloop acquisition, centralize campaign data via API connectors, run behaviour-based attribution as an independent measurement layer versus ad-platform KPIs, set spend/anomaly alerts, and use AI-assisted ad-level recommendations.
Operational QA for tagging teams
No-code QA tooling (live event inspector, debug mode), continuous data-quality monitoring, and role/IP-restricted platform access claims reduce reliance on pure developer debugging when tags and server-side pipelines change.

Stormly

AI agent for trends, anomalies, and root-cause style digs
Stormly positions an AI agent that watches connected e-commerce data for trends and anomalies (for example conversion drops or product spikes), then delivers plain-language findings—often to the inbox—with root-cause style exploration for questions like mobile conversion drops or regional return spikes. AI assistant access is plan-dependent; the public DPA documents Azure OpenAI (Microsoft) handling of assistant queries with a 30-day retention window and property stripping rules. Best for merchandising and growth leads who want narrative answers without waiting on a data team.
SKU-aware e-commerce report library (plus custom builds)
Ready reports target commerce questions: New Arrivals Performance (early SKU winners/laggards), Unviewed & Unsold Products, cart abandonment and revenue contribution by product/category, Conversion Journey and funnels by device/region, A/B test insights, Aha Moment Discovery, cross-selling analysis, and broader library items (retention, CLV, forecasting, SQL report, and more). Vendor materials state custom reports are included without a separate fee when a needed view is missing—useful for mid-market retailers that outgrow generic event charts.
Shopify, Adobe Commerce, Segment, and GTM-oriented connections
Homepage setup emphasizes linking Shopify, Adobe Commerce, or Segment quickly, with Google Tag Manager also listed among integrations. The DPA describes additional programmatic paths (JS library, import, custom endpoints, third-party sources). Fits stores already on common commerce stacks; teams on exotic storefronts should validate event coverage and product-feed depth in a pilot before replacing an existing analytics stack.
End-user tracking with IP anonymization defaults
Per the DPA, IP addresses for end-user analytics are not stored in full: the last octet is removed and geo/timezone are derived from the anonymized value. Web integrations automatically capture first-party cookie user ids, page/referrer/UTM context, and device metadata; app properties depend on client or CDP configuration. This is still full product analytics (not cookieless aggregate-only web stats)—clients remain responsible for consent banners and lawful basis for shopper tracking.
Public DPA, security architecture, and Dutch contracting
B2B buyers can download a Data Processing Agreement (effective 2023-09-06) and a Security Architecture page listing subprocessors, encryption expectations, backup retention (analytics backups up to six months), and logical tenant isolation. Contracts and DPA are governed by Dutch law with Amsterdam courts. Useful for EU procurement packages—but US-group subprocessors (AWS, Vultr, Azure OpenAI) still require transfer and CLOUD Act diligence.

Assurance & compliance: Commanders Act vs Stormly
Assurance & compliance	Commanders Act	Stormly
Independent security / no-logs audit	Not applicable Not a no-logs VPN/analytics product; marketing data platform processes customer event/profile data by design.	Not found Security Architecture describes encryption, monitoring, isolation, and vulnerability contact (security@stormly.com); no public third-party audit PDF found.
Independent security / pentest program	Vendor claimed Security product sheet claims external pentests (black/grey box) every six months and customer audit rights; no public audit PDF reviewed.	Not listed
ISO 27001	Partial Security sheet attributes ISO 27001 (and related) compliance to the hosting provider in France; not verified as Commanders Act's own current certificate.	Not found No public ISO 27001 certificate located on official legal/security pages reviewed.
SOC 2 / SOC 3	Partial Security sheet states hosting provider complies with SOC Type 1 and 2; not verified as vendor-owned SOC 2 report.	Not found No public SOC 2/3 report located on official pages reviewed.
GDPR / EU data protection	Vendor claimed French controller/processor entity; public privacy policy, named DPO, EU storage claim for site data, integrated consent tooling. Customer DPA terms not fully public on marketing pages.	Vendor claimed NL entity; public privacy policy and DPA (GDPR-oriented); IP last-octet anonymization for end-user analytics; SCCs language for restricted transfers in DPA.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but Cloudflare CDN on public app/platform hostnames and incomplete public subprocessor list for customer data path. Not legal advice.	Partial EU entity / no known US parent, but public client subprocessors include AWS, Vultr, and Microsoft Azure OpenAI (US-group companies). Account path historically also lists Amazon SES and Stripe. Residency claims do not remove US-group legal exposure. Indicative only—not legal advice.
Data processing agreement (B2B)	Unknown Website privacy policy covers visitor/site processing; standard B2B DPA / Art. 28 package not located as a public self-serve download—request in procurement.	Vendor claimed Downloadable DPA PDF linked from stormly.com/dpa (effective 6 September 2023); audit rights and subprocessor notice described; Security Architecture lists subprocessors.
EU AI Act	Not applicable Includes AI-assisted ad recommendations; not assessed here as a high-risk AI system product category.	Partial Product includes an AI assistant via Azure OpenAI; not positioned as a high-risk AI system marketing claim. Buyers should map AI assistant use to their own AI Act / internal AI policy—vendor does not publish a full AI Act conformity package on the pages reviewed.

Considerations & known limitations: Commanders Act vs Stormly
Considerations & known limitations	Commanders Act	Stormly
Limited public subprocessor inventory	Medium Marketing site does not publish a clear list of subprocessors for customer event/CDP data. Cloudflare is observable on public hostnames; backend host is described generically as a French data center. Request written subprocessors, regions, and SCCs before relying on 'EU-only' narratives.	Not listed
ISO/SOC claims tied to hosting provider	Medium Security sheet language credits the data-center provider for ISO 27001 and SOC Type 1/2. Do not treat footer logos as proof of Commanders Act's own certifications without certificate IDs.	Not listed
Enterprise SaaS scope and switching cost	Medium PlatformX spans TMS, CMP, CDP, and media optimization. Implementation (server-side migration, consent redesign, CAPI mapping) is non-trivial; not a drop-in free GTM replacement for all teams.	Not listed
No self-host option	Low Fully managed SaaS only. Organizations with hard on-prem or open-source requirements need different tools.	Not listed
US-group cloud and AI subprocessors	Not listed	Medium Despite Dutch HQ and EU residency marketing, client data paths publicly include AWS, Vultr, and Microsoft Azure OpenAI. Transfer tooling (SCCs) and encryption of backups are documented, but CLOUD Act / US legal process risk remains a diligence item for sovereignty-sensitive buyers.
No public ISO/SOC or independent audit	Not listed	Medium Enterprise security questionnaires may stall without ISO 27001/SOC 2 packs. DPA offers information/audit rights—plan time for NDA evidence requests.
Azure OpenAI retains assistant context 30 days	Not listed	Medium AI queries and aggregate report results are stored on Microsoft Azure OpenAI for 30 days per DPA. Property stripping reduces some identifiers, but misconfigured event properties could still expose sensitive content—govern AI use and property hygiene.
Controller privacy policy vs security architecture drift	Not listed	Low Privacy policy (controller, effective 2019) still emphasizes Vultr USA wording in places, while Security Architecture (client data) lists Hetzner/AWS/Vultr/Azure. Ask for a single current subprocessor and region matrix at contract time.
Not a privacy web-analytics substitute	Not listed	Low Full product analytics with cookies/identifiers for web integrations—not a cookieless aggregate counter. Consent UX remains on the client.

Fit

Commanders Act

Best fit when

Marketing ops teams replacing or complementing GTM with governed server-side destinations and CAPIs
Enterprises that want tag management, consent, CDP segments, and activation under one French SaaS contract
Performance teams needing independent multi-channel attribution and campaign data hub after Adloop
Organizations prioritizing an EU legal entity and EU data-center marketing claims for MarTech collection tooling
Teams that need no-code QA, data-quality monitoring, and consent-aware partner delivery controls

Poor fit when

Solo sites or SMBs that only need free/client-side GTM or lightweight privacy page analytics
Buyers requiring open-source or fully self-hosted tag/CDP infrastructure
Procurement that must prove vendor-owned ISO 27001/SOC 2 from public certificate registries before RFP (provider-level claims need clarification)
Use cases limited to pure product analytics without marketing destination/CAPI complexity

Consider instead when

When: You mainly need EU web analytics with lighter tag/consent tooling, not a full CDP + media stack
Consider: etracker
German analytics + tag/consent oriented stack; smaller surface than PlatformX
When: You want Swiss cookieless analytics plus server-side tagging/activation without a French enterprise CDP suite
Consider: fusedeck
Narrower product; different jurisdiction (CH)
When: You need free client-side tagging and Google-native defaults, and can accept US hyperscaler jurisdiction
Consider: Google Tag Manager (and Google marketing stack)
Often retained in hybrid with Commanders Act server-side
When: Self-host open analytics is a hard requirement
Consider: Matomo (self-host or EU Matomo hosting peers such as Friendly Analytics)
Not a CDP/CAPI replacement

Stormly

Best fit when

Merchandising, product, UX, and growth teams on Shopify or Adobe Commerce who need SKU, cart, and assortment analytics without a dedicated data science org
Retail brands that want ready e-commerce report templates (new arrivals, unviewed/unsold, funnels, A/B, aha moments) plus vendor-built custom reports
EU buyers who want a Dutch legal entity, Amsterdam courts, and a downloadable DPA/Security Architecture package
Teams that value AI-generated trend/anomaly narratives delivered to the inbox more than building every chart from a blank event schema
Stacks already using Segment or Google Tag Manager as the event pipe into analytics

Poor fit when

Publishers or marketing sites that only need lightweight privacy-friendly page analytics (not product/SKU depth)
Orgs that require open-source self-hosting or full control of a private analytics warehouse as the default
Procurement policies that forbid US-group subprocessors (AWS, Vultr, Microsoft Azure OpenAI) even when EU regions are claimed
Assurance programs that require public ISO 27001/SOC 2 evidence before pilot (not found on vendor pages reviewed)
Companies operating blockchain products/services—restricted by Stormly’s terms

Consider instead when

When: You only need privacy-oriented website metrics (pageviews, sources) rather than SKU-level product analytics
Consider: Plausible Analytics, Simple Analytics, or Pirsch Analytics
EU web-analytics peers; different category from e-commerce product analytics
When: You need deep general-purpose product analytics, large ecosystem, and mature multi-product SaaS event modeling
Consider: Mixpanel or Amplitude
US incumbents; stronger breadth, different jurisdiction and commercial model
When: You primarily need free/universal marketing acquisition reporting already embedded in the stack
Consider: Google Analytics (incumbent) or dual-run GA for marketing + Stormly for product/merch
GA is not SKU-first product analytics; Stormly is not a GA replacement for every report

Open questions for due diligence

Commanders Act

Will Fjord Technologies provide a current Art. 28 DPA, subprocessor list, and data-flow diagram for PlatformX customer event data?
Which legal entity and cloud region process production customer data today, and are backups/DR in the same jurisdiction?
Does Commanders Act hold its own ISO 27001 or SOC 2 (certificate number/date), or only rely on hosting-provider attestations?
What is the minimum commercial package if the buyer only needs TMS + CMP versus full CDP + Adloop?
How are US ad-platform CAPIs and optional Google/Meta connections handled for transfer impact assessments?

Stormly

Can Stormly provide a current region map (which data classes live on Hetzner vs Vultr vs AWS) under NDA for our DPIA?
Are ISO 27001, SOC 2, or penetration-test summaries available on request for enterprise security review?
Which event properties from our Shopify/Adobe feed are excluded from Azure OpenAI prompts by default in our tenant?
Do custom report builds and SQL access sit only on the custom tier, and what SLAs apply?
Has the 2019 controller privacy policy been superseded for hosting wording relative to the Security Architecture list?