Contentsquare vs etracker

Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).

ePrivacyseal materials and vendor pages describe independent ePrivacy Consult audit of consent-free cookieless analytics posture; not a full public penetration-test report. Vendor also claims regular infrastructure pen tests.

Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.

IPHH housing described as ISO/IEC 27001:2013-certified. No public organisation-level ISO 27001 certificate for etracker/JustRelate analytics found in materials reviewed.

Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.

Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.

No public SOC 2/SOC 3 report located on official trust/security pages reviewed.

French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.

EU/DE controller-processor setup; cookieless default under legitimate interest; Art. 28 DPA on registration; privacy notice + objection patterns documented.

EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.

EuropeanStack assessment: German entity, no known US parent, own-server housing at IPHH (no public AWS/GCP/Azure analytics store) → core exposure low. Partial because optional conversion sync and Google connectors can send data to US-group destinations when enabled by the customer. Not legal advice.

Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.

Vendor states DPA/AV concludes on account registration; public DPA PDFs and in-app DPA under Settings → Data processing agreement.

Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.

Product is web/marketing analytics, not an AI-system offering as primary positioning.

DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.

Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).

Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.

Vendor and ePrivacy listing materials assert seal for consent-free cookieless mode under GDPR/TDDDG. Scope is privacy/consent posture, not a general security cert.

Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.

Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.

Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.

Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.

ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.

ePrivacyseal and vendor guidance support cookieless default under TDDDG/GDPR, but hybrid cookies, marketing tags, and non-German supervisory interpretations can change the picture. Operators remain responsible for DPIA and notices.

Core storage is claimed German; enabling Google/Meta/TikTok/Microsoft conversion upload or Looker Studio connectors creates additional processing at those destinations. Map each integration in your transfer assessment.

No public SOC 2 or org-level ISO 27001 package found; IPHH housing ISO and ePrivacyseal are the main published assurance artefacts. May slow enterprise security questionnaires.

No self-host path. Exit requires export/API planning; multi-year usage contracts are common in this category—confirm terms on the vendor site.

Housing (IPHH) is named; a full live subprocessor schedule (support tooling, email, etc.) was not found as a single public table. Request under NDA/procurement if required.