Contentsquare vs Mouseflow

Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).

Vendor claims third-party penetration/vulnerability tests and offers a Security Kit; no public independent no-logs audit report found for download without request.

Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.

Vendor states data centers maintain ISO 27001; request Security Kit for certificate scope—not independently re-verified against a public registry in this draft.

Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.

Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.

Privacy page mentions SOC 2 Type II-certified infrastructure; compliance/About emphasize SOC 1 Type II for data centers; FAQ prefers SOC 1 as internal standard. Confirm report type/scope via Security Kit.

French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.

Danish entity; public GDPR page, DPA, IP masking, EU residency option, SCCs/DPF transfer language. Customer remains responsible for consent and PII exclusion from HTML.

EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.

Danish entity, no known US parent; session data on Google Cloud (Belgium/Iowa) and US affiliate Mouseflow, Inc. may process Customer Data. EU residency does not eliminate US-group cloud risk. Indicative only—not legal advice.

Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.

Public DPA at mouseflow.com/legal/data-processing-agreement/ with electronic signature; SCCs and DPF language included.

Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.

Behavior analytics SaaS with optional AI assistants (Mina, MCP); not positioned as a high-risk AI system product for this checklist.

DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.

Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).

Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.

Vendor states data centers maintain PCI DSS compliance; not a substitute for customer PCI scope on payment pages—mask card fields.

Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.

Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.

Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.

Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.

ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.

Even EU-region (Belgium) storage uses Google Cloud EMEA Limited. Material for DPIAs that treat any US-group cloud as in scope for CLOUD Act/transfer analysis.

Mouseflow, Inc. (Texas) is listed for consulting, support, maintenance, implementation, and development on Customer Data—not only a marketing office.

Defaults mask IPs/keystrokes/sensitive fields, but customers must audit DOM/HTML, forms, and custom variables; incidental PII is a shared-responsibility risk in this category.

Public materials emphasize infrastructure certifications; SOC 1 vs SOC 2 wording differs across pages—verify current reports rather than assuming org-wide SOC 2.

Closed multi-tenant SaaS only; no official on-prem path if residency or operator control requirements demand it.