Contentsquare vs SEAL Metrics

Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).

Vendor mentions regular security audits and independent legal audits; no public third-party audit PDF found on site/docs.

Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.

Data location docs list ISO 27001 as planned, not certified.

Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.

Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.

Vendor docs list SOC 2 Type II as in progress — not a completed public report.

French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.

Spanish entity; cookieless architecture; EEA processing claims; DPA published. Legal conclusion remains for counsel.

EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.

EU entity / no known US parent; analytics at rest in Dublin. Cloudflare (US group) processes TLS transit at EU edge. Not legal advice.

Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.

Public DPA page; vendor states standard DPA with every plan, custom on Enterprise.

Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.

Core product is measurement analytics; optional LENS private AI is a feature—confirm classification if heavily relied on for automated decisions.

DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.

Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).

Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.

Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.

Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.

Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.

Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.

ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.

Even with Dublin storage, Cloudflare sits on encrypted traffic. Procurement that bans any US-group vendor in the path will need a written exception or alternative edge posture.

SOC 2 in progress and ISO planned per vendor docs. Enterprise security questionnaires may block until reports are available under NDA.

Vendor argues no personal data / no cookies so analytics need no banner. Other scripts on the same site and national guidance still matter—get DPO sign-off.

No self-host path. Mitigate with API/BigQuery export and dual-running with GA4 during evaluation.

Docs say EU data center in Dublin without naming the cloud or colo operator. Ask for the concrete provider in the TPSR pack.