Contentsquare vs Swetrix

Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).

Searched marketing, DPA, privacy, and data policy; no public independent audit PDF located. Open-source code is available for review.

Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.

No public ISO 27001 certification claim found on primary pages.

Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.

Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.

No public SOC 2/3 report found.

French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.

UK company; public GDPR/PECR discussion in Data Policy; cookieless design with non-stored IPs for standard analytics; Hetzner DE hosting; public DPA. Optional replays may be personal data depending on configuration—customer assesses legal basis.

EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.

No known US parent; primary analytics on Hetzner DE. Material exception: Sentry (US) processes End User error data per DPA; Privacy Policy also lists AWS and OpenRouter (US) for customer email/AI. Indicative medium exposure—not a clean bill. Not legal advice.

Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.

Public DPA at swetrix.com/dpa incorporated by Terms; acceptance by use of Service; signed copy on request.

Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.

Core product is web analytics, not an AI system. Optional Ask AI / OpenRouter is ancillary; confirm if your deployment enables it.

DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.

Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).

Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.

Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.

Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.

Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.

Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.

ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.

Primary analytics hosting is Hetzner DE, but Sentry (US) is an End User error-tracking sub-processor on the DPA, and AWS/OpenRouter appear for customer email/AI. Orgs with strict no-US-cloud rules need explicit acceptance or self-host CE to avoid those paths.

Cloud replays can capture DOM and inputs unless masked. Customers must enable startSessionReplay(), configure privacy modes/exclusions, and provide notices/consent where required—misconfiguration can reintroduce personal data risk that standard cookieless pageviews avoid.

Assurance relies on first-party policies, Hetzner infrastructure claims, and open source. Enterprise questionnaires that hard-gate on certs will stall until materials are provided under NDA or produced.

Self-host CE is free and covers core analytics, but replays and several Cloud growth/ops features are limited or Cloud-only. Budget and feature planning must not assume feature parity.

Cookieless design deliberately prevents classic multi-day visitor retention. Teams that need that metric class need another product or consented identity.