Contentsquare vs Tinylytics

Compare Contentsquare and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics, Microsoft Clarity

Contentsquare

France· Web Analytics

Needs review

Shortlist Contentsquare when a European-headquartered enterprise needs zone heatmaps, replay, journeys, and error-to-revenue analysis in one SaaS, with a public DPA and selectable Ireland hosting. Skip when you cannot accept AWS or Azure (US-group cloud), session replay of visitor pages, or a sales-led Pro and Enterprise stack. Consider Mouseflow for a smaller European heatmap and replay tool, or Plausible / Friendly Analytics when you only need privacy-first traffic analytics.

EU-operated (FR SAS)Zone heatmapsSession replayPublic DPAEU or US cloud regionISO 27001 (claimed)

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

Contentsquare vs Tinylytics: Snapshot
Feature	Contentsquare	Tinylytics
Country of origin	France	United Kingdom
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	France	United Kingdom
Legal entity	Content Square SAS, 7 rue de Madrid, 75008 Paris, France	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Not listed	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Visitor hosting on AWS and Azure: Ireland (eu-west-1 / North Europe) by default for EU customers, or Virginia. Free and Growth stay in Ireland. Backup region unnamed. Support: Zendesk (USA), Atlassian (Australia), Content Square, Inc. (USA). Sense: Bedrock, Azure LLMs, OpenAI (PA chat). VoC: Twilio, Daily.co, Postmark, Tremendous. Conversation Intelligence: Deepgram, Snowflake, Salesforce.	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	Paris-headquartered experience intelligence platform: zone heatmaps, session replay, journey analysis, Voice of Customer, and Sense AI on AWS or Azure with selectable EU or US regions.	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	gdpr experience-analytics session-replay heatmaps voice-of-customer enterprise	gdpr analytics privacy cookie-free uptime-monitoring indie api

At a glance: Contentsquare vs Tinylytics
At a glance	Contentsquare	Tinylytics
HQ	Paris, France	Not listed
Legal entity (typical EU)	Content Square SAS	Not listed
Founded	2012 (Paris)	Not listed
Hosting	AWS and Azure, Ireland or Virginia	Not listed
Deployment	Multi-tenant SaaS (not self-hosted)	Managed SaaS only (not open source, not self-hosted)
Commercial model	Free and Growth self-serve; Pro and Enterprise sales-led	Paid site-count plans; short trial; no permanent free tier
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Primary hosting	Not listed	Hetzner, Falkenstein, Germany
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: Contentsquare vs Tinylytics
Key capabilities	Contentsquare	Tinylytics
EU-operated (FR SAS)	Yes	Not listed
Zone heatmaps	Yes	Not listed
Session replay	Yes	Not listed
Public DPA	Yes	Not listed
EU or US cloud region	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Cookieless analytics	Not listed	Yes
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
SaaS only (no self-host)	Not listed	Yes
Solo-founder UK	Not listed	Yes

Contentsquare

Zone-based heatmaps and journey analysis
Experience Analytics maps clicks, hovers, and scrolls to page zones and attributes engagement, conversion, and revenue to those elements. Journey analysis (Pro and Enterprise) follows visitors from entry to exit so CRO and UX teams can find drop-off without reconstructing funnels in a separate BI tool. Limit: Free and Growth include heatmaps but not the full journey module.
Session replay with Smart Capture
The Main Tag and mobile SDKs auto-capture clicks, scrolls, taps, and swipes without a full custom event taxonomy. Replays can be summarized by Sense. Docs expose CSS-selector and page-level PII masking. Customer-submitted identifiers (email, username) are off by default. Limit: Shopify checkout replay and zoning require Shopify Plus, and checkout pages must use page masking. The product is multi-tenant SaaS, not a self-hosted recorder.
Error, speed, and frustration monitoring
Experience Monitoring ties JavaScript errors, crashes, custom business errors, and page-speed metrics to the same sessions as replay. Frustration Score ranks journeys with rage clicks and similar signals. Impact Quantification estimates conversion and revenue effects so engineering can triage by business cost. Alerts and several of these modules are Pro and Enterprise only.
Voice of Customer and conversation intelligence
Surveys and feedback (Ask), Observe, and Engage interviews or user tests sit on the same group platform as Hotjar-branded VoC. Conversation Intelligence (Loris) scores agent and requester chats, including optional audio via Deepgram. Interview and user-test recordings are retained for 2 years per the DPA. These modules pull extra subprocessors (Twilio, Daily.co, Postmark, Tremendous).
Sense AI on regional LLM endpoints
Sense generates dashboards, error summaries, mapping help, and replay summaries from captured behavior. The DPA lists AWS Bedrock and Azure models for Growth, Pro, and Enterprise, served from EU or US regions based on customer location. Product Analytics Sense Chat can also call OpenAI. The vendor says customers should avoid putting personal data in prompts. This is in-product AI, not a self-hosted model.
Selectable AWS or Azure residency plus enterprise access
EU-based customers default to Ireland (AWS eu-west-1 or Azure North Europe). US hosting (Virginia) is an explicit option. SAML 2.0 SSO and MFA are documented. Data Connect can export visitor data to a warehouse (Frankfurt or Virginia for Experience Analytics). There is no EU-sovereign cloud option that avoids US-group providers.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: Contentsquare vs Tinylytics
Assurance & compliance	Contentsquare	Tinylytics
Independent security / no-logs audit	On request / NDA Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Vendor claimed Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
ISO 27701	Vendor claimed Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.	Not listed
SOC 2 / SOC 3	Vendor claimed Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Partial Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.
EU-U.S. Data Privacy Framework	Vendor claimed DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.	Not listed
HIPAA	Vendor claimed Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).	Not listed
CSA STAR	Vendor claimed Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.	Not listed

Considerations & known limitations: Contentsquare vs Tinylytics
Considerations & known limitations	Contentsquare	Tinylytics
AWS and Azure plus US SaaS subprocessors	Medium Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.	Not listed
High-sensitivity visitor capture	Medium Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.	Not listed
Full DX stack is sales-led	Low Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.	Not listed
Hotjar, Heap, and Loris live in one group	Low Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.	Not listed
ISO and SOC evidence behind the trust portal	Low ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.	Not listed
US-group subprocessors on the data path	Not listed	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

Contentsquare

Best fit when

Enterprise or mid-market CRO, UX, ecommerce, and digital product teams that need zoning, journeys, and replay tied to conversion
European buyers who want a French SAS contracting entity and a public DPA with EU SCCs under French law
Teams already running GA4 or Adobe Analytics that need a visual DX layer rather than another pageview tool
Support and engineering groups that must reproduce errors from the visitor's screen and rank them by revenue impact
Organisations that can accept AWS or Azure Ireland as the primary region and will configure PII masking on checkout and forms

Poor fit when

Buyers who require no US-group cloud, no US affiliate support access, and no US SaaS subprocessors
Teams that only need cookieless traffic analytics without session replay or heatmaps
Procurement that mandates self-hosted or open-source DXA with data never leaving owned infrastructure
Sites that cannot deploy a third-party Main Tag or mobile SDK, or cannot mask PII in replays

Consider instead when

When: You want European heatmap, replay, and friction analysis at a smaller scale than enterprise DXA
Consider: Mouseflow
Danish SaaS in the catalog. Confirm its own hosting and DPA independently.
When: You only need privacy-first page analytics without session video
Consider: Plausible Analytics or Friendly Analytics
Different job: traffic and privacy, not zoning or replay.
When: You already use Hotjar for surveys and light replay and do not need enterprise quantification
Consider: Stay on the Hotjar (Ask / Observe / Engage) SKU in the same group
Same French SAS for non-Americas contracts. Not a separate catalog product at draft time.
When: You need US-parented enterprise DXA already standardized in the US stack
Consider: FullStory, or Adobe Analytics plus a replay add-on
Closer operationally to Contentsquare's full suite, but not European-operated.

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

Contentsquare

What is the geographic backup or DR region for the Ireland pipeline (security page says a backup region, not which one)?
Can a reviewer download current ISO 27001, ISO 27701, and SOC 2 Type II reports from the trust portal, including scope and expiry?
Is Content Square, Inc. support access to EU visitor data on by default, or only when a ticket requires it?
Who holds controlling ownership after SoftBank Vision Fund, Sixth Street, and other rounds (no US parent found, but cap table is private)?
For Sense, what exact visitor fields leave the selected region when Bedrock, Azure, or OpenAI is invoked?
Does the latest public-authorities transparency report show any US law-enforcement requests for EU visitor data?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?