etracker vs Hotjar

ePrivacyseal materials and vendor pages describe independent ePrivacy Consult audit of consent-free cookieless analytics posture; not a full public penetration-test report. Vendor also claims regular infrastructure pen tests.

Vendor claims annual external penetration tests and publishes a Trust Portal with pentest reports behind access. No public independent no-logs audit (this is a recorder, not a no-logs VPN).

IPHH housing described as ISO/IEC 27001:2013-certified. No public organisation-level ISO 27001 certificate for etracker/JustRelate analytics found in materials reviewed.

Contentsquare states it is ISO 27001 certified (also claims ISO 27017, 27018, 27701). Certificates are on the Trust Portal; not independently downloaded for this draft.

No public SOC 2/SOC 3 report located on official trust/security pages reviewed.

Trust portal and security pages claim a SOC 2 Type II report. Report not independently downloaded.

EU/DE controller-processor setup; cookieless default under legitimate interest; Art. 28 DPA on registration; privacy notice + objection patterns documented.

EU parent and contracting entity for non-Americas Hotjar Services. Public DPA, SCCs, and GDPR language. Customer is controller and must supply a lawful basis for visitor capture.

EuropeanStack assessment: German entity, no known US parent, own-server housing at IPHH (no public AWS/GCP/Azure analytics store) → core exposure low. Partial because optional conversion sync and Google connectors can send data to US-group destinations when enabled by the customer. Not legal advice.

Assessment, not a vendor slogan. French parent and no known US parent, but AWS and Azure host visitor data, Content Square, Inc. and Zendesk process support data, and US regions exist. Not legal advice.

Vendor states DPA/AV concludes on account registration; public DPA PDFs and in-app DPA under Settings → Data processing agreement.

Public Contentsquare DPA incorporated by the MSA. Execution of the MSA or an order form is treated as execution of the DPA and SCCs.

Vendor and ePrivacy listing materials assert seal for consent-free cookieless mode under GDPR/TDDDG. Scope is privacy/consent posture, not a general security cert.

Product is web/marketing analytics, not an AI-system offering as primary positioning.

Core product is analytics and replay, not an AI system sold as such. Sense AI and survey LLMs exist as optional features. Confirm AI Act role if you enable those modules.

Security page displays a STAR badge. Scope and level not independently verified.

ePrivacyseal and vendor guidance support cookieless default under TDDDG/GDPR, but hybrid cookies, marketing tags, and non-German supervisory interpretations can change the picture. Operators remain responsible for DPIA and notices.

Core storage is claimed German; enabling Google/Meta/TikTok/Microsoft conversion upload or Looker Studio connectors creates additional processing at those destinations. Map each integration in your transfer assessment.

No public SOC 2 or org-level ISO 27001 package found; IPHH housing ISO and ePrivacyseal are the main published assurance artefacts. May slow enterprise security questionnaires.

No self-host path. Exit requires export/API planning; multi-year usage contracts are common in this category—confirm terms on the vendor site.

Housing (IPHH) is named; a full live subprocessor schedule (support tooling, email, etc.) was not found as a single public table. Request under NDA/procurement if required.

Acquired in 2021 and described as merged into Contentsquare on 1 July 2025. New contracts are Contentsquare entities. A scheduled DXA transition from 18 August 2026 can move data and retire the old UI unless you elect to stay. Practical impact: vendor risk, product roadmap, and DPA counterparty are the French group, not Hotjar Ltd.

Visitor data sits on AWS and Azure. Zendesk (USA) and Content Square, Inc. handle support. US regions are default for some geographies. Practical impact: an Ireland region does not remove US-group infrastructure from a CLOUD Act discussion.

The vendor asks customers to block non-permitted personal data and claims card masking. Misconfigured tags still record inputs or on-screen PII. Practical impact: you need a suppressions review and a consent story before go-live.

No official self-hosted or open-source edition. Practical impact: skip this product if residency rules require your own servers.

Sense AI and survey AI use AWS Bedrock and Azure OpenAI. Practical impact: disable those features or map their regions if procurement treats LLMs as a separate transfer.