etracker vs Mouseflow

Compare etracker and Mouseflow on capabilities, jurisdiction, assurance, and fit for European buyers.

etracker

Germany· Web Analytics

Needs review

Shortlist etracker when you need German-hosted marketing-grade web analytics with a cookieless default, integrated tag/consent tooling, and optional ad conversion sync. Skip when you must self-host open source (prefer Matomo) or only need lightweight pageview charts (prefer Plausible or similar). Treat ePrivacyseal consent-free claims as vendor-audited posture—confirm with your counsel and DPIA.

Cookieless default trackingEU/DE hosted (IPHH)ePrivacyseal (claimed)Tag + consent suiteAd conversion syncSaaS only (not self-host)

View listing Visit Website

Mouseflow

Denmark· Web Analytics

Needs review

Shortlist when you need session replay, heatmaps, friction scoring, and journey/funnel analysis from a Danish SaaS with public DPA and pin-able EU (Belgium) or US (Iowa) Google Cloud residency. Skip when you only need cookieless pageview analytics, must avoid US-group cloud or US affiliate processing, or require self-host—consider etracker, Friendly Analytics, or a self-hosted stack instead.

Session replayHeatmaps + friction scoresEU or US residencyDPA availableDenmark HQISO 27001 DC (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

etracker vs Mouseflow: Snapshot
Feature	etracker	Mouseflow
Country of origin	Germany	Denmark
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Denmark
Legal entity	JustRelate Deutschland GmbH (Charlottenburg HRB 218235); product brand JustRelate etracker / etracker	Mouseflow ApS, Flæsketorvet 68, 1711 Copenhagen V, Denmark; affiliate Mouseflow, Inc., Austin, Texas
Governing law	Not listed	Denmark (DPA); courts of Copenhagen for DPA disputes
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Primary analytics processing on etracker's own servers in Germany/EU with housing at IPHH Internet Port Hamburg GmbH (vendor: no third-party access to apps/data for housing). Optional customer-enabled outbound paths to Google/Meta/TikTok/Microsoft Ads (conversion upload) and Google Looker Studio connectors—not core storage hosts.	Google Cloud EMEA Limited storage/hosting in Belgium (EU) and Iowa (USA); region by signup geography (EU customers → EU; Americas/Oceania → US). Affiliates Mouseflow ApS (DK) and Mouseflow, Inc. (TX) process Customer Data for support/implementation; DoiT Multi-Cloud Sverige (SE) for multi-cloud consulting.
Summary	German SaaS web and marketing analytics from JustRelate: cookieless default tracking, integrated tag/consent management, e-commerce and ad conversion sync on EU-hosted servers.	Denmark-headquartered behavior analytics SaaS: session replay, heatmaps, friction detection, journey analytics, and AI insights for CRO and UX teams, with EU or US Google Cloud residency and a public DPA.
Tags	analytics gdpr saas cookieless privacy marketing-analytics consent-management e-commerce	analytics gdpr saas session-replay heatmaps friction enterprise ai cro

At a glance: etracker vs Mouseflow
At a glance	etracker	Mouseflow
HQ / legal entity	JustRelate Deutschland GmbH, Berlin (product ops Hamburg)	Not listed
Product type	Web & marketing analytics SaaS (+ tag/CMP modules)	Not listed
Hosting	Own servers, IPHH housing, Hamburg/Germany	Google Cloud Belgium (EU) or Iowa (US)
Open source	No	Not listed
Self-hosted	No	Not listed
Commercial model	Usage-based SaaS licence (hit tiers); trial commonly offered	Session-volume SaaS; free tier; unlimited users
HQ	Not listed	Copenhagen, Denmark
Legal entity	Not listed	Mouseflow ApS (+ Mouseflow, Inc. US affiliate)
Category	Not listed	Behavior analytics / session replay SaaS
Self-host / OSS	Not listed	No / No

Key capabilities: etracker vs Mouseflow
Key capabilities	etracker	Mouseflow
Cookieless default tracking	Yes	Not listed
EU/DE hosted (IPHH)	Yes	Not listed
ePrivacyseal (claimed)	Yes	Not listed
Tag + consent suite	Yes	Not listed
Ad conversion sync	Yes	Not listed
SaaS only (not self-host)	Yes	Not listed
Session replay	Not listed	Yes
Heatmaps + friction scores	Not listed	Yes
EU or US residency	Not listed	Yes
DPA available	Not listed	Yes
Denmark HQ	Not listed	Yes
ISO 27001 DC (claimed)	Not listed	Yes

etracker

Cookieless session analytics (consent-oriented default)
Server-side session tokens link interactions without analytical cookies or device fingerprinting by default; IP truncation and daily-rotating hashes limit long-term recognition. Suits sites that want visit/conversion metrics under legitimate interest while keeping optional hybrid cookies behind consent.
Integrated tag and consent management
One product surface to load etracker and third-party tags and sync them with consent rules, reducing dual maintenance between a separate CMP and GTM. Best when marketers need gated Maps/ads tags without rebuilding the full Google stack.
Server-side conversion sync to major ad platforms
Upload conversions measured in etracker to Google Ads, Meta, TikTok, and Microsoft Ads so bid algorithms receive server-side signals. Customer-controlled outbound path—useful for paid media, but introduces destination-platform processing outside German housing.
E-commerce, UX scrollmaps, and multi-level drill-downs
Shop funnels from product list to order (including vouchers and abandonment), scrollmaps projected on pages, and reports with multi-dimension drill-downs plus attribution model switching. Aimed at merchandising and growth teams, not just pageview counters.
First-party tracking domain and BI exports
Optional own-subdomain tracking (including Let's Encrypt workflow docs) to reduce ad-blocker and ITP loss; connectors/API/SFTP-style raw data paths toward Looker Studio, Power BI, and warehouses. Ops teams still configure domains and data pipelines themselves.

Mouseflow

Full-session replay without sampling
Records complete visitor journeys—clicks, scrolls, navigations, device context—for later playback, starring, tagging, and sharing. Mouseflow markets 100% recording (no sampling) so rare bugs and checkout failures are not lost to traffic samples; filter by source, device, page, or friction events before reviewing.
Heatmaps with segment and period comparison
Click, scroll, movement, and attention heatmaps overlay page layouts so teams see ignored CTAs and fold issues. Compare devices, campaigns, or time ranges side by side to measure redesign impact without running a separate heatmap product.
Friction Detection and Mina AI prioritization
Automated scores surface rage clicks, dead clicks, hesitations, form abandons, and JavaScript errors, with links into the underlying replays. Mina AI answers natural-language questions about sessions and heatmaps so analysts spend less time manual-filtering queues.
Journey maps, funnels, forms, and surveys
Multi-page Journey Analytics, conversion funnels, field-level form analytics, and on-site feedback surveys sit in one workspace so drop-off diagnosis does not require four vendors. Useful for CRO and ecommerce teams closing the loop from path → leak → fix.
EU or US data residency on Google Cloud
Public subprocessors list Google Cloud EMEA Limited with Belgium (EU) and Iowa (USA) storage. Signup geography determines default region (EU customers → EU; Americas/Oceania → US). Confirm contracted region and subprocessor annex before treating residency as guaranteed.
Privacy controls, DPA, and Visual Privacy Tool
Vendor defaults include IP masking, keystroke exclusion for EU visitors, and field/element masking; customers must still audit HTML for PII. A public B2B DPA is available for electronic signature, with SCCs/DPF language for international transfers.

Assurance & compliance: etracker vs Mouseflow
Assurance & compliance	etracker	Mouseflow
Independent security / privacy audit	Vendor claimed ePrivacyseal materials and vendor pages describe independent ePrivacy Consult audit of consent-free cookieless analytics posture; not a full public penetration-test report. Vendor also claims regular infrastructure pen tests.	Partial Vendor claims third-party penetration/vulnerability tests and offers a Security Kit; no public independent no-logs audit report found for download without request.
ISO 27001	Partial IPHH housing described as ISO/IEC 27001:2013-certified. No public organisation-level ISO 27001 certificate for etracker/JustRelate analytics found in materials reviewed.	Vendor claimed Vendor states data centers maintain ISO 27001; request Security Kit for certificate scope—not independently re-verified against a public registry in this draft.
SOC 2 / SOC 3	Not found No public SOC 2/SOC 3 report located on official trust/security pages reviewed.	Partial Privacy page mentions SOC 2 Type II-certified infrastructure; compliance/About emphasize SOC 1 Type II for data centers; FAQ prefers SOC 1 as internal standard. Confirm report type/scope via Security Kit.
GDPR / EU data protection	Vendor claimed EU/DE controller-processor setup; cookieless default under legitimate interest; Art. 28 DPA on registration; privacy notice + objection patterns documented.	Vendor claimed Danish entity; public GDPR page, DPA, IP masking, EU residency option, SCCs/DPF transfer language. Customer remains responsible for consent and PII exclusion from HTML.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: German entity, no known US parent, own-server housing at IPHH (no public AWS/GCP/Azure analytics store) → core exposure low. Partial because optional conversion sync and Google connectors can send data to US-group destinations when enabled by the customer. Not legal advice.	Partial Danish entity, no known US parent; session data on Google Cloud (Belgium/Iowa) and US affiliate Mouseflow, Inc. may process Customer Data. EU residency does not eliminate US-group cloud risk. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Vendor states DPA/AV concludes on account registration; public DPA PDFs and in-app DPA under Settings → Data processing agreement.	Vendor claimed Public DPA at mouseflow.com/legal/data-processing-agreement/ with electronic signature; SCCs and DPF language included.
ePrivacyseal (privacy seal)	Vendor claimed Vendor and ePrivacy listing materials assert seal for consent-free cookieless mode under GDPR/TDDDG. Scope is privacy/consent posture, not a general security cert.	Not listed
EU AI Act	Not applicable Product is web/marketing analytics, not an AI-system offering as primary positioning.	Not applicable Behavior analytics SaaS with optional AI assistants (Mina, MCP); not positioned as a high-risk AI system product for this checklist.
PCI DSS (data center)	Not listed	Vendor claimed Vendor states data centers maintain PCI DSS compliance; not a substitute for customer PCI scope on payment pages—mask card fields.

Considerations & known limitations: etracker vs Mouseflow
Considerations & known limitations	etracker	Mouseflow
Consent-free claims still need local legal review	Medium ePrivacyseal and vendor guidance support cookieless default under TDDDG/GDPR, but hybrid cookies, marketing tags, and non-German supervisory interpretations can change the picture. Operators remain responsible for DPIA and notices.	Not listed
Optional conversion sync / BI connectors to US platforms	Medium Core storage is claimed German; enabling Google/Meta/TikTok/Microsoft conversion upload or Looker Studio connectors creates additional processing at those destinations. Map each integration in your transfer assessment.	Not listed
Limited public enterprise security certs	Low No public SOC 2 or org-level ISO 27001 package found; IPHH housing ISO and ePrivacyseal are the main published assurance artefacts. May slow enterprise security questionnaires.	Not listed
SaaS-only, closed source	Low No self-host path. Exit requires export/API planning; multi-year usage contracts are common in this category—confirm terms on the vendor site.	Not listed
No exhaustive public subprocessor register	Low Housing (IPHH) is named; a full live subprocessor schedule (support tooling, email, etc.) was not found as a single public table. Request under NDA/procurement if required.	Not listed
Google Cloud (US-group) hosts session data	Not listed	Medium Even EU-region (Belgium) storage uses Google Cloud EMEA Limited. Material for DPIAs that treat any US-group cloud as in scope for CLOUD Act/transfer analysis.
US affiliate processes Customer Data	Not listed	Medium Mouseflow, Inc. (Texas) is listed for consulting, support, maintenance, implementation, and development on Customer Data—not only a marketing office.
Session replay can capture unexpected PII	Not listed	Medium Defaults mask IPs/keystrokes/sensitive fields, but customers must audit DOM/HTML, forms, and custom variables; incidental PII is a shared-responsibility risk in this category.
ISO/SOC claims are data-center scoped	Not listed	Low Public materials emphasize infrastructure certifications; SOC 1 vs SOC 2 wording differs across pages—verify current reports rather than assuming org-wide SOC 2.
SaaS-only (no self-host)	Not listed	Low Closed multi-tenant SaaS only; no official on-prem path if residency or operator control requirements demand it.

Fit

etracker

Best fit when

EU/German organisations replacing GA4 to reduce consent-mode data loss and US-linked analytics storage
Performance marketers needing campaign attribution plus server-side conversion upload to major ad platforms
E-commerce teams measuring product-to-checkout funnels, vouchers, and abandonment in one privacy-oriented SaaS
Agencies managing multi-account portfolios that want integrated tag and consent management without a separate CMP licence stack
Publishers and regulated sectors that require a German processor, Art. 28 DPA, and documented objection mechanisms

Poor fit when

Teams that must self-host open-source analytics with full infrastructure control (Matomo, Offen, etc.)
Sites that only need minimal cookieless pageviews without shop, UX, or paid-media depth
Procurement that requires published SOC 2 or organisation-level ISO 27001 for the analytics vendor before shortlisting
Buyers expecting a durable free-forever tier comparable to Google Analytics

Consider instead when

When: You need open-source self-host or full data-plane control on your own infrastructure
Consider: Matomo (self-host or Matomo by Stackhero / Friendly Analytics managed)
etracker is closed-source SaaS only
When: You want a lightweight EU cookieless counter without marketing suites
Consider: Plausible Analytics, Wide Angle Analytics, or digistats Analytics
Simpler product surface; fewer e-commerce and ad-sync features
When: You stay fully inside Google Ads optimisation and accept consent/US-transfer tradeoffs
Consider: Google Analytics 4
Deeper Google ecosystem wiring; different privacy posture

Mouseflow

Best fit when

CRO, UX, and ecommerce teams that need full session recordings linked to heatmaps and funnels
Mid-market orgs wanting public session-volume packaging and unlimited seats rather than per-seat DX platforms
EU buyers who can accept Google Cloud hosting if Customer Data is pinned to the Belgium region
Teams that want vendor friction scoring and Mina AI triage instead of manual replay queues only
Procurement that requires a signable DPA, SCCs/DPF language, and a published subprocessor list

Poor fit when

Sites that only need cookieless aggregate web analytics without DOM session replay
Hard sovereignty mandates that forbid US-group cloud (Google Cloud) or any US legal entity in the support path
Buyers requiring open-source or official self-hosted deployment
Enterprises standardized on Contentsquare/FullStory-class platforms who need deep custom DX integrations already covered there

Consider instead when

When: You need cookieless traffic analytics without session replay depth
Consider: etracker or Friendly Analytics
Different category focus: measurement and privacy defaults vs high-fidelity replay
When: You want free heatmaps/replays and accept Microsoft as processor
Consider: Microsoft Clarity
Lower cost of entry; different privacy and commercial model
When: You need enterprise digital-experience analytics with heavy customization
Consider: Contentsquare or FullStory
Higher implementation and procurement weight
When: You need Swiss/EU product hosts with no Google Cloud visitor path
Consider: Friendly Analytics or fusedeck
Confirm each peer’s subprocessor list independently

Open questions for due diligence

etracker

Will procurement receive a current subprocessor list covering support, email, and any non-IPHH infrastructure?
Does JustRelate publish an organisation-level ISO 27001 or SOC 2 report for the analytics service (beyond IPHH housing)?
For your jurisdictions outside Germany, does counsel accept the cookieless legitimate-interest posture without a consent banner?
Which optional outbound integrations (ads conversion upload, Looker Studio, third-party tags) will you enable, and how are those transfers documented?

Mouseflow

Will the order form / DPA annex hard-pin EU (Belgium) residency for our account, including backups and AI features?
Which categories of Customer Data does Mouseflow, Inc. (Texas) access in day-to-day support?
Can the current ISO 27001 / SOC report package be validated (scope, dates, legal entity) via the Security Kit?
Are AI (Mina) and MCP features processed only in the same residency region as session storage?
What is the published retention default per plan and the process/SLA for deletion after offboarding?