Friendly Analytics vs Sitesights

Compare Friendly Analytics and Sitesights on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Hotjar, Matomo

Friendly Analytics

Switzerland· Web Analytics

Needs review

Shortlist when you need full Matomo depth (heatmaps, funnels, ecommerce, API) with Swiss product hosting and managed privacy defaults—especially regulated CH/EU orgs leaving Google Analytics. Skip when you only want a minimal pageview counter, a free self-serve tier, or pure DIY Matomo ops—consider Plausible, etracker, or self-hosted Matomo instead.

Matomo-as-a-ServiceCookieless by defaultSwiss product hostingISO 27001 (claimed)DPA availableEU / on-prem option

View listing Visit Website

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies

View listing Visit Website

Highlighted rows differ between the two products.

Friendly Analytics vs Sitesights: Snapshot
Feature	Friendly Analytics	Sitesights
Country of origin	Switzerland	Germany
Category	Web Analytics	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	Switzerland	Germany
Legal entity	Friendly LLC (Friendly GmbH on DPA), Werkhofstrasse 5, 6052 Hergiswil, Switzerland	Drude, Grossert GbR
Governing law	Swiss law (per customer principal agreement / DPA framework)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Analytics product: Infomaniak (CH) primary hosting; Netstream and Hosttech (CH) backups. AWS listed only for Friendly Automate email, not Analytics. Enterprise marketing also offers EU or on-premise hosting. Company ops: US SaaS including Google Workspace, HelpScout, Stripe, Notion, Calendly, Cloudflare (help docs).	Product databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.
Summary	Swiss Matomo-as-a-Service: cookieless-by-default web analytics with heatmaps, funnels, and ecommerce, product data hosted in Switzerland, plus enterprise DPA and on-prem options.	German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.
Tags	analytics privacy gdpr matomo open-source switzerland nfadp enterprise self-hosted	analytics privacy gdpr cookieless saas api germany

At a glance: Friendly Analytics vs Sitesights
At a glance	Friendly Analytics	Sitesights
HQ	Hergiswil, Switzerland	Not listed
Legal entity	Friendly LLC / Friendly GmbH	Not listed
Stack	Matomo (unmodified + premium plugins)	Not listed
Product hosts	Infomaniak; backups Netstream & Hosttech (CH)	Not listed
Commercial model	Hit-based SaaS; enterprise custom; no free trial	Free start; pageviews + events subscriptions (Paddle)
Open source base	Matomo; portable to other Matomo hosts	Not listed
HQ / entity	Not listed	Drude, Grossert GbR, Germany
Category	Not listed	Web analytics (SaaS)
Hosting (product)	Not listed	Hetzner, Germany (vendor docs)
Tracking model	Not listed	Cookieless; 48h rotating server hash
Open source	Not listed	No (libs/plugins public; core SaaS proprietary)

Key capabilities: Friendly Analytics vs Sitesights
Key capabilities	Friendly Analytics	Sitesights
Matomo-as-a-Service	Yes	Not listed
Cookieless by default	Yes	Not listed
Swiss product hosting	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
DPA available	Yes	Not listed
EU / on-prem option	Yes	Not listed
Cookieless tracking	Not listed	Yes
EU-operated (DE)	Not listed	Yes
Hetzner Germany (claimed)	Not listed	Yes
Server-side API	Not listed	Yes
Funnels + page flow	Not listed	Yes
Multi-project / agencies	Not listed	Yes

Friendly Analytics

Matomo-as-a-Service with privacy defaults
Runs unmodified Matomo plus selected premium plugins, preconfigured for cookieless tracking, IP truncation, and nFADP/GDPR-oriented defaults so teams avoid operating Matomo themselves while keeping exit paths to another Matomo host.
Heatmaps, funnels, session recording, and ecommerce
Beyond pageviews: heatmaps, privacy-oriented session replays, conversion funnels, form analytics, A/B tests, and ecommerce reporting for UX and revenue analysis without bolting on a separate US product suite.
Swiss product hosting with EU or on-prem options
Visitor analytics hosted with Infomaniak in Switzerland; backups via Netstream and Hosttech (CH). Enterprise can contract Swiss, EU, or on-premise placement—confirm region in the order form rather than assuming SaaS-only CH.
Ads conversion export without third-party pixels
Advertising Conversion Export sends conversions to Google or Bing via API so campaigns can be optimized without placing those vendors' tracking codes on your site—useful when privacy policy bans extra ad tags.
GA import, reporting API, and Matomo portability
Historical Google Analytics data can be imported (manual, effort-billed). Reporting API and live export links feed BI tools; data can move to another Matomo instance, limiting classic SaaS lock-in.
Enterprise contracts, SSO, and dedicated instances
Enterprise tier adds custom DPA/DORA/NDA/SLA paperwork, dedicated account management, SSO, custom domain, dedicated instance, and phone/video support for banks, insurers, and public bodies.

Sitesights

Cookieless 48-hour rotating session hash
Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).
Sub-1 KB client script plus WordPress and Shopify plugins
Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.
Server-side REST API with C# and Node libraries
Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.
Real-time overview with campaign and device filters
Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.
Custom funnels and page-flow journey maps
Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.
Multi-project workspaces with roles for agencies
Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

Assurance & compliance: Friendly Analytics vs Sitesights
Assurance & compliance	Friendly Analytics	Sitesights
Independent security / no-logs audit	Not found Vendor describes anonymization defaults and mentions external pen tests in ISO materials; no public independent no-logs audit report found.	Not found No public third-party security or no-logs audit PDF located on the official site or docs.
ISO 27001	Vendor claimed Vendor publishes ISO/IEC 27001:2022 certification covering the company/products with a certificate PDF; not independently re-verified against the cert body registry in this draft.	Not found No public ISO 27001 certificate found on official pages.
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on security/about pages reviewed.	Not found No public SOC 2/3 report found on official pages.
GDPR / EU data protection	Vendor claimed Swiss entity; public materials assert nFADP and GDPR alignment; cookieless defaults and CH processing described in DPA.	Vendor claimed German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.
US CLOUD Act exposure (indicative)	Partial Swiss entity, no known US parent; Analytics product hosts are Swiss (Infomaniak/Netstream/Hosttech). Medium/partial because company subprocessors include US SaaS (e.g. Google Workspace, HelpScout, Stripe, Cloudflare). AWS not used for Analytics per vendor list. Indicative only—not legal advice.	Partial EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA text for Friendly GmbH; customers asked to contact to sign. Enterprise also references DORA/NDA/SLA packs.	Not found No standalone public DPA download found during research; request under contract for B2B processing.
EU AI Act	Not applicable Web analytics SaaS; not positioned as an AI system product.	Not applicable Web analytics product; not marketed as an AI system under the EU AI Act.
ISO 9001	Vendor claimed Vendor publishes ISO 9001 certification materials alongside ISO 27001.	Not listed

Considerations & known limitations: Friendly Analytics vs Sitesights
Considerations & known limitations	Friendly Analytics	Sitesights
US company-operation subprocessors	Medium Support, email/calendar, payments, CRM/docs, and help-docs edge use US-headquartered SaaS even though Analytics visitor data hosts are Swiss. Material for DPIAs that demand zero US processors in any vendor process.	Not listed
Cookie features can reintroduce consent needs	Low Default is cookieless, but enabling cookie-based Matomo capabilities may require banners for EU visitors—configuration discipline required.	Not listed
Small Swiss operator dependency	Low Seven-person-scale Open Startup; mitigations include Matomo portability and open financial transparency, but capacity and roadmap still depend on a small firm.	Not listed
Certifications vendor-published	Low ISO 27001/9001 are claimed with PDFs on the vendor site; procurement should verify certificate validity with the issuing body.	Not listed
Do not conflate with Friendly Automate	Medium Automate uses AWS for email sending. Scope assessments to Analytics-only subprocessors unless you also buy Automate.	Not listed
No public independent security audit	Not listed	Medium ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.
Incomplete public subprocessor list	Not listed	Medium Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.
US-group CDN on marketing site	Not listed	Low Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.
48-hour hash limits long-term visitor analytics	Not listed	Low By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.
On-premise availability is marketing-only detail	Not listed	Low About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Fit

Friendly Analytics

Best fit when

Teams that want Matomo's full feature set without self-hosting ops burden
Swiss and EU organizations prioritizing CH product residency (Infomaniak + CH backups)
Sites aiming for cookieless measurement under default privacy configuration
Marketing teams needing heatmaps, funnels, ecommerce, and ad conversion export without Google Analytics
Enterprises needing DPA/DORA/SLA paperwork, SSO, or dedicated instances

Poor fit when

Buyers who only need lightweight pageview analytics and prefer a free tier (see Plausible-class tools)
Teams that must self-operate every component with no SaaS operator in the path
Orgs that require zero US-headquartered tools anywhere in the vendor's company stack (support/billing SaaS is disclosed)
Use cases outside web/app analytics (Friendly Automate is a different product with different subprocessors)

Consider instead when

When: You want a minimal, open-source, cookieless counter with simpler SaaS UX
Consider: Plausible Analytics
Less Matomo plugin depth; different hosting/operator story (Estonia).
When: You need German enterprise analytics with long public-sector track record
Consider: etracker
Different stack (not Matomo); compare cookieless claims and contracts directly.
When: You prefer a modern EU analytics product with open-source core and lean UI
Consider: Pirsch Analytics
Germany-based; trade Matomo feature breadth for a different product surface.
When: You already run Matomo well and only need software, not a Swiss operator
Consider: Self-hosted Matomo
Maximum control; you own privacy config, updates, and hosting risk.

Sitesights

Best fit when

EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
Agencies and freelancers managing many client sites with projects and role-based invites
Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
WordPress or Shopify properties that want official plugin paths plus a light client script
Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
UX research needs for heatmaps or session replay
Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

When: You want a minimal EU cookieless SaaS or a well-known self-host option
Consider: Plausible Analytics
Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.
When: You need full self-host control, on-prem by default, or mature open-source governance
Consider: Matomo (self-hosted)
Heavier stack, deeper feature surface, and you operate the data plane yourself.
When: You need identity-rich product analytics, retention cohorts, or event warehouses
Consider: Mixpanel or similar product-analytics platforms
Different category—Sitesights is website/app growth analytics, not a full product analytics suite.
When: You need heatmaps, recordings, or UX feedback loops
Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools
Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Open questions for due diligence

Friendly Analytics

Will the signed DPA and order form pin hosting to Switzerland only, or allow EU/on-prem variants?
Which company subprocessors (HelpScout, Google Workspace, Stripe, etc.) receive which categories of customer personal data in practice?
Can the current ISO 27001 certificate be validated against the certification body's public register (scope, dates, sites)?
For enterprise: what is the RPO/RTO and whether backups remain exclusively in Switzerland?
If both Analytics and Automate are purchased, how are subprocessors and data paths segmented contractually?

Sitesights

Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?