Compare Insights and Plausible Analytics on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo
Austria· Web Analytics
Needs review
Shortlist when you need cookie-free hosted analytics with first-class custom events for SPAs from an Austrian operator. Skip when you need self-host, public ISO/SOC packs, or infrastructure without Google Firebase—consider Plausible Analytics, Simple Analytics, or Pirsch Analytics instead (or self-hosted Matomo).
Estonia· Web Analytics
Needs review
Shortlist when you need cookieless website analytics with EU-owned visitor hosting, a lightweight script, AGPL transparency, and either managed Cloud or self-hosted CE. Skip when you need heatmaps/session replay, multi-day user-level product analytics, HIPAA/BAA, free forever hosted analytics, or zero non-EU SaaS anywhere in vendor ops—consider Matomo-class (e.g. Friendly Analytics / Piwik PRO), Pirsch, or Simple Analytics depending on depth vs simplicity.
Highlighted rows differ between the two products.
| Feature | Insights | Plausible Analytics |
|---|---|---|
| Country of origin | Austria | Estonia |
| Category | Web Analytics | Web Analytics |
| Open source | Yes | Yes |
| Self-hosted | No | Yes |
| Headquarters | Austria | Estonia |
| Legal entity | Unsourced Digital OG | Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia |
| Governing law | Not listed | Estonian / EU law context for the OÜ; confirm contract terms for governing law clauses |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Operator: Unsourced Digital OG (Austria). Vendor-documented infrastructure includes Google Firebase—Cloud Functions, Firebase Authentication (customer accounts), and Firebase Hosting—with temporary IP handling described for those Google services. Visitor analytics designed without cookies and without IP storage in DB/logs; still a US-group cloud path for processing/hosting/auth. | Visitor analytics: Hetzner (Falkenstein, Germany), UpCloud (Finland, DB/exports), Bunny (Slovenia, CDN/DNS/DDoS)—European-owned; vendor states visitor data never leaves the EU. Customer-account subprocessors include Paddle (payments), Postmark (email), Gravatar, optional Google (GA import), Help Scout, Nolt; site tools may include hCaptcha, Algolia, Mailchimp. SCCs claimed for non-EU processors. |
| Summary | Austrian privacy-first hosted web analytics: page views and custom events without cookies or stored visitor IPs, with an MIT open-source JS client (backend uses Google Firebase). | Estonian open-source, cookieless web analytics (AGPLv3): lightweight script, EU-owned hosting on Hetzner/UpCloud/Bunny, managed Cloud plus self-hosted Community Edition. |
| Tags |
| At a glance | Insights | Plausible Analytics |
|---|---|---|
| HQ / law | Austria (Unsourced Digital OG; Austrian governing law) | Not listed |
| Product type | Hosted privacy web analytics + custom events | Not listed |
| Client license | MIT (insights-js); backend proprietary | Not listed |
| Self-host | No public self-host option | Not listed |
| Commercial model | Free low-volume tier; paid by monthly event/pageview volume | Pageview-based Cloud SaaS; free CE self-host |
| Known infra | Google Firebase (Functions, Auth, Hosting) per vendor docs | Not listed |
| HQ | Not listed | Tartu, Estonia |
| Legal entity | Not listed | Plausible Insights OÜ (reg. 14709274) |
| Visitor hosts | Not listed | Hetzner DE; UpCloud FI; Bunny SI |
| License | Not listed | AGPLv3; Cloud + Community Edition |
| Tracking model | Not listed | Cookieless; daily rotating hash; no PII stored |
| Key capabilities | Insights | Plausible Analytics |
|---|---|---|
| Cookie-free tracking | Yes | Not listed |
| Custom events | Yes | Not listed |
| MIT client (insights-js) | Yes | Not listed |
| Austrian entity | Yes | Not listed |
| Hosted SaaS | Yes | Not listed |
| Firebase data path | Yes | Not listed |
| Cookieless by design | Not listed | Yes |
| EU-owned visitor hosts | Not listed | Yes |
| AGPLv3 open source | Not listed | Yes |
| Self-host CE | Not listed | Yes |
| DPA automatic | Not listed | Yes |
| Lightweight script | Not listed | Yes |
Cookie-free page views and user flows
Tracks bounce rate, referrers, visits, and user-flow style page statistics without setting analytics cookies, so sites can avoid cookie banners driven solely by analytics. Script init plus trackPages() is the usual path for SPAs.
Custom and cancelable event tracking
insights-js supports named events with string parameters, unique-per-session flags, parameter-only updates, and remove/cancel for long-lived events (e.g. subscribe then unsubscribe). Built for product and funnel metrics, not pageviews only.
MIT open-source TypeScript client
The browser/npm client (insights-js) is MIT-licensed on GitHub with TypeScript types and helpers for locale, screen type, path, referrer, and duration buckets. Supports React, Angular, Vue, UMD script, and multi-project App instances. Backend remains proprietary SaaS.
Visitor anonymization pipeline (vendor-described)
Vendor docs: IPs hashed only in RAM for fraud checks (not stored in DB or logs); user agents reduced to browser/OS; optional screen sizes rounded to 50px; Do Not Track honoured. Confirm fit with your DPO—anonymous design is not a legal certification.
Developer-oriented integration
One-minute script install or npm package; docs cover multi-project tracking, ignoreErrors/disabled flags for production environments, and hash/search options on page paths. Lightweight client positioned against heavier GA-style tags.
Cookieless measurement with daily rotating visitor hash
No cookies, localStorage, or persistent IDs. Uniques use hash(daily_salt + domain + IP + UA); salt rotates every 24 hours and raw IP/UA are never stored—so analytics can often run without a consent banner, at the cost of no multi-day user stitching.
Lightweight script and single-page traffic dashboard
Vendor claims a script ~54× smaller than Google Analytics with real-time updates (~30s), sources, pages, devices, UTM channels, scroll-depth goals, and optional Google Search Console import—built for marketers who refuse GA4 report complexity.
Goals, custom events, funnels, and revenue on Cloud
Codeless page goals, file downloads, outbound clicks, custom events/properties, AI-referral traffic views, and (on higher Cloud plans) funnels, user journeys, and ecommerce revenue attribution—not session replay or in-app product analytics.
EU-owned visitor hosting (Hetzner, UpCloud, Bunny)
Cloud visitor data is processed on European-owned infrastructure: Hetzner (Germany), UpCloud (Finland), Bunny CDN (Slovenia). Plausible states visitor data never leaves the EU and is not stored on US hyperscalers.
AGPLv3 open source with Community Edition self-host
Full codebase on GitHub; free CE for self-host (long-term releases ~twice yearly). Cloud-only features include advanced bot filtering, funnels/journeys, ecommerce revenue, SSO, and Sites API—self-host ops, backups, and upgrades are yours.
Automatic DPA, Stats API, exports, and enterprise SSO
Public DPA applies to Cloud customers by use; CSV export and Stats API for BI; Business/Enterprise add higher API limits, raw event exports, managed proxy, and SAML SSO (Google Workspace, Okta, Microsoft Entra ID per docs).
| Assurance & compliance | Insights | Plausible Analytics |
|---|---|---|
| Independent security / no-logs audit | Not found Vendor describes no IP storage in DB/logs and RAM-only hashing; no public third-party audit PDF found. | Not found Open-source code and security overview published; no public independent pen-test or no-logs audit PDF found on compliance/security pages. |
| ISO 27001 | Not found No public certificate on getinsights.io at research time. | Not found No ISO 27001 claim located on security or compliance hub pages reviewed. |
| SOC 2 / SOC 3 | Not found No public SOC report found. | Not found No SOC 2/3 claim located on security or compliance hub pages reviewed. |
| GDPR / EU data protection | Vendor claimed Austrian entity; privacy policy and data-collection docs; cookie-free/no-stored-IP design for visitors. Firebase/Google processing still requires transfer/DPA diligence. | Vendor claimed EU entity; cookieless non-PII design; public data policy, DPA, and vendor-published legal assessment on GDPR/ePrivacy positioning. |
| US CLOUD Act exposure (indicative) | Partial EU entity / no known US parent, but Google Firebase (US-group) used for Cloud Functions, Auth, and Hosting per vendor data page. Indicative medium exposure. Not legal advice. | Partial Estonian OÜ, no known US parent; visitor data on EU-owned Hetzner/UpCloud/Bunny. Partial/medium because customer-account subprocessors include US-oriented SaaS (e.g. Postmark, Help Scout, Gravatar, optional Google). Indicative only—not legal advice. |
| Data processing agreement (B2B) | Not found No standalone public DPA page found; request from contact@getinsights.io for B2B use. | Vendor claimed Public DPA applies automatically to Cloud customers by use of the service; lists processor duties and 48-hour breach notification target. |
| EU AI Act | Not applicable Web analytics product, not an AI system product page. | Not applicable Website analytics product; not marketed as an AI system under the AI Act. |
| Considerations & known limitations | Insights | Plausible Analytics |
|---|---|---|
| Google Firebase on critical path | High Vendor documents Firebase Cloud Functions, Auth, and Hosting. Anonymous visitor design does not remove US-group cloud dependency for hosting/auth/processing—material for sovereignty-sensitive buyers. | Not listed |
| No public independent audit or certs | Medium No ISO 27001, SOC 2, or third-party no-logs audit found on the public site. Rely on vendor claims plus your own review of the open client. | Not listed |
| Client open source only; no self-host | Medium insights-js is MIT; dashboard/backend are closed SaaS. You cannot run the full product on your infrastructure. | Not listed |
| Small team / continuity | Medium Product presented as built by two freelance developers under Unsourced Digital OG. Assess vendor longevity and support SLAs for business-critical analytics. | Not listed |
| Bounce/unique metrics need SPA routing | Low Client docs: trackPages bounce and unique views expect a client-side router and do not use cookies/localStorage; multi-page full reloads can skew metrics. | Not listed |
| US-linked customer-account subprocessors | Not listed | Medium Visitor metrics stay on EU-owned hosts, but billing, email, support, and optional integrations use providers such as Postmark, Paddle, Help Scout, Gravatar, and Google—material for zero-US-processor policies. |
| No public ISO 27001 / SOC 2 | Not listed | Medium Compliance hub emphasizes product design and EU hosting rather than ISO/SOC certificates; orgs with mandatory cert checklists must request evidence or accept open-source + DPA packaging. |
| Self-host CE feature and release lag | Not listed | Low CE is free but long-term releases (~twice yearly) and omits Cloud-only funnels, journeys, ecommerce revenue, SSO, and advanced bot filtering—ops burden sits with you. |
| No multi-day user identity or replay | Not listed | Low Daily hash resets prevent cross-day visitor stitching by design; heatmaps/session replay are out of scope—teams needing those must add other tools. |
| Misconfiguration can reintroduce personal data | Not listed | Medium Passing emails, patient IDs, or other identifiers in URLs or custom properties undermines the non-PII model; vendor also states no HIPAA/BAA. |
When: You want simple hosted EU privacy page analytics with a strong Plausible-style product footprint
Consider: Plausible Analytics
Compare event depth: Insights markets custom events as a core differentiator vs simpler page-focused tools.
When: You want cookie-free analytics with an explicit privacy brand and different commercial packaging
Consider: Simple Analytics
Verify each vendor's hosting and subprocessor pages side by side.
When: You prefer a German peer privacy analytics product
Consider: Pirsch Analytics
Compare event features, regions, and legal docs for your DPA process.
When: You need full control of the stack or on-prem processing
Consider: Self-hosted Matomo (or similar open analytics)
Higher ops cost; no dependency on Insights SaaS or Firebase.
When: You need Matomo-depth features (heatmaps, session recording, heavy on-prem packaging)
Consider: Friendly Analytics, Piwik PRO, or self-hosted Matomo
Trade Plausible’s minimalism for plugin breadth and different operators.
When: You want a lean EU privacy analytics peer with a different stack or license posture
Consider: Pirsch Analytics or Simple Analytics
Compare hosting ownership, funnels/ecommerce gates, and self-host options side by side.
When: You only need edge-level basic counts and already run Cloudflare
Consider: Cloudflare Web Analytics
Simpler install path; US company and thinner marketing analytics surface.
When: You need free hosted analytics and accept Google’s data practices
Consider: Google Analytics
Different legal and commercial model—not an EU privacy substitute.