JENTIS vs Tinylytics

Compare JENTIS and Tinylytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

JENTIS

Austria· Web Analytics

Needs review

Shortlist when you need managed server-side / first-party capture with EU-entity hosting and multi-destination activation (ads + analytics). Skip when you only want lightweight privacy analytics or free self-hosted tagging—consider Piwik PRO or etracker for EU analytics-first stacks, or Google sGTM if you will operate a Google-centric pipeline yourself.

EU-operated (Austria)Server-side tag managerEU/EEA hosting (claimed)ISO 27001 (claimed)Managed SaaSNot open source

View listing Visit Website

Tinylytics

United Kingdom· Web Analytics

Needs review

Shortlist Tinylytics when you want cookieless page analytics plus bundled uptime/SSL/content checks for a handful of small sites, with primary data on Hetzner in Germany and founder support. Skip when you need self-host/open source, formal ISO/SOC packs, or enterprise multi-tenant governance—consider Plausible Analytics or Simple Analytics instead.

Cookieless analyticsPrimary host: Hetzner DEUptime + SSL monitoringBroken-link crawlsSaaS only (no self-host)Solo-founder UK

View listing Visit Website

Highlighted rows differ between the two products.

JENTIS vs Tinylytics: Snapshot
Feature	JENTIS	Tinylytics
Country of origin	Austria	United Kingdom
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Austria	United Kingdom
Legal entity	JENTIS GmbH	Vincent Ritter Consulting (service brand; terms state not separately incorporated yet)
Governing law	Austria / EU GDPR	Not clearly stated as a single governing-law clause on the public terms page; confirm contractually
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Product: default EU/EEA-only processing on ISO 27001-certified cloud; docs cite IONOS cloud (Germany/EU). Exact host/region named in customer DPA. Optional non-EU instances may add non-EU subprocessors if selected. Marketing website separately uses Host Europe (DE) and US SaaS (HubSpot, Salesforce, Google) for corporate CRM/ads—not the Twin Server product path.	Primary analytics storage: Hetzner Falkenstein (Germany). CDN/security: Cloudflare. Error monitoring: Sentry.io. Payments: Paddle and Lemon Squeezy (Stripe company). Optional: IPinfo geo fallback for API hits; opt-in AI Insights via xAI and Google Gemini. No public backup-provider detail beyond that stack.
Summary	Austrian managed server-side data capture and hybrid tag manager: first-party Twin Server collection, consent-aware routing, and ad activation for multi-tool MarTech stacks.	Privacy-first cookieless web analytics for small sites, with bundled uptime/SSL checks, content monitoring, events, and founder support—hosted primarily on Hetzner in Germany.
Tags	gdpr server-side-tracking tag-management first-party-data martech austria	gdpr analytics privacy cookie-free uptime-monitoring indie api

At a glance: JENTIS vs Tinylytics
At a glance	JENTIS	Tinylytics
HQ	Vienna, Austria	Not listed
Legal entity	JENTIS GmbH (FN 529675i)	Not listed
Founded	2020	Not listed
Product type	Managed server-side data capture / hybrid tag manager	Not listed
Hosting model	Managed SaaS; EU/EEA by default (IONOS cited in docs)	Not listed
Open source	No	Not listed
Self-hosted product	No (managed hosting)	Not listed
Commercial model	Sales-led SaaS (demo / consultation)	Paid site-count plans; short trial; no permanent free tier
HQ / operator	Not listed	Vincent Ritter Consulting, United Kingdom
Launched	Not listed	12 June 2023 (live counters on homepage)
Primary hosting	Not listed	Hetzner, Falkenstein, Germany
Deployment	Not listed	Managed SaaS only (not open source, not self-hosted)
Differentiators	Not listed	Analytics + uptime/SSL/content monitoring + widgets

Key capabilities: JENTIS vs Tinylytics
Key capabilities	JENTIS	Tinylytics
EU-operated (Austria)	Yes	Not listed
Server-side tag manager	Yes	Not listed
EU/EEA hosting (claimed)	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
Managed SaaS	Yes	Not listed
Not open source	Yes	Not listed
Cookieless analytics	Not listed	Yes
Primary host: Hetzner DE	Not listed	Yes
Uptime + SSL monitoring	Not listed	Yes
Broken-link crawls	Not listed	Yes
SaaS only (no self-host)	Not listed	Yes
Solo-founder UK	Not listed	Yes

JENTIS

Hybrid server-side tag management
One container for client- and server-side tags with first-party DNS; migrate data-layer logic and debug from browser hit to server dispatch without running your own sGTM fleet.
Twin Server capture and transforms
Server-side session mirror that can pseudonymize, anonymize, enrich, and time-frame parameters before forwarding—usable as a CNIL-style proxy pattern when configured carefully.
Essential Mode for non-consent traffic
Configurable minimized/anonymized capture when marketing consent is refused so sessions and conversions are not fully invisible—subject to DPO/legal sign-off per jurisdiction.
Synthetic Users for ad activation
Models trained on consented first-party data produce synthetic conversion signals for Google, Meta, TikTok, and other ad APIs; measure impact with holdouts—legal basis is configuration-specific.
Managed EU connectors and raw export
Vendor-maintained connectors across analytics, ads, and MarTech plus raw data export/API-style control; not a self-hosted open-source stack.

Tinylytics

Cookie-free unique hits with rotating salts
Page views and unique hits without tracking cookies or fingerprinting. Uniques combine truncated request signals with a 12-hour rotating salt and one-way hash, reset daily at midnight UTC; visitor IPs are not stored in hits. Suited to indie sites that want trendable uniques without consent banners for analytics cookies.
Thunder Clap uptime, SSL, and domain alerts
In-house multi-region health checks (default every 10 minutes) confirm downtime before emailing, plus SSL expiry notices and domain monitoring. Ultra can shorten intervals. Replaces a separate uptime tool for small fleets—but false downs can occur if WAFs block the Tinylytics monitor user-agent.
Daily content crawl for broken links and mixed content
Subscribed sites can crawl up to 50 pages (two levels deep) on a daily cadence, flagging broken links and mixed HTTP assets on HTTPS pages, with ignore lists and re-check. Ultra adds optional AI spell-check on visible copy—keep it off if AI subprocessors are out of policy.
Attribute-based event tracking (beta)
Enable events on the embed script and mark elements with data-tinylytics-event using category.action names (optional values for downloads). No GTM required; beacon mode helps navigations. Still beta—expect API/schema changes and incomplete capture under aggressive blockers.
Public stats, kudos, hit counters, API, and webhooks
Share passcode-protected public stats, embed hit counters and kudos buttons, export CSV, call the documented API, and push signed webhooks for visits, events, and monitoring. Built for transparent blogs and light automation rather than enterprise BI warehouses.

Assurance & compliance: JENTIS vs Tinylytics
Assurance & compliance	JENTIS	Tinylytics
Independent security / no-logs audit	Not found No public independent no-logs or third-party security audit PDF located; ISO is the main public assurance claim.	Not found No public third-party security or no-logs audit report found on official docs.
ISO 27001	Vendor claimed Vendor states ISO 27001 / ISO 27001:2013 certification on site footer and privacy docs; certificate not independently verified in this draft.	Not found No ISO 27001 claim found on privacy, compliance, or hosting pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found on marketing or privacy docs.	Not found No SOC 2/3 report or claim found on public site.
GDPR / EU data protection	Vendor claimed Austrian controller entity; product marketed as privacy-by-design processor with EU hosting, CMP hooks, and transform functions. Not legal advice—confirm config and DPA.	Vendor claimed Vendor documents GDPR-oriented design (cookieless, data minimisation, EU primary host, deletion). Not independent certification.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: AT entity and no known US parent; product hosting claimed EU-only (e.g. IONOS). Residual exposure via customer-chosen US destinations and any non-EU instance option. Not legal advice.	Partial UK operator, no known US parent, primary host Hetzner DE; partial exposure via Cloudflare, Sentry, Lemon Squeezy/Paddle, optional IPinfo and opt-in US AI APIs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Sample DPA via Customer Legal Hub; required for SaaS processing. Confirm signed version and subprocessor annex.	Not found No public DPA/downloadable processor agreement found; ask the vendor before B2B rollout.
EU AI Act	Not applicable Core product is tag/data capture; Synthetic Users is ML-assisted but product is not marketed as a general-purpose AI system. Revisit if Synthetic Users becomes a primary regulated AI offering.	Not applicable Core product is analytics/monitoring; optional AI insights are secondary and opt-in.

Considerations & known limitations: JENTIS vs Tinylytics
Considerations & known limitations	JENTIS	Tinylytics
Consent modes need legal sign-off	High Essential Mode and Synthetic Users can re-open measurement when users refuse cookies; legality depends on jurisdiction, configuration, and DPO assessment—not automatic compliance.	Not listed
Downstream US ad/analytics tools	Medium Even with EU capture, enabling Google/Meta/TikTok connectors can transfer personal data to US providers; use transforms/proxy patterns and transfer tools as required.	Not listed
ISO claimed; limited public audits	Medium ISO 27001 is vendor-asserted; no independent public security/no-logs audit found. Request certificate, pen-test summaries, and full subprocessor list under NDA if needed.	Not listed
Managed SaaS, not self-host	Medium No open-source self-host product path; ops simplicity trades for vendor dependency, sales-led pricing, and migration cost if you later leave.	Not listed
Implementation and data-layer effort	Low Migration from client-side tags still needs DNS, data layer, CMP mapping, and QA—vendor connectors reduce but do not eliminate engineering work.	Not listed
US-group subprocessors on the data path	Not listed	Medium Cloudflare, Sentry, payment processors (incl. Lemon Squeezy/Stripe group), optional IPinfo and opt-in xAI/Gemini mean the stack is not EU-only end-to-end despite Hetzner primary storage.
Solo-founder operational concentration	Not listed	Medium Service is provided by Vincent Ritter Consulting / a solo developer. Support is personal and fast for indies, but bus-factor and formal SLA expectations differ from larger vendors.
No public ISO/SOC/audit or DPA pack	Not listed	Medium Enterprise security questionnaires will hit gaps until the vendor supplies audits and a B2B DPA under NDA or email.
Scale and feature boundaries	Not listed	Low Content crawls are depth/page limited; event tracking is beta; fair-usage applies to extreme hit volumes; no self-host escape hatch.
Optional AI shares aggregated analytics	Not listed	Low AI Insights and related AI spell-check are opt-in and send aggregated (not visitor PII per vendor) data to third-party AI providers—leave disabled under strict AI policies.

Fit

JENTIS

Best fit when

E-commerce and multi-brand sites that lose conversion data to blockers, ITP, and consent drop-off
Performance marketing teams activating into Google, Meta, TikTok, and other ad APIs from first-party events
Analytics/DPO pairs that need data-point-level governance, CMP sync, and pseudonymization before third-country tools
Organizations preferring a managed EU capture layer over self-operated server-side GTM
Stacks that feed both EU analytics (e.g. Piwik PRO) and global ad platforms from one collection path

Poor fit when

Teams seeking free, open-source, or fully self-hosted analytics only
Lightweight privacy page analytics without ad activation or hybrid tag management
Buyers who cannot run sales-led procurement, data-layer work, and legal review of consent modes
Use cases that need a full CDP/BI product rather than capture and routing

Consider instead when

When: You primarily need EU privacy-focused web analytics (and optional self-host), not multi-destination ad activation
Consider: Piwik PRO or etracker
JENTIS can still sit in front of Piwik PRO; choose the analytics product when capture is not the bottleneck.
When: You are Google-only and will operate server-side GTM yourself
Consider: Google Tag Manager (server-side) + GA4
Lower cash cost; higher ops burden and different transfer/jurisdiction posture.
When: You need a full customer data platform or enterprise analytics suite
Consider: Adobe Analytics or a dedicated CDP (e.g. Tealium)
JENTIS is capture/routing at the start of the chain, not a CDP replacement.

Tinylytics

Best fit when

Indie blogs, portfolios, and side projects that want simple cookieless stats without Google Analytics
Small sites that also want uptime, SSL expiry, and broken-link checks in the same tool
Operators who prefer founder-answered support and lightweight embeds over enterprise marketing stacks
Teams OK with managed EU primary hosting and willing to review named US-group subprocessors (CDN, payments, optional AI)
Agencies managing a modest number of client sites with public stats or kudos-style engagement widgets

Poor fit when

Orgs that require self-hosted collectors or open-source audit of the full analytics stack
Procurement needing published ISO 27001, SOC 2, independent audits, or a downloadable DPA out of the box
Very high-traffic properties needing contractual capacity/SLA commitments beyond fair-usage conversation
Policies that ban Cloudflare/Sentry/US payment or optional US AI APIs on any data path
Teams that need session replay, heatmaps, or deep advertising attribution (Clarity/GA territory)

Consider instead when

When: You need open-source and optional self-hosting of the analytics stack
Consider: Plausible Analytics
Estonian product with Cloud plus Community Edition self-host; less bundling of uptime/content monitors.
When: You want European cookieless analytics with a simpler analytics-only scope
Consider: Simple Analytics
Strong privacy positioning; compare feature depth and monitoring separately.
When: You need free-at-scale marketing analytics, ads integrations, or attribution depth
Consider: Google Analytics (incumbent) — or stay on a privacy tool if GA is disallowed
Different privacy and sovereignty profile entirely.
When: You need session replay or heatmaps and accept that privacy model
Consider: Microsoft Clarity or specialised replay tools
Tinylytics deliberately avoids fingerprinting-style session products.

Open questions for due diligence

JENTIS

What is the exact production cloud provider, region, and subprocessor list on the current DPA annex?
Can the vendor produce a current ISO 27001 certificate and any independent penetration-test summary?
Has legal counsel approved Essential Mode and Synthetic Users for your markets (ePrivacy/GDPR basis)?
Which destinations will receive personal data vs pseudonymized/synthetic signals only?
What SLA, raw data retention, and exit/export terms apply to your tier?

Tinylytics

Will Vincent Ritter Consulting sign a GDPR Article 28 DPA and provide a current subprocessor list under contract?
Are backups/DR and email delivery fully covered by the named providers, or are there additional hosts?
Is there any roadmap for independent security review, SOC 2, or ISO 27001?
What contractual terms apply for accounts consistently above the fair-usage hit threshold?
For AI Insights: exact retention, regions, and processor terms at xAI and Google for the paid API plans used?