Offen Fair Web Analytics vs Publytics

Compare Offen Fair Web Analytics and Publytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Offen Fair Web Analytics

Germany· Web Analytics

Needs review

Shortlist when you want self-hosted, Apache-2.0 analytics that only measures after opt-in, encrypts events in the browser, and lets visitors open their own data in the Auditorium. Skip when you need cookieless full-coverage metrics, session replay/heatmaps, or zero-ops managed EU hosting—consider Plausible, Pirsch, or Friendly Analytics instead.

Opt-in onlyBrowser E2E encryptionSelf-hostedApache-2.0Visitor data accessBerlin-based project

View listing Visit Website

Publytics

Italy· Web Analytics

Needs review

Shortlist when you need cookieless, unsampled publisher analytics with multi-site Network views and a public EU DPA from an Italian SaaS operator. Skip when you need self-hosting, product analytics at GA4/Adobe depth, or product-level ISO/SOC—consider Plausible (simpler privacy analytics / self-host options) or Matomo (self-host ownership) instead.

Cookieless trackingNo default samplingMulti-site NetworkEU-hosted (EuroVPS/Hetzner)Public B2B DPAPublisher-focused UX

View listing Visit Website

Highlighted rows differ between the two products.

Offen Fair Web Analytics vs Publytics: Snapshot
Feature	Offen Fair Web Analytics	Publytics
Country of origin	Germany	Italy
Category	Web Analytics	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	Germany	Italy
Legal entity	Public legal notice lists Frederik Ring, Berlin (offen.software); product authors Frederik Ring and Hendrik Niefeld—no separate GmbH name verified on imprint	Publytics S.r.l. / Publytics SRL, Via Val Leventina 3 INT 1, 20148 Milan (MI), Italy (VAT IT13079420967)
Governing law	Germany (indicative from Berlin imprint)	Italy / EU GDPR (processor under published DPA)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Product is operator self-hosted (your VPS/cloud/on-prem). No Offen multi-tenant analytics SaaS or vendor subprocessor list for visitor events. Related marketing site (offen.software) names Hetzner Online GmbH (Germany) as host—not the analytics data path. Optional community deploys include Heroku (operator choice).	Analytics infrastructure subprocessors in public DPA: EuroVPS (Euclid Services Ltd, Cyprus) and Hetzner Online GmbH (Germany). Data policy/DPA: EU storage (NL, DE, FI; DPA also IT); no transfer outside the EU for analytics processing. Account path: Stripe (payments), Brevo/Sendinblue (email).
Summary	Open-source, self-hosted web analytics with opt-in consent, browser-side end-to-end encryption, and a shared Auditorium so visitors can see and control their own usage data.	Cookieless web analytics SaaS for digital publishers: unsampled real-time and historical metrics, multi-site Network views, GA import, and EU-hosted measurement from an Italian company.
Tags	privacy gdpr analytics open-source self-hosted opt-in e2e-encryption	privacy gdpr web-analytics cookieless publishers real-time

At a glance: Offen Fair Web Analytics vs Publytics
At a glance	Offen Fair Web Analytics	Publytics
HQ / authors	Berlin, Germany (Frederik Ring & Hendrik Niefeld)	Not listed
License	Apache-2.0 (code/docs); logo CC-BY-NC-ND-4.0	Not listed
Delivery	Self-host only (binary, Docker, community deploys)	Not listed
Consent model	Opt-in only; first-party cookies	Not listed
Default retention	6 months (configurable shorter)	Not listed
Funding note	NLnet NGI support (project-stated)	Not listed
HQ	Not listed	Milan, Italy
Legal entity	Not listed	Publytics S.r.l. (VAT IT13079420967)
Hosting	Not listed	EuroVPS + Hetzner (EU regions)
Deployment	Not listed	Managed SaaS (not self-hosted)
Commercial model	Not listed	Pageview tiers; free trial
Open source	Not listed	No (tracker uses MIT library code)

Key capabilities: Offen Fair Web Analytics vs Publytics
Key capabilities	Offen Fair Web Analytics	Publytics
Opt-in only	Yes	Not listed
Browser E2E encryption	Yes	Not listed
Self-hosted	Yes	Not listed
Apache-2.0	Yes	Not listed
Visitor data access	Yes	Not listed
Berlin-based project	Yes	Not listed
Cookieless tracking	Not listed	Yes
No default sampling	Not listed	Yes
Multi-site Network	Not listed	Yes
EU-hosted (EuroVPS/Hetzner)	Not listed	Yes
Public B2B DPA	Not listed	Yes
Publisher-focused UX	Not listed	Yes

Offen Fair Web Analytics

Opt-in only collection with first-party cookies
No analytics events are recorded until the visitor actively consents. Cookies are first-party and the tracker is meant to run on a same-site subdomain so third-party cookie restrictions and cross-site tracking models do not apply. Visitors who never opt in leave no usage trail—expect lower absolute volumes than cookieless tools that measure by default.
Browser-side end-to-end encryption of usage events
Clients encrypt usage data before it leaves the browser; the server stores ciphertext and cannot decrypt events alone. Only the visitor (via their cookie) and the matching operator account can open that visitor's data in the Auditorium. Practical impact: a compromised database or overly broad ops access does not yield plaintext browsing histories the way a typical self-hosted analytics DB would.
Auditorium for both operators and visitors
Operators see aggregates across pages where the installation is active (unique users/sessions, top pages, filters). Each opted-in visitor can open the same style of UI for their own data only, with plain-language metric explanations, and can delete data or fully opt out later. This is the fair design point: measurement is not a one-way glass.
Essential metrics without IP or User-Agent capture
Dashboards cover real-time activity, page views, unique users and sessions, bounce rate, returning users, top pages, referrers, UTM campaign/source, landing and exit pages, weekly retention, and load time. Location is country-level from timezone mapping; mobile share uses orientation capability—not IP geolocation or UA parsing. No heatmaps, session replay, or warehouse-grade product analytics.
Lightweight self-host: binary, Docker, SQLite or SQL
Production installs use a single binary (Linux/Windows/macOS) or the offen/offen image; docs also cover Heroku, Uberspace, and YunoHost. Default store is SQLite; MySQL and Postgres are supported. AutoTLS can request Let's Encrypt certificates. Config is environment variables or offen.env. You own uptime, backups, SMTP for password reset, and the subdomain layout.
Multi-site accounts, teams, and short retention
One installation can cover multiple websites with shared team access. Default retention is six months with automatic deletion; operators can shorten retention (e.g. 12 weeks, 30 days, 7 days) knowing shorter values purge older events on startup. Consent banner appearance is customizable; UI locales include EN, DE, FR, ES, PT, and VI.

Publytics

Unsampled real-time and daily publisher metrics
Dashboard and Real-time views show active users (including last-minute and 30-minute windows), top pages, sources, social referrals, and day trends—with minute-level trend comparison documented for real-time. Vendor states no default data sampling, so reports reflect full counted client-side traffic rather than GA-style estimates on large properties.
Multi-site Network mode for content portfolios
Business and Enterprise plans can group properties into Networks (plan caps apply: e.g. up to three Networks on Business, unlimited on Enterprise). Network views mirror site dashboards with split-by-site filters, combined real-time tables, and PDF/CSV export across the portfolio—built for multi-brand publishers rather than single blogs.
Cookieless measurement with daily-rotating visitor hash
Tracking avoids cookies and permanent device IDs. Per the DPA, IP and User-Agent are used only to derive a daily salted hash for unique visitors, then discarded; metrics stay aggregated (URL, referrer, browser/OS, device, country). Designed so many sites can skip consent banners for analytics alone—confirm with counsel for your jurisdictions and any custom IDs you add.
Historical import, custom events/dimensions, and API
Import paths cover GA4 and other tools (Plausible/Fathom mentioned) with support-assisted finalization. Custom events, dimensions, and metrics scale by plan; REST API uses Sanctum Bearer tokens scoped to subscribed sites. Fits teams rebuilding GA-era reporting without rebuilding infrastructure.
AI referral traffic reporting
Dedicated documentation for traffic referred from AI systems (ChatGPT, Gemini, Claude, Perplexity, Copilot, Mistral, Google AI Overviews, Deepseek, and others). Useful for publishers optimizing for answer-engine and AI-overview discovery alongside classic SEO sources.

Assurance & compliance: Offen Fair Web Analytics vs Publytics
Assurance & compliance	Offen Fair Web Analytics	Publytics
Independent security / architecture audit	Not found No public third-party audit PDF found; coordinated disclosure via SECURITY.md email only.	Not found Searched official site; no public third-party security or no-logs audit PDF found. DPA describes hashing and non-retention of raw IP/UA.
ISO 27001	Not found No public ISO 27001 certification claim found on official site or docs.	Not found No Publytics product certificate found. Host EuroVPS markets ISO certifications; that is infrastructure provider scope, not Publytics certification.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No public SOC 2/3 report found on official Publytics pages.
GDPR / EU data protection	Vendor claimed EU authors; opt-in, data minimization (no IP/UA), visitor access/erasure, short default retention, Datensparsamkeit framing. Self-host means operator remains controller—confirm your legal basis and notice.	Vendor claimed Italian controller/processor entity; cookieless design; public Art. 28 DPA; EU hosting named. Not legal advice.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: no known US parent; product not delivered as US-hosted vendor SaaS. Operator-chosen infrastructure (including optional Heroku/US cloud) can still create CLOUD Act paths for stored ciphertext/metadata. Not legal advice.	Partial EU entity, no known US parent; analytics hosts EuroVPS + Hetzner in EU with DPA no third-country transfer for service data. Account billing via Stripe (US company). Not a vendor 'safe' claim—EuropeanStack assessment only.
Data processing agreement (B2B)	Not applicable No multi-tenant vendor analytics processing relationship documented; operator self-hosts and is typically controller. Custom development/support via offen.software is separate from a standard SaaS DPA.	Vendor claimed Full public DPA at https://publytics.net/dpa with Annex B subprocessors and Annex C security/transfer instructions.
EU AI Act	Not applicable Web analytics metrics product; not an AI system product.	Not applicable Web analytics product; AI-referral reporting is measurement of referrers, not an AI system product.

Considerations & known limitations: Offen Fair Web Analytics vs Publytics
Considerations & known limitations	Offen Fair Web Analytics	Publytics
Opt-in undercounts absolute traffic	High Visitors who never consent generate no events. Growth and content KPIs will not match cookieless tools or GA-style default measurement—treat as design, not a misconfiguration.	Not listed
You own uptime, backups, and secrets	Medium No managed Offen cloud. Operators must run HTTPS/subdomain layout, set OFFEN_SECRET for stable sessions, configure SMTP for resets, and back up SQLite/SQL—plus avoid reverse proxies that log IPs if minimization is a goal.	Not listed
E2E crypto is vendor-claimed architecture	Medium Browser-side encryption and server inability to decrypt are core claims from project docs/README, not independently audited in public materials found. Security-sensitive orgs should review source or commission assessment.	Not listed
Hosting choice reintroduces cloud jurisdiction	Medium Self-host on US-group cloud or Heroku means CLOUD Act/subprocessor analysis shifts to your host even though Offen itself is Berlin-based OSS without a vendor SaaS region map.	Not listed
No public ISO/SOC or audit pack	Low Procurement checklists that require vendor ISO 27001/SOC 2 will stall; evidence is open source and design docs, not cert registry entries.	Not listed
Essential metrics only	Medium No heatmaps, session replay, advanced funnels, or product-analytics warehouse features. Wrong tool if the shortlist criterion is UX research depth rather than fair traffic statistics.	Not listed
SaaS-only (no self-host)	Not listed	Medium All measurement depends on Publytics cloud availability and vendor roadmap. Teams with residency or air-gap requirements need Matomo/Plausible CE-style self-host alternatives.
No public independent security audit	Not listed	Medium Hashing and non-retention claims are first-party (DPA/docs). No public third-party audit was found—enterprise security reviews will need questionnaires, DPA audit rights, and possibly NDA materials.
Feature depth tied to pageview tiers	Not listed	Low Networks, API rate limits, custom dimensions/metrics, retention years, and time granularity differ by Lite/Business/Enterprise. Validate limits against portfolio size before migration.
US payment processor on account path	Not listed	Low Stripe processes payments (US company). Separate from DPA Annex B analytics hosts, but relevant if procurement treats all vendor SaaS touchpoints as in-scope for CLOUD Act diligence.
Customer-injected identifiers can re-identify	Not listed	Medium DPA warns controllers not to inject unique user IDs that re-identify visitors via the script. Misconfiguration can undermine the cookieless privacy model.

Fit

Offen Fair Web Analytics

Best fit when

Public-sector, media, NGO, or mission-driven sites that need visitor-visible transparency and strict opt-in
EU teams that must keep analytics off third-party trackers and can run a small always-on instance
Operators who want first-party subdomain cookies, CSP-aware embedding, and no IP/User-Agent collection
Organisations evaluating fair-processing design over maximum measurement coverage
Teams comfortable with SQLite or SQL self-host ops (binary or Docker) and publishing their own privacy notice

Poor fit when

Product or growth teams that require near-complete traffic measurement without consent friction
Needs for heatmaps, session replay, funnels, or ad-ecosystem attribution comparable to Hotjar/Mixpanel/GA
Buyers seeking a vendor-managed multi-tenant analytics cloud with SLAs and a signed vendor DPA as processor
Large enterprises that require public ISO 27001/SOC 2 or third-party security audit packs before shortlist

Consider instead when

When: You want privacy-oriented analytics with managed EU hosting and lower consent friction
Consider: Plausible Analytics or Pirsch Analytics
Typically optimised for simpler cookieless or low-friction models and hosted plans; less radical visitor Auditorium design than Offen.
When: You need EU hosted privacy analytics with operator support and less self-host burden
Consider: Friendly Analytics
European catalog peer oriented to hosted privacy analytics; compare consent model and feature depth to Offen’s opt-in + E2E approach.
When: You need deep product analytics, funnels, or session UX tooling rather than fair traffic metrics
Consider: Hotjar, Mixpanel, or a full GA4 stack (with legal review)
Different category: richer product/UX analytics, different jurisdiction and subprocessor profile.

Publytics

Best fit when

Content publishers and media sites that want GA3-style reporting without cookies or default sampling
Multi-brand portfolios that need Network dashboards, split-by-site filters, and shared exports
Teams migrating historical series from GA4 (or Plausible/Fathom) into a privacy-oriented SaaS
EU-oriented controllers who want Italian legal entity, published DPA, and EU infrastructure subprocessors named in annexes
Editorial/SEO leads who need real-time active users, sources, and AI-referral reporting without operating self-hosted analytics

Poor fit when

Organizations that require self-hosted or open-source analytics only
Product/growth teams that need GA4/Adobe-class event modeling, experiment stacks, and ads ecosystem integrations
Buyers that need verified product ISO 27001/SOC 2 certificates before shortlist (none found for Publytics itself)
Very simple single-site blogs that only need minimal privacy metrics—lighter tools may be enough

Consider instead when

When: You want open-core privacy analytics with optional self-host
Consider: Plausible Analytics
Simpler surface; stronger self-host/open-core path than Publytics SaaS-only model
When: You must run analytics on your own infrastructure
Consider: Matomo (self-host) or Plausible Community Edition
Publytics is managed cloud only—no official on-prem product
When: You need deep product analytics and marketing stack integration
Consider: Google Analytics or Adobe Analytics
Trade privacy/EU-hosting priorities for ecosystem breadth

Open questions for due diligence

Offen Fair Web Analytics

Will your traffic and KPI model tolerate opt-in-only measurement after a pilot on a non-critical property?
Where will you host the instance (EU on-prem/VPS vs US-group cloud), and who holds OFFEN_SECRET and DB backups?
Do procurement rules require third-party audits or ISO/SOC that Offen does not publish?
Do you need a signed vendor DPA as processor, or is controller-only self-host acceptable to counsel?
Is subdomain + CSP (script-src/frame-src + unsafe-inline styles for the banner) feasible on your main site?

Publytics

Will Publytics provide completed security questionnaire, pen-test summary, or ISO evidence under NDA for enterprise procurement?
Exact current pageview tier limits, Network caps, and retention for the sites you will migrate?
Is GA4 historical import complete for your property structure (events, custom dimensions) or only core traffic series?
How are subprocessors for account services (Stripe, Brevo) contractually covered relative to the analytics DPA annex?
Any planned US or non-EU hosting options that would change the current EU-only transfer instruction?