Offen Fair Web Analytics vs Pulse by Ciphera

Compare Offen Fair Web Analytics and Pulse by Ciphera on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics

Offen Fair Web Analytics

Germany· Web Analytics

Needs review

Shortlist when you want self-hosted, Apache-2.0 analytics that only measures after opt-in, encrypts events in the browser, and lets visitors open their own data in the Auditorium. Skip when you need cookieless full-coverage metrics, session replay/heatmaps, or zero-ops managed EU hosting—consider Plausible, Pirsch, or Friendly Analytics instead.

Opt-in onlyBrowser E2E encryptionSelf-hostedApache-2.0Visitor data accessBerlin-based project

View listing Visit Website

Pulse by Ciphera

Belgium· Web Analytics

Needs review

Shortlist Pulse when you want cookieless traffic analytics plus uptime and Lighthouse in one Belgian-operated, Swiss-hosted SaaS and can accept a closed managed backend. Skip when you need full self-hosting or GA-style user-level history; consider Plausible Analytics or Simple Analytics instead.

EU-operatedCookielessOpen-source clientSwiss-hosted dataNo analytics cookies

View listing Visit Website

Highlighted rows differ between the two products.

Offen Fair Web Analytics vs Pulse by Ciphera: Snapshot
Feature	Offen Fair Web Analytics	Pulse by Ciphera
Country of origin	Germany	Belgium
Category	Web Analytics	Web Analytics
Open source	Yes	Yes
Self-hosted	Yes	No
Headquarters	Germany	Belgium
Legal entity	Public legal notice lists Frederik Ring, Berlin (offen.software); product authors Frederik Ring and Hendrik Niefeld—no separate GmbH name verified on imprint	Ciphera BV
Governing law	Germany (indicative from Berlin imprint)	Belgian law (GDPR); Swiss FADP for infrastructure location
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
EU-hosted status	Not listed	Partial
Hosting / residency	Product is operator self-hosted (your VPS/cloud/on-prem). No Offen multi-tenant analytics SaaS or vendor subprocessor list for visitor events. Related marketing site (offen.software) names Hetzner Online GmbH (Germany) as host—not the analytics data path. Optional community deploys include Heroku (operator choice).	Primary compute and object storage on Exoscale in Switzerland (Zurich). Encrypted backups and domain registration via Infomaniak (Switzerland). CDN/DNS/DDoS via Bunny (Slovenia HQ, global edge for transient IPs). Payments via Mollie (Netherlands). GitHub (US) for public source code only, per Trust page.
Summary	Open-source, self-hosted web analytics with opt-in consent, browser-side end-to-end encryption, and a shared Auditorium so visitors can see and control their own usage data.	Cookie-free web analytics with traffic, funnels, uptime and Lighthouse checks in one Belgian-operated, Swiss-hosted dashboard.
Tags	open-source privacy gdpr analytics self-hosted opt-in e2e-encryption	open-source privacy gdpr cookie-free web-analytics cookieless

At a glance: Offen Fair Web Analytics vs Pulse by Ciphera
At a glance	Offen Fair Web Analytics	Pulse by Ciphera
HQ / authors	Berlin, Germany (Frederik Ring & Hendrik Niefeld)	Not listed
License	Apache-2.0 (code/docs); logo CC-BY-NC-ND-4.0	AGPL-3.0 client; managed backend closed
Delivery	Self-host only (binary, Docker, community deploys)	Not listed
Consent model	Opt-in only; first-party cookies	Not listed
Default retention	6 months (configurable shorter)	Not listed
Funding note	NLnet NGI support (project-stated)	Not listed
HQ	Not listed	Diegem, Belgium (Ciphera BV)
Legal entity	Not listed	Ciphera BV (KBO/BCE 1013.721.660)
Founded	Not listed	18 September 2024 (CBE)
Primary data region	Not listed	Switzerland (Exoscale Zurich)
Commercial model	Not listed	Free Hobby tier; paid plans by traffic scale
Cookieless	Not listed	Yes (vendor claim: no cookies, no fingerprinting)
Data residency regions	Not listed	Switzerland (Exoscale primary; Infomaniak backups)

Key capabilities: Offen Fair Web Analytics vs Pulse by Ciphera
Key capabilities	Offen Fair Web Analytics	Pulse by Ciphera
Opt-in only	Yes	Not listed
Browser E2E encryption	Yes	Not listed
Self-hosted	Yes	Not listed
Apache-2.0	Yes	Not listed
Visitor data access	Yes	Not listed
Berlin-based project	Yes	Yes
Cookieless	Not listed	Yes
Open-source client	Not listed	Yes
Swiss-hosted data	Not listed	Yes
No analytics cookies	Not listed	Yes

Offen Fair Web Analytics

Opt-in only collection with first-party cookies
No analytics events are recorded until the visitor actively consents. Cookies are first-party and the tracker is meant to run on a same-site subdomain so third-party cookie restrictions and cross-site tracking models do not apply. Visitors who never opt in leave no usage trail—expect lower absolute volumes than cookieless tools that measure by default.
Browser-side end-to-end encryption of usage events
Clients encrypt usage data before it leaves the browser; the server stores ciphertext and cannot decrypt events alone. Only the visitor (via their cookie) and the matching operator account can open that visitor's data in the Auditorium. Practical impact: a compromised database or overly broad ops access does not yield plaintext browsing histories the way a typical self-hosted analytics DB would.
Auditorium for both operators and visitors
Operators see aggregates across pages where the installation is active (unique users/sessions, top pages, filters). Each opted-in visitor can open the same style of UI for their own data only, with plain-language metric explanations, and can delete data or fully opt out later. This is the fair design point: measurement is not a one-way glass.
Essential metrics without IP or User-Agent capture
Dashboards cover real-time activity, page views, unique users and sessions, bounce rate, returning users, top pages, referrers, UTM campaign/source, landing and exit pages, weekly retention, and load time. Location is country-level from timezone mapping; mobile share uses orientation capability—not IP geolocation or UA parsing. No heatmaps, session replay, or warehouse-grade product analytics.
Lightweight self-host: binary, Docker, SQLite or SQL
Production installs use a single binary (Linux/Windows/macOS) or the offen/offen image; docs also cover Heroku, Uberspace, and YunoHost. Default store is SQLite; MySQL and Postgres are supported. AutoTLS can request Let's Encrypt certificates. Config is environment variables or offen.env. You own uptime, backups, SMTP for password reset, and the subdomain layout.
Multi-site accounts, teams, and short retention
One installation can cover multiple websites with shared team access. Default retention is six months with automatic deletion; operators can shorten retention (e.g. 12 weeks, 30 days, 7 days) knowing shorter values purge older events on startup. Consent banner appearance is customizable; UI locales include EN, DE, FR, ES, PT, and VI.

Pulse by Ciphera

Cookieless traffic dashboard
Pageviews, unique-visitor estimates, referrers, UTM campaigns, device or browser splits, and country-level geo from a single script tag, without cookies or fingerprinting according to Ciphera's privacy docs.
Journeys and conversion funnels
Step-by-step path columns and multi-step funnels with drop-off analysis, filterable by page, country, device, or referrer for privacy-preserving conversion debugging.
Uptime monitors with alert routes
Built-in uptime checks with downtime and recovery alerts to email, Slack, Discord, or a webhook, so availability sits beside traffic in one console.
Daily Lighthouse and Core Web Vitals
Scheduled mobile and desktop Lighthouse runs with performance, accessibility, best-practices, SEO scores, and Core Web Vitals trends without a separate RUM product.
Inspectable AGPL client and read API
Dashboard and tracking script are AGPL-3.0 on GitHub; Ciphera also documents a public read API, CLI, and export paths while keeping the managed backend closed.

Assurance & compliance: Offen Fair Web Analytics vs Pulse by Ciphera
Assurance & compliance	Offen Fair Web Analytics	Pulse by Ciphera
Independent security / architecture audit	Not found No public third-party audit PDF found; coordinated disclosure via SECURITY.md email only.	Not found Trust page states no independent audit yet; Tessera self-audit published; independent audit planned.
ISO 27001	Not found No public ISO 27001 certification claim found on official site or docs.	Not found Ciphera explicitly states it holds no ISO 27001 certification.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found Ciphera explicitly states it holds no SOC 2 certification.
GDPR / EU data protection	Vendor claimed EU authors; opt-in, data minimization (no IP/UA), visitor access/erasure, short default retention, Datensparsamkeit framing. Self-host means operator remains controller—confirm your legal basis and notice.	Vendor claimed Belgian controller; privacy policy describes GDPR/FADP bases and Pulse processor role. Not legal advice.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: no known US parent; product not delivered as US-hosted vendor SaaS. Operator-chosen infrastructure (including optional Heroku/US cloud) can still create CLOUD Act paths for stored ciphertext/metadata. Not legal advice.	Partial EU (Belgian) entity with no known US parent; primary hosts are European (Exoscale, Infomaniak, Bunny, Mollie). Residual paths: GitHub (US) for source code only; Bunny global edge for transient IPs. Indicative only, not legal advice.
Data processing agreement (B2B)	Not applicable No multi-tenant vendor analytics processing relationship documented; operator self-hosts and is typically controller. Custom development/support via offen.software is separate from a standard SaaS DPA.	On request / NDA Privacy policy: DPA available on request at privacy@ciphera.net for Pulse processor relationships.
EU AI Act	Not applicable Web analytics metrics product; not an AI system product.	Not applicable Web analytics product; not an AI system product page.

Considerations & known limitations: Offen Fair Web Analytics vs Pulse by Ciphera
Considerations & known limitations	Offen Fair Web Analytics	Pulse by Ciphera
Opt-in undercounts absolute traffic	High Visitors who never consent generate no events. Growth and content KPIs will not match cookieless tools or GA-style default measurement—treat as design, not a misconfiguration.	Not listed
You own uptime, backups, and secrets	Medium No managed Offen cloud. Operators must run HTTPS/subdomain layout, set OFFEN_SECRET for stable sessions, configure SMTP for resets, and back up SQLite/SQL—plus avoid reverse proxies that log IPs if minimization is a goal.	Not listed
E2E crypto is vendor-claimed architecture	Medium Browser-side encryption and server inability to decrypt are core claims from project docs/README, not independently audited in public materials found. Security-sensitive orgs should review source or commission assessment.	Not listed
Hosting choice reintroduces cloud jurisdiction	Medium Self-host on US-group cloud or Heroku means CLOUD Act/subprocessor analysis shifts to your host even though Offen itself is Berlin-based OSS without a vendor SaaS region map.	Not listed
No public ISO/SOC or audit pack	Low Procurement checklists that require vendor ISO 27001/SOC 2 will stall; evidence is open source and design docs, not cert registry entries.	Not listed
Essential metrics only	Medium No heatmaps, session replay, advanced funnels, or product-analytics warehouse features. Wrong tool if the shortlist criterion is UX research depth rather than fair traffic statistics.	Not listed
Managed backend is not open source	Not listed	Medium You can audit the browser script and dashboard code, but not the operated ingestion and storage service. Procurement that requires full-stack self-host or full server auditability should look elsewhere.
No ISO/SOC or independent audit yet	Not listed	Medium Ciphera publishes threat models, a warrant canary, and a subprocessor list, but explicitly has no ISO 27001 or SOC 2 and no completed independent audit. Enterprise security reviews will need questionnaires and a signed DPA.
Primary data residency is Switzerland, not EU/EEA	Not listed	Low Swiss adequacy covers many GDPR transfer questions, but policies that hard-require EU/EEA datacenter soil will classify this as partial rather than EU-hosted.
Marketing vs privacy wording conflicts	Not listed	Low Product FAQ pages disagree on whether custom events ship today and whether a DPA is needed. Prefer privacy@ and the privacy policy for legal commitments until Ciphera aligns the FAQs.

Fit

Offen Fair Web Analytics

Best fit when

Public-sector, media, NGO, or mission-driven sites that need visitor-visible transparency and strict opt-in
EU teams that must keep analytics off third-party trackers and can run a small always-on instance
Operators who want first-party subdomain cookies, CSP-aware embedding, and no IP/User-Agent collection
Organisations evaluating fair-processing design over maximum measurement coverage
Teams comfortable with SQLite or SQL self-host ops (binary or Docker) and publishing their own privacy notice

Poor fit when

Product or growth teams that require near-complete traffic measurement without consent friction
Needs for heatmaps, session replay, funnels, or ad-ecosystem attribution comparable to Hotjar/Mixpanel/GA
Buyers seeking a vendor-managed multi-tenant analytics cloud with SLAs and a signed vendor DPA as processor
Large enterprises that require public ISO 27001/SOC 2 or third-party security audit packs before shortlist

Consider instead when

When: You want privacy-oriented analytics with managed EU hosting and lower consent friction
Consider: Plausible Analytics or Pirsch Analytics
Typically optimised for simpler cookieless or low-friction models and hosted plans; less radical visitor Auditorium design than Offen.
When: You need EU hosted privacy analytics with operator support and less self-host burden
Consider: Friendly Analytics
European catalog peer oriented to hosted privacy analytics; compare consent model and feature depth to Offen’s opt-in + E2E approach.
When: You need deep product analytics, funnels, or session UX tooling rather than fair traffic metrics
Consider: Hotjar, Mixpanel, or a full GA4 stack (with legal review)
Different category: richer product/UX analytics, different jurisdiction and subprocessor profile.

Pulse by Ciphera

Best fit when

EU or Swiss organisations replacing GA4 primarily to remove analytics cookies and consent-banner friction
Teams that want traffic, funnels, uptime, and Lighthouse scores in one vendor console
Buyers who need a Belgian legal entity and named European subprocessors rather than a US cookieless SaaS
Sites that can work with aggregate and month-scoped visitor estimates instead of persistent user IDs
Engineering leads who want the browser script and dashboard code on GitHub under AGPL-3.0 for inspection

Poor fit when

Organisations that must self-host the full analytics backend (Pulse's managed core is closed)
Product analytics use cases that need durable cross-visit identity, cohorting, or GA4 BigQuery-style user exports
Buyers requiring completed ISO 27001, SOC 2, or a published independent security audit today
Teams that need EU/EEA soil specifically rather than Swiss residency (primary data is in Switzerland)

Consider instead when

When: You need a mature EU cookieless analytics product with an official full-stack self-host option
Consider: Plausible Analytics
Plausible (Estonia) is the common self-host plus SaaS peer; Pulse keeps the backend managed-only.
When: You want a minimal Dutch cookieless counter without uptime or Lighthouse bundles
Consider: Simple Analytics
Closer peer for strictly analytics SaaS; Pulse differentiates with ops-style panels.
When: You need enterprise analytics with strong EU residency controls and heavier compliance packaging
Consider: Piwik PRO or Friendly Analytics
Heavier Matomo-class or Swiss-hosted peers when Pulse's startup assurance set is too thin.

Open questions for due diligence

Offen Fair Web Analytics

Will your traffic and KPI model tolerate opt-in-only measurement after a pilot on a non-critical property?
Where will you host the instance (EU on-prem/VPS vs US-group cloud), and who holds OFFEN_SECRET and DB backups?
Do procurement rules require third-party audits or ISO/SOC that Offen does not publish?
Do you need a signed vendor DPA as processor, or is controller-only self-host acceptable to counsel?
Is subdomain + CSP (script-src/frame-src + unsafe-inline styles for the banner) feasible on your main site?

Pulse by Ciphera

Will Ciphera sign your standard DPA and return the full registered-address subprocessor appendix on request?
What is the retention and deletion SLA for a single customer's Pulse project data after contract end?
When is the planned independent security audit scheduled, and will the report be public?
Are Google Search Console, Bing, or CDN analytics panels generally available, or only mentioned in some marketing copy?