Offen Fair Web Analytics vs Swetrix

Compare Offen Fair Web Analytics and Swetrix on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Offen Fair Web Analytics

Germany· Web Analytics

Needs review

Shortlist when you want self-hosted, Apache-2.0 analytics that only measures after opt-in, encrypts events in the browser, and lets visitors open their own data in the Auditorium. Skip when you need cookieless full-coverage metrics, session replay/heatmaps, or zero-ops managed EU hosting—consider Plausible, Pirsch, or Friendly Analytics instead.

Opt-in onlyBrowser E2E encryptionSelf-hostedApache-2.0Visitor data accessBerlin-based project

View listing Visit Website

Swetrix

United Kingdom· Web Analytics

Needs review

Shortlist Swetrix when you want cookieless traffic plus product-oriented tools (funnels, RUM, errors, optional Cloud replays) under a UK company with Hetzner DE hosting and AGPLv3 self-host CE. Skip when you need public ISO/SOC packs, zero US-group subprocessors, multi-year cookie retention cohorts, or free forever hosted analytics—consider Plausible Analytics or Simple Analytics for minimal traffic-only privacy analytics, or Matomo for heavyweight self-host control.

Cookieless trackingHetzner DE hostingOpen source (AGPLv3)Self-host CEFunnels + errors + RUMPublic DPA

View listing Visit Website

Highlighted rows differ between the two products.

Offen Fair Web Analytics vs Swetrix: Snapshot
Feature	Offen Fair Web Analytics	Swetrix
Country of origin	Germany	United Kingdom
Category	Web Analytics	Web Analytics
Open source	Yes	Yes
Self-hosted	Yes	Yes
Headquarters	Germany	United Kingdom
Legal entity	Public legal notice lists Frederik Ring, Berlin (offen.software); product authors Frederik Ring and Hendrik Niefeld—no separate GmbH name verified on imprint	Swetrix Ltd (SC797389), Edinburgh, Scotland
Governing law	Germany (indicative from Berlin imprint)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Product is operator self-hosted (your VPS/cloud/on-prem). No Offen multi-tenant analytics SaaS or vendor subprocessor list for visitor events. Related marketing site (offen.software) names Hetzner Online GmbH (Germany) as host—not the analytics data path. Optional community deploys include Heroku (operator choice).	Cloud analytics data: Hetzner Online GmbH (Germany) per DPA/Data Policy. End User error monitoring sub-processor: Sentry / Functional Software Inc. (United States). Customer-side Privacy Policy list also includes Paddle (UK payments), Fastmail (Australia business email), AWS (US transactional/marketing email), OpenRouter (US optional AI chat). No known US parent.
Summary	Open-source, self-hosted web analytics with opt-in consent, browser-side end-to-end encryption, and a shared Auditorium so visitors can see and control their own usage data.	Cookieless, privacy-first web analytics from a UK company: traffic, funnels, errors, and performance on Hetzner in Germany, with AGPLv3 self-host Community Edition and optional Cloud session replays.
Tags	analytics open-source privacy gdpr self-hosted opt-in e2e-encryption	analytics open-source privacy gdpr cookieless self-host product-analytics

At a glance: Offen Fair Web Analytics vs Swetrix
At a glance	Offen Fair Web Analytics	Swetrix
HQ / authors	Berlin, Germany (Frederik Ring & Hendrik Niefeld)	Not listed
License	Apache-2.0 (code/docs); logo CC-BY-NC-ND-4.0	AGPLv3 (Community Edition)
Delivery	Self-host only (binary, Docker, community deploys)	Not listed
Consent model	Opt-in only; first-party cookies	Not listed
Default retention	6 months (configurable shorter)	Not listed
Funding note	NLnet NGI support (project-stated)	Not listed
HQ	Not listed	Edinburgh, United Kingdom
Legal entity	Not listed	Swetrix Ltd (SC797389)
Governing law	Not listed	Scotland (Terms)
Primary hosting	Not listed	Hetzner Online GmbH, Germany
Commercial model	Not listed	Event-volume Cloud subscription; free self-host CE; timed trial
Open source	Not listed	Yes — github.com/Swetrix/swetrix

Key capabilities: Offen Fair Web Analytics vs Swetrix
Key capabilities	Offen Fair Web Analytics	Swetrix
Opt-in only	Yes	Not listed
Browser E2E encryption	Yes	Not listed
Self-hosted	Yes	Not listed
Apache-2.0	Yes	Not listed
Visitor data access	Yes	Not listed
Berlin-based project	Yes	Not listed
Cookieless tracking	Not listed	Yes
Hetzner DE hosting	Not listed	Yes
Open source (AGPLv3)	Not listed	Yes
Self-host CE	Not listed	Yes
Funnels + errors + RUM	Not listed	Yes
Public DPA	Not listed	Yes

Offen Fair Web Analytics

Opt-in only collection with first-party cookies
No analytics events are recorded until the visitor actively consents. Cookies are first-party and the tracker is meant to run on a same-site subdomain so third-party cookie restrictions and cross-site tracking models do not apply. Visitors who never opt in leave no usage trail—expect lower absolute volumes than cookieless tools that measure by default.
Browser-side end-to-end encryption of usage events
Clients encrypt usage data before it leaves the browser; the server stores ciphertext and cannot decrypt events alone. Only the visitor (via their cookie) and the matching operator account can open that visitor's data in the Auditorium. Practical impact: a compromised database or overly broad ops access does not yield plaintext browsing histories the way a typical self-hosted analytics DB would.
Auditorium for both operators and visitors
Operators see aggregates across pages where the installation is active (unique users/sessions, top pages, filters). Each opted-in visitor can open the same style of UI for their own data only, with plain-language metric explanations, and can delete data or fully opt out later. This is the fair design point: measurement is not a one-way glass.
Essential metrics without IP or User-Agent capture
Dashboards cover real-time activity, page views, unique users and sessions, bounce rate, returning users, top pages, referrers, UTM campaign/source, landing and exit pages, weekly retention, and load time. Location is country-level from timezone mapping; mobile share uses orientation capability—not IP geolocation or UA parsing. No heatmaps, session replay, or warehouse-grade product analytics.
Lightweight self-host: binary, Docker, SQLite or SQL
Production installs use a single binary (Linux/Windows/macOS) or the offen/offen image; docs also cover Heroku, Uberspace, and YunoHost. Default store is SQLite; MySQL and Postgres are supported. AutoTLS can request Let's Encrypt certificates. Config is environment variables or offen.env. You own uptime, backups, SMTP for password reset, and the subdomain layout.
Multi-site accounts, teams, and short retention
One installation can cover multiple websites with shared team access. Default retention is six months with automatic deletion; operators can shorten retention (e.g. 12 weeks, 30 days, 7 days) knowing shorter values purge older events on startup. Consent banner appearance is customizable; UI locales include EN, DE, FR, ES, PT, and VI.

Swetrix

Cookieless traffic analytics with hashed sessions
Lightweight script captures pageviews, referrers/UTMs, devices, and city-level geo without cookies or client-side storage. Per the Data Policy, IP and User-Agent are hashed in memory with a daily rotating salt; only a random session id is stored—so you get sessions without long-term cross-day visitor retention.
Funnels, custom events, and goals
Instrument signups, purchases, and other conversions as custom events; build multi-step funnels and goals in the dashboard. Useful for product and growth teams who need drop-off analysis without bolting on a second product-analytics SaaS.
Real-user performance and client error tracking
Records Web Performance API timings (TTFB, DNS, TLS, render, full page load) and optional JavaScript errors with stack/context by page and browser. Bridges marketing traffic views with engineering signals that pure pageview tools omit.
Opt-in Cloud session replays with privacy modes
Cloud projects can call startSessionReplay() to record DOM and interactions; default modes mask text/inputs. Replays are not created by ordinary pageviews—customers must enable them and own consent, masking, and page exclusions. Cloud-only versus Community Edition.
AGPLv3 open source with Docker self-host CE
Core platform is public on GitHub under GNU AGPLv3; Community Edition deploys via official Docker docs with MySQL, ClickHouse, and Redis. CE includes core analytics, events, sessions, funnels, performance, and errors—but not all Cloud extras (replays, some alerts/org/AI features).
Alerts, API, GA import, and team access
Configure alerts to email, Slack, Telegram, Discord, webhooks, or push; pull or push data via the API; import GA4 history; invite organisations with roles or share password-protected/public dashboards. Fits agencies and multi-site operators who outgrow single-user tools.

Assurance & compliance: Offen Fair Web Analytics vs Swetrix
Assurance & compliance	Offen Fair Web Analytics	Swetrix
Independent security / architecture audit	Not found No public third-party audit PDF found; coordinated disclosure via SECURITY.md email only.	Not found Searched marketing, DPA, privacy, and data policy; no public independent audit PDF located. Open-source code is available for review.
ISO 27001	Not found No public ISO 27001 certification claim found on official site or docs.	Not found No public ISO 27001 certification claim found on primary pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No public SOC 2/3 report found.
GDPR / EU data protection	Vendor claimed EU authors; opt-in, data minimization (no IP/UA), visitor access/erasure, short default retention, Datensparsamkeit framing. Self-host means operator remains controller—confirm your legal basis and notice.	Vendor claimed UK company; public GDPR/PECR discussion in Data Policy; cookieless design with non-stored IPs for standard analytics; Hetzner DE hosting; public DPA. Optional replays may be personal data depending on configuration—customer assesses legal basis.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: no known US parent; product not delivered as US-hosted vendor SaaS. Operator-chosen infrastructure (including optional Heroku/US cloud) can still create CLOUD Act paths for stored ciphertext/metadata. Not legal advice.	Partial No known US parent; primary analytics on Hetzner DE. Material exception: Sentry (US) processes End User error data per DPA; Privacy Policy also lists AWS and OpenRouter (US) for customer email/AI. Indicative medium exposure—not a clean bill. Not legal advice.
Data processing agreement (B2B)	Not applicable No multi-tenant vendor analytics processing relationship documented; operator self-hosts and is typically controller. Custom development/support via offen.software is separate from a standard SaaS DPA.	Vendor claimed Public DPA at swetrix.com/dpa incorporated by Terms; acceptance by use of Service; signed copy on request.
EU AI Act	Not applicable Web analytics metrics product; not an AI system product.	Not applicable Core product is web analytics, not an AI system. Optional Ask AI / OpenRouter is ancillary; confirm if your deployment enables it.

Considerations & known limitations: Offen Fair Web Analytics vs Swetrix
Considerations & known limitations	Offen Fair Web Analytics	Swetrix
Opt-in undercounts absolute traffic	High Visitors who never consent generate no events. Growth and content KPIs will not match cookieless tools or GA-style default measurement—treat as design, not a misconfiguration.	Not listed
You own uptime, backups, and secrets	Medium No managed Offen cloud. Operators must run HTTPS/subdomain layout, set OFFEN_SECRET for stable sessions, configure SMTP for resets, and back up SQLite/SQL—plus avoid reverse proxies that log IPs if minimization is a goal.	Not listed
E2E crypto is vendor-claimed architecture	Medium Browser-side encryption and server inability to decrypt are core claims from project docs/README, not independently audited in public materials found. Security-sensitive orgs should review source or commission assessment.	Not listed
Hosting choice reintroduces cloud jurisdiction	Medium Self-host on US-group cloud or Heroku means CLOUD Act/subprocessor analysis shifts to your host even though Offen itself is Berlin-based OSS without a vendor SaaS region map.	Not listed
No public ISO/SOC or audit pack	Low Procurement checklists that require vendor ISO 27001/SOC 2 will stall; evidence is open source and design docs, not cert registry entries.	Medium Assurance relies on first-party policies, Hetzner infrastructure claims, and open source. Enterprise questionnaires that hard-gate on certs will stall until materials are provided under NDA or produced.
Essential metrics only	Medium No heatmaps, session replay, advanced funnels, or product-analytics warehouse features. Wrong tool if the shortlist criterion is UX research depth rather than fair traffic statistics.	Not listed
US-group subprocessors (Sentry, AWS, OpenRouter)	Not listed	Medium Primary analytics hosting is Hetzner DE, but Sentry (US) is an End User error-tracking sub-processor on the DPA, and AWS/OpenRouter appear for customer email/AI. Orgs with strict no-US-cloud rules need explicit acceptance or self-host CE to avoid those paths.
Session replay is opt-in and controller-owned	Not listed	Medium Cloud replays can capture DOM and inputs unless masked. Customers must enable startSessionReplay(), configure privacy modes/exclusions, and provide notices/consent where required—misconfiguration can reintroduce personal data risk that standard cookieless pageviews avoid.
Cloud vs Community Edition feature gap	Not listed	Low Self-host CE is free and covers core analytics, but replays and several Cloud growth/ops features are limited or Cloud-only. Budget and feature planning must not assume feature parity.
Daily salt rotation limits retention metrics	Not listed	Low Cookieless design deliberately prevents classic multi-day visitor retention. Teams that need that metric class need another product or consented identity.

Fit

Offen Fair Web Analytics

Best fit when

Public-sector, media, NGO, or mission-driven sites that need visitor-visible transparency and strict opt-in
EU teams that must keep analytics off third-party trackers and can run a small always-on instance
Operators who want first-party subdomain cookies, CSP-aware embedding, and no IP/User-Agent collection
Organisations evaluating fair-processing design over maximum measurement coverage
Teams comfortable with SQLite or SQL self-host ops (binary or Docker) and publishing their own privacy notice

Poor fit when

Product or growth teams that require near-complete traffic measurement without consent friction
Needs for heatmaps, session replay, funnels, or ad-ecosystem attribution comparable to Hotjar/Mixpanel/GA
Buyers seeking a vendor-managed multi-tenant analytics cloud with SLAs and a signed vendor DPA as processor
Large enterprises that require public ISO 27001/SOC 2 or third-party security audit packs before shortlist

Consider instead when

When: You want privacy-oriented analytics with managed EU hosting and lower consent friction
Consider: Plausible Analytics or Pirsch Analytics
Typically optimised for simpler cookieless or low-friction models and hosted plans; less radical visitor Auditorium design than Offen.
When: You need EU hosted privacy analytics with operator support and less self-host burden
Consider: Friendly Analytics
European catalog peer oriented to hosted privacy analytics; compare consent model and feature depth to Offen’s opt-in + E2E approach.
When: You need deep product analytics, funnels, or session UX tooling rather than fair traffic metrics
Consider: Hotjar, Mixpanel, or a full GA4 stack (with legal review)
Different category: richer product/UX analytics, different jurisdiction and subprocessor profile.

Swetrix

Best fit when

SMEs, agencies, and product teams replacing GA4 who need cookieless traffic stats without a cookie banner driven only by analytics
Engineering-minded buyers who want error tracking and real-user performance in the same privacy-first dashboard as pageviews
Teams that may enable Cloud session replays later but can treat them as explicit opt-in with their own legal basis
Operators willing to run Docker Community Edition (MySQL/ClickHouse/Redis) when Cloud commercial terms or feature limits do not fit
Buyers who need a public B2B DPA, API access, GA4 import, and multi-channel alerts under a UK legal entity

Poor fit when

Enterprises that require published ISO 27001 / SOC 2 certificates or independent audit PDFs before shortlist
Policies that forbid any US-group subprocessors (Sentry is listed for End User error data; AWS/OpenRouter appear for customer services)
Use cases that depend on long-term cookie-based retention or cross-device identity graphs
Buyers who only want free hosted analytics with no paid Cloud tier and no self-host operations burden
Sites that will run session replays on sensitive flows without capacity to configure masking, exclusions, and consent

Consider instead when

When: You only need minimal cookieless pageviews/referrers with the smallest possible product surface
Consider: Plausible Analytics or Simple Analytics
Swetrix adds funnels, errors, RUM, and Cloud replays; peers stay closer to pure traffic analytics.
When: You need deep on-prem control, plugins, and mature enterprise self-host packaging
Consider: Matomo (self-host or managed EU hosts such as Matomo by Stackhero)
Heavier ops and optional cookies; stronger fit for large controlled deployments.
When: You must stay inside Google advertising measurement and free GA4 ecosystem tooling
Consider: Google Analytics
Trade privacy, consent, and transfer complexity for ads integration and zero software fee.

Open questions for due diligence

Offen Fair Web Analytics

Will your traffic and KPI model tolerate opt-in-only measurement after a pilot on a non-critical property?
Where will you host the instance (EU on-prem/VPS vs US-group cloud), and who holds OFFEN_SECRET and DB backups?
Do procurement rules require third-party audits or ISO/SOC that Offen does not publish?
Do you need a signed vendor DPA as processor, or is controller-only self-host acceptable to counsel?
Is subdomain + CSP (script-src/frame-src + unsafe-inline styles for the banner) feasible on your main site?

Swetrix

Can Enterprise contracts exclude or replace Sentry (and other US-group subprocessors) for End User data paths?
Are ISO 27001, SOC 2, or pen-test summaries available under NDA?
What is the exact backup/DR location topology beyond “secure backups” wording on the DPA?
Which Cloud-only features remain permanently out of CE versus delayed open-source release?
For session replay at your traffic volumes, what retention defaults and export/delete SLAs apply on your plan?