Piwik PRO vs Polish

Compare Piwik PRO and Polish on capabilities, jurisdiction, assurance, and fit for European buyers.

Piwik PRO

Poland· Web Analytics

Needs review

Shortlist Piwik PRO when you need a managed European analytics controller with integrated consent, tagging, and real-time data activation—and you can accept cloud residency on Azure and/or Elastx. Skip when you require open-source self-hosting (consider Matomo or Friendly Analytics) or only need a minimal cookieless counter (Plausible, Simple Analytics).

EU HQ (Poland)Analytics + tags + consentData activationEU hosting optionsISO 27001 / SOC 2 (claimed)HIPAA BAA (Enterprise)

View listing Visit Website

Polish

France· Marketing Technology (MarTech) / Tag Management / Customer Data Platform

Needs review

Shortlist when you want a French-operated AI agent to rewrite and test headlines/CTAs on live traffic with minimal install. Skip when you need published subprocessors, a signed DPA on day one, self-hosting, or enterprise experiment governance. Consider VWO for mature A/B suites, or Mouseflow / Commanders Act when analytics or MarTech depth matters more than autonomous copy.

EU-operatedAI CRO agentFirst-party pixelSaaSEarly access

View listing Visit Website

Highlighted rows differ between the two products.

Piwik PRO vs Polish: Snapshot
Feature	Piwik PRO	Polish
Country of origin	Poland	France
Category	Web Analytics	Marketing Technology (MarTech) / Tag Management / Customer Data Platform
Open source	No	No
Self-hosted	No	No
Headquarters	Poland	France
Legal entity	Piwik PRO SA (Wrocław); affiliates Piwik PRO LLC (New York), Piwik PRO GmbH (Berlin)	DOGFOODED SAS (SIREN 107391229), 117 rue de Vaugirard, 75015 Paris
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Customer-selectable regions: Microsoft Azure public cloud (US, Netherlands, Germany, Hong Kong) and Elastx (Sweden, EU-operated). Enterprise private cloud: 60+ Azure regions plus Elastx. Business plan marketing highlights Swedish EU-operated hosting. No classic customer self-host.	Marketing site and app responses served via Vercel (US-group cloud). No public subprocessor schedule for databases, AI inference, email, or backups. Account auth uses Google sign-in per privacy policy.
Summary	Polish privacy-first analytics suite combining web and mobile analytics, tag management, consent management, and real-time data activation for regulated teams.	French AI CRO agent that rewrites headlines and CTAs from first-party visit signals, tests them on live traffic, and keeps what converts.
Tags	saas analytics privacy gdpr hipaa consent-management tag-manager enterprise api	saas AI agents CRO A/B testing personalization first-party pixel

At a glance: Piwik PRO vs Polish
At a glance	Piwik PRO	Polish
HQ	Wrocław, Poland (Piwik PRO SA)	Paris, France
Product type	Commercial analytics suite (SaaS / private cloud)	SaaS AI CRO / personalization agent
Open source	No (closed source since split from Matomo lineage)	No
Self-host	No classic on-prem; public or private cloud only	No (not documented)
Hosting (public)	Azure US/NL/DE/HK; Elastx Sweden	Not listed
Modules	Analytics, Tag Manager, Consent Manager, Data Activation	Not listed
Commercial model	Business subscription + trial; Enterprise custom	Monthly subscription with short free trial
Legal entity	Not listed	DOGFOODED SAS (SIREN 107391229)
Install	Not listed	Single head snippet

Key capabilities: Piwik PRO vs Polish
Key capabilities	Piwik PRO	Polish
EU HQ (Poland)	Yes	Not listed
Analytics + tags + consent	Yes	Not listed
Data activation	Yes	Not listed
EU hosting options	Yes	Not listed
ISO 27001 / SOC 2 (claimed)	Yes	Not listed
HIPAA BAA (Enterprise)	Yes	Not listed
EU-operated	Not listed	Yes
AI CRO agent	Not listed	Yes
First-party pixel	Not listed	Yes
SaaS	Not listed	Yes
Early access	Not listed	Yes

Piwik PRO

ClickHouse-backed web & mobile analytics
Session-level web and app analytics with custom reports, funnels, user flows, multi-channel attribution, and calculated metrics. Vendor positions unsampled collection by default with optional sampling for extreme volumes, plus raw export via API, files, and BigQuery—aimed at teams that outgrew pre-aggregated MySQL-style tools.
Anonymous tracking when cookies are declined
Collect privacy-safe behavioral signals without identifiers when visitors refuse cookies or when you configure limited measurement modes. Marketing can still see channels and journeys; personal identifiers and full attribution wait for a valid lawful basis—useful under GDPR/ePrivacy friction.
Integrated Consent Manager and Tag Manager
Capture and store consent, drive tag firing from preferences, and handle visitor data requests in-product. Optional Cookie Information CMP and server-side tagging paths reduce the usual glue code between a separate CMP, GTM, and analytics.
Data Activation for real-time personalization
Segment audiences from live behavior and trigger on-site or outbound actions without exporting every event to a second CDP first. Suited to regulated marketers who want activation on first-party data they control.
Selectable cloud residency (Azure + Elastx)
Public cloud regions include Azure US, NL, DE, and HK plus Elastx Sweden; Enterprise private cloud spans 60+ Azure regions and Elastx. Business plan marketing highlights EU-operated Swedish hosting—pick region in procurement, not after go-live.
Regulated-industry packaging (GDPR tooling, HIPAA BAA path)
DPA available on Business signup; Enterprise adds private cloud, higher action volumes, SLAs, and HIPAA Business Associate Agreements for healthcare marketing analytics. Vendor also claims ISO 27001 and SOC 2—request current certificates in diligence.

Polish

Visit-aware headline and CTA rewriting
Uses first-party visit context (source, campaign, device, new vs returning) to draft headlines and CTAs in the site language and configured brand voice, without changing logo, colors, or layout.
Live-traffic keep-what-converts loop
Serves variants on real visitors, allocates more traffic to what converts, and rewrites underperformers. Early access focuses on headlines/CTAs; fuller per-visitor page layouts are described as early-member rollout.
Plain-language decision feed with human control
Every audience, page, and result lands in a readable feed. Operators set voice instructions, approve or auto-publish pages, steer tone, or pause anything.
One-line install across common stacks
A single script tag in the page head covers Next.js, Webflow, WordPress, Shopify, or plain HTML. Returning visitors are described as served from cache so the pixel stays async and light.
First-party conversion pixel
Measurement is Polish's own first-party pixel, independent of your analytics stack. Marketing claims no cookies; the privacy policy still describes an anonymous identifier stored in the browser, so treat cookie claims as needing legal review.

Assurance & compliance: Piwik PRO vs Polish
Assurance & compliance	Piwik PRO	Polish
Independent security / no-logs audit	Partial Vendor states regular external security audits and SOC 2/ISO programs; no public third-party no-logs-style audit PDF reviewed for this draft. Request reports under NDA.	Not found No public security or audit page located.
ISO 27001	Vendor claimed Asserted on privacy-security and platform pages; certificate not independently re-verified against a public registry for this entry.	Not found No ISO claim found on getpolish.app.
SOC 2 / SOC 3	Vendor claimed Vendor claims SOC 2 (comparison content references type II) and SOC 2-certified infrastructure; obtain current report in diligence.	Not found No SOC 2/3 claim found.
HIPAA / BAA	Vendor claimed HIPAA-oriented offering with BAA on Enterprise path per vendor; not available on all plan tiers.	Not listed
GDPR / EU data protection	Vendor claimed EU legal entity, residency options, consent tooling, anonymization, and DPA. Compliance depends on customer configuration and purposes.	Vendor claimed EU (French) controller entity and a public privacy policy exist; confirm lawful basis, DPA, and cookie/identifier treatment for your sites.
US CLOUD Act exposure (indicative)	Partial No known US parent (Polish SA). Medium exposure due to Microsoft Azure as public/private cloud subprocessor and optional US region; Elastx Sweden is EU-operated alternative. Not legal advice.	Partial EU entity / no known US parent, but public site runs on Vercel and account auth uses Google. Backend subprocessors unpublished. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Business DPA linked from Business plan signup (piwik.pro/business-dpa/); Enterprise contracts expand terms.	Not found No public DPA download or in-product DPA link found; email hello@dogfooded.com.
EU AI Act	Not applicable Analytics/activation platform; not marketed as an AI system provider. Customer AI use of exported data is out of product scope.	Unknown Product is AI-centric (autonomous copy generation) but no AI Act classification or documentation was published on the site.

Considerations & known limitations: Piwik PRO vs Polish
Considerations & known limitations	Piwik PRO	Polish
US-group cloud (Azure) in hosting path	Medium Even with EU region selection, Azure introduces US-group infrastructure risk. Pin region, review SCCs/subprocessors, and escalate if policy forbids US cloud groups entirely.	Not listed
Closed source and no classic self-host	Medium Cannot independently audit full source or run fully air-gapped on customer iron. Private cloud still involves vendor-managed stack on Azure/Elastx.	Not listed
Certifications not independently verified here	Low ISO 27001, SOC 2, and HIPAA are vendor-claimed. Request certificates/reports and BAA text before treating them as assured.	Not listed
Paid plans only after Core sunset	Low Free Core has been discontinued; evaluation relies on trials and paid Business/Enterprise metering by actions/domains.	Not listed
Compliance depends on configuration	Medium Anonymous modes and CNIL exemption require correct setup and purpose limitation. Misconfiguration can recreate the same legal exposure teams left GA to avoid.	Not listed
No public subprocessor or region list	Not listed	Medium Hosting beyond Vercel edge headers and Google sign-in is unpublished. Procurement should request a subprocessor schedule and regions before production on personal data-heavy sites.
Cookieless marketing vs stored browser identifier	Not listed	Medium Marketing promises no cookies while the privacy policy describes an anonymous identifier stored in the browser. Legal review is needed for consent banners and ePrivacy.
Early-access feature scope	Not listed	Low Fuller per-visitor page layouts are still rolling out; today's verified core is headline/CTA rewriting and testing.
US-group cloud and auth dependencies	Not listed	Medium Vercel-served app and Google sign-in create US CLOUD Act-relevant paths even though the legal entity is French.

Fit

Piwik PRO

Best fit when

Regulated marketing/analytics teams that want one suite for measurement, consent, tags, and activation under a Polish legal entity
Public sector and EU enterprises that need selectable EU residency (e.g. Elastx Sweden or Azure NL/DE) plus a formal B2B DPA
Healthcare digital teams evaluating HIPAA-aware analytics with a signed BAA on Enterprise
Organizations leaving GA4 primarily for residency, no vendor ad-network reuse, and anonymous pre-consent measurement options
Teams that need enterprise reporting depth (custom reports, funnels, flows, attribution) beyond lightweight privacy analytics

Poor fit when

Buyers who mandate fully self-hosted open-source analytics with no cloud hypervisor vendor
Sites that only need simple cookieless page analytics without tag management or activation
Teams that refuse any US-group infrastructure (Azure appears in public hosting options even when EU regions are chosen)
Orgs seeking a free forever analytics tier (Core plan sunset; paid Business/Enterprise only)

Consider instead when

When: You need open-source code and true on-premises control
Consider: Matomo (self-host) or Friendly Analytics / Matomo by Stackhero for managed Matomo
Piwik PRO is proprietary cloud/private-cloud only.
When: You want minimal, cookieless EU analytics without enterprise suite complexity
Consider: Plausible Analytics or Simple Analytics
Far smaller feature surface; no HIPAA/CDP-style activation packaging.
When: You need a German enterprise analytics vendor with long public-sector presence
Consider: etracker
Different product depth and packaging—compare consent tooling and activation needs.

Polish

Best fit when

Founders or lean growth teams without a dedicated CRO function
Sites that can paste one head snippet (Next.js, Webflow, WordPress, Shopify, HTML)
Teams that want AI-written headline/CTA variants tested on real traffic
Buyers who need a French SAS contracting entity for MarTech shortlists
Operators who want pause/approve controls and a plain-language change feed

Poor fit when

Orgs that require a public subprocessor list, SOC 2/ISO pack, or in-product DPA before pilot
Teams that need self-hosting or Google-free authentication
Enterprises needing mature multivariate governance comparable to VWO-class platforms
Buyers seeking a full analytics, CDP, or tag-management suite rather than CRO copy automation

Consider instead when

When: You need a mature experiment / A/B platform with deeper governance
Consider: VWO
US incumbent; stronger classic experiment tooling, weaker AI-autonomous copy story than Polish.
When: You primarily need European web analytics or session insight, not autonomous copy CRO
Consider: Mouseflow or Piwik PRO
Analytics depth first; they do not replace Polish's rewrite-and-test agent.
When: You need French/EU MarTech, tag management, or CDP breadth
Consider: Commanders Act
Broader MarTech stack; not an AI headline agent.

Open questions for due diligence

Piwik PRO

What exact subprocessor list and backup/DR locations apply to the contracted region (Azure vs Elastx) today?
Can the vendor provide current ISO 27001 certificate scope and SOC 2 Type II report under NDA?
For healthcare: which plan tier, region, and BAA wording cover the intended PHI workflows?
Does the Business Swedish hosting path avoid Azure entirely for production data, or only for selected components?
What residual free/legacy Core accounts remain, and what is the migration deadline for this tenant?

Polish

Will DOGFOODED SAS sign a B2B DPA and publish subprocessors (hosting, AI model provider, email, backups) with regions?
Where is optimization/visitor data stored at rest, and is an EU-only processing path available?
How is the anonymous browser identifier implemented if marketing claims no cookies (localStorage, cookie, other)?
Is non-Google authentication planned for workspace accounts?
What AI model providers process page copy, and is customer content retained for training?