Piwik PRO vs Sitesights

Compare Piwik PRO and Sitesights on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics, Matomo, Mixpanel

Piwik PRO

Poland· Web Analytics

Needs review

Shortlist Piwik PRO when you need a managed European analytics controller with integrated consent, tagging, and real-time data activation—and you can accept cloud residency on Azure and/or Elastx. Skip when you require open-source self-hosting (consider Matomo or Friendly Analytics) or only need a minimal cookieless counter (Plausible, Simple Analytics).

EU HQ (Poland)Analytics + tags + consentData activationEU hosting optionsISO 27001 / SOC 2 (claimed)HIPAA BAA (Enterprise)

View listing Visit Website

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies

View listing Visit Website

Highlighted rows differ between the two products.

Piwik PRO vs Sitesights: Snapshot
Feature	Piwik PRO	Sitesights
Country of origin	Poland	Germany
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Poland	Germany
Legal entity	Piwik PRO SA (Wrocław); affiliates Piwik PRO LLC (New York), Piwik PRO GmbH (Berlin)	Drude, Grossert GbR
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Customer-selectable regions: Microsoft Azure public cloud (US, Netherlands, Germany, Hong Kong) and Elastx (Sweden, EU-operated). Enterprise private cloud: 60+ Azure regions plus Elastx. Business plan marketing highlights Swedish EU-operated hosting. No classic customer self-host.	Product databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.
Summary	Polish privacy-first analytics suite combining web and mobile analytics, tag management, consent management, and real-time data activation for regulated teams.	German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.
Tags	analytics privacy gdpr saas api hipaa consent-management tag-manager enterprise	analytics privacy gdpr saas api cookieless germany

At a glance: Piwik PRO vs Sitesights
At a glance	Piwik PRO	Sitesights
HQ	Wrocław, Poland (Piwik PRO SA)	Not listed
Product type	Commercial analytics suite (SaaS / private cloud)	Not listed
Open source	No (closed source since split from Matomo lineage)	No (libs/plugins public; core SaaS proprietary)
Self-host	No classic on-prem; public or private cloud only	Not listed
Hosting (public)	Azure US/NL/DE/HK; Elastx Sweden	Not listed
Modules	Analytics, Tag Manager, Consent Manager, Data Activation	Not listed
Commercial model	Business subscription + trial; Enterprise custom	Free start; pageviews + events subscriptions (Paddle)
HQ / entity	Not listed	Drude, Grossert GbR, Germany
Category	Not listed	Web analytics (SaaS)
Hosting (product)	Not listed	Hetzner, Germany (vendor docs)
Tracking model	Not listed	Cookieless; 48h rotating server hash

Key capabilities: Piwik PRO vs Sitesights
Key capabilities	Piwik PRO	Sitesights
EU HQ (Poland)	Yes	Not listed
Analytics + tags + consent	Yes	Not listed
Data activation	Yes	Not listed
EU hosting options	Yes	Not listed
ISO 27001 / SOC 2 (claimed)	Yes	Not listed
HIPAA BAA (Enterprise)	Yes	Not listed
Cookieless tracking	Not listed	Yes
EU-operated (DE)	Not listed	Yes
Hetzner Germany (claimed)	Not listed	Yes
Server-side API	Not listed	Yes
Funnels + page flow	Not listed	Yes
Multi-project / agencies	Not listed	Yes

Piwik PRO

ClickHouse-backed web & mobile analytics
Session-level web and app analytics with custom reports, funnels, user flows, multi-channel attribution, and calculated metrics. Vendor positions unsampled collection by default with optional sampling for extreme volumes, plus raw export via API, files, and BigQuery—aimed at teams that outgrew pre-aggregated MySQL-style tools.
Anonymous tracking when cookies are declined
Collect privacy-safe behavioral signals without identifiers when visitors refuse cookies or when you configure limited measurement modes. Marketing can still see channels and journeys; personal identifiers and full attribution wait for a valid lawful basis—useful under GDPR/ePrivacy friction.
Integrated Consent Manager and Tag Manager
Capture and store consent, drive tag firing from preferences, and handle visitor data requests in-product. Optional Cookie Information CMP and server-side tagging paths reduce the usual glue code between a separate CMP, GTM, and analytics.
Data Activation for real-time personalization
Segment audiences from live behavior and trigger on-site or outbound actions without exporting every event to a second CDP first. Suited to regulated marketers who want activation on first-party data they control.
Selectable cloud residency (Azure + Elastx)
Public cloud regions include Azure US, NL, DE, and HK plus Elastx Sweden; Enterprise private cloud spans 60+ Azure regions and Elastx. Business plan marketing highlights EU-operated Swedish hosting—pick region in procurement, not after go-live.
Regulated-industry packaging (GDPR tooling, HIPAA BAA path)
DPA available on Business signup; Enterprise adds private cloud, higher action volumes, SLAs, and HIPAA Business Associate Agreements for healthcare marketing analytics. Vendor also claims ISO 27001 and SOC 2—request current certificates in diligence.

Sitesights

Cookieless 48-hour rotating session hash
Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).
Sub-1 KB client script plus WordPress and Shopify plugins
Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.
Server-side REST API with C# and Node libraries
Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.
Real-time overview with campaign and device filters
Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.
Custom funnels and page-flow journey maps
Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.
Multi-project workspaces with roles for agencies
Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

Assurance & compliance: Piwik PRO vs Sitesights
Assurance & compliance	Piwik PRO	Sitesights
Independent security / no-logs audit	Partial Vendor states regular external security audits and SOC 2/ISO programs; no public third-party no-logs-style audit PDF reviewed for this draft. Request reports under NDA.	Not found No public third-party security or no-logs audit PDF located on the official site or docs.
ISO 27001	Vendor claimed Asserted on privacy-security and platform pages; certificate not independently re-verified against a public registry for this entry.	Not found No public ISO 27001 certificate found on official pages.
SOC 2 / SOC 3	Vendor claimed Vendor claims SOC 2 (comparison content references type II) and SOC 2-certified infrastructure; obtain current report in diligence.	Not found No public SOC 2/3 report found on official pages.
HIPAA / BAA	Vendor claimed HIPAA-oriented offering with BAA on Enterprise path per vendor; not available on all plan tiers.	Not listed
GDPR / EU data protection	Vendor claimed EU legal entity, residency options, consent tooling, anonymization, and DPA. Compliance depends on customer configuration and purposes.	Vendor claimed German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.
US CLOUD Act exposure (indicative)	Partial No known US parent (Polish SA). Medium exposure due to Microsoft Azure as public/private cloud subprocessor and optional US region; Elastx Sweden is EU-operated alternative. Not legal advice.	Partial EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Business DPA linked from Business plan signup (piwik.pro/business-dpa/); Enterprise contracts expand terms.	Not found No standalone public DPA download found during research; request under contract for B2B processing.
EU AI Act	Not applicable Analytics/activation platform; not marketed as an AI system provider. Customer AI use of exported data is out of product scope.	Not applicable Web analytics product; not marketed as an AI system under the EU AI Act.

Considerations & known limitations: Piwik PRO vs Sitesights
Considerations & known limitations	Piwik PRO	Sitesights
US-group cloud (Azure) in hosting path	Medium Even with EU region selection, Azure introduces US-group infrastructure risk. Pin region, review SCCs/subprocessors, and escalate if policy forbids US cloud groups entirely.	Not listed
Closed source and no classic self-host	Medium Cannot independently audit full source or run fully air-gapped on customer iron. Private cloud still involves vendor-managed stack on Azure/Elastx.	Not listed
Certifications not independently verified here	Low ISO 27001, SOC 2, and HIPAA are vendor-claimed. Request certificates/reports and BAA text before treating them as assured.	Not listed
Paid plans only after Core sunset	Low Free Core has been discontinued; evaluation relies on trials and paid Business/Enterprise metering by actions/domains.	Not listed
Compliance depends on configuration	Medium Anonymous modes and CNIL exemption require correct setup and purpose limitation. Misconfiguration can recreate the same legal exposure teams left GA to avoid.	Not listed
No public independent security audit	Not listed	Medium ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.
Incomplete public subprocessor list	Not listed	Medium Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.
US-group CDN on marketing site	Not listed	Low Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.
48-hour hash limits long-term visitor analytics	Not listed	Low By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.
On-premise availability is marketing-only detail	Not listed	Low About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Fit

Piwik PRO

Best fit when

Regulated marketing/analytics teams that want one suite for measurement, consent, tags, and activation under a Polish legal entity
Public sector and EU enterprises that need selectable EU residency (e.g. Elastx Sweden or Azure NL/DE) plus a formal B2B DPA
Healthcare digital teams evaluating HIPAA-aware analytics with a signed BAA on Enterprise
Organizations leaving GA4 primarily for residency, no vendor ad-network reuse, and anonymous pre-consent measurement options
Teams that need enterprise reporting depth (custom reports, funnels, flows, attribution) beyond lightweight privacy analytics

Poor fit when

Buyers who mandate fully self-hosted open-source analytics with no cloud hypervisor vendor
Sites that only need simple cookieless page analytics without tag management or activation
Teams that refuse any US-group infrastructure (Azure appears in public hosting options even when EU regions are chosen)
Orgs seeking a free forever analytics tier (Core plan sunset; paid Business/Enterprise only)

Consider instead when

When: You need open-source code and true on-premises control
Consider: Matomo (self-host) or Friendly Analytics / Matomo by Stackhero for managed Matomo
Piwik PRO is proprietary cloud/private-cloud only.
When: You want minimal, cookieless EU analytics without enterprise suite complexity
Consider: Plausible Analytics or Simple Analytics
Far smaller feature surface; no HIPAA/CDP-style activation packaging.
When: You need a German enterprise analytics vendor with long public-sector presence
Consider: etracker
Different product depth and packaging—compare consent tooling and activation needs.

Sitesights

Best fit when

EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
Agencies and freelancers managing many client sites with projects and role-based invites
Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
WordPress or Shopify properties that want official plugin paths plus a light client script
Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
UX research needs for heatmaps or session replay
Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

When: You want a minimal EU cookieless SaaS or a well-known self-host option
Consider: Plausible Analytics
Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.
When: You need full self-host control, on-prem by default, or mature open-source governance
Consider: Matomo (self-hosted)
Heavier stack, deeper feature surface, and you operate the data plane yourself.
When: You need identity-rich product analytics, retention cohorts, or event warehouses
Consider: Mixpanel or similar product-analytics platforms
Different category—Sitesights is website/app growth analytics, not a full product analytics suite.
When: You need heatmaps, recordings, or UX feedback loops
Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools
Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Open questions for due diligence

Piwik PRO

What exact subprocessor list and backup/DR locations apply to the contracted region (Azure vs Elastx) today?
Can the vendor provide current ISO 27001 certificate scope and SOC 2 Type II report under NDA?
For healthcare: which plan tier, region, and BAA wording cover the intended PHI workflows?
Does the Business Swedish hosting path avoid Azure entirely for production data, or only for selected components?
What residual free/legacy Core accounts remain, and what is the migration deadline for this tenant?

Sitesights

Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?