Plausible Analytics vs Publytics

Compare Plausible Analytics and Publytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Plausible Analytics

Estonia· Web Analytics

Needs review

Shortlist when you need cookieless website analytics with EU-owned visitor hosting, a lightweight script, AGPL transparency, and either managed Cloud or self-hosted CE. Skip when you need heatmaps/session replay, multi-day user-level product analytics, HIPAA/BAA, free forever hosted analytics, or zero non-EU SaaS anywhere in vendor ops—consider Matomo-class (e.g. Friendly Analytics / Piwik PRO), Pirsch, or Simple Analytics depending on depth vs simplicity.

Cookieless by designEU-owned visitor hostsAGPLv3 open sourceSelf-host CEDPA automaticLightweight script

View listing Visit Website

Publytics

Italy· Web Analytics

Needs review

Shortlist when you need cookieless, unsampled publisher analytics with multi-site Network views and a public EU DPA from an Italian SaaS operator. Skip when you need self-hosting, product analytics at GA4/Adobe depth, or product-level ISO/SOC—consider Plausible (simpler privacy analytics / self-host options) or Matomo (self-host ownership) instead.

Cookieless trackingNo default samplingMulti-site NetworkEU-hosted (EuroVPS/Hetzner)Public B2B DPAPublisher-focused UX

View listing Visit Website

Highlighted rows differ between the two products.

Plausible Analytics vs Publytics: Snapshot
Feature	Plausible Analytics	Publytics
Country of origin	Estonia	Italy
Category	Web Analytics	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	Estonia	Italy
Legal entity	Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia	Publytics S.r.l. / Publytics SRL, Via Val Leventina 3 INT 1, 20148 Milan (MI), Italy (VAT IT13079420967)
Governing law	Estonian / EU law context for the OÜ; confirm contract terms for governing law clauses	Italy / EU GDPR (processor under published DPA)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Visitor analytics: Hetzner (Falkenstein, Germany), UpCloud (Finland, DB/exports), Bunny (Slovenia, CDN/DNS/DDoS)—European-owned; vendor states visitor data never leaves the EU. Customer-account subprocessors include Paddle (payments), Postmark (email), Gravatar, optional Google (GA import), Help Scout, Nolt; site tools may include hCaptcha, Algolia, Mailchimp. SCCs claimed for non-EU processors.	Analytics infrastructure subprocessors in public DPA: EuroVPS (Euclid Services Ltd, Cyprus) and Hetzner Online GmbH (Germany). Data policy/DPA: EU storage (NL, DE, FI; DPA also IT); no transfer outside the EU for analytics processing. Account path: Stripe (payments), Brevo/Sendinblue (email).
Summary	Estonian open-source, cookieless web analytics (AGPLv3): lightweight script, EU-owned hosting on Hetzner/UpCloud/Bunny, managed Cloud plus self-hosted Community Edition.	Cookieless web analytics SaaS for digital publishers: unsampled real-time and historical metrics, multi-site Network views, GA import, and EU-hosted measurement from an Italian company.
Tags	web-analytics privacy cookieless gdpr analytics open-source saas self-hosted estonia google-analytics-alternative	web-analytics privacy cookieless gdpr publishers real-time

At a glance: Plausible Analytics vs Publytics
At a glance	Plausible Analytics	Publytics
HQ	Tartu, Estonia	Milan, Italy
Legal entity	Plausible Insights OÜ (reg. 14709274)	Publytics S.r.l. (VAT IT13079420967)
Visitor hosts	Hetzner DE; UpCloud FI; Bunny SI	Not listed
License	AGPLv3; Cloud + Community Edition	Not listed
Commercial model	Pageview-based Cloud SaaS; free CE self-host	Pageview tiers; free trial
Tracking model	Cookieless; daily rotating hash; no PII stored	Not listed
Hosting	Not listed	EuroVPS + Hetzner (EU regions)
Deployment	Not listed	Managed SaaS (not self-hosted)
Open source	Not listed	No (tracker uses MIT library code)

Key capabilities: Plausible Analytics vs Publytics
Key capabilities	Plausible Analytics	Publytics
Cookieless by design	Yes	Yes
EU-owned visitor hosts	Yes	Not listed
AGPLv3 open source	Yes	Not listed
Self-host CE	Yes	Not listed
DPA automatic	Yes	Not listed
Lightweight script	Yes	Not listed
No default sampling	Not listed	Yes
Multi-site Network	Not listed	Yes
EU-hosted (EuroVPS/Hetzner)	Not listed	Yes
Public B2B DPA	Not listed	Yes
Publisher-focused UX	Not listed	Yes

Plausible Analytics

Cookieless measurement with daily rotating visitor hash
No cookies, localStorage, or persistent IDs. Uniques use hash(daily_salt + domain + IP + UA); salt rotates every 24 hours and raw IP/UA are never stored—so analytics can often run without a consent banner, at the cost of no multi-day user stitching.
Lightweight script and single-page traffic dashboard
Vendor claims a script ~54× smaller than Google Analytics with real-time updates (~30s), sources, pages, devices, UTM channels, scroll-depth goals, and optional Google Search Console import—built for marketers who refuse GA4 report complexity.
Goals, custom events, funnels, and revenue on Cloud
Codeless page goals, file downloads, outbound clicks, custom events/properties, AI-referral traffic views, and (on higher Cloud plans) funnels, user journeys, and ecommerce revenue attribution—not session replay or in-app product analytics.
EU-owned visitor hosting (Hetzner, UpCloud, Bunny)
Cloud visitor data is processed on European-owned infrastructure: Hetzner (Germany), UpCloud (Finland), Bunny CDN (Slovenia). Plausible states visitor data never leaves the EU and is not stored on US hyperscalers.
AGPLv3 open source with Community Edition self-host
Full codebase on GitHub; free CE for self-host (long-term releases ~twice yearly). Cloud-only features include advanced bot filtering, funnels/journeys, ecommerce revenue, SSO, and Sites API—self-host ops, backups, and upgrades are yours.
Automatic DPA, Stats API, exports, and enterprise SSO
Public DPA applies to Cloud customers by use; CSV export and Stats API for BI; Business/Enterprise add higher API limits, raw event exports, managed proxy, and SAML SSO (Google Workspace, Okta, Microsoft Entra ID per docs).

Publytics

Unsampled real-time and daily publisher metrics
Dashboard and Real-time views show active users (including last-minute and 30-minute windows), top pages, sources, social referrals, and day trends—with minute-level trend comparison documented for real-time. Vendor states no default data sampling, so reports reflect full counted client-side traffic rather than GA-style estimates on large properties.
Multi-site Network mode for content portfolios
Business and Enterprise plans can group properties into Networks (plan caps apply: e.g. up to three Networks on Business, unlimited on Enterprise). Network views mirror site dashboards with split-by-site filters, combined real-time tables, and PDF/CSV export across the portfolio—built for multi-brand publishers rather than single blogs.
Cookieless measurement with daily-rotating visitor hash
Tracking avoids cookies and permanent device IDs. Per the DPA, IP and User-Agent are used only to derive a daily salted hash for unique visitors, then discarded; metrics stay aggregated (URL, referrer, browser/OS, device, country). Designed so many sites can skip consent banners for analytics alone—confirm with counsel for your jurisdictions and any custom IDs you add.
Historical import, custom events/dimensions, and API
Import paths cover GA4 and other tools (Plausible/Fathom mentioned) with support-assisted finalization. Custom events, dimensions, and metrics scale by plan; REST API uses Sanctum Bearer tokens scoped to subscribed sites. Fits teams rebuilding GA-era reporting without rebuilding infrastructure.
AI referral traffic reporting
Dedicated documentation for traffic referred from AI systems (ChatGPT, Gemini, Claude, Perplexity, Copilot, Mistral, Google AI Overviews, Deepseek, and others). Useful for publishers optimizing for answer-engine and AI-overview discovery alongside classic SEO sources.

Assurance & compliance: Plausible Analytics vs Publytics
Assurance & compliance	Plausible Analytics	Publytics
Independent security / no-logs audit	Not found Open-source code and security overview published; no public independent pen-test or no-logs audit PDF found on compliance/security pages.	Not found Searched official site; no public third-party security or no-logs audit PDF found. DPA describes hashing and non-retention of raw IP/UA.
ISO 27001	Not found No ISO 27001 claim located on security or compliance hub pages reviewed.	Not found No Publytics product certificate found. Host EuroVPS markets ISO certifications; that is infrastructure provider scope, not Publytics certification.
SOC 2 / SOC 3	Not found No SOC 2/3 claim located on security or compliance hub pages reviewed.	Not found No public SOC 2/3 report found on official Publytics pages.
GDPR / EU data protection	Vendor claimed EU entity; cookieless non-PII design; public data policy, DPA, and vendor-published legal assessment on GDPR/ePrivacy positioning.	Vendor claimed Italian controller/processor entity; cookieless design; public Art. 28 DPA; EU hosting named. Not legal advice.
US CLOUD Act exposure (indicative)	Partial Estonian OÜ, no known US parent; visitor data on EU-owned Hetzner/UpCloud/Bunny. Partial/medium because customer-account subprocessors include US-oriented SaaS (e.g. Postmark, Help Scout, Gravatar, optional Google). Indicative only—not legal advice.	Partial EU entity, no known US parent; analytics hosts EuroVPS + Hetzner in EU with DPA no third-country transfer for service data. Account billing via Stripe (US company). Not a vendor 'safe' claim—EuropeanStack assessment only.
Data processing agreement (B2B)	Vendor claimed Public DPA applies automatically to Cloud customers by use of the service; lists processor duties and 48-hour breach notification target.	Vendor claimed Full public DPA at https://publytics.net/dpa with Annex B subprocessors and Annex C security/transfer instructions.
EU AI Act	Not applicable Website analytics product; not marketed as an AI system under the AI Act.	Not applicable Web analytics product; AI-referral reporting is measurement of referrers, not an AI system product.

Considerations & known limitations: Plausible Analytics vs Publytics
Considerations & known limitations	Plausible Analytics	Publytics
US-linked customer-account subprocessors	Medium Visitor metrics stay on EU-owned hosts, but billing, email, support, and optional integrations use providers such as Postmark, Paddle, Help Scout, Gravatar, and Google—material for zero-US-processor policies.	Not listed
No public ISO 27001 / SOC 2	Medium Compliance hub emphasizes product design and EU hosting rather than ISO/SOC certificates; orgs with mandatory cert checklists must request evidence or accept open-source + DPA packaging.	Not listed
Self-host CE feature and release lag	Low CE is free but long-term releases (~twice yearly) and omits Cloud-only funnels, journeys, ecommerce revenue, SSO, and advanced bot filtering—ops burden sits with you.	Not listed
No multi-day user identity or replay	Low Daily hash resets prevent cross-day visitor stitching by design; heatmaps/session replay are out of scope—teams needing those must add other tools.	Not listed
Misconfiguration can reintroduce personal data	Medium Passing emails, patient IDs, or other identifiers in URLs or custom properties undermines the non-PII model; vendor also states no HIPAA/BAA.	Not listed
SaaS-only (no self-host)	Not listed	Medium All measurement depends on Publytics cloud availability and vendor roadmap. Teams with residency or air-gap requirements need Matomo/Plausible CE-style self-host alternatives.
No public independent security audit	Not listed	Medium Hashing and non-retention claims are first-party (DPA/docs). No public third-party audit was found—enterprise security reviews will need questionnaires, DPA audit rights, and possibly NDA materials.
Feature depth tied to pageview tiers	Not listed	Low Networks, API rate limits, custom dimensions/metrics, retention years, and time granularity differ by Lite/Business/Enterprise. Validate limits against portfolio size before migration.
US payment processor on account path	Not listed	Low Stripe processes payments (US company). Separate from DPA Annex B analytics hosts, but relevant if procurement treats all vendor SaaS touchpoints as in-scope for CLOUD Act diligence.
Customer-injected identifiers can re-identify	Not listed	Medium DPA warns controllers not to inject unique user IDs that re-identify visitors via the script. Misconfiguration can undermine the cookieless privacy model.

Fit

Plausible Analytics

Best fit when

Teams replacing GA4 who want aggregate marketing metrics without cookies or user profiles
EU orgs that require visitor analytics on European-owned infrastructure (Hetzner/UpCloud/Bunny)
Sites that prioritize script weight, Core Web Vitals, and a one-page dashboard
Buyers who want AGPL auditability and optional Community Edition self-host exit
Agencies and multi-site operators needing shared links, team seats, and pageview-tiered Cloud plans
Procurement paths that value a public DPA, data policy, and subprocessor list over ISO/SOC certificates

Poor fit when

Product analytics needs: multi-day user identity, cohorts, retention, feature experiments
UX research that requires heatmaps, session replay, or rage-click recording
Healthcare or other programs that require HIPAA and a BAA (explicitly not offered)
Buyers who need free forever hosted analytics with no subscription
Orgs that forbid any US-linked SaaS in vendor account tooling (Postmark, Help Scout, etc. are listed)

Consider instead when

When: You need Matomo-depth features (heatmaps, session recording, heavy on-prem packaging)
Consider: Friendly Analytics, Piwik PRO, or self-hosted Matomo
Trade Plausible’s minimalism for plugin breadth and different operators.
When: You want a lean EU privacy analytics peer with a different stack or license posture
Consider: Pirsch Analytics or Simple Analytics
Compare hosting ownership, funnels/ecommerce gates, and self-host options side by side.
When: You only need edge-level basic counts and already run Cloudflare
Consider: Cloudflare Web Analytics
Simpler install path; US company and thinner marketing analytics surface.
When: You need free hosted analytics and accept Google’s data practices
Consider: Google Analytics
Different legal and commercial model—not an EU privacy substitute.

Publytics

Best fit when

Content publishers and media sites that want GA3-style reporting without cookies or default sampling
Multi-brand portfolios that need Network dashboards, split-by-site filters, and shared exports
Teams migrating historical series from GA4 (or Plausible/Fathom) into a privacy-oriented SaaS
EU-oriented controllers who want Italian legal entity, published DPA, and EU infrastructure subprocessors named in annexes
Editorial/SEO leads who need real-time active users, sources, and AI-referral reporting without operating self-hosted analytics

Poor fit when

Organizations that require self-hosted or open-source analytics only
Product/growth teams that need GA4/Adobe-class event modeling, experiment stacks, and ads ecosystem integrations
Buyers that need verified product ISO 27001/SOC 2 certificates before shortlist (none found for Publytics itself)
Very simple single-site blogs that only need minimal privacy metrics—lighter tools may be enough

Consider instead when

When: You want open-core privacy analytics with optional self-host
Consider: Plausible Analytics
Simpler surface; stronger self-host/open-core path than Publytics SaaS-only model
When: You must run analytics on your own infrastructure
Consider: Matomo (self-host) or Plausible Community Edition
Publytics is managed cloud only—no official on-prem product
When: You need deep product analytics and marketing stack integration
Consider: Google Analytics or Adobe Analytics
Trade privacy/EU-hosting priorities for ecosystem breadth

Open questions for due diligence

Plausible Analytics

Which exact customer personal data categories does each account subprocessor (Postmark, Paddle, Help Scout, etc.) receive in production?
Can Enterprise contracts exclude optional integrations (Google, Help Scout) or pin subprocessor lists for regulated buyers?
Are independent pen-test reports or ISO/SOC roadmaps available under NDA?
What are contracted RPO/RTO and backup locations beyond the high-level Hetzner/UpCloud description?
For CE self-host: which Cloud-only features remain permanently out of CE versus merely delayed on the long-term release train?

Publytics

Will Publytics provide completed security questionnaire, pen-test summary, or ISO evidence under NDA for enterprise procurement?
Exact current pageview tier limits, Network caps, and retention for the sites you will migrate?
Is GA4 historical import complete for your property structure (events, custom dimensions) or only core traffic series?
How are subprocessors for account services (Stripe, Brevo) contractually covered relative to the analytics DPA annex?
Any planned US or non-EU hosting options that would change the current EU-only transfer instruction?