Plausible Analytics vs rdyrct

Compare Plausible Analytics and rdyrct on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Analytics

Plausible Analytics

Estonia· Web Analytics

Needs review

Shortlist when you need cookieless website analytics with EU-owned visitor hosting, a lightweight script, AGPL transparency, and either managed Cloud or self-hosted CE. Skip when you need heatmaps/session replay, multi-day user-level product analytics, HIPAA/BAA, free forever hosted analytics, or zero non-EU SaaS anywhere in vendor ops—consider Matomo-class (e.g. Friendly Analytics / Piwik PRO), Pirsch, or Simple Analytics depending on depth vs simplicity.

Cookieless by designEU-owned visitor hostsAGPLv3 open sourceSelf-host CEDPA automaticLightweight script

View listing Visit Website

rdyrct

Italy· Marketing Technology (MarTech) / Tag Management / Customer Data Platform

Needs review

Shortlist when you need branded short links, QR codes, and organization-scoped APIs with an explicit no-IP click schema under Italian control. Skip when you need a full website analytics suite or a vendor with published ISO/SOC audits and a registered company imprint. Consider Plausible Analytics for sitewide privacy analytics, or keep Google Analytics / Tag Manager when you need broad tagging rather than a redirect layer.

EU-operatedOpen sourceSelf-hostableNo IP in click analyticsAPI + MCP

View listing Visit Website

Highlighted rows differ between the two products.

Plausible Analytics vs rdyrct: Snapshot
Feature	Plausible Analytics	rdyrct
Country of origin	Estonia	Italy
Category	Web Analytics	Marketing Technology (MarTech) / Tag Management / Customer Data Platform
Open source	Yes	Yes
Self-hosted	Yes	Yes
Headquarters	Estonia	Italy
Legal entity	Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia	Andrea Bruno (data controller; no public company registry ID found)
Governing law	Estonian / EU law context for the OÜ; confirm contract terms for governing law clauses	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Visitor analytics: Hetzner (Falkenstein, Germany), UpCloud (Finland, DB/exports), Bunny (Slovenia, CDN/DNS/DDoS)—European-owned; vendor states visitor data never leaves the EU. Customer-account subprocessors include Paddle (payments), Postmark (email), Gravatar, optional Google (GA import), Help Scout, Nolt; site tools may include hCaptcha, Algolia, Mailchimp. SCCs claimed for non-EU processors.	Primary app and redirects on Cloudflare Workers/D1/KV/R2. Privacy policy also lists Resend (email), Polar (billing MoR), PostHog EU (optional product analytics), and Sentry (errors).
Summary	Estonian open-source, cookieless web analytics (AGPLv3): lightweight script, EU-owned hosting on Hetzner/UpCloud/Bunny, managed Cloud plus self-hosted Community Edition.	Italy-built URL shortener and QR platform for teams, with custom domains, UTM campaigns, and privacy-respecting click analytics.
Tags	analytics privacy open-source saas web-analytics cookieless gdpr self-hosted estonia google-analytics-alternative	analytics privacy open-source saas URL shortener branded links QR codes UTM Cloudflare Workers

At a glance: Plausible Analytics vs rdyrct
At a glance	Plausible Analytics	rdyrct
HQ	Tartu, Estonia	Not listed
Legal entity	Plausible Insights OÜ (reg. 14709274)	Not listed
Visitor hosts	Hetzner DE; UpCloud FI; Bunny SI	Not listed
License	AGPLv3; Cloud + Community Edition	MIT
Commercial model	Pageview-based Cloud SaaS; free CE self-host	Free tier + subscription (Polar MoR)
Tracking model	Cookieless; daily rotating hash; no PII stored	Not listed
HQ / controller	Not listed	Andrea Bruno (Italy)
Governing law	Not listed	Italian law (terms)
Hosted stack	Not listed	Cloudflare Workers, D1, KV, R2
Data residency regions	Not listed	Cloudflare edge (global PoPs); product analytics via PostHog EU when consented
Cookieless click analytics	Not listed	Click schema excludes IP; necessary session cookie for accounts; PostHog cookie only with consent

Key capabilities: Plausible Analytics vs rdyrct
Key capabilities	Plausible Analytics	rdyrct
Cookieless by design	Yes	Not listed
EU-owned visitor hosts	Yes	Not listed
AGPLv3 open source	Yes	Not listed
Self-host CE	Yes	Not listed
DPA automatic	Yes	Not listed
Lightweight script	Yes	Not listed
EU-operated	Not listed	Yes
Open source	Not listed	Yes
Self-hostable	Not listed	Yes
No IP in click analytics	Not listed	Yes
API + MCP	Not listed	Yes

Plausible Analytics

Cookieless measurement with daily rotating visitor hash
No cookies, localStorage, or persistent IDs. Uniques use hash(daily_salt + domain + IP + UA); salt rotates every 24 hours and raw IP/UA are never stored—so analytics can often run without a consent banner, at the cost of no multi-day user stitching.
Lightweight script and single-page traffic dashboard
Vendor claims a script ~54× smaller than Google Analytics with real-time updates (~30s), sources, pages, devices, UTM channels, scroll-depth goals, and optional Google Search Console import—built for marketers who refuse GA4 report complexity.
Goals, custom events, funnels, and revenue on Cloud
Codeless page goals, file downloads, outbound clicks, custom events/properties, AI-referral traffic views, and (on higher Cloud plans) funnels, user journeys, and ecommerce revenue attribution—not session replay or in-app product analytics.
EU-owned visitor hosting (Hetzner, UpCloud, Bunny)
Cloud visitor data is processed on European-owned infrastructure: Hetzner (Germany), UpCloud (Finland), Bunny CDN (Slovenia). Plausible states visitor data never leaves the EU and is not stored on US hyperscalers.
AGPLv3 open source with Community Edition self-host
Full codebase on GitHub; free CE for self-host (long-term releases ~twice yearly). Cloud-only features include advanced bot filtering, funnels/journeys, ecommerce revenue, SSO, and Sites API—self-host ops, backups, and upgrades are yours.
Automatic DPA, Stats API, exports, and enterprise SSO
Public DPA applies to Cloud customers by use; CSV export and Stats API for BI; Business/Enterprise add higher API limits, raw event exports, managed proxy, and SAML SSO (Google Workspace, Okta, Microsoft Entra ID per docs).

rdyrct

Branded short links on custom domains
Point your domain at rdyrct with automatic TLS. Custom domains get chosen slugs; the shared rdyr.cc namespace always assigns random slugs. Hobby allows one custom domain and Pro allows five.
Privacy-bounded click analytics
Each click stores country, referrer, device, and timestamp only. The vendor states IP addresses and precise locations are never stored. Retention is plan-tiered (7 / 30 / 365 days on Free / Hobby / Pro).
UTM campaigns and quiet-link alerts
Built-in UTM builder plus import of existing UTM parameters. Campaigns, sources, and mediums rank by clicks; analytics compare periods, show activity heatmaps, and flag links with no clicks in 30 days or large week-over-week drops.
QR codes with optional logo
Generate PNG or SVG QR codes per link with colors and dot shapes. Logo overlays are a paid-plan capability with size limits. A browser-side QR generator page works without an account.
Organizations, API, and MCP
Owner, admin, and member roles with email invites that expire after 7 days. Organization-scoped REST API keys and a hosted MCP server with OAuth or API key auth are available on every plan.
MIT open source on Cloudflare
Self-host on Cloudflare Workers, D1, KV, and R2 from the public GitHub repository. Hosted-service terms do not apply to self-hosted installs; you become the platform admin and set your own limits.

Assurance & compliance: Plausible Analytics vs rdyrct
Assurance & compliance	Plausible Analytics	rdyrct
Independent security / no-logs audit	Not found Open-source code and security overview published; no public independent pen-test or no-logs audit PDF found on compliance/security pages.	Not found Vendor claims no IP storage for clicks; no independent audit PDF found on the public site.
ISO 27001	Not found No ISO 27001 claim located on security or compliance hub pages reviewed.	Not found
SOC 2 / SOC 3	Not found No SOC 2/3 claim located on security or compliance hub pages reviewed.	Not found
GDPR / EU data protection	Vendor claimed EU entity; cookieless non-PII design; public data policy, DPA, and vendor-published legal assessment on GDPR/ePrivacy positioning.	Vendor claimed Italian data controller; privacy policy describes lawful bases, rights, and Italian DPA complaint path. Confirm DPA for B2B.
US CLOUD Act exposure (indicative)	Partial Estonian OÜ, no known US parent; visitor data on EU-owned Hetzner/UpCloud/Bunny. Partial/medium because customer-account subprocessors include US-oriented SaaS (e.g. Postmark, Help Scout, Gravatar, optional Google). Indicative only—not legal advice.	Partial Italian operator / no known US parent, but hosted path uses Cloudflare, Resend, Polar MoR, and Sentry (US-group SaaS/cloud). Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA applies automatically to Cloud customers by use of the service; lists processor duties and 48-hour breach notification target.	Not found No public DPA download or in-product DPA link found during research.
EU AI Act	Not applicable Website analytics product; not marketed as an AI system under the AI Act.	Not applicable

Considerations & known limitations: Plausible Analytics vs rdyrct
Considerations & known limitations	Plausible Analytics	rdyrct
US-linked customer-account subprocessors	Medium Visitor metrics stay on EU-owned hosts, but billing, email, support, and optional integrations use providers such as Postmark, Paddle, Help Scout, Gravatar, and Google—material for zero-US-processor policies.	Not listed
No public ISO 27001 / SOC 2	Medium Compliance hub emphasizes product design and EU hosting rather than ISO/SOC certificates; orgs with mandatory cert checklists must request evidence or accept open-source + DPA packaging.	Not listed
Self-host CE feature and release lag	Low CE is free but long-term releases (~twice yearly) and omits Cloud-only funnels, journeys, ecommerce revenue, SSO, and advanced bot filtering—ops burden sits with you.	Not listed
No multi-day user identity or replay	Low Daily hash resets prevent cross-day visitor stitching by design; heatmaps/session replay are out of scope—teams needing those must add other tools.	Not listed
Misconfiguration can reintroduce personal data	Medium Passing emails, patient IDs, or other identifiers in URLs or custom properties undermines the non-PII model; vendor also states no HIPAA/BAA.	Not listed
US-group hosting and SaaS subprocessors	Not listed	Medium Core service runs on Cloudflare; email, billing MoR, and error monitoring also use US-group providers. Teams with a hard ban on US cloud need self-host controls plus their own vendor choices, or a different product.
Individual data controller without public company registry ID	Not listed	Medium Procurement teams that require a registered company imprint and VAT ID will need offline confirmation; the public site names Andrea Bruno as controller under Italian law only.
No public independent audit or ISO/SOC	Not listed	Medium No-IP click claims are vendor statements. Security questionnaires that mandate third-party audits will stall until materials are provided under NDA or published.
Young public product	Not listed	Low Domain and public GitHub repository date from July 2026. Expect faster change and thinner operational history than long-running shorteners.

Fit

Plausible Analytics

Best fit when

Teams replacing GA4 who want aggregate marketing metrics without cookies or user profiles
EU orgs that require visitor analytics on European-owned infrastructure (Hetzner/UpCloud/Bunny)
Sites that prioritize script weight, Core Web Vitals, and a one-page dashboard
Buyers who want AGPL auditability and optional Community Edition self-host exit
Agencies and multi-site operators needing shared links, team seats, and pageview-tiered Cloud plans
Procurement paths that value a public DPA, data policy, and subprocessor list over ISO/SOC certificates

Poor fit when

Product analytics needs: multi-day user identity, cohorts, retention, feature experiments
UX research that requires heatmaps, session replay, or rage-click recording
Healthcare or other programs that require HIPAA and a BAA (explicitly not offered)
Buyers who need free forever hosted analytics with no subscription
Orgs that forbid any US-linked SaaS in vendor account tooling (Postmark, Help Scout, etc. are listed)

Consider instead when

When: You need Matomo-depth features (heatmaps, session recording, heavy on-prem packaging)
Consider: Friendly Analytics, Piwik PRO, or self-hosted Matomo
Trade Plausible’s minimalism for plugin breadth and different operators.
When: You want a lean EU privacy analytics peer with a different stack or license posture
Consider: Pirsch Analytics or Simple Analytics
Compare hosting ownership, funnels/ecommerce gates, and self-host options side by side.
When: You only need edge-level basic counts and already run Cloudflare
Consider: Cloudflare Web Analytics
Simpler install path; US company and thinner marketing analytics surface.
When: You need free hosted analytics and accept Google’s data practices
Consider: Google Analytics
Different legal and commercial model—not an EU privacy substitute.

rdyrct

Best fit when

Teams that need branded short links and QR codes under one organization with owner/admin/member roles
Buyers who require click analytics without storing IP addresses or precise locations
Engineers who want REST API keys and a hosted MCP server for agent-driven link workflows
Operators willing to run on Cloudflare Workers, including self-host on their own Cloudflare account
Italian or EU-governed procurement where the named Italian data controller and Italian governing law matter

Poor fit when

Organizations that need a full sitewide web analytics product rather than link and QR redirect analytics
Buyers that require a published ISO 27001 or SOC 2 report before shortlisting
Teams that refuse US-group subprocessors entirely (hosted path uses Cloudflare, Resend, Polar MoR, and Sentry)
Enterprises that need a registered company imprint with public VAT/registry ID on the vendor site

Consider instead when

When: You need privacy-friendly website analytics across pages, not just short-link redirects
Consider: Plausible Analytics or Trackboxx
Those products measure site traffic; rdyrct measures links and QR scans you create.
When: You need a mature MarTech CDP / tag management suite with enterprise contracts
Consider: Commanders Act
rdyrct is a focused shortener and QR tool, not a customer data platform.
When: You already standardize on Google tagging for campaigns and only need redirect vanity domains later
Consider: Google Analytics or Google Tag Manager
Keep them for sitewide tagging; evaluate rdyrct only for the short-link and QR control plane.

Open questions for due diligence

Plausible Analytics

Which exact customer personal data categories does each account subprocessor (Postmark, Paddle, Help Scout, etc.) receive in production?
Can Enterprise contracts exclude optional integrations (Google, Help Scout) or pin subprocessor lists for regulated buyers?
Are independent pen-test reports or ISO/SOC roadmaps available under NDA?
What are contracted RPO/RTO and backup locations beyond the high-level Hetzner/UpCloud description?
For CE self-host: which Cloud-only features remain permanently out of CE versus merely delayed on the long-term release train?

rdyrct

Will the vendor sign a B2B DPA and provide a current subprocessor list with regions?
Is there a registered Italian sole proprietorship or company VAT ID for contracting?
Are any independent security or no-logs audits available under NDA?
For self-host: which Cloudflare regions or account controls are recommended for residency-sensitive deployments?