Publytics vs Sitesights

Compare Publytics and Sitesights on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Publytics

Italy· Web Analytics

Needs review

Shortlist when you need cookieless, unsampled publisher analytics with multi-site Network views and a public EU DPA from an Italian SaaS operator. Skip when you need self-hosting, product analytics at GA4/Adobe depth, or product-level ISO/SOC—consider Plausible (simpler privacy analytics / self-host options) or Matomo (self-host ownership) instead.

Cookieless trackingNo default samplingMulti-site NetworkEU-hosted (EuroVPS/Hetzner)Public B2B DPAPublisher-focused UX

View listing Visit Website

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies

View listing Visit Website

Highlighted rows differ between the two products.

Publytics vs Sitesights: Snapshot
Feature	Publytics	Sitesights
Country of origin	Italy	Germany
Category	Web Analytics	Web Analytics
Open source	No	No
Self-hosted	No	No
Headquarters	Italy	Germany
Legal entity	Publytics S.r.l. / Publytics SRL, Via Val Leventina 3 INT 1, 20148 Milan (MI), Italy (VAT IT13079420967)	Drude, Grossert GbR
Governing law	Italy / EU GDPR (processor under published DPA)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Analytics infrastructure subprocessors in public DPA: EuroVPS (Euclid Services Ltd, Cyprus) and Hetzner Online GmbH (Germany). Data policy/DPA: EU storage (NL, DE, FI; DPA also IT); no transfer outside the EU for analytics processing. Account path: Stripe (payments), Brevo/Sendinblue (email).	Product databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.
Summary	Cookieless web analytics SaaS for digital publishers: unsampled real-time and historical metrics, multi-site Network views, GA import, and EU-hosted measurement from an Italian company.	German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.
Tags	cookieless privacy gdpr web-analytics publishers real-time	cookieless privacy gdpr analytics saas api germany

At a glance: Publytics vs Sitesights
At a glance	Publytics	Sitesights
HQ	Milan, Italy	Not listed
Legal entity	Publytics S.r.l. (VAT IT13079420967)	Not listed
Hosting	EuroVPS + Hetzner (EU regions)	Not listed
Deployment	Managed SaaS (not self-hosted)	Not listed
Commercial model	Pageview tiers; free trial	Free start; pageviews + events subscriptions (Paddle)
Open source	No (tracker uses MIT library code)	No (libs/plugins public; core SaaS proprietary)
HQ / entity	Not listed	Drude, Grossert GbR, Germany
Category	Not listed	Web analytics (SaaS)
Hosting (product)	Not listed	Hetzner, Germany (vendor docs)
Tracking model	Not listed	Cookieless; 48h rotating server hash

Key capabilities: Publytics vs Sitesights
Key capabilities	Publytics	Sitesights
Cookieless tracking	Yes	Yes
No default sampling	Yes	Not listed
Multi-site Network	Yes	Not listed
EU-hosted (EuroVPS/Hetzner)	Yes	Not listed
Public B2B DPA	Yes	Not listed
Publisher-focused UX	Yes	Not listed
EU-operated (DE)	Not listed	Yes
Hetzner Germany (claimed)	Not listed	Yes
Server-side API	Not listed	Yes
Funnels + page flow	Not listed	Yes
Multi-project / agencies	Not listed	Yes

Publytics

Unsampled real-time and daily publisher metrics
Dashboard and Real-time views show active users (including last-minute and 30-minute windows), top pages, sources, social referrals, and day trends—with minute-level trend comparison documented for real-time. Vendor states no default data sampling, so reports reflect full counted client-side traffic rather than GA-style estimates on large properties.
Multi-site Network mode for content portfolios
Business and Enterprise plans can group properties into Networks (plan caps apply: e.g. up to three Networks on Business, unlimited on Enterprise). Network views mirror site dashboards with split-by-site filters, combined real-time tables, and PDF/CSV export across the portfolio—built for multi-brand publishers rather than single blogs.
Cookieless measurement with daily-rotating visitor hash
Tracking avoids cookies and permanent device IDs. Per the DPA, IP and User-Agent are used only to derive a daily salted hash for unique visitors, then discarded; metrics stay aggregated (URL, referrer, browser/OS, device, country). Designed so many sites can skip consent banners for analytics alone—confirm with counsel for your jurisdictions and any custom IDs you add.
Historical import, custom events/dimensions, and API
Import paths cover GA4 and other tools (Plausible/Fathom mentioned) with support-assisted finalization. Custom events, dimensions, and metrics scale by plan; REST API uses Sanctum Bearer tokens scoped to subscribed sites. Fits teams rebuilding GA-era reporting without rebuilding infrastructure.
AI referral traffic reporting
Dedicated documentation for traffic referred from AI systems (ChatGPT, Gemini, Claude, Perplexity, Copilot, Mistral, Google AI Overviews, Deepseek, and others). Useful for publishers optimizing for answer-engine and AI-overview discovery alongside classic SEO sources.

Sitesights

Cookieless 48-hour rotating session hash
Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).
Sub-1 KB client script plus WordPress and Shopify plugins
Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.
Server-side REST API with C# and Node libraries
Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.
Real-time overview with campaign and device filters
Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.
Custom funnels and page-flow journey maps
Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.
Multi-project workspaces with roles for agencies
Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

Assurance & compliance: Publytics vs Sitesights
Assurance & compliance	Publytics	Sitesights
Independent security / no-logs audit	Not found Searched official site; no public third-party security or no-logs audit PDF found. DPA describes hashing and non-retention of raw IP/UA.	Not found No public third-party security or no-logs audit PDF located on the official site or docs.
ISO 27001	Not found No Publytics product certificate found. Host EuroVPS markets ISO certifications; that is infrastructure provider scope, not Publytics certification.	Not found No public ISO 27001 certificate found on official pages.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found on official Publytics pages.	Not found No public SOC 2/3 report found on official pages.
GDPR / EU data protection	Vendor claimed Italian controller/processor entity; cookieless design; public Art. 28 DPA; EU hosting named. Not legal advice.	Vendor claimed German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.
US CLOUD Act exposure (indicative)	Partial EU entity, no known US parent; analytics hosts EuroVPS + Hetzner in EU with DPA no third-country transfer for service data. Account billing via Stripe (US company). Not a vendor 'safe' claim—EuropeanStack assessment only.	Partial EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Full public DPA at https://publytics.net/dpa with Annex B subprocessors and Annex C security/transfer instructions.	Not found No standalone public DPA download found during research; request under contract for B2B processing.
EU AI Act	Not applicable Web analytics product; AI-referral reporting is measurement of referrers, not an AI system product.	Not applicable Web analytics product; not marketed as an AI system under the EU AI Act.

Considerations & known limitations: Publytics vs Sitesights
Considerations & known limitations	Publytics	Sitesights
SaaS-only (no self-host)	Medium All measurement depends on Publytics cloud availability and vendor roadmap. Teams with residency or air-gap requirements need Matomo/Plausible CE-style self-host alternatives.	Not listed
No public independent security audit	Medium Hashing and non-retention claims are first-party (DPA/docs). No public third-party audit was found—enterprise security reviews will need questionnaires, DPA audit rights, and possibly NDA materials.	Medium ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.
Feature depth tied to pageview tiers	Low Networks, API rate limits, custom dimensions/metrics, retention years, and time granularity differ by Lite/Business/Enterprise. Validate limits against portfolio size before migration.	Not listed
US payment processor on account path	Low Stripe processes payments (US company). Separate from DPA Annex B analytics hosts, but relevant if procurement treats all vendor SaaS touchpoints as in-scope for CLOUD Act diligence.	Not listed
Customer-injected identifiers can re-identify	Medium DPA warns controllers not to inject unique user IDs that re-identify visitors via the script. Misconfiguration can undermine the cookieless privacy model.	Not listed
Incomplete public subprocessor list	Not listed	Medium Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.
US-group CDN on marketing site	Not listed	Low Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.
48-hour hash limits long-term visitor analytics	Not listed	Low By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.
On-premise availability is marketing-only detail	Not listed	Low About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Fit

Publytics

Best fit when

Content publishers and media sites that want GA3-style reporting without cookies or default sampling
Multi-brand portfolios that need Network dashboards, split-by-site filters, and shared exports
Teams migrating historical series from GA4 (or Plausible/Fathom) into a privacy-oriented SaaS
EU-oriented controllers who want Italian legal entity, published DPA, and EU infrastructure subprocessors named in annexes
Editorial/SEO leads who need real-time active users, sources, and AI-referral reporting without operating self-hosted analytics

Poor fit when

Organizations that require self-hosted or open-source analytics only
Product/growth teams that need GA4/Adobe-class event modeling, experiment stacks, and ads ecosystem integrations
Buyers that need verified product ISO 27001/SOC 2 certificates before shortlist (none found for Publytics itself)
Very simple single-site blogs that only need minimal privacy metrics—lighter tools may be enough

Consider instead when

When: You want open-core privacy analytics with optional self-host
Consider: Plausible Analytics
Simpler surface; stronger self-host/open-core path than Publytics SaaS-only model
When: You must run analytics on your own infrastructure
Consider: Matomo (self-host) or Plausible Community Edition
Publytics is managed cloud only—no official on-prem product
When: You need deep product analytics and marketing stack integration
Consider: Google Analytics or Adobe Analytics
Trade privacy/EU-hosting priorities for ecosystem breadth

Sitesights

Best fit when

EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
Agencies and freelancers managing many client sites with projects and role-based invites
Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
WordPress or Shopify properties that want official plugin paths plus a light client script
Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
UX research needs for heatmaps or session replay
Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

When: You want a minimal EU cookieless SaaS or a well-known self-host option
Consider: Plausible Analytics
Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.
When: You need full self-host control, on-prem by default, or mature open-source governance
Consider: Matomo (self-hosted)
Heavier stack, deeper feature surface, and you operate the data plane yourself.
When: You need identity-rich product analytics, retention cohorts, or event warehouses
Consider: Mixpanel or similar product-analytics platforms
Different category—Sitesights is website/app growth analytics, not a full product analytics suite.
When: You need heatmaps, recordings, or UX feedback loops
Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools
Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Open questions for due diligence

Publytics

Will Publytics provide completed security questionnaire, pen-test summary, or ISO evidence under NDA for enterprise procurement?
Exact current pageview tier limits, Network caps, and retention for the sites you will migrate?
Is GA4 historical import complete for your property structure (events, custom dimensions) or only core traffic series?
How are subprocessors for account services (Stripe, Brevo) contractually covered relative to the analytics DPA annex?
Any planned US or non-EU hosting options that would change the current EU-only transfer instruction?

Sitesights

Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?