Sitesights vs TelemetryDeck

Compare Sitesights and TelemetryDeck on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Matomo, Mixpanel

Logo: Sitesights

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies
View listingVisit Website
Logo: TelemetryDeck

TelemetryDeck

Germany· Web Analytics

Needs review

Shortlist TelemetryDeck for multi-platform app analytics when on-device double-hash anonymization, cookieless signals, open SDKs, and a German-operated SaaS matter more than self-host or profile-heavy product suites. Skip when you need website-only simplicity (Plausible/Pirsch), full self-host control (Matomo/Plausible CE), or Mixpanel/Firebase-class identity and ecosystem depth—and have legal review the vendor’s “not personal data / not Art. 28 processor” DPA model plus AWS/Azure subprocessors.

Multi-platform app SDKsOn-device anonymizationCookieless signalsEU-operated (DE GmbH)Open-source client SDKsManaged SaaS (no self-host)
View listingVisit Website

Highlighted rows differ between the two products.

Sitesights vs TelemetryDeck: Snapshot
FeatureLogo: SitesightsSitesightsLogo: TelemetryDeckTelemetryDeck
Country of originGermanyGermany
CategoryWeb AnalyticsWeb Analytics
Open sourceNoNo
Self-hostedNoNo
HeadquartersGermanyGermany
Legal entityDrude, Grossert GbRTelemetryDeck GmbH, Von-der-Tann-Str. 54, 86159 Augsburg (HRB 37541)
Governing lawNot listedGermany (terms reference German law / Bayern courts; consumer protections may vary)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumMedium
Hosting / residencyProduct databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.Product analytics: Microsoft Azure Amsterdam (NL), AWS Frankfurt (DE), Hetzner Falkenstein and Nürnberg (DE) per Privacy FAQ. Website privacy policy lists Microsoft Ireland Operations Ltd, Amazon Web Services Inc (US entity), and Hetzner Online GmbH as hosters with claimed Art. 28 contracts for site hosting. Account-side: HubSpot Inc (US CRM), Brevo/Sendinblue GmbH (DE email), Stripe payments per terms.
Summary

German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.

German privacy-first app analytics SaaS: lightweight multi-platform SDKs, on-device double-hash anonymization, cookieless signals, and managed dashboards for mobile, desktop, and web products.

Tags
analyticscookielessprivacygdprsaasgermanyapi
analyticscookielessprivacygdprsaasgermanyapp-analyticsmobile-sdkfree-tier
At a glance: Sitesights vs TelemetryDeck
At a glanceLogo: SitesightsSitesightsLogo: TelemetryDeckTelemetryDeck
HQ / entityDrude, Grossert GbR, GermanyNot listed
CategoryWeb analytics (SaaS)Not listed
Hosting (product)Hetzner, Germany (vendor docs)Not listed
Tracking modelCookieless; 48h rotating server hashNot listed
Open sourceNo (libs/plugins public; core SaaS proprietary)Not listed
Commercial modelFree start; pageviews + events subscriptions (Paddle)Free tier + monthly event volume; plan-based query retention
HQNot listedAugsburg, Germany (TelemetryDeck GmbH)
Legal entityNot listedTelemetryDeck GmbH · HRB 37541 · VAT DE353418916
Product typeNot listedManaged app/web analytics SaaS
Self-hostNot listedNo (open-source client SDKs only)
Hosting (vendor)Not listedAzure Amsterdam; AWS Frankfurt; Hetzner Falkenstein/Nürnberg
DPANot listedPublic DPA/AVV asserting anonymized non-processor model; TOMs on request
Key capabilities: Sitesights vs TelemetryDeck
Key capabilitiesLogo: SitesightsSitesightsLogo: TelemetryDeckTelemetryDeck
Cookieless trackingYesYes
EU-operated (DE)YesYes
Hetzner Germany (claimed)YesNot listed
Server-side APIYesNot listed
Funnels + page flowYesNot listed
Multi-project / agenciesYesNot listed
Multi-platform app SDKsNot listedYes
On-device anonymizationNot listedYes
Open-source client SDKsNot listedYes
Managed SaaS (no self-host)Not listedYes

Sitesights

  • Cookieless 48-hour rotating session hash

    Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).

  • Sub-1 KB client script plus WordPress and Shopify plugins

    Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.

  • Server-side REST API with C# and Node libraries

    Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.

  • Real-time overview with campaign and device filters

    Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.

  • Custom funnels and page-flow journey maps

    Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.

  • Multi-project workspaces with roles for agencies

    Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

TelemetryDeck

  • Multi-platform SDKs and HTTP signal ingest

    Official clients for Swift (Apple platforms including visionOS), Kotlin/Android, JavaScript, Flutter, React/React Native, Vue, and a one-line web snippet, with community Unity, Rust WASM, and Vapor clients. Any runtime can POST to the documented ingest API. Suits cross-platform product teams; not a drop-in replacement for a full marketing tag manager suite.

  • On-device salt-and-hash user anonymization

    Client SDKs salt and hash user identifiers on device; the server applies a second salt and hash so neither side can reverse the original ID. App analytics docs state IPs are never stored for signals; timestamps are rounded to the hour. Limit: publishers must not put personal data in custom metadata, or the anonymization model breaks for that payload.

  • Cookieless app and web tracking model

    No analytics cookies for product signals: apps keep a local anonymized identifier; web derives a hashed identifier from date, site, and partial IP context without storing full IPs. Aimed at leaner consent UX and simpler App Store privacy labels versus cookie-based trackers—still confirm legal posture for your jurisdiction and configuration.

  • Product dashboards, funnels, TQL, and notebooks

    Pre-built overview and AARRR-style customer journeys (acquisition, activation, retention, revenue), technical metrics (devices, versions, errors), visual funnel builder, Explore for raw signal types, TelemetryDeck Query Language for advanced insights, and Notebooks mixing live charts with markdown. Test mode separates IDE/dev traffic from production.

  • Volume-based SaaS with free tier and plan retention

    Commercial model is monthly event/signal volume with a free tier and paid plans that differ on included volume and how long data stays query-ready (cold storage may hold older data). Free accounts can stop ingesting when the budget is exhausted; paid plans warn and may auto-upgrade after sustained overage. Check current limits on the vendor dashboard—no self-host option.

Assurance & compliance: Sitesights vs TelemetryDeck
Assurance & complianceLogo: SitesightsSitesightsLogo: TelemetryDeckTelemetryDeck
Independent security / no-logs audit
Not found

No public third-party security or no-logs audit PDF located on the official site or docs.

Not found

Vendor claims no IP storage and open SDK code for inspection; no public third-party no-logs or security audit report found in this pass.

ISO 27001
Not found

No public ISO 27001 certificate found on official pages.

Not found

No public ISO 27001 certificate page located.

SOC 2 / SOC 3
Not found

No public SOC 2/3 report found on official pages.

Not found

No public SOC 2/3 report located.

GDPR / EU data protection
Vendor claimed

German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.

Vendor claimed

EU (German) controller entity; privacy policy and Privacy FAQ document anonymization, non-storage of IPs for signals, and EU hosting regions. Vendor asserts analytics signals are not personal data—validate with counsel for your config.

US CLOUD Act exposure (indicative)
Partial

EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.

Partial

German GmbH, no known US parent, EU regions named—but public hosters include AWS and Microsoft (US groups) and HubSpot (US) for CRM. Indicative medium exposure. Not legal advice.

Data processing agreement (B2B)
Not found

No standalone public DPA download found during research; request under contract for B2B processing.

Partial

Public DPA at telemetrydeck.com/dpa (German AVV prevails). Document asserts TelemetryDeck is not Art. 28 processor/joint controller because signals are anonymized; TOMs on request. Not a classic processor AVV—legal review required.

EU AI Act
Not applicable

Web analytics product; not marketed as an AI system under the EU AI Act.

Not applicable

Product analytics / telemetry; not marketed as an AI system core offering.

Considerations & known limitations: Sitesights vs TelemetryDeck
Considerations & known limitationsLogo: SitesightsSitesightsLogo: TelemetryDeckTelemetryDeck
No public independent security audit
Medium

ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.

Not listed
Incomplete public subprocessor list
Medium

Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.

Not listed
US-group CDN on marketing site
Low

Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.

Not listed
48-hour hash limits long-term visitor analytics
Low

By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.

Not listed
On-premise availability is marketing-only detail
Low

About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Not listed
US-group cloud and CRM subprocessorsNot listed
Medium

Even with EU regions, AWS and Microsoft Azure are US-group providers; HubSpot processes customer CRM data in a US SaaS path. Buyers with strict no-US-cloud policies need written architecture confirmation or another vendor.

Anonymization / non-processor legal modelNot listed
Medium

Public DPA states TelemetryDeck is neither processor nor joint controller for service data. Strong if true for your configuration; risky if custom metadata reintroduces personal data or if counsel disagrees with the anonymization analysis.

No public ISO/SOC or independent auditNot listed
Medium

No ISO 27001, SOC 2, or independent no-logs audit found publicly. Enterprise security questionnaires may need NDA materials or alternate assurance.

Free-tier ingest hard-stopNot listed
Low

Free plans discard events after the included monthly budget; overage data is not recoverable. Production apps on free tier need monitoring or a paid plan.

No self-hosted productNot listed
Low

Only client SDKs are open source. Organizations that must keep analytics databases on-prem cannot use TelemetryDeck as a full stack.

Fit

Sitesights

Best fit when

  • EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
  • Agencies and freelancers managing many client sites with projects and role-based invites
  • Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
  • WordPress or Shopify properties that want official plugin paths plus a light client script
  • Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

  • Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
  • Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
  • Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
  • UX research needs for heatmaps or session replay
  • Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

  • When: You want a minimal EU cookieless SaaS or a well-known self-host option

    Consider: Plausible Analytics

    Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.

  • When: You need full self-host control, on-prem by default, or mature open-source governance

    Consider: Matomo (self-hosted)

    Heavier stack, deeper feature surface, and you operate the data plane yourself.

  • When: You need identity-rich product analytics, retention cohorts, or event warehouses

    Consider: Mixpanel or similar product-analytics platforms

    Different category—Sitesights is website/app growth analytics, not a full product analytics suite.

  • When: You need heatmaps, recordings, or UX feedback loops

    Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools

    Sitesights focuses on traffic, events, funnels, and flows—not session replay.

TelemetryDeck

Best fit when

  • Mobile/desktop/web app teams that instrument events in code (Swift, Kotlin, Flutter, RN, JS) rather than only a website script
  • Product orgs prioritizing cookieless, double-hashed identifiers and leaner App Store privacy narratives versus ad-tech SDKs
  • Teams leaving Firebase Analytics or Mixpanel who accept a simpler event model for privacy-oriented defaults
  • European buyers wanting a German legal entity and EU-region hosting (Azure NL, AWS Frankfurt, Hetzner DE) with public privacy docs
  • Indie and small teams that want a free tier to start and volume-based paid plans as signal volume grows

Poor fit when

  • Organizations that must self-host the full analytics stack on their own infrastructure
  • Website-only traffic measurement without native app SDKs (Plausible/Pirsch are usually better fits)
  • Buyers that require public ISO 27001/SOC 2 certificates or a conventional Art. 28 processor DPA without the vendor’s anonymization legal model
  • Teams needing deep identity graphs, CRM-style user profiles, or full product-analytics marketing suites
  • Workloads that forbid US-group cloud providers entirely (AWS and Microsoft Azure are in the public host list)

Consider instead when

  • When: You only need privacy-friendly website analytics with a simple script

    Consider: Plausible Analytics or Pirsch Analytics

    Stronger web-first UX; weaker native multi-platform SDK story than TelemetryDeck

  • When: You must self-host analytics and own the database

    Consider: Matomo (self-host) or Plausible Community Edition

    TelemetryDeck is managed SaaS only

  • When: You need Firebase/Google ecosystem depth or free crash+remote-config adjacency

    Consider: Firebase Analytics (accept Google jurisdiction and tracking model)

    Different privacy and lock-in trade-offs

  • When: You need enterprise product analytics with rich identity and experimentation packaging

    Consider: Mixpanel or Amplitude

    Heavier privacy/cookie surface; more suite features

Open questions for due diligence

Sitesights

  • Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
  • Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
  • What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
  • Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
  • How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?

TelemetryDeck

  • Will counsel accept the public non-processor DPA/AVV model for your app’s identifier and metadata configuration?
  • Can TelemetryDeck provide TOMs, subprocessor list for the analytics plane, and any ISO/SOC or pen-test reports under NDA?
  • Which exact AWS/Azure services and accounts process customer organization data versus anonymized signals?
  • What contractual options exist to exclude or pin HubSpot and other US SaaS tools for account administration?
  • Current free-tier and paid plan event limits and retention windows for your expected volume (confirm on live plans UI)?