Sitesights vs Trackboxx

Compare Sitesights and Trackboxx on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Logo: Sitesights

Sitesights

Germany· Web Analytics

Needs review

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies
View listingVisit Website
Logo: Trackboxx

Trackboxx

Germany· Web Analytics

Needs review

Shortlist Trackboxx when you want German-operated, cookie-free hosted analytics with ecommerce and agency-friendly public dashboards. Skip when you need self-host/open-source control or GA-class product analytics—consider Plausible (self-host option) or Matomo instead.

Cookie-free trackingGermany-operatedFrankfurt analytics hostingE-commerce analyticsB2B DPA availableManaged SaaS
View listingVisit Website

Highlighted rows differ between the two products.

Sitesights vs Trackboxx: Snapshot
FeatureLogo: SitesightsSitesightsLogo: TrackboxxTrackboxx
Country of originGermanyGermany
CategoryWeb AnalyticsWeb Analytics
Open sourceNoNo
Self-hostedNoNo
HeadquartersGermanyGermany
Legal entityDrude, Grossert GbRTrackboxx / Christian Pust (sole trader imprint; Halberstadt seat, Grönwohld branch)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumMedium
Hosting / residencyProduct databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.Visitor analytics: TK Enterprises Ltd infrastructure in First Colo Frankfurt. CDN: BunnyWay d.o.o. (Slovenia). Payments: Paddle.com Market Ltd (UK). Email/newsletters: Amazon SES (AWS; EU regions primary, possible US). Chat on marketing site: Userlike UG (Germany).
Summary

German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.

German cookie-free web analytics SaaS: day-rotating hash tracking, ecommerce and UTM dashboards, hosted analytics in Frankfurt with a published B2B DPA.

Tags
analyticsprivacygdprsaascookielessapigermany
analyticsprivacygdprsaascookie-freeecommerce
At a glance: Sitesights vs Trackboxx
At a glanceLogo: SitesightsSitesightsLogo: TrackboxxTrackboxx
HQ / entityDrude, Grossert GbR, GermanyNot listed
CategoryWeb analytics (SaaS)Not listed
Hosting (product)Hetzner, Germany (vendor docs)Not listed
Tracking modelCookieless; 48h rotating server hashNot listed
Open sourceNo (libs/plugins public; core SaaS proprietary)No
Commercial modelFree start; pageviews + events subscriptions (Paddle)Pageview packages; free tier + trial; Paddle checkout
HQNot listedHalberstadt / Grönwohld, Germany
Legal entityNot listedTrackboxx / Christian Pust (imprint)
Product typeNot listedManaged web analytics SaaS
Self-hostNot listedNo
Analytics hostingNot listedFirst Colo, Frankfurt (via TK Enterprises Ltd)
Key capabilities: Sitesights vs Trackboxx
Key capabilitiesLogo: SitesightsSitesightsLogo: TrackboxxTrackboxx
Cookieless trackingYesNot listed
EU-operated (DE)YesNot listed
Hetzner Germany (claimed)YesNot listed
Server-side APIYesNot listed
Funnels + page flowYesNot listed
Multi-project / agenciesYesNot listed
Cookie-free trackingNot listedYes
Germany-operatedNot listedYes
Frankfurt analytics hostingNot listedYes
E-commerce analyticsNot listedYes
B2B DPA availableNot listedYes
Managed SaaSNot listedYes

Sitesights

  • Cookieless 48-hour rotating session hash

    Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).

  • Sub-1 KB client script plus WordPress and Shopify plugins

    Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.

  • Server-side REST API with C# and Node libraries

    Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.

  • Real-time overview with campaign and device filters

    Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.

  • Custom funnels and page-flow journey maps

    Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.

  • Multi-project workspaces with roles for agencies

    Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

Trackboxx

  • Cookie-free day-hash session tracking

    No analytics cookies. Same-day visitor correlation uses hashes of IP, user agent, site ID, and a daily rotating signature (page hashes also include host/path). Hashes expire within 24 hours so multi-day visitor histories and IP recovery are not available by design.

  • Traffic, channel, and live visitor dashboards

    Dashboards cover visits, pageviews, bounce rate, dwell time, devices/browsers, geo down to city, channel mix including AI traffic, outbound link clicks, live visitors on a short refresh interval, and period-over-period comparisons without a heavy analyst UI.

  • E-commerce funnels and revenue breakdowns

    Shop metrics include products sold, cart abandonment, add-to-cart style signals, checkout funnel visibility, and revenue by channel and location—aimed at operators who need store KPIs without a full GA4 ecommerce implementation.

  • UTM, goals, GSC keywords, and public reports

    Campaign UTMs, conversion goals (including auto goals), optional Google Search Console keyword views, shareable public dashboards (URL or iframe), and PDF reports support marketers and agencies who need client-facing summaries.

  • CMS and shop plugins plus GA import

    Documented integrations include WordPress, Shopware, Shopify, JTL, and ePages. Help center also covers script install, excluding own IP/paths, ads tracking patterns, and importing historical Google Analytics data when migrating.

Assurance & compliance: Sitesights vs Trackboxx
Assurance & complianceLogo: SitesightsSitesightsLogo: TrackboxxTrackboxx
Independent security / no-logs audit
Not found

No public third-party security or no-logs audit PDF located on the official site or docs.

Not found

No public third-party audit PDF or cert registry entry found on primary pages.

ISO 27001
Not found

No public ISO 27001 certificate found on official pages.

Not found

No ISO 27001 claim found on imprint, help center, or DPA materials reviewed.

SOC 2 / SOC 3
Not found

No public SOC 2/3 report found on official pages.

Not found

No SOC 2/3 report referenced on public trust materials reviewed.

GDPR / EU data protection
Vendor claimed

German controller (Drude, Grossert GbR); cookieless hashing and EU hosting claims in docs/privacy. Confirm DPA and legal basis for IP/geo with counsel.

Vendor claimed

German controller imprint; cookie-free hash model; public DPA; processing described as EU/EEA. Vendor asserts DSGVO fitness—confirm with counsel for your site stack.

US CLOUD Act exposure (indicative)
Partial

EU entity / no known US parent; product hosting claimed on Hetzner Germany. Marketing site lists Cloudflare (US); payments via Paddle; full SaaS subprocessor list not public. Indicative only—not legal advice.

Partial

EU sole-trader operator, no known US parent; analytics hosting claimed in Frankfurt. Partial/medium because privacy policy names Amazon SES (AWS) for email with possible US transfers; payments via UK Paddle. Not legal advice.

Data processing agreement (B2B)
Not found

No standalone public DPA download found during research; request under contract for B2B processing.

Vendor claimed

Free AV/DPA offered at order and as PDF; annex lists hosting, Paddle, BunnyWay.

EU AI Act
Not applicable

Web analytics product; not marketed as an AI system under the EU AI Act.

Not applicable

Web analytics SaaS; not an AI system product for AI Act high-risk classification purposes.

Considerations & known limitations: Sitesights vs Trackboxx
Considerations & known limitationsLogo: SitesightsSitesightsLogo: TrackboxxTrackboxx
No public independent security audit
Medium

ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.

Medium

Procurement teams that require cert packs will need questionnaires, DPA annex review, and possibly NDA materials beyond the public site.

Incomplete public subprocessor list
Medium

Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.

Not listed
US-group CDN on marketing site
Low

Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.

Not listed
48-hour hash limits long-term visitor analytics
Low

By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.

Not listed
On-premise availability is marketing-only detail
Low

About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Not listed
Consent banner claim is vendor legal opinionNot listed
Medium

Trackboxx argues legitimate interest and no opt-in for its cookie-free tracker alone, while noting some DPOs disagree. Other tags on the site can still force banners. Treat as diligence input, not a legal certificate.

Amazon SES on email pathNot listed
Medium

Privacy policy discloses AWS SES for system/newsletter email with possible US transfers. Distinct from Frankfurt analytics storage, but raises residual US-group process exposure for account communications.

No self-host editionNot listed
Low

Managed SaaS only. Policies that mandate customer-operated infrastructure need a different product.

Same-day hash limits multi-day user journeysNot listed
Low

By design you cannot rebuild long-lived individual visitor histories across days. Teams needing identity-resolution analytics will find this a hard product limit.

Fit

Sitesights

Best fit when

  • EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
  • Agencies and freelancers managing many client sites with projects and role-based invites
  • Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
  • WordPress or Shopify properties that want official plugin paths plus a light client script
  • Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

  • Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
  • Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
  • Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
  • UX research needs for heatmaps or session replay
  • Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

  • When: You want a minimal EU cookieless SaaS or a well-known self-host option

    Consider: Plausible Analytics

    Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.

  • When: You need full self-host control, on-prem by default, or mature open-source governance

    Consider: Matomo (self-hosted)

    Heavier stack, deeper feature surface, and you operate the data plane yourself.

  • When: You need identity-rich product analytics, retention cohorts, or event warehouses

    Consider: Mixpanel or similar product-analytics platforms

    Different category—Sitesights is website/app growth analytics, not a full product analytics suite.

  • When: You need heatmaps, recordings, or UX feedback loops

    Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools

    Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Trackboxx

Best fit when

  • German/EU SMEs and agencies replacing cookie-heavy GA for simpler privacy-oriented traffic stats
  • Online shops that need cart abandonment and revenue-by-channel without a full GA4 ecommerce stack
  • Teams that want public dashboards or PDF reports for clients and partners
  • Sites prioritizing fuller capture when consent banners and blockers suppress third-party analytics
  • Operators who accept managed SaaS and pageview-based packaging over self-hosting

Poor fit when

  • Organizations that must self-host or run open-source analytics under their own keys
  • Product/growth teams needing session replay, heatmaps, or advanced funnel/experiment suites
  • Enterprises requiring published ISO/SOC audit packs and extensive SSO/export documentation before shortlist
  • Buyers who need multi-year individual visitor identity graphs rather than same-day hash sessions

Consider instead when

  • When: You need cookieless EU analytics with an official self-host path

    Consider: Plausible Analytics (Cloud or Community Edition)

    Trade Trackboxx ecommerce/plugin depth for open-source deployability.

  • When: You want maximal privacy minimalism and a very small surface area

    Consider: Simple Analytics

    Simpler feature set; less ecommerce and shop-plugin emphasis than Trackboxx.

  • When: You need deep self-hosted analytics or on-prem control

    Consider: Matomo or Piwik PRO-class platforms

    Heavier ops and UI; stronger fit for full data residency under your infrastructure.

  • When: You depend on Google Ads identity graphs, Audiences, and free unlimited scale

    Consider: Google Analytics

    Keep GA only with full consent/transfer diligence; not a privacy substitute for Trackboxx.

Open questions for due diligence

Sitesights

  • Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
  • Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
  • What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
  • Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
  • How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?

Trackboxx

  • Is the DPA annex (subprocessors, TOMs) current relative to Amazon SES and any other processors used in production today?
  • What backup/DR locations and encryption practices apply beyond the First Colo Frankfurt statement?
  • Are enterprise SSO, data export APIs, or retention controls documented for larger buyers?
  • Has any independent penetration test or privacy audit been completed under NDA?