Swetrix vs Vantevo Analytics

Compare Swetrix and Vantevo Analytics on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Fathom Analytics, Google Analytics, Matomo

Swetrix

United Kingdom· Web Analytics

Needs review

Shortlist Swetrix when you want cookieless traffic plus product-oriented tools (funnels, RUM, errors, optional Cloud replays) under a UK company with Hetzner DE hosting and AGPLv3 self-host CE. Skip when you need public ISO/SOC packs, zero US-group subprocessors, multi-year cookie retention cohorts, or free forever hosted analytics—consider Plausible Analytics or Simple Analytics for minimal traffic-only privacy analytics, or Matomo for heavyweight self-host control.

Cookieless trackingHetzner DE hostingOpen source (AGPLv3)Self-host CEFunnels + errors + RUMPublic DPA

View listing Visit Website

Vantevo Analytics

Italy· Web Analytics

Needs review

Shortlist Vantevo when you want Italian-operated, cookie-less site analytics with a flat dashboard, goals/events, optional GA historical import, and beta ecommerce funnel events under a public DPA. Skip when you need multi-day returning-visitor identity, self-hosting/open source, or enterprise-grade public certifications—consider Plausible/Simple Analytics/Pirsch for lighter peers, or Piwik PRO for self-host/compliance-heavy programs.

Cookie-less trackingSingle-dashboard metricsEcommerce events (beta)GA history importPublic DPAItalian operator

View listing Visit Website

Highlighted rows differ between the two products.

Swetrix vs Vantevo Analytics: Snapshot
Feature	Swetrix	Vantevo Analytics
Country of origin	United Kingdom	Italy
Category	Web Analytics	Web Analytics
Open source	Yes	No
Self-hosted	Yes	No
Headquarters	United Kingdom	Italy
Legal entity	Swetrix Ltd (SC797389), Edinburgh, Scotland	Netforce Srl, Via Po' 136/A, 43124 Parma PR, Italy
Governing law	Not listed	Italian law (controller established in Italy; Terms governed by place of establishment)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Cloud analytics data: Hetzner Online GmbH (Germany) per DPA/Data Policy. End User error monitoring sub-processor: Sentry / Functional Software Inc. (United States). Customer-side Privacy Policy list also includes Paddle (UK payments), Fastmail (Australia business email), AWS (US transactional/marketing email), OpenRouter (US optional AI chat). No known US parent.	Vendor claims EU servers and EU backups. Public DPA names OVH Datacenter Roubaix and an AWS datacenter for storage/processing. Additional third parties: Stripe (payments), Crisp (support chat), optional Google Analytics and Search Console APIs when customers connect them.
Summary	Cookieless, privacy-first web analytics from a UK company: traffic, funnels, errors, and performance on Hetzner in Germany, with AGPLv3 self-host Community Edition and optional Cloud session replays.	Italian cookie-less web analytics from Netforce Srl (Parma): single-dashboard traffic, events, goals, and ecommerce funnels with EU processing claims and a public DPA.
Tags	analytics privacy gdpr cookieless open-source self-host product-analytics	analytics privacy gdpr cookie-less ecommerce api italy

At a glance: Swetrix vs Vantevo Analytics
At a glance	Swetrix	Vantevo Analytics
HQ	Edinburgh, United Kingdom	Parma, Italy (Netforce Srl)
Legal entity	Swetrix Ltd (SC797389)	Not listed
Governing law	Scotland (Terms)	Not listed
Primary hosting	Hetzner Online GmbH, Germany	Not listed
License	AGPLv3 (Community Edition)	Not listed
Commercial model	Event-volume Cloud subscription; free self-host CE; timed trial	View-based subscription after free trial
Open source	Yes — github.com/Swetrix/swetrix	Not listed
Product type	Not listed	Cookie-less web analytics SaaS
Self-host / OSS	Not listed	No (SaaS only; not open source)
Hosting (public DPA)	Not listed	OVH Roubaix + AWS datacenter; EU processing claims
Notable limit	Not listed	No multi-day returning visitors; max 50 sites/account (Terms)

Key capabilities: Swetrix vs Vantevo Analytics
Key capabilities	Swetrix	Vantevo Analytics
Cookieless tracking	Yes	Not listed
Hetzner DE hosting	Yes	Not listed
Open source (AGPLv3)	Yes	Not listed
Self-host CE	Yes	Not listed
Funnels + errors + RUM	Yes	Not listed
Public DPA	Yes	Not listed
Cookie-less tracking	Not listed	Yes
Single-dashboard metrics	Not listed	Yes
Ecommerce events (beta)	Not listed	Yes
GA history import	Not listed	Yes
Public DPA	Not listed	Yes
Italian operator	Not listed	Yes

Swetrix

Cookieless traffic analytics with hashed sessions
Lightweight script captures pageviews, referrers/UTMs, devices, and city-level geo without cookies or client-side storage. Per the Data Policy, IP and User-Agent are hashed in memory with a daily rotating salt; only a random session id is stored—so you get sessions without long-term cross-day visitor retention.
Funnels, custom events, and goals
Instrument signups, purchases, and other conversions as custom events; build multi-step funnels and goals in the dashboard. Useful for product and growth teams who need drop-off analysis without bolting on a second product-analytics SaaS.
Real-user performance and client error tracking
Records Web Performance API timings (TTFB, DNS, TLS, render, full page load) and optional JavaScript errors with stack/context by page and browser. Bridges marketing traffic views with engineering signals that pure pageview tools omit.
Opt-in Cloud session replays with privacy modes
Cloud projects can call startSessionReplay() to record DOM and interactions; default modes mask text/inputs. Replays are not created by ordinary pageviews—customers must enable them and own consent, masking, and page exclusions. Cloud-only versus Community Edition.
AGPLv3 open source with Docker self-host CE
Core platform is public on GitHub under GNU AGPLv3; Community Edition deploys via official Docker docs with MySQL, ClickHouse, and Redis. CE includes core analytics, events, sessions, funnels, performance, and errors—but not all Cloud extras (replays, some alerts/org/AI features).
Alerts, API, GA import, and team access
Configure alerts to email, Slack, Telegram, Discord, webhooks, or push; pull or push data via the API; import GA4 history; invite organisations with roles or share password-protected/public dashboards. Fits agencies and multi-site operators who outgrow single-user tools.

Vantevo Analytics

Daily-rotating hash visitor counting (no analytics cookies)
Visitor uniqueness for a day is derived from HASH(salt + domain + IP + User-Agent) with a salt that rotates every 24 hours; IP and User-Agent are not retained after hashing, per the DPA and docs. No cookies, localStorage, or browser cache for the analytics session—and therefore no multi-day new/returning visitor split. Fits privacy-led sites that prioritize aggregate trends over identity graphs.
Single-page traffic dashboard
Unique visitors, sessions, page views, bounce rate, duration, entry/exit pages, geography, devices, languages, referrals, and UTM campaigns appear on one overview without multi-level custom report builders. Aimed at agencies and SMEs that want operational metrics without a full-time analytics specialist.
Custom events, goals, and automatic link/download tracking
Track button clicks, scrolls, form submits, custom event names with metadata, and conversion goals; outbound links and file downloads can be auto-captured with HTML attributes to exclude specific URLs. Useful for content and lead-gen sites measuring meaningful actions without cookie tags.
Ecommerce funnel events (beta script)
Optional vantevo-ecommerce.js records wishlist, view item, cart add/remove, checkout stages, payment type, coupons, variants/categories, and purchase—docs mark the ecommerce section as still in beta. Best for shops that need privacy-oriented funnel visibility and can accept beta maturity.
Universal Analytics import and multi-platform install paths
Connect Google Analytics to import page statistics from January 2018 onward into the same calendar view (with documented metric gaps and API limits). Ship via head script, WordPress plugin, React/Vue/npm packages, Shopify/Wix theme paste, hybrid apps, or server-side event APIs—plus optional Search Console connection for keyword/impression views.

Assurance & compliance: Swetrix vs Vantevo Analytics
Assurance & compliance	Swetrix	Vantevo Analytics
Independent security / no-logs audit	Not found Searched marketing, DPA, privacy, and data policy; no public independent audit PDF located. Open-source code is available for review.	Not found No public third-party audit PDF or no-logs attestation found on security/docs pages searched.
ISO 27001	Not found No public ISO 27001 certification claim found on primary pages.	Not found No ISO 27001 certificate or registry evidence found on the public site.
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No SOC 2/3 report referenced on public trust/legal pages.
GDPR / EU data protection	Vendor claimed UK company; public GDPR/PECR discussion in Data Policy; cookieless design with non-stored IPs for standard analytics; Hetzner DE hosting; public DPA. Optional replays may be personal data depending on configuration—customer assesses legal basis.	Vendor claimed Italian controller (Netforce Srl); cookie-less visitor model and EU hosting asserted on docs/GDPR pages; public DPA available. Vendor “100% GDPR compliant” wording is a claim, not independent legal certification.
US CLOUD Act exposure (indicative)	Partial No known US parent; primary analytics on Hetzner DE. Material exception: Sentry (US) processes End User error data per DPA; Privacy Policy also lists AWS and OpenRouter (US) for customer email/AI. Indicative medium exposure—not a clean bill. Not legal advice.	Partial EU entity / no known US parent, but DPA lists AWS alongside OVH Roubaix; Stripe and optional Google APIs are US-group services. Not a clean EU-only infrastructure story. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA at swetrix.com/dpa incorporated by Terms; acceptance by use of Service; signed copy on request.	Vendor claimed Public DPA at vantevo.io/dpa; Terms state DPA forms part of the main agreement (customer controller, Netforce processor).
EU AI Act	Not applicable Core product is web analytics, not an AI system. Optional Ask AI / OpenRouter is ancillary; confirm if your deployment enables it.	Not applicable Web analytics SaaS; not marketed as an AI system product.

Considerations & known limitations: Swetrix vs Vantevo Analytics
Considerations & known limitations	Swetrix	Vantevo Analytics
US-group subprocessors (Sentry, AWS, OpenRouter)	Medium Primary analytics hosting is Hetzner DE, but Sentry (US) is an End User error-tracking sub-processor on the DPA, and AWS/OpenRouter appear for customer email/AI. Orgs with strict no-US-cloud rules need explicit acceptance or self-host CE to avoid those paths.	Not listed
Session replay is opt-in and controller-owned	Medium Cloud replays can capture DOM and inputs unless masked. Customers must enable startSessionReplay(), configure privacy modes/exclusions, and provide notices/consent where required—misconfiguration can reintroduce personal data risk that standard cookieless pageviews avoid.	Not listed
No public ISO/SOC or third-party audit	Medium Assurance relies on first-party policies, Hetzner infrastructure claims, and open source. Enterprise questionnaires that hard-gate on certs will stall until materials are provided under NDA or produced.	Not listed
Cloud vs Community Edition feature gap	Low Self-host CE is free and covers core analytics, but replays and several Cloud growth/ops features are limited or Cloud-only. Budget and feature planning must not assume feature parity.	Not listed
Daily salt rotation limits retention metrics	Low Cookieless design deliberately prevents classic multi-day visitor retention. Teams that need that metric class need another product or consented identity.	Not listed
AWS (and other US-group services) in data path	Not listed	Medium Despite Italian HQ and EU hosting marketing, the DPA explicitly stores data at OVH Roubaix and an AWS datacenter. Stripe payments and optional Google integrations add further US-group processors. Organizations with strict “no US cloud” policies need written clarification of regions, SCCs, and residual access risk.
No public ISO/SOC or independent audit	Not listed	Medium Shortlisting relies on vendor security measures described in the DPA (encryption, backups, breach notification windows) without published certs or third-party audit reports. Security questionnaires and NDA evidence may be required for regulated buyers.
No multi-day visitor identity by design	Not listed	Low Daily salt rotation and cookie-less design prevent classic returning-visitor and cross-device analysis. This is a privacy feature for many buyers and a hard product limit for others.
Ecommerce module still beta	Not listed	Medium Official ecommerce docs mark the section as beta/incomplete for final publication. Do not assume GA ecommerce parity or long-term event stability without a pilot.
View overage and website caps in Terms	Not listed	Low Recording can pause after plan-specific overage tolerances; Terms also set a 50-website maximum per account. Align marketing “unlimited domains” language with contract terms before large agency rollouts.
SaaS-only dependency	Not listed	Low No public self-host option. Continuity depends on Netforce operations, OVH/AWS, and export/delete workflows (JSON/CSV return or delete timelines in DPA/Terms).

Fit

Swetrix

Best fit when

SMEs, agencies, and product teams replacing GA4 who need cookieless traffic stats without a cookie banner driven only by analytics
Engineering-minded buyers who want error tracking and real-user performance in the same privacy-first dashboard as pageviews
Teams that may enable Cloud session replays later but can treat them as explicit opt-in with their own legal basis
Operators willing to run Docker Community Edition (MySQL/ClickHouse/Redis) when Cloud commercial terms or feature limits do not fit
Buyers who need a public B2B DPA, API access, GA4 import, and multi-channel alerts under a UK legal entity

Poor fit when

Enterprises that require published ISO 27001 / SOC 2 certificates or independent audit PDFs before shortlist
Policies that forbid any US-group subprocessors (Sentry is listed for End User error data; AWS/OpenRouter appear for customer services)
Use cases that depend on long-term cookie-based retention or cross-device identity graphs
Buyers who only want free hosted analytics with no paid Cloud tier and no self-host operations burden
Sites that will run session replays on sensitive flows without capacity to configure masking, exclusions, and consent

Consider instead when

When: You only need minimal cookieless pageviews/referrers with the smallest possible product surface
Consider: Plausible Analytics or Simple Analytics
Swetrix adds funnels, errors, RUM, and Cloud replays; peers stay closer to pure traffic analytics.
When: You need deep on-prem control, plugins, and mature enterprise self-host packaging
Consider: Matomo (self-host or managed EU hosts such as Matomo by Stackhero)
Heavier ops and optional cookies; stronger fit for large controlled deployments.
When: You must stay inside Google advertising measurement and free GA4 ecosystem tooling
Consider: Google Analytics
Trade privacy, consent, and transfer complexity for ads integration and zero software fee.

Vantevo Analytics

Best fit when

EU/Italian teams replacing Google Analytics for marketing-site KPIs without analytics cookies
Agencies needing a simple multi-site dashboard clients can read without GA training
Shops that want privacy-oriented funnel events (cart → checkout → purchase) and accept beta maturity
Migrations that need to pull Universal Analytics page history into a privacy-first tool
Stacks using WordPress, Shopify, React/Next, Vue/Nuxt, or server-side event APIs

Poor fit when

Requirements for multi-day returning visitors, cross-device identity, or ad-platform audience sync
Mandatory self-hosting, open-source code audit, or on-prem only deployments
Procurement that requires public ISO 27001/SOC 2 evidence and independent security audits before shortlist
Heavy product analytics / cohort experimentation beyond site and ecommerce funnel events
Accounts that need more than the Terms’ 50-website cap without vendor exception

Consider instead when

When: You want a well-known lightweight EU privacy analytics tool with strong community presence
Consider: Plausible Analytics or Simple Analytics
Compare ecommerce depth, GA import, and commercial packaging side by side.
When: You need self-host or enterprise compliance packaging
Consider: Piwik PRO (or Matomo self-host outside this catalog’s EU-SaaS peers)
Vantevo is SaaS-only with no public self-host edition found.
When: You need full product analytics and long-horizon cohorts
Consider: Mixpanel or similar product analytics suites
Different category: identity-rich product instrumentation vs privacy-first site metrics.
When: You specifically want German-market privacy analytics peers
Consider: Pirsch Analytics or etracker (catalog peers)
Validate feature parity on ecommerce and import paths.

Open questions for due diligence

Swetrix

Can Enterprise contracts exclude or replace Sentry (and other US-group subprocessors) for End User data paths?
Are ISO 27001, SOC 2, or pen-test summaries available under NDA?
What is the exact backup/DR location topology beyond “secure backups” wording on the DPA?
Which Cloud-only features remain permanently out of CE versus delayed open-source release?
For session replay at your traffic volumes, what retention defaults and export/delete SLAs apply on your plan?

Vantevo Analytics

Which exact AWS region(s) and services are in production, and are standard contractual clauses / transfer impact assessments available on request?
Is a current subprocessor list (beyond DPA/privacy mentions of OVH, AWS, Stripe, Crisp, Google) available under NDA?
Are ISO 27001, SOC 2, or independent penetration-test summaries available for enterprise procurement?
What is the production roadmap and support SLA for ecommerce events leaving beta?
How should multi-brand agencies interpret “unlimited domains” marketing versus the Terms’ 50-website cap—exceptions available?