← Back to Directory
Logo: Mouseflow

Mouseflow

Denmark-headquartered behavior analytics SaaS: session replay, heatmaps, friction detection, journey analytics, and AI insights for CRO and UX teams, with EU or US Google Cloud residency and a public DPA.

analyticssession-replayheatmapsfrictiongdprsaasenterpriseaicro
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Mouseflow is a Denmark-headquartered behavior analytics SaaS for websites and digital experiences. It records visitor sessions and turns them into session replays, heatmaps, friction scores, journey maps, conversion funnels, form analytics, and on-site surveys.

It exists for marketing, UX, CRO, and ecommerce teams that need to see how people use a site, not only which pages they hit. According to Mouseflow, sessions are recorded at full rate without sampling, and every plan includes unlimited seats.

The concrete differentiator is that all-in-one replay and heatmap stack with EU or US Google Cloud residency and a public DPA. It is not cookieless privacy analytics.

Session replayHeatmaps + friction scoresEU or US residencyDPA availableDenmark HQISO 27001 DC (claimed)

Shortlist when you need session replay, heatmaps, friction scoring, and journey/funnel analysis from a Danish SaaS with public DPA and pin-able EU (Belgium) or US (Iowa) Google Cloud residency. Skip when you only need cookieless pageview analytics, must avoid US-group cloud or US affiliate processing, or require self-host—consider etracker, Friendly Analytics, or a self-hosted stack instead.

Key capabilities

Records complete visitor journeys—clicks, scrolls, navigations, device context—for later playback, starring, tagging, and sharing. Mouseflow markets 100% recording (no sampling) so rare bugs and checkout failures are not lost to traffic samples; filter by source, device, page, or friction events before reviewing.

Click, scroll, movement, and attention heatmaps overlay page layouts so teams see ignored CTAs and fold issues. Compare devices, campaigns, or time ranges side by side to measure redesign impact without running a separate heatmap product.

Automated scores surface rage clicks, dead clicks, hesitations, form abandons, and JavaScript errors, with links into the underlying replays. Mina AI answers natural-language questions about sessions and heatmaps so analysts spend less time manual-filtering queues.

Multi-page Journey Analytics, conversion funnels, field-level form analytics, and on-site feedback surveys sit in one workspace so drop-off diagnosis does not require four vendors. Useful for CRO and ecommerce teams closing the loop from path → leak → fix.

Public subprocessors list Google Cloud EMEA Limited with Belgium (EU) and Iowa (USA) storage. Signup geography determines default region (EU customers → EU; Americas/Oceania → US). Confirm contracted region and subprocessor annex before treating residency as guaranteed.

Vendor defaults include IP masking, keystroke exclusion for EU visitors, and field/element masking; customers must still audit HTML for PII. A public B2B DPA is available for electronic signature, with SCCs/DPF language for international transfers.

At a glance

HQ
Copenhagen, Denmark
Legal entity
Mouseflow ApS (+ Mouseflow, Inc. US affiliate)
Category
Behavior analytics / session replay SaaS
Hosting
Google Cloud Belgium (EU) or Iowa (US)
Self-host / OSS
No / No
Commercial model
Session-volume SaaS; free tier; unlimited users

Best fit when

  • CRO, UX, and ecommerce teams that need full session recordings linked to heatmaps and funnels
  • Mid-market orgs wanting public session-volume packaging and unlimited seats rather than per-seat DX platforms
  • EU buyers who can accept Google Cloud hosting if Customer Data is pinned to the Belgium region
  • Teams that want vendor friction scoring and Mina AI triage instead of manual replay queues only
  • Procurement that requires a signable DPA, SCCs/DPF language, and a published subprocessor list

Poor fit when

  • Sites that only need cookieless aggregate web analytics without DOM session replay
  • Hard sovereignty mandates that forbid US-group cloud (Google Cloud) or any US legal entity in the support path
  • Buyers requiring open-source or official self-hosted deployment
  • Enterprises standardized on Contentsquare/FullStory-class platforms who need deep custom DX integrations already covered there

Consider instead when

  • When: You need cookieless traffic analytics without session replay depth

    Consider: etracker or Friendly Analytics

    Different category focus: measurement and privacy defaults vs high-fidelity replay

  • When: You want free heatmaps/replays and accept Microsoft as processor

    Consider: Microsoft Clarity

    Lower cost of entry; different privacy and commercial model

  • When: You need enterprise digital-experience analytics with heavy customization

    Consider: Contentsquare or FullStory

    Higher implementation and procurement weight

  • When: You need Swiss/EU product hosts with no Google Cloud visitor path

    Consider: Friendly Analytics or fusedeck

    Confirm each peer’s subprocessor list independently

Jurisdiction & ownership

Legal entity
Mouseflow ApS, Flæsketorvet 68, 1711 Copenhagen V, Denmark; affiliate Mouseflow, Inc., Austin, Texas
Governing law
Denmark (DPA); courts of Copenhagen for DPA disputes
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Google Cloud EMEA Limited storage/hosting in Belgium (EU) and Iowa (USA); region by signup geography (EU customers → EU; Americas/Oceania → US). Affiliates Mouseflow ApS (DK) and Mouseflow, Inc. (TX) process Customer Data for support/implementation; DoiT Multi-Cloud Sverige (SE) for multi-cloud consulting.

No known US corporate parent (Danish HQ; Offspring Capital DK investor history). Medium CLOUD Act exposure from Google Cloud (US-group) and US affiliate processing, even when EU residency is selected. Indicative only—not legal advice.

  • Independent security / no-logs auditPartial
  • ISO 27001Vendor claimed
  • SOC 2 / SOC 3Partial
  • GDPR / EU data protectionVendor claimed
  • +4

Considerations & known limitations

  • MediumGoogle Cloud (US-group) hosts session data

    Even EU-region (Belgium) storage uses Google Cloud EMEA Limited. Material for DPIAs that treat any US-group cloud as in scope for CLOUD Act/transfer analysis.

  • MediumUS affiliate processes Customer Data

    Mouseflow, Inc. (Texas) is listed for consulting, support, maintenance, implementation, and development on Customer Data—not only a marketing office.

  • MediumSession replay can capture unexpected PII

    Defaults mask IPs/keystrokes/sensitive fields, but customers must audit DOM/HTML, forms, and custom variables; incidental PII is a shared-responsibility risk in this category.

  • LowISO/SOC claims are data-center scoped

    Public materials emphasize infrastructure certifications; SOC 1 vs SOC 2 wording differs across pages—verify current reports rather than assuming org-wide SOC 2.

  • LowSaaS-only (no self-host)

    Closed multi-tenant SaaS only; no official on-prem path if residency or operator control requirements demand it.

Open questions for due diligence

  • Will the order form / DPA annex hard-pin EU (Belgium) residency for our account, including backups and AI features?
  • Which categories of Customer Data does Mouseflow, Inc. (Texas) access in day-to-day support?
  • Can the current ISO 27001 / SOC report package be validated (scope, dates, legal entity) via the Security Kit?
  • Are AI (Mina) and MCP features processed only in the same residency region as session storage?
  • What is the published retention default per plan and the process/SLA for deletion after offboarding?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Mouseflow lists Google Cloud EMEA Limited for storage/hosting (Belgium, EU and Iowa, USA), affiliates Mouseflow ApS (Denmark) and Mouseflow, Inc. (Texas) for support/implementation, and DoiT Multi-Cloud Sverige (Sweden) for multi-cloud consulting. EU-based customers’ Customer Data is stored in the EU per the vendor’s residency table; Americas/Oceania default to the US. Always re-read mouseflow.com/legal/subprocessors at contract time.

Yes. A public DPA is published and can be signed electronically; it names Mouseflow ApS or Mouseflow, Inc. depending on the commercial agreement, treats the customer as controller and Mouseflow as processor for defined session/technical data, and incorporates SCCs plus EU-U.S. Data Privacy Framework language where transfers apply. Customers remain responsible for consent banners and excluding PII from captured HTML.

No. Mouseflow is proprietary multi-tenant SaaS. There is no official self-host or open-source distribution. Teams that need on-prem or full stack control should evaluate self-hosted session tools or Matomo-class stacks (for example Friendly Analytics for managed Matomo) instead.

Packaging is primarily session-volume based with a free forever tier, public paid tiers, unlimited users on listed plans, a short premium trial, and custom enterprise terms (SSO, BAAs for US healthcare contexts, etc.). Retention windows and feature packs scale with plan. Check mouseflow.com/pricing for current caps—do not hard-code currency figures into policies.

HQ is Danish (Mouseflow ApS), but session data is hosted on Google Cloud (US-group infrastructure) and a US affiliate may process Customer Data for support. EU residency limits where data sits for EU signups; it does not remove US-group cloud or affiliate processing from a DPIA. Treat exposure as material for sovereignty-hard mandates; pair EU region pinning with legal review of the DPA and subprocessor list. Not legal advice.

Vendor materials state data centers maintain ISO 27001, SOC 1 Type II, and PCI DSS (HIPAA for the US data center). Privacy pages also mention SOC 2 Type II-certified infrastructure, while FAQ text prefers SOC 1 as the internal standard. Request the Security Kit for current reports and verify scope—do not assume org-wide SOC 2 without the document.