← Back to Directory
Logo: Offen Fair Web Analytics

Offen Fair Web Analytics

Open-source, self-hosted web analytics with opt-in consent, browser-side end-to-end encryption, and a shared Auditorium so visitors can see and control their own usage data.

Open sourceSelf-hosted
analyticsopen-sourceprivacyself-hostedopt-ingdpre2e-encryption
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Offen Fair Web Analytics is open-source, self-hosted web analytics built so visitors and site operators share the same view of what is collected. You deploy a single binary or Docker image on infrastructure you control and only start collecting after the visitor actively opts in.

It exists as a German project for sites that reject silent third-party analytics. There is no vendor multi-tenant SaaS for the product itself: usage events stay on your instance.

The concrete differentiator is browser-side end-to-end encryption plus the Auditorium: the server stores ciphertext and cannot decrypt events on its own. Only the visitor and the matching operator account can inspect that visitor's data.

Opt-in onlyBrowser E2E encryptionSelf-hostedApache-2.0Visitor data accessBerlin-based project

Shortlist when you want self-hosted, Apache-2.0 analytics that only measures after opt-in, encrypts events in the browser, and lets visitors open their own data in the Auditorium. Skip when you need cookieless full-coverage metrics, session replay/heatmaps, or zero-ops managed EU hosting—consider Plausible, Pirsch, or Friendly Analytics instead.

Key capabilities

No analytics events are recorded until the visitor actively consents. Cookies are first-party and the tracker is meant to run on a same-site subdomain so third-party cookie restrictions and cross-site tracking models do not apply. Visitors who never opt in leave no usage trail—expect lower absolute volumes than cookieless tools that measure by default.

Clients encrypt usage data before it leaves the browser; the server stores ciphertext and cannot decrypt events alone. Only the visitor (via their cookie) and the matching operator account can open that visitor's data in the Auditorium. Practical impact: a compromised database or overly broad ops access does not yield plaintext browsing histories the way a typical self-hosted analytics DB would.

Operators see aggregates across pages where the installation is active (unique users/sessions, top pages, filters). Each opted-in visitor can open the same style of UI for their own data only, with plain-language metric explanations, and can delete data or fully opt out later. This is the fair design point: measurement is not a one-way glass.

Dashboards cover real-time activity, page views, unique users and sessions, bounce rate, returning users, top pages, referrers, UTM campaign/source, landing and exit pages, weekly retention, and load time. Location is country-level from timezone mapping; mobile share uses orientation capability—not IP geolocation or UA parsing. No heatmaps, session replay, or warehouse-grade product analytics.

Production installs use a single binary (Linux/Windows/macOS) or the offen/offen image; docs also cover Heroku, Uberspace, and YunoHost. Default store is SQLite; MySQL and Postgres are supported. AutoTLS can request Let's Encrypt certificates. Config is environment variables or offen.env. You own uptime, backups, SMTP for password reset, and the subdomain layout.

One installation can cover multiple websites with shared team access. Default retention is six months with automatic deletion; operators can shorten retention (e.g. 12 weeks, 30 days, 7 days) knowing shorter values purge older events on startup. Consent banner appearance is customizable; UI locales include EN, DE, FR, ES, PT, and VI.

At a glance

HQ / authors
Berlin, Germany (Frederik Ring & Hendrik Niefeld)
License
Apache-2.0 (code/docs); logo CC-BY-NC-ND-4.0
Delivery
Self-host only (binary, Docker, community deploys)
Consent model
Opt-in only; first-party cookies
Default retention
6 months (configurable shorter)
Funding note
NLnet NGI support (project-stated)

Best fit when

  • Public-sector, media, NGO, or mission-driven sites that need visitor-visible transparency and strict opt-in
  • EU teams that must keep analytics off third-party trackers and can run a small always-on instance
  • Operators who want first-party subdomain cookies, CSP-aware embedding, and no IP/User-Agent collection
  • Organisations evaluating fair-processing design over maximum measurement coverage
  • Teams comfortable with SQLite or SQL self-host ops (binary or Docker) and publishing their own privacy notice

Poor fit when

  • Product or growth teams that require near-complete traffic measurement without consent friction
  • Needs for heatmaps, session replay, funnels, or ad-ecosystem attribution comparable to Hotjar/Mixpanel/GA
  • Buyers seeking a vendor-managed multi-tenant analytics cloud with SLAs and a signed vendor DPA as processor
  • Large enterprises that require public ISO 27001/SOC 2 or third-party security audit packs before shortlist

Consider instead when

  • When: You want privacy-oriented analytics with managed EU hosting and lower consent friction

    Consider: Plausible Analytics or Pirsch Analytics

    Typically optimised for simpler cookieless or low-friction models and hosted plans; less radical visitor Auditorium design than Offen.

  • When: You need EU hosted privacy analytics with operator support and less self-host burden

    Consider: Friendly Analytics

    European catalog peer oriented to hosted privacy analytics; compare consent model and feature depth to Offen’s opt-in + E2E approach.

  • When: You need deep product analytics, funnels, or session UX tooling rather than fair traffic metrics

    Consider: Hotjar, Mixpanel, or a full GA4 stack (with legal review)

    Different category: richer product/UX analytics, different jurisdiction and subprocessor profile.

Jurisdiction & ownership

Legal entity
Public legal notice lists Frederik Ring, Berlin (offen.software); product authors Frederik Ring and Hendrik Niefeld—no separate GmbH name verified on imprint
Governing law
Germany (indicative from Berlin imprint)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Product is operator self-hosted (your VPS/cloud/on-prem). No Offen multi-tenant analytics SaaS or vendor subprocessor list for visitor events. Related marketing site (offen.software) names Hetzner Online GmbH (Germany) as host—not the analytics data path. Optional community deploys include Heroku (operator choice).

Indicative only—not legal advice. Vendor CLOUD Act path is low for pure self-host OSS with no known US parent and no vendor US-cloud subprocessors for product data. If you deploy Offen on AWS/GCP/Azure/Heroku, exposure follows your host, not Offen's legal entity alone.

  • Independent security / architecture auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • HighOpt-in undercounts absolute traffic

    Visitors who never consent generate no events. Growth and content KPIs will not match cookieless tools or GA-style default measurement—treat as design, not a misconfiguration.

  • MediumYou own uptime, backups, and secrets

    No managed Offen cloud. Operators must run HTTPS/subdomain layout, set OFFEN_SECRET for stable sessions, configure SMTP for resets, and back up SQLite/SQL—plus avoid reverse proxies that log IPs if minimization is a goal.

  • MediumE2E crypto is vendor-claimed architecture

    Browser-side encryption and server inability to decrypt are core claims from project docs/README, not independently audited in public materials found. Security-sensitive orgs should review source or commission assessment.

  • MediumHosting choice reintroduces cloud jurisdiction

    Self-host on US-group cloud or Heroku means CLOUD Act/subprocessor analysis shifts to your host even though Offen itself is Berlin-based OSS without a vendor SaaS region map.

  • LowNo public ISO/SOC or audit pack

    Procurement checklists that require vendor ISO 27001/SOC 2 will stall; evidence is open source and design docs, not cert registry entries.

  • MediumEssential metrics only

    No heatmaps, session replay, advanced funnels, or product-analytics warehouse features. Wrong tool if the shortlist criterion is UX research depth rather than fair traffic statistics.

Open questions for due diligence

  • Will your traffic and KPI model tolerate opt-in-only measurement after a pilot on a non-critical property?
  • Where will you host the instance (EU on-prem/VPS vs US-group cloud), and who holds OFFEN_SECRET and DB backups?
  • Do procurement rules require third-party audits or ISO/SOC that Offen does not publish?
  • Do you need a signed vendor DPA as processor, or is controller-only self-host acceptable to counsel?
  • Is subdomain + CSP (script-src/frame-src + unsafe-inline styles for the banner) feasible on your main site?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

No. Collection is opt-in only. Until a visitor actively consents, Offen records no usage events for them. That is stricter than many privacy analytics products that still count pageviews without a consent cookie. Plan reporting and A/B expectations around lower coverage, and surface the Auditorium so consent is an informed choice rather than a dark-pattern banner.

By design, usage payloads are encrypted in the browser before upload; the server is not meant to hold decryptable event plaintext. Operators and the individual visitor decrypt via the Auditorium model. This reduces blast radius versus typical self-hosted analytics that store readable events in SQL—but you still must protect operator credentials, OFFEN_SECRET, TLS, and backups, and treat the design as claimed architecture unless you commission your own review.

A small always-on host (often one CPU core; about 512 MB to 2 GB RAM depending on concurrent operator logins), HTTPS (bring your own certs or enable AutoTLS), a subdomain of the same registrable domain as the site you measure (for first-party cookie and same-origin isolation), and a datastore (SQLite default, or MySQL/Postgres). Embed script.js with your account id; adjust CSP for script-src and frame-src to that subdomain and allow unsafe-inline styles for the consent banner. Configure SMTP if you want reliable password-reset email.

The product path documented by the project is self-host only—binary, Docker, or community deploy guides (Heroku, Uberspace, YunoHost). There is no vendor multi-tenant analytics SaaS described on the official site. Commercial work from the same people is positioned under offen.software as custom development and self-host support, not a turnkey Offen Cloud SKU. If you need zero-ops EU hosted analytics, shortlist peers such as Plausible, Pirsch, or Friendly Analytics instead.

Default retention is six months, after which events are deleted; shorter windows are configurable and destructive when lowered. Opted-in visitors can review their metrics in the Auditorium and delete existing usage data or opt out entirely. Operators should still publish their own privacy notice covering the legal basis, retention choice, and how to open the Auditorium—self-hosting does not remove controller duties under GDPR.