← Back to Directory
Logo: Piwik PRO

Piwik PRO

Polish privacy-first analytics suite combining web and mobile analytics, tag management, consent management, and real-time data activation for regulated teams.

analyticsprivacygdprhipaaconsent-managementtag-managersaasenterpriseapi
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Piwik PRO is a commercial analytics and data-activation suite from Piwik PRO SA in Wrocław, Poland. It is not a freemium open-source tracker. Since diverging from the former Piwik/Matomo lineage around 2016, it ships as a closed-source cloud platform with analytics, tag manager, consent manager, and data activation under one license.

It exists for regulated teams that need privacy-compatible measurement and activation without assembling four vendors. Reporting is built on ClickHouse. Unsampled collection is the default.

The concrete differentiator is that four-module suite plus a documented path to France's CNIL audience-measurement consent exemption when configured to CNIL's constraints. Piwik PRO states it does not offer classic on-premises self-hosting; customers choose public or private cloud residency.

EU HQ (Poland)Analytics + tags + consentData activationEU hosting optionsISO 27001 / SOC 2 (claimed)HIPAA BAA (Enterprise)

Shortlist Piwik PRO when you need a managed European analytics controller with integrated consent, tagging, and real-time data activation—and you can accept cloud residency on Azure and/or Elastx. Skip when you require open-source self-hosting (consider Matomo or Friendly Analytics) or only need a minimal cookieless counter (Plausible, Simple Analytics).

Key capabilities

Session-level web and app analytics with custom reports, funnels, user flows, multi-channel attribution, and calculated metrics. Vendor positions unsampled collection by default with optional sampling for extreme volumes, plus raw export via API, files, and BigQuery—aimed at teams that outgrew pre-aggregated MySQL-style tools.

Collect privacy-safe behavioral signals without identifiers when visitors refuse cookies or when you configure limited measurement modes. Marketing can still see channels and journeys; personal identifiers and full attribution wait for a valid lawful basis—useful under GDPR/ePrivacy friction.

Capture and store consent, drive tag firing from preferences, and handle visitor data requests in-product. Optional Cookie Information CMP and server-side tagging paths reduce the usual glue code between a separate CMP, GTM, and analytics.

Segment audiences from live behavior and trigger on-site or outbound actions without exporting every event to a second CDP first. Suited to regulated marketers who want activation on first-party data they control.

Public cloud regions include Azure US, NL, DE, and HK plus Elastx Sweden; Enterprise private cloud spans 60+ Azure regions and Elastx. Business plan marketing highlights EU-operated Swedish hosting—pick region in procurement, not after go-live.

DPA available on Business signup; Enterprise adds private cloud, higher action volumes, SLAs, and HIPAA Business Associate Agreements for healthcare marketing analytics. Vendor also claims ISO 27001 and SOC 2—request current certificates in diligence.

At a glance

HQ
Wrocław, Poland (Piwik PRO SA)
Product type
Commercial analytics suite (SaaS / private cloud)
Open source
No (closed source since split from Matomo lineage)
Self-host
No classic on-prem; public or private cloud only
Hosting (public)
Azure US/NL/DE/HK; Elastx Sweden
Modules
Analytics, Tag Manager, Consent Manager, Data Activation
Commercial model
Business subscription + trial; Enterprise custom

Best fit when

  • Regulated marketing/analytics teams that want one suite for measurement, consent, tags, and activation under a Polish legal entity
  • Public sector and EU enterprises that need selectable EU residency (e.g. Elastx Sweden or Azure NL/DE) plus a formal B2B DPA
  • Healthcare digital teams evaluating HIPAA-aware analytics with a signed BAA on Enterprise
  • Organizations leaving GA4 primarily for residency, no vendor ad-network reuse, and anonymous pre-consent measurement options
  • Teams that need enterprise reporting depth (custom reports, funnels, flows, attribution) beyond lightweight privacy analytics

Poor fit when

  • Buyers who mandate fully self-hosted open-source analytics with no cloud hypervisor vendor
  • Sites that only need simple cookieless page analytics without tag management or activation
  • Teams that refuse any US-group infrastructure (Azure appears in public hosting options even when EU regions are chosen)
  • Orgs seeking a free forever analytics tier (Core plan sunset; paid Business/Enterprise only)

Consider instead when

  • When: You need open-source code and true on-premises control

    Consider: Matomo (self-host) or Friendly Analytics / Matomo by Stackhero for managed Matomo

    Piwik PRO is proprietary cloud/private-cloud only.

  • When: You want minimal, cookieless EU analytics without enterprise suite complexity

    Consider: Plausible Analytics or Simple Analytics

    Far smaller feature surface; no HIPAA/CDP-style activation packaging.

  • When: You need a German enterprise analytics vendor with long public-sector presence

    Consider: etracker

    Different product depth and packaging—compare consent tooling and activation needs.

Jurisdiction & ownership

Legal entity
Piwik PRO SA (Wrocław); affiliates Piwik PRO LLC (New York), Piwik PRO GmbH (Berlin)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Customer-selectable regions: Microsoft Azure public cloud (US, Netherlands, Germany, Hong Kong) and Elastx (Sweden, EU-operated). Enterprise private cloud: 60+ Azure regions plus Elastx. Business plan marketing highlights Swedish EU-operated hosting. No classic customer self-host.

Polish parent company with US subsidiary, not a US parent. Azure (US-group) hosting drives medium indicative CLOUD Act exposure even for EU-region pins. Confirm live subprocessor schedule and SCCs in the DPA. Not legal advice.

  • Independent security / no-logs auditPartial
  • ISO 27001Vendor claimed
  • SOC 2 / SOC 3Vendor claimed
  • HIPAA / BAAVendor claimed
  • +4

Considerations & known limitations

  • MediumUS-group cloud (Azure) in hosting path

    Even with EU region selection, Azure introduces US-group infrastructure risk. Pin region, review SCCs/subprocessors, and escalate if policy forbids US cloud groups entirely.

  • MediumClosed source and no classic self-host

    Cannot independently audit full source or run fully air-gapped on customer iron. Private cloud still involves vendor-managed stack on Azure/Elastx.

  • LowCertifications not independently verified here

    ISO 27001, SOC 2, and HIPAA are vendor-claimed. Request certificates/reports and BAA text before treating them as assured.

  • LowPaid plans only after Core sunset

    Free Core has been discontinued; evaluation relies on trials and paid Business/Enterprise metering by actions/domains.

  • MediumCompliance depends on configuration

    Anonymous modes and CNIL exemption require correct setup and purpose limitation. Misconfiguration can recreate the same legal exposure teams left GA to avoid.

Open questions for due diligence

  • What exact subprocessor list and backup/DR locations apply to the contracted region (Azure vs Elastx) today?
  • Can the vendor provide current ISO 27001 certificate scope and SOC 2 Type II report under NDA?
  • For healthcare: which plan tier, region, and BAA wording cover the intended PHI workflows?
  • Does the Business Swedish hosting path avoid Azure entirely for production data, or only for selected components?
  • What residual free/legacy Core accounts remain, and what is the migration deadline for this tenant?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

No. Piwik PRO is a closed-source, cloud-hosted suite. Official glossary materials state it does not offer classic on-premises self-hosting. Deployment choices are public cloud and private cloud (Azure regions and/or Elastx Sweden), not a downloadable appliance you run fully offline. If you need open-source on-prem analytics, evaluate Matomo or EU Matomo hosts instead.

You select a region at contract time. Public materials list Microsoft Azure (US, Netherlands, Germany, Hong Kong) and Elastx in Sweden, with broader private-cloud Azure options on Enterprise. Business plan pages emphasize EU-operated Swedish hosting. The controller company is Polish (Piwik PRO SA), with US/German affiliates—not a US parent. Still, Azure is US-group infrastructure, so treat CLOUD Act exposure as medium and review the DPA subprocessor list, SCCs, and pinned region before assuming “EU-only risk.”

Partially, with configuration limits. Piwik PRO supports anonymous tracking when visitors decline cookies, and CNIL has listed it among audience tools eligible for a consent exemption in France when you follow CNIL’s constrained setup (no personal data for ads, no forbidden data merges/exports). That exemption is configuration-specific and France-focused—not a universal GDPR waiver. Confirm current CNIL documentation and your DPO’s lawful-basis analysis for each market.

A Business subscription bundles Analytics, Consent Management, Tag Manager, and Data Activation, with action-volume and domain-based metering, multi-month data retention (vendor cites 25 months on Business), and a time-limited free trial (no card required to start, per vendor). Enterprise is custom: higher volumes, private cloud, implementation services, SLAs, and options such as a HIPAA BAA. A free “Core” tier has been sunset in favor of paid plans—check the live pricing and trial pages for current packaging.

Shared early history, separate products since ~2016. Matomo remains open source with true self-hosting and a large plugin ecosystem. Piwik PRO is proprietary SaaS/private-cloud with ClickHouse-oriented reporting, integrated consent and data activation, formal ISO/SOC/HIPAA marketing, and vendor-managed operations. Prefer Matomo when code auditability and on-prem control dominate; prefer Piwik PRO when you want a managed suite with activation and sector compliance packaging.

Vendor materials include a Business Data Processing Agreement as part of signup/terms and state ISO 27001, SOC 2, and HIPAA certifications plus regular external security reviews. EuropeanStack has not independently verified certificates against public registries for this entry—request current audit reports, subprocessor schedules, and (for healthcare) the BAA text during procurement.