← Back to Directory
Logo: Simple Analytics

Simple Analytics

Dutch privacy-first web analytics SaaS: cookieless pageviews and campaigns without visitor IDs or stored IPs, EU-hosted by Simple Analytics B.V. in Amsterdam.

analyticsprivacycookielessgdprweb-analyticssaasapieu-hosted
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Simple Analytics is a Netherlands-based, privacy-first web analytics SaaS for teams that need traffic and campaign visibility without cookies, visitor IDs, or stored personal data. It is operated by Simple Analytics B.V. in Amsterdam. It was founded in 2018 by Adriaan van Rossum and is self-funded.

It exists as a Dutch alternative to Google Analytics for sites that would rather lose person-level journeys than run consent-gated trackers. According to the vendor, IPs are dropped, user-agents are truncated, and unique visits are inferred from the referrer hostname rather than cookies.

The concrete differentiator is that no-visitor-ID design. There is no official self-host path; open source is not the commercial model.

Cookieless analyticsNo stored IPs / visitor IDsEU-hosted (NL focus)Dutch B.V.Works beside GA4API & BI export

Shortlist when you need EU-operated, cookieless web metrics without visitor IDs or stored IPs—especially as a visibility layer beside GA4. Skip when you need self-host/open-source control, session replay, or identity-rich marketing analytics; consider Plausible Analytics or Matomo/Piwik PRO instead.

Key capabilities

Collects pageviews, referrers, UTMs, time-on-page, and scroll depth without cookies, localStorage, fingerprints, or stored IP addresses. Unique visits are inferred from referrer hostname matching, not device IDs. Built for sites that want analytics without a consent banner solely for this tool—and without building visitor profiles.

Country-level location is derived from the visitor’s IANA time zone rather than IP lookup, so IPs can be dropped end-to-end. City/region is not available; some border and multi-country zones can mis-tag. Useful when legal teams reject IP-based geolocation even when hashed.

Positioned to measure traffic lost when consent is denied in cookie-based tools. Import historical Google Analytics data; export via Stats/Export APIs and integrations toward Looker Studio, Power BI, and warehouse workflows so analysts can compare consented vs observed traffic without replacing every GA report.

Vendor claims a single script under 5 KB. Supports events, automated events (e.g. downloads, outbound links), goals, filters, email reports, and robot/referrer-spam controls. Ad-blocker resilience is via first-party proxy or custom subdomain CNAME—not automatic immunity for every blocklist.

Hosted product from Simple Analytics B.V. (Amsterdam) with role-oriented team features on higher tiers and documented SAML SSO for Okta and Microsoft Entra. No official self-host edition—operations and residency follow the vendor’s EU infrastructure and public subprocessor list.

At a glance

HQ
Amsterdam, Netherlands
Legal entity
Simple Analytics B.V. (KVK 88269922)
Founded
2018
Product type
Hosted web analytics SaaS (not self-hosted)
Open source
No (proprietary)
Data focus
Cookieless, non-identifying aggregate metrics
Primary hosting
Netherlands (EU); see subprocessors
Commercial model
Free hobby tier + usage-based paid + enterprise

Best fit when

  • Teams measuring traffic lost when consent is denied in cookie-based analytics (GA4/Adobe)
  • Public-sector and regulated sites that need no cookies/IPs/visitor profiles for web stats
  • EU procurement that requires Dutch legal entity + published EU subprocessors for visitor data
  • Agencies/multi-site operators wanting a simple hosted dashboard, reports, and API/BI egress
  • Sites that want essential pageview/referrer/UTM metrics without an analytics-only consent banner

Poor fit when

  • Product analytics needing session replay, heatmaps, or person-level funnels
  • Organizations that must self-host analytics or prefer open-source governance (see Plausible/Matomo)
  • Buyers requiring city/region geolocation accuracy (country is timezone-derived)
  • Teams whose primary need is identity-rich attribution, audiences, and marketing automation inside the analytics suite

Consider instead when

  • When: You need open-source and/or official self-hosting of privacy-first analytics

    Consider: Plausible Analytics (catalog: plausible_analytics) or Matomo

    Simple Analytics is hosted SaaS only; Plausible and Matomo cover self-host paths many security policies require.

  • When: You need a deeper EU enterprise analytics platform with configurable processing and on-prem options

    Consider: Piwik PRO (catalog: piwik_pro)

    Heavier suite and procurement surface than Simple Analytics’ minimal cookieless product.

  • When: You need identity graphs, remarketing audiences, and full marketing analytics depth

    Consider: Google Analytics or Adobe Analytics

    Keep those for consented deep analysis; Simple Analytics is the opposite design tradeoff.

  • When: You want another lightweight EU cookieless tracker and are comparing peers

    Consider: Pirsch Analytics (pirsch_analytics) or Friendly Analytics (friendly_analytics)

    Compare retention, multi-site, SSO, and API maturity rather than GDPR slogans alone.

Jurisdiction & ownership

Legal entity
Simple Analytics B.V., Amsterdam (KVK 88269922, VAT NL864560011B01)
Governing law
Netherlands / EU
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Analytics data claimed processed in the Netherlands/EU. Public subprocessors (May 2026): Worldstream + Leaseweb (NL hosting), Hetzner (DE hosting), Bunny (SI CDN/DNS), Hyperping (FR uptime), Intention (NL domains). Vendor states this list covers website visitor-data subprocessors only—not payments/internal ops.

No known US parent; small self-funded Dutch team per About page. CLOUD Act exposure assessed low for the published EU analytics subprocessor path—not a legal safe harbor. GDPR page still mentions Cloudflare for CDN/DDoS while subprocessors list Bunny—confirm edge/CDN path in diligence. Indicative only; not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Partial
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumHosted SaaS only—no self-host

    No official self-host edition. Orgs with air-gap or on-prem telemetry mandates need Plausible self-host, Matomo, or similar instead.

  • MediumSOC 2 not yet complete

    SOC 2 Type II is publicly 'in progress'. Enterprise security reviews may block until a report is available or accept compensating controls (minimal data + EU hosts).

  • LowReferrer-based uniques and timezone country

    Uniques are not durable visitor IDs; country is timezone-based with known mis-tag edge cases. Totals will differ from GA client-ID models—set stakeholder expectations.

  • LowCDN/DDoS vendor documentation inconsistency

    Subprocessors list Bunny (EU) for CDN/DNS; GDPR page still references Cloudflare for CDN/DDoS. Ask for current edge path before asserting zero US-group infrastructure touch.

  • LowSmall independent operator

    Public About page describes a three-person self-funded team. Fine for many sites; large enterprises should assess continuity, support SLAs, and roadmap capacity explicitly.

Open questions for due diligence

  • Is Cloudflare still used for any CDN/DDoS path, or has Bunny fully replaced it for edge services?
  • When will SOC 2 Type II complete, and will the report be available under NDA?
  • What exact data-retention windows apply per plan for your expected traffic volume?
  • Will the vendor sign your standard DPA/SCC pack as-is for public-sector procurement?
  • Are any non-EU subprocessors used for account email, payments, or support that could affect broader vendor risk (visitor analytics list excludes these)?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Usually no—and the vendor markets it as a cookieless companion more than a full GA4 replacement. You get aggregated pageviews, referrers, campaigns, devices, and events without visitor graphs, remarketing audiences, or consent-gated session models. Many teams keep GA4/Adobe for deep consented reporting and add Simple Analytics to see traffic those tools miss when consent is denied or blockers strip third-party scripts.

Per vendor docs, uniqueness is inferred from the referrer hostname: same-site navigations count as non-unique; cross-host referrers start a new unique. That avoids cookies and IP hashing but is not the same as a durable visitor ID. Expect different totals than GA-style client IDs, especially on SPAs, multi-domain journeys, and privacy browsers that strip referrers.

Security pages state analytics data is processed in the Netherlands/EU. The public subprocessors list (May 2026) names Worldstream and Leaseweb (NL hosting), Hetzner (DE hosting), Bunny (SI CDN/DNS), Hyperping (FR uptime), and Intention (NL domains). The list is scoped to website visitor data, not every internal SaaS the company uses. Confirm current CDN/DDoS vendors in procurement—the GDPR page still mentions Cloudflare in places while the subprocessor table lists Bunny.

The vendor argues a DPA is usually not required because it claims not to process personal data, but says it can review and sign customer-provided DPAs that match the architecture. SOC 2 Type II is in progress (not complete at research time). No public ISO 27001 certificate or independent security audit PDF was found on primary trust pages—plan questionnaire time accordingly.

No official self-host product is offered; it is a multi-tenant SaaS. If your policy requires on-prem telemetry or full operational control of the analytics stack, evaluate open-source or self-host peers such as Plausible (self-host option) or Matomo / Piwik PRO instead. You can still reduce third-party script exposure with Simple Analytics’ first-party proxy/custom domain patterns.

Self-serve SaaS with a free hobby tier (limited history and sites; fair-use pageviews), a 14-day trial, paid plans that scale with usage (pageviews/data points), and enterprise packaging for security reviews, SSO, SLAs, and procurement. Confirm current limits and retention on the official pricing page—figures change and are omitted here deliberately.