← Back to Directory
Logo: Sitesights

Sitesights

German cookieless web analytics SaaS with real-time dashboards, events, funnels, and server-side APIs. Operated by Drude, Grossert GbR; product data claimed on Hetzner in Germany.

analyticscookielessprivacygdprsaasapigermany
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Sitesights is a German cookieless web analytics SaaS for websites and mobile apps, operated by Drude, Grossert GbR. It positions itself as a lightweight alternative to Google Analytics for traffic, campaigns, events, and conversion paths.

It exists for German and EU sites that want real-time dashboards without storing tracking cookies. According to the vendor, the standard path builds a server-side session hash from IP, User-Agent, site identifier, and a salt that rotates every 48 hours.

The concrete differentiator is that hash model plus funnels and server-side APIs, with product data claimed on Hetzner in Germany.

Cookieless trackingEU-operated (DE)Hetzner Germany (claimed)Server-side APIFunnels + page flowMulti-project / agencies

Shortlist Sitesights when you need German-operated cookieless web analytics with real-time dashboards, funnels, page flow, and a server-side API—especially agencies and SaaS teams that want Hetzner Germany hosting claims without running Matomo. Skip when you need public ISO/SOC audits, long-term visitor identity, session replay, or a fully published subprocessor pack; consider Plausible Analytics or self-hosted Matomo instead.

Key capabilities

Standard tracking does not set cookies. Sitesights generates a server-side salted hash from IP, User-Agent, and site id with a salt that rotates every 48 hours, so long-term cross-day visitor re-identification is intentionally broken. Useful when teams want essential traffic metrics without a cookie-consent banner solely for analytics—confirm legal basis with counsel for your jurisdiction and data fields (including geo).

Drop-in client snippet marketed as under 1 KB, with official WordPress and Shopify integration paths for non-engineers. Fits marketing sites and stores that need quick instrumentation without a heavy tag manager stack.

Send page views and events from your backend with API-key auth so ad blockers cannot strip the beacon. MIT-licensed C# and Node.js libraries on GitHub speed integration; keep API keys off the client. Preferred path for accuracy-critical SaaS and app backends.

Live dashboard for visitors, pageviews, and sessions with advanced filters, UTM/campaign views, geo, browser, OS, screen size, and daytime patterns. Aimed at operators who want essential marketing analytics in one place rather than a full product-analytics suite.

Build multi-step funnels and visual page-flow maps to see entry paths, routes, and exits. Helps conversion and UX work without session replay. Depth is journey-oriented, not identity-graph product analytics.

Group sites and apps into projects, assign roles/permissions, and invite clients or teammates. Marketing materials reference high ceilings for team seats and properties on paid plans—verify current limits on the official pricing page.

At a glance

HQ / entity
Drude, Grossert GbR, Germany
Category
Web analytics (SaaS)
Hosting (product)
Hetzner, Germany (vendor docs)
Tracking model
Cookieless; 48h rotating server hash
Open source
No (libs/plugins public; core SaaS proprietary)
Commercial model
Free start; pageviews + events subscriptions (Paddle)

Best fit when

  • EU teams replacing GA4 with cookieless SaaS and wanting funnels/page-flow beyond a bare traffic counter
  • Agencies and freelancers managing many client sites with projects and role-based invites
  • Engineering-led installs that prefer server-side pageview/event ingestion against ad blockers
  • WordPress or Shopify properties that want official plugin paths plus a light client script
  • Orgs that value a German GbR legal entity and Hetzner Germany hosting claims over US multi-region analytics

Poor fit when

  • Product analytics requiring long-term user identity, cross-device stitching, or CDP-style profiles (48h hash by design)
  • Buyers who need public ISO 27001, SOC 2, or independent audit PDFs before shortlist
  • Teams that require self-serve open-source self-host as the primary deployment (on-prem only claimed, not documented as OSS)
  • UX research needs for heatmaps or session replay
  • Procurement that requires a complete public subprocessor list without an NDA conversation

Consider instead when

  • When: You want a minimal EU cookieless SaaS or a well-known self-host option

    Consider: Plausible Analytics

    Simpler metric set; strong self-host story. Sitesights markets deeper funnels/page-flow and multi-project agency features.

  • When: You need full self-host control, on-prem by default, or mature open-source governance

    Consider: Matomo (self-hosted)

    Heavier stack, deeper feature surface, and you operate the data plane yourself.

  • When: You need identity-rich product analytics, retention cohorts, or event warehouses

    Consider: Mixpanel or similar product-analytics platforms

    Different category—Sitesights is website/app growth analytics, not a full product analytics suite.

  • When: You need heatmaps, recordings, or UX feedback loops

    Consider: Hotjar, Microsoft Clarity, or EU UX-analytics tools

    Sitesights focuses on traffic, events, funnels, and flows—not session replay.

Jurisdiction & ownership

Legal entity
Drude, Grossert GbR
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Medium
Hosting / residency
Product databases and app servers claimed in Germany on Hetzner. Marketing site uses Cloudflare (US) CDN. Payments via Paddle. Full product subprocessor/backup list not published on main site.

No known US parent; primary analytics path described as Hetzner DE. CLOUD Act row is EuropeanStack's indicative assessment (not a vendor claim): medium because of US-group CDN on the public site, global payment MoR, and incomplete public subprocessors. Not legal advice.

  • Independent security / no-logs auditNot found
  • ISO 27001Not found
  • SOC 2 / SOC 3Not found
  • GDPR / EU data protectionVendor claimed
  • +3

Considerations & known limitations

  • MediumNo public independent security audit

    ISO 27001, SOC 2, and third-party security audits were not found on public pages. Enterprises may need to commission questionnaires or wait for vendor artifacts under NDA.

  • MediumIncomplete public subprocessor list

    Hetzner (product) and Cloudflare (marketing site) are documented; backups, email, support, and monitoring vendors for the SaaS are not fully listed. Ask for a current subprocessor annex.

  • LowUS-group CDN on marketing site

    Privacy policy lists Cloudflare Inc. (US) for the public website CDN. Separate from claimed Hetzner product data path, but relevant to overall vendor surface area.

  • Low48-hour hash limits long-term visitor analytics

    By design, the rotating salt prevents durable cross-day visitor recognition. Teams needing retention cohorts or multi-week funnels by person must model events differently or choose product-analytics tools.

  • LowOn-premise availability is marketing-only detail

    About page claims on-prem hosting; docs do not provide a self-serve install guide. Treat as sales-assisted until scope is confirmed in writing.

Open questions for due diligence

  • Will the vendor sign a B2B DPA and provide a complete subprocessor list (backups, email, support, monitoring)?
  • Is the Hetzner Germany residency contractual for all analytics tenant data, including DR/backups?
  • What is the formal on-premise offering (SLA, update model, supported regions) versus SaaS-only?
  • Are any ISO 27001 / SOC 2 / penetration-test reports available under NDA?
  • How should geolocation fields and IP hashing be assessed under your counsel's GDPR legal-basis analysis?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

The vendor states that the standard Sitesights method uses no cookies and a server-side hash that rotates every 48 hours, so a cookie consent is not required for that mode. Legal outcomes still depend on your DPA analysis (IP hashing, geo fields, legitimate interest vs consent). Do not treat marketing claims as legal advice; document the configuration you ship.

Sitesights is operated by Drude, Grossert GbR in Germany. Product docs state that databases and application servers are in Germany on Hetzner. The marketing site privacy policy also lists Cloudflare (US) for CDN delivery of the public website. Ask for a written DPA and full subprocessor list covering backups, email, and support before enterprise sign-off.

Use the client script or plugins for fast installs on content sites. Prefer the server-side REST API (and C#/Node libraries) when ad blockers suppress front-end tags or when you already collect metrics in your backend. Server-side requires careful API-key handling and, for geo fields, your own geolocation source or reverse-proxy headers.

The primary product is multi-tenant SaaS. The About page mentions an on-premise option at a customer data center, but public docs do not present a self-serve open-source install. If residency or air-gapped control is mandatory, request on-prem terms in writing—or shortlist self-hosted Plausible/Matomo.

Sitesights markets a free start and paid plans billed by pageviews and events, with subscription payments via Paddle. Feature ceilings (API, team seats, site counts) are described on the marketing site and can change—always confirm current packaging on sitesights.io before procurement.

The analytics platform is proprietary SaaS. What is public on GitHub are integration assets (WordPress plugin, C# and Node tracking libraries), typically MIT-licensed. That is not the same as an open-source analytics server you can fork and run.