Contentsquare vs Hotjar

Trust portal lists a pentest report and security whitepaper behind access. Security page claims annual external pentests, monthly scans, and a public bug bounty. No public no-logs audit (wrong category for a behavior recorder).

Vendor claims annual external penetration tests and publishes a Trust Portal with pentest reports behind access. No public independent no-logs audit (this is a recorder, not a no-logs VPN).

Trust portal and security page state ISO/IEC 27001 certification (also 27017, 27018). Certificate files require portal access. Not independently verified in a public registry during this draft.

Contentsquare states it is ISO 27001 certified (also claims ISO 27017, 27018, 27701). Certificates are on the Trust Portal; not independently downloaded for this draft.

Vendor claims ISO/IEC 27701 on the trust portal and company page. Same access-gated evidence.

Vendor states it holds a SOC 2 Type II report. Report is on the trust portal, not a public PDF in this research pass.

Trust portal and security pages claim a SOC 2 Type II report. Report not independently downloaded.

French SAS, public DPA with GDPR, UK GDPR, ePrivacy Directive, EU SCCs (French law, French courts), customer-as-controller. Customer still owns consent, masking, and lawful basis for visitor capture.

EU parent and contracting entity for non-Americas Hotjar Services. Public DPA, SCCs, and GDPR language. Customer is controller and must supply a lawful basis for visitor capture.

EuropeanStack assessment, not a vendor slogan. French entity and no known US parent, but visitor data sits on AWS and Azure (US-group clouds), a US affiliate provides support, and US SaaS subprocessors include Zendesk, Postmark, OpenAI, Deepgram, Snowflake, and Salesforce. US region is an explicit option. DPF covers the US entity. Not legal advice.

Assessment, not a vendor slogan. French parent and no known US parent, but AWS and Azure host visitor data, Content Square, Inc. and Zendesk process support data, and US regions exist. Not legal advice.

Public DPA last updated June 2026 (v.2026.2). Subprocessor objection window 30 days. SCCs Module Two and Three.

Public Contentsquare DPA incorporated by the MSA. Execution of the MSA or an order form is treated as execution of the DPA and SCCs.

Sense is in-product generative AI over customer and visitor data (Bedrock, Azure, OpenAI). No public AI Act conformity statement found. Customer is told to avoid personal data in prompts. Not treated as not_applicable.

Core product is analytics and replay, not an AI system sold as such. Sense AI and survey LLMs exist as optional features. Confirm AI Act role if you enable those modules.

DPA and services privacy policy state Content Square, Inc. is DPF certified (EU-U.S., UK Extension, Swiss-U.S.). Listing not re-opened during this draft.

Security page displays a HIPAA mark. No public BAA text reviewed. Confirm with vendor if health data is in scope (DPA says the service is not designed for sensitive data).

Security page shows a STAR mark. Trust portal lists CAIQ. Registry entry not independently opened.

Security page displays a STAR badge. Scope and level not independently verified.

Even with Ireland as the default EU region, the infrastructure providers are Amazon Web Services and Microsoft. Support and AI paths include Zendesk, a US affiliate, Bedrock or Azure OpenAI, and in some modules OpenAI, Deepgram, Snowflake, and Salesforce. Practical impact: a residency policy that bans US-group processors will fail this vendor regardless of the France HQ story.

Session replay and zoning record on-page behavior and can include on-screen text. Masking is configurable, not a guarantee that every form is clean. The customer is controller for consent and special-category data. Practical impact: legal and privacy must review checkout, account, and health or finance pages before go-live.

Journeys, error and speed analysis, alerts, and Data Connect are documented as Pro and Enterprise. Free and Growth cover heatmaps and replay only. Practical impact: do not shortlist on the free signup if those enterprise modules are the actual requirement.

Subprocessors and retention differ by module (13 months DXA, 37 months product analytics, 2 years for interview recordings). Practical impact: a Hotjar-only DPIA does not cover Conversation Intelligence or Sense Chat.

ISO 27001 and SOC 2 Type II are vendor-claimed. Independent certificate files were not downloaded in this draft. Practical impact: security review should request current reports before treating badges as verified.

Acquired in 2021 and described as merged into Contentsquare on 1 July 2025. New contracts are Contentsquare entities. A scheduled DXA transition from 18 August 2026 can move data and retire the old UI unless you elect to stay. Practical impact: vendor risk, product roadmap, and DPA counterparty are the French group, not Hotjar Ltd.

Visitor data sits on AWS and Azure. Zendesk (USA) and Content Square, Inc. handle support. US regions are default for some geographies. Practical impact: an Ireland region does not remove US-group infrastructure from a CLOUD Act discussion.

The vendor asks customers to block non-permitted personal data and claims card masking. Misconfigured tags still record inputs or on-screen PII. Practical impact: you need a suppressions review and a consent story before go-live.

No official self-hosted or open-source edition. Practical impact: skip this product if residency rules require your own servers.

Sense AI and survey AI use AWS Bedrock and Azure OpenAI. Practical impact: disable those features or map their regions if procurement treats LLMs as a separate transfer.