Matomo

Open-source Google Analytics alternative. NZ company; self-host for EU sovereignty or use an EU managed host.

Web analytics

Self-hosted

Hosting: Self-hosted Reviewed

GPL analytics on your EU server — full control of visitor data.

FES Scores 9

Pillar	Criterion	Score	Evidence
Easy	Day-one UX Can non-technical staff use it without a project?	3	Powerful UI; configuration takes time. Source
Easy	Operate Admin burden, updates, backups and language coverage.	2	You patch PHP/MySQL stack. Source
Easy	Integrate SSO, mail/CalDAV, APIs and common NGO connectors.	4	Tag manager, goals and many plugins. Source
Fair	Lock-in / exit Can you leave with your data in open formats, at known cost?	5	Rule baseline (rubric_v1): self-host + open-source path supports exit with your data. Source
Fair	Sovereignty EU legal entity, EU hosting, and exposure to extra-EU lawful access?	4	Rule baseline (rubric_v1): non-EU vendor; self-host still lets you pick EU infra — verify update/support exposure. Source
Fair	Openness Open source or open standards? Are independent implementations possible?	5	Rule baseline (rubric_v1): license classified as open-source family. Source
Secure	IT security Authentication, encryption, patch cadence and independent audit.	4	Depends on your hardening. Source
Secure	User security 2FA, roles, phishing resistance and safe defaults.	3	Roles when configured. Source
Secure	Personal data GDPR fit: DPA, residency, sub-processors and Schrems II posture.	5	Data never leaves your infra by default. Source

Indicative scores from public information — how we score.

Hosting: Global SaaS Reviewed

Official Matomo Cloud: visitor data stored in the EU (Frankfurt); vendor is Matomo / InnoCraft (New Zealand).

FES Scores 9

Pillar	Criterion	Score	Evidence
Easy	Day-one UX Can non-technical staff use it without a project?	4	Managed cloud is quick for marketing teams. Source
Easy	Operate Admin burden, updates, backups and language coverage.	5	Hosting, updates and backups are included. Source
Easy	Integrate SSO, mail/CalDAV, APIs and common NGO connectors.	4	Same APIs, tag manager and plugin ecosystem. Source
Fair	Lock-in / exit Can you leave with your data in open formats, at known cost?	2	Rule baseline (rubric_v1): global SaaS APIs/export exist, but suite gravity and remapping remain. Source
Fair	Sovereignty EU legal entity, EU hosting, and exposure to extra-EU lawful access?	1	Rule baseline (rubric_v1): non-EU legal entity + global SaaS — high extra-EU lawful-access exposure. Source
Fair	Openness Open source or open standards? Are independent implementations possible?	5	Rule baseline (rubric_v1): license classified as open-source family. Source
Secure	IT security Authentication, encryption, patch cadence and independent audit.	4	Vendor-managed AWS EU infrastructure; review their security docs. Source
Secure	User security 2FA, roles, phishing resistance and safe defaults.	3	Matomo roles and access controls; account security is shared. Source
Secure	Personal data GDPR fit: DPA, residency, sub-processors and Schrems II posture.	3	EU residency and DPA available; NZ support access and subprocessors still need review. Source

Indicative scores from public information — how we score.