Data processing agreement (dpa) — Plausible Analytics

Cited by

Facts read from this source

• Region Report an error

  “Plausible Analytics is a European company and our data infrastructure is based in Germany and subject to the EU’s strong data privacy laws.”

• Data residency Report an error

  “All tracked data is secured, encrypted and hosted on renewable energy powered servers in Germany. Visitor data is processed and stored within the European Union on EU-owned infrastructure.”

• DPA addendum Report an error

  “This Data Processing Agreement (“DPA”) is an addendum to the Terms of Service between Plausible Analytics and the customer.”

• GDPR roles Report an error

  “The parties agree that the customer is the data controller and that Plausible Analytics is its data processor in relation to visitor data that is processed in the course of providing the service.”

• No cookies Report an error

  “We do not use cookies, browser cache nor local storage. We do not store, retrieve nor extract anything from visitor devices.”

• Anonymization Report an error

  “We generate a daily changing identifier based on these inputs. To anonymize these datapoints and make them impossible to relate back to the user, we run them through a hash function with a rotating salt.”

• No raw ip storage Report an error

  “The raw IP address and User-Agent are never stored in logs, databases or on disk.”

• Retention salt Report an error

  “Old salts are deleted every 24 hours to prevent linking visitor information across days and to eliminate the possibility of reconstructing original data.”

• Encryption Report an error

  “We use HTTPS in transit and strong hashing techniques. We apply strict firewall rules, private networking and secure backups. Passwords are hashed using bcrypt.”

• Open source Report an error

  “Plausible Analytics is open source software, allowing anyone to audit our code and understand how data is handled.”

• Subprocessors Report an error

  “Plausible Analytics uses subprocessors where necessary. These subprocessors are bound by data protection agreements and may process data only to provide the services Plausible Analytics has retained them for.”

• Change notification Report an error

  “Plausible Analytics will notify the customer of changes to subprocessors via in-app notifications, email or blog. The customer may object and terminate the agreement if necessary.”

• Breach notification Report an error

  “Plausible Analytics will notify the customer of any data breach without undue delay (no later than 48 hours) and take appropriate mitigation steps.”

• Audit rights Report an error

  “Such audits require at least 30 days’ written notice, take place during normal business hours without disrupting the service, are limited to once per year unless a supervisory authority requires otherwise, are bound by confidentiality, and are carried out at the customer’s cost.”

• Deletion Report an error

  “All data will be permanently deleted without undue delay upon deletion. This action is irreversible.”

• Deletion on lapse Report an error

  “You instruct Plausible Analytics to delete the affected team’s dashboards and stats after trial expiry or subscription lapse in accordance with the Cancellation and termination section of our Terms of Service.”

• Data subject requests Report an error

  “Plausible Analytics assists the customer with data protection obligations and forwards data subject requests to the customer.”

• DPA effective Report an error

  “This DPA is effective as of October 21, 2020, replaces any previously agreed data processing agreement between you and Plausible Analytics, and may be updated from time to time.”

• DPA acceptance Report an error

  “Use of the service constitutes acceptance of this DPA. No separate signature is required.”

• DPA last updated Report an error

  “Last updated: October 2026”

• Instruction processing Report an error

  “Plausible Analytics processes visitor data only in accordance with documented instructions from the customer through the use of the service.”

• Confidentiality Report an error

  “Persons authorised to process visitor data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.”

• Ownership Report an error

  “You retain full ownership and control of your website data. We obtain no rights from you to your website data.”

• No persistent identifier Report an error

  “We do not attempt to generate a device-persistent identifier.”

• Data subject scope Report an error

  “The group of data subjects affected includes end-users of the controller’s websites which use the service.”

• Article28 evidence Report an error

  “Plausible Analytics makes available to the customer the information necessary to demonstrate compliance with Article 28 GDPR, primarily through our published documentation (see our compliance page) and written answers to the customer’s questions.”

Scores citing this record

• The Agency Developer Consent-free operation & data minimisation
• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Consent-free operation & data minimisation
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Consent-free operation & data minimisation
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Consent-free operation & data minimisation
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Consent-free operation & data minimisation
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner European sovereignty
• The Skeptic Consent-free operation & data minimisation
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty