Conversion Optimization
Varify.io
EU-Made Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 3 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Varify Software GmbH · varify.io
Compare with VWO → Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Varify.io is a German client-side A/B testing platform. Its scores are strongest on consent and tracking, 6 to 8, and weakest on experimentation scope and performance impact, both 4 to 5. The consent design is documented: variants play out from localStorage without a banner while tracking fires only after consent via Google Consent Mode or a consent tool, under a written ePrivacy position. Data and integrations score 6 to 7, carried by a BigQuery route placing raw, line-by-line, unsampled experiment data in the customer's project. Experimentation scope scores low because delivery stays client-side — server-side testing appears only as a feature-grid entry, with no public information on SDKs, holdouts or personalisation against a control — and statistical rigour, 4 to 6, names its methods and guidance, but we found no public information on sequential testing or sample ratio mismatch detection. The judges did not genuinely split: no criterion spans more than two points. Pricing is flat with unlimited traffic, though the captured pages give different entry figures — €119, 199 € and 249 € per month — and AI credits are unpriced.
Speaks for it
- Variants are played out without consent while tracking is triggered separately only after consent, via Google Consent Mode V1 and V2 or a consent tool.
- The BigQuery integration places raw, line-by-line, unsampled experiment data in the customer's own project and displays imported events as goals.
- Flat-rate pricing with unlimited traffic, published Growth and Pro prices, and a 15-day trial with no credit card details.
- Client-side coverage is broad — visual editor, redirect and split-URL tests, multi-page experiments, full-factorial multivariate tests, mutual exclusion and audience targeting.
- An 11.5 KB snippet size is published, and the anti-flicker documentation states its trade-off, including the warning that it may negatively affect Core Web Vitals and SEO.
Held against it
- Server-side testing appears only as a feature-grid entry, and we found no public information on SDKs, feature flags, holdouts or personalisation tested against a control.
- We found no public information on sequential testing, multiple-comparison correction or sample ratio mismatch detection.
- The captured pages give different figures for the entry price — €119 per month on the homepage, 199 € and 249 € elsewhere — and AI credits are unpriced.
- The Frankfurt hosting claim sits in marketing copy, we found no public information on the hosting provider or subprocessors of the testing product itself, and the imprint and privacy policy name the entity differently — Varify Software GmbH against Varify GmbH.
- We found no public information on measured Core Web Vitals impact, asynchronous loading, CDN delivery of the snippet or self-hosting.
Best for
- You run client-side experiments for a German or EU audience and need variants served while analytics tracking waits for consent.
- You verify results in your own data — the BigQuery route delivers raw, line-by-line, unsampled experiment data into your own project beside automatic GA4 evaluation.
- You want a traffic-independent invoice — flat-rate pricing with unlimited traffic, published Growth and Pro prices, and a 15-day trial with no credit card details.
Avoid if
- You need server-side delivery, feature flags or holdouts — the user documentation shows a client-side programme, with server-side testing as a feature-grid entry.
- You must pin down one entry price before committing — the captured pages give different figures for it, and AI credits are priced only as a monthly credit package or with your own API key.
- Your procurement requires a subprocessor list and a data processing agreement for the testing product's visitor data — the published privacy policy documents the vendor's own website chain, with SOC 2 marked as coming soon.
- Flicker-sensitive pages cannot absorb an anti-flicker script — the vendor itself states in writing that it may negatively affect Core Web Vitals and SEO.
The scores
Experiment types & delivery
Show reasoningHide reasoning
How this is scored
What can be tested and where: client-side changes through an editor, server-side and feature experiments through SDKs, multivariate and multi-page tests, and personalisation — judged on what the documentation shows rather than on the feature grid.
0 — Simple A/B split of one page element through a visual editor; no server-side option, no targeting beyond URL.
3 — Client-side A/B and split-URL tests with basic audience targeting, and no SDK or server-side delivery.
5 — Client-side and server-side experiments through documented SDKs for common languages, multivariate and multi-page tests, audience targeting on behaviour and attributes, and rule-based personalisation.
8 — Feature-flag-based experiments sharing one audience and metric model with web tests, mutually exclusive experiment groups, holdouts, edge or CDN delivery, and personalisation that can itself be tested against a control.
10 — One experimentation programme across every surface: web, app, server and edge from the same platform, experiment interactions managed, a documented experiment lifecycle from hypothesis to archived result, and a library of past results a team can search.
The Growth Lead
The visual editor is genuinely rich — move, hide, replace image, style and layout changes, responsive device switcher, keyword insertion — and the platform covers multi-page tests, several variants, split-URL testing, full-factorial multivariate tests with automatic combination of traffic, mutual exclusion of experiments, and audience plus page targeting, which covers everything my team tests client-side. We found no documented SDK, feature-flag delivery or edge delivery in the user documentation; server-side A/B testing appears only as an entry in a feature list, and no personalisation that can itself be tested against a control is documented. 11 12 5 6 13
The E-Commerce Manager
The visual editor, split-URL tests, multi-page experiments and full-factorial multivariate tests in one platform are properly documented, and audience targeting plus mutual exclusion go beyond the basics. But server-side testing appears only as a line on a features overview, and I found no SDK documentation for it, no holdouts, and no way to test a personalisation against a control — the thing I need before trusting a personalised product page. 5 6 11 13
The Product Engineer
Client-side coverage is solid and documented — visual editor with CSS/HTML/JS, redirect and split-URL tests, multi-page experiments, full-factorial multivariate tests with automatic combination generation, audience targeting and mutual exclusion — but delivery is the snippet-and-editor model throughout. The only server-side mention is a feature-grid entry, and we found no public documentation of server-side SDKs, feature-flag experiments, holdouts or personalisation. 5 6 1 11 13
The CRO Consultant
The client-side programme is genuinely broad: a deep visual editor feature list, full-factorial multivariate testing with automatic combinations, multi-page experiments, redirect and split-URL tests, mutual exclusion and audience targeting. Server-side testing appears only as a feature-grid entry, and we found no public information on SDKs, feature flags, holdouts, or personalisation that can itself be tested against a control. 11 6 5 13 12
The Data Protection Officer
The documentation shows client-side A/B, redirect and split-URL tests, full-factorial multivariate and multi-page experiments, mutual exclusion and audience targeting, all served through the visual editor. Server-side A/B testing appears only as a feature listing, and we found no public information on documented SDKs, feature flags, holdouts or edge delivery, so the programme stays client-side in substance. 5 6 11 13
The Skeptic
The client side is documented in depth — a visual editor with redirect and split-URL tests, full-factorial multivariate, multi-page experiments, multiple variants, audience and page targeting, and mutual exclusion of experiments — which already exceeds a basic split-and-target product. Server-side testing appears only as a label in a feature list with no SDK documentation behind it, and we found no public information on holdouts, feature flags, edge delivery or personalisation. 5 6 11 13
Statistical method & guardrails
Show reasoningHide reasoning
How this is scored
Which statistics decide the winner and what protects the customer from misreading them. Scored on what the vendor documents: the method by name, how peeking and multiple comparisons are handled, and whether sample ratio mismatch is detected.
0 — A "winner" or "probability to beat" figure with no documented method, no stated sample-size guidance and no warning against stopping early.
3 — The method is named (frequentist or Bayesian) but its assumptions are not documented, and nothing prevents a test from being called while it is still underpowered.
5 — Documented method with confidence or credible intervals, a sample-size or test-duration calculator, and stated guidance on when a result may be read.
8 — Sequential testing or an equivalent documented protection against peeking, correction for multiple metrics or variants, sample ratio mismatch detection, variance reduction such as CUPED, and guardrail metrics that can stop a harmful test.
10 — The statistics are auditable: methodology published in enough detail to reproduce a result, the choice of method explained per use case, raw per-visitor data available for independent re-analysis, and the interface refuses to present an underpowered result as a conclusion.
The Growth Lead
The method is documented by name — a one-sided chi-square test for binomial targets and a one-sided t-test for value metrics, with a Bayesian option and a two-sided switch in the Pro plan — plus a significance calculator, a runtime forecast towards 95 % significance, A/A testing support, and guidance I can quote to the board: at least ten days, at least 500 conversions per variant, a maximum of three metrics, and interim significance values ignored. What I cannot defend yet: no sequential testing, no correction for multiple comparisons beyond the advice to limit metrics, and we found no public information on sample ratio mismatch detection, variance reduction or guardrail metrics that stop a harmful test. 7 8 11
The E-Commerce Manager
The method is named precisely — a one-sided chi-square for conversion metrics, a one-sided t-test for revenue, with a two-sided option and a Bayesian alternative in the Pro plan, plus a significance calculator, A/A testing and unusually plain guidance of ten days minimum and at least 500 conversions per variant with interim results to be ignored. What is missing is machinery, not honesty: I found no sequential testing, no sample ratio mismatch detection, no correction for multiple metrics beyond a warning, and no public information on variance reduction or guardrail metrics. 7 8 11 13
The Product Engineer
The method is named with real assumptions — frequentist by default, one-sided chi-square for rates and a one-sided t-test for value metrics, two-sided and Bayesian as account-level Pro options — plus a significance calculator, a Bayesian runtime forecast to 95 % significance, A/A testing, and written guidance to run at least ten days with 500 conversions per variant and to ignore interim significance. We found no public information on sequential testing or other peeking protection, correction for multiple metrics or variants, sample ratio mismatch detection, variance reduction or guardrail metrics that stop a harmful test. 7 8 11
The CRO Consultant
Methods are named and specific — one-sided chi-square and t-tests by default, a two-tailed frequentist option and a Bayesian mode on the Pro plan — alongside a significance calculator, minimum guidance of ten days and 500 conversions per variant, explicit instruction to ignore interim results, and A/A testing to validate setup. We found no public information on sequential testing, correction for multiple metrics, sample ratio mismatch detection or variance reduction. 7 8 13
The Data Protection Officer
The default method is named and partly specified — a one-sided chi-square test for rates and a one-sided t-test for value metrics, with a Bayesian option in the Pro plan — and published guidance says to ignore interim results and run at least ten days with at least 500 conversions per variant. We found no public information on confidence or credible intervals, correction for multiple metrics, or sample ratio mismatch detection. 7 8 13
The Skeptic
Credit where due: the machinery is named — one-sided chi-square for binomial targets, one-sided Student t-test for value metrics, an optional two-tailed setting, a Bayesian alternative with a runtime forecast — alongside an A/A test facility and concrete reading guidance (ten days minimum, 500 conversions per variant, at most three metrics, ignore interim significance). All of it is advisory: we found no public information on sequential testing against peeking, any multiple-comparison correction, sample ratio mismatch detection or variance reduction, and nothing prevents an underpowered test from being called. The Bayesian option outputs a probability that a variant is better, and we found no public information on its assumptions, the prior included — a figure I treat as marketing until the prior is on the table. 7 8
Consent & visitor tracking
Show reasoningHide reasoning
How this is scored
Whether the test script respects §25 TDDDG and the ePrivacy rules as evidenced on the vendor's own pages: when the script runs relative to consent, what it stores on the device, whether a cookieless or consent-free mode exists, and how visitor identifiers are handled.
0 — Nothing on the vendor's pages says what the script stores on the device or whether it runs before consent; consent is described as the customer's problem.
3 — Cookies or local storage are listed, and a consent integration is mentioned, but the documentation does not say what the script does before consent is given.
5 — Documented behaviour before and after consent, integration with common consent management platforms, a published list of cookies and storage keys with their lifetime, and IP anonymisation described.
8 — A documented consent-pending mode that holds tracking until consent while variants can still be served, a cookieless or first-party-only option, retention of visitor data stated, and guidance on the legal basis for testing in the EU.
10 — Built for §25 TDDDG: the default configuration stores nothing on the device without consent, a server-side or cookieless mode documented end to end, per-visitor data deletable on request, and the vendor states in writing how each mode maps to consent requirements.
The Growth Lead
This is their pitch and it is documented in detail: variant assignment runs on localStorage independent of consent while tracking fires only after consent via Google Consent Mode or a consent tool, the snippet can be integrated without consent, and the cookieless position under ePrivacy is argued in writing, including the limits of localStorage in private mode. We found no published list of storage keys with their lifetime, no statement on IP anonymisation, and the mapping of each mode to legal requirements rests on marketing argument rather than a written per-mode guide. 9 10 2 1
The E-Commerce Manager
Variants are played out and users assigned without any banner while tracking to analytics is held until consent via Google Consent Mode V1/V2 or a consent tool — exactly the separation I want — and the vendor puts in writing its position that strictly necessary localStorage for variant assignment is exempt under ePrivacy, with 100% of visitors testable. I found no published list of storage keys with their lifetimes and no statement of how long experiment data is kept beyond a 14-day log deletion. 1 2 9 10
The Product Engineer
The strongest part of the product: variant playout and tracking are separate, the snippet can serve experiments without consent while tracking fires only after consent via Google Consent Mode V1/V2 or a consent tool, assignment lives in localStorage with no cookies, and the vendor publishes its own ePrivacy reasoning that consent-free variant assignment is exempt. Log files are deleted after 14 days and a general deletion policy exists; we found no public information on per-visitor deletion or a written mapping of every mode to consent requirements. 9 10 2 1
The CRO Consultant
This is a story a client's DPO can actually read: variant assignment sits in local storage under a written strictly-necessary ePrivacy position, experiments play out while tracking is held back until consent via Consent Mode V1, V2 or a consent tool, and the whole design is cookieless. We found no public information on IP anonymisation or a published list of storage keys with their lifetimes, and retention for the testing product's own visitor data is covered only by a generic deletion policy. 9 10 2 1
The Data Protection Officer
The pages answer my standing question: the snippet can be integrated without consent, variants are played out directly, and tracking is triggered separately only after consent, with Google Consent Mode and consent-tool integration documented — a consent-pending separation I can work with. We found no public information listing the local storage keys with their lifetimes, on IP anonymisation, or on retention of visitor data, and the cookieless claim rests on the vendor's own reading that strictly necessary variant assignment needs no consent. 1 2 9 10
The Skeptic
Documented where it counts: variant play-out and tracking are separated so variants can be served while tracking waits for consent, the snippet may run consent-free, Google Tag Manager Consent Mode V1 and V2 plus consent-tool integrations are offered, and storage is localStorage rather than cookies, backed by a written ePrivacy position on why the vendor considers it consent-exempt. We found no public information on a list of storage keys with their lifetimes or on IP anonymisation, retention appears only generally (log files at most fourteen days), and the consent-free position is argued on a marketing page rather than mapped to §25 TDDDG. 9 10 2
Snippet performance & flicker
Show reasoningHide reasoning
How this is scored
The cost the client-side snippet imposes on the page it tests: blocking load, flicker of original content, script weight and the effect on Core Web Vitals — scored on what the vendor measures and publishes, not on "lightning fast".
0 — A synchronous snippet with no stated size, no flicker handling and no mention of performance.
3 — An anti-flicker snippet that hides the page until the test loads, with a timeout, and no published figures for script size or load cost.
5 — Script size and loading behaviour documented, asynchronous loading option, flicker handling explained with its trade-off, and CDN delivery of the snippet.
8 — Published performance figures including impact on Core Web Vitals, a self-hosting or first-party-domain option for the script, per-project bundles containing only active experiments, and a server-side or edge alternative for flicker-sensitive tests.
10 — Performance is a stated commitment: measured overhead published and maintained, flicker eliminated by edge or server-side rendering as a documented path, and tooling that shows the customer what their own configuration costs the page.
The Growth Lead
They publish a concrete 11.5 KB snippet size and document the anti-flicker script honestly — optional, configurable 4-second maximum hide, and a plain warning that it can negatively affect Core Web Vitals and SEO — with head placement recommended because flicker comes from the snippet loading too late. We found no public information on an asynchronous loading option, CDN delivery of the snippet, published Core Web Vitals impact figures, a self-hosting or first-party-domain option, or per-project bundles, so the flicker-sensitive path beyond the anti-flicker trade-off is not evidenced. 10 11 12
The E-Commerce Manager
An 11.5 KB snippet is published, head placement is recommended to stop flicker, and the optional anti-flicker script is documented with its default 4-second hide and an unusually honest warning that it can hurt Core Web Vitals and SEO. I found no published figures for the measured effect on Core Web Vitals, and no public information on an asynchronous loading option, CDN delivery of the snippet, self-hosting, or per-project bundles. 10 11 12
The Product Engineer
They publish an 11.5 KB snippet, recommend head placement, and document the anti-flicker script unusually honestly — a configurable 4-second hide, and a warning that it can hurt Core Web Vitals and SEO. We found no public information on measured load cost or Core Web Vitals impact, an asynchronous loading option, self-hosting or first-party-domain delivery, or an edge or server-side alternative for flicker-sensitive tests. 10 11 12
The CRO Consultant
The snippet weight is published at 11.5 KB, and the anti-flicker script is documented honestly with its configurable four-second hide duration plus a stated risk to Core Web Vitals and SEO, and head placement guidance to avoid flicker. We found no published figures for the snippet's effect on Core Web Vitals, and no public information on asynchronous loading, CDN delivery of the snippet, self-hosting, or per-project bundles. 10 11 12
The Data Protection Officer
The snippet is published at 11.5 KB, head placement is recommended against flicker, and the optional anti-flicker script is documented with its configurable four-second hide and its stated negative effect on Core Web Vitals. We found no public information on an asynchronous loading option, CDN delivery of the snippet, self-hosting on a first-party domain, or measured figures for the snippet's own effect on Core Web Vitals. 10 11 12
The Skeptic
An 11.5 KB snippet size is published, and the anti-flicker documentation is unusually honest: the script is optional, the four-second maximum hide is configurable, and the vendor states in writing that it can negatively affect Core Web Vitals and SEO. We found no public information on asynchronous loading, CDN delivery of the snippet, measured Core Web Vitals impact, self-hosting, or per-project bundles. 10 11 12
Analytics, data export & integrations
Show reasoningHide reasoning
How this is scored
Getting results and raw data out: integration with analytics and tag management, export of visitor-level results, warehouse-native analysis, and an API — because an experiment result that cannot be checked in the customer's own data is a claim, not a finding.
0 — Results visible in the vendor's dashboard only; no export, no analytics integration, no API.
3 — CSV export of aggregated results and one analytics integration, with no visitor-level data and no documented API.
5 — Integrations with common analytics and tag managers, export of results, and a documented API for managing experiments and reading results.
8 — Visitor-level raw data export or streaming to a data warehouse, warehouse-native analysis on the customer's own metrics, CDP integration for audiences, and an API with stated limits.
10 — The platform treats the customer's warehouse as the source of truth: metrics defined once and computed there, full historical experiment data exportable in open formats, and a versioned API a team can build its own programme tooling on.
The Growth Lead
The analytics story is strong: automatic GA4 tracking with per-test audiences created in GA4, segment and filter reports, plus Adobe Analytics, Matomo, Piwik Pro, etracker, econda, PostHog and tag-manager options, and a BigQuery integration that puts the raw, unfiltered, line-by-line data in my own project with no sampling — exactly what I need when finance questions an uplift. The Experiment API is offered as an expert function with no documented limits, and we found no public information on CDP integration for audience streaming. 14 13 12 8
The E-Commerce Manager
Results land in my own BigQuery project raw, unfiltered and line-by-line with no sampling, BigQuery events show up as goals in the reports, and there are exact numbers per combination for e-commerce metrics — that is how a result gets checked rather than believed. The analytics bench is broad (GA4, Matomo, Piwik Pro, etracker, econda, Adobe Analytics, PostHog) with results export and an Experiment API offered as an expert function. I found no public information on API rate limits, CDP audience integration, or a versioned API contract. 12 13 14 6
The Product Engineer
The BigQuery path is real: automatic setup into the customer's own project, raw line-by-line data with no sampling, events displayed as goals, and exact per-combination numbers for e-commerce multivariate tests, alongside GA4 import, a broad set of analytics and tag-manager integrations, results export and an Experiment API offered as an expert function. We found no public information on the API's limits or versioning or on CDP integration for audiences, and metrics still live in the vendor's reporting rather than being defined once and computed in the warehouse. 14 13 6 8 12
The CRO Consultant
Results are computed in the customer's own data — automatic GA4 integration creating per-test audiences, plus a BigQuery route showing raw, line-by-line data with no sampling and events importable as goals — next to a wide analytics toolset and a results export. The API is documented only as an expert function with no stated limits, and we found no public information on exporting Varify-tracking raw data or CDP audience integration. 13 14 12 2 8
The Data Protection Officer
Integrations with the common analytics and tag tools are documented alongside export of results, and the BigQuery integration delivers raw, line-by-line experiment data into the customer's own project without sampling — data the customer keeps under their own control. We found no public information on stated API limits or a CDP integration; the Experiment API is described only as an expert function. 12 13 14
The Skeptic
An experiment result you can check in your own data is a finding, not a claim — and this product gets that far: automatic GA4 evaluation, integrations for Adobe Analytics, etracker, econda, Matomo, Piwik Pro and PostHog, results export, and a BigQuery integration placing raw, line-by-line, unsampled experiment data in the customer's own project as goals and segments. The experiment API is offered as an "expert function"; we found no public information on its rate limits, versioning, or on a CDP integration for audiences. 13 14 6 12
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where visitor data is processed and stored and who the contracting entity is. Independently sourced by the sovereignty pipeline; weighted higher here than in categories that hold only the customer's own data, because the script runs on every visitor to the customer's site and their behaviour is what the platform records.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and visitor data leaving the EU without a stated safeguard.
3 — EU data residency offered as an option or an enterprise add-on while the contracting entity is non-EU, or the subprocessor list is absent.
5 — EU processing of visitor data as standard and an EU contracting entity, but parts of the chain — CDN, support access, analytics — are non-EU without an explained safeguard.
8 — EU hosting on named infrastructure including the delivery of the snippet, EU contracting entity, subprocessor list published, and a DPA covering the visitor data the script collects.
10 — Sovereign end to end and evidenced: vendor, entity, hosting, snippet delivery and every subprocessor European, certification published, and no visitor data reaching a non-EU party at any point.
The Growth Lead
A German contracting entity with a Munich court registration and an external data protection officer, and Frankfurt hosting claimed on the marketing pages — but the privacy policy itself does not confirm where the hosted testing product stores data and names no subprocessor list for the product. Website delivery runs through Cloudflare with processing in the USA, chat and newsletter data go to a US-headquartered provider, and the imprint and the privacy policy give different company names for the controller. 1 2 3 10
The E-Commerce Manager
A German contracting entity registered at Munich Local Court (HRB 289569) and a Frankfurt hosting claim on the marketing pages, but the privacy policy names infrastructure only for the vendor's own website (Amazon AWS via Luxembourg) and I found no public information naming the hosting or snippet-delivery infrastructure of the testing product itself. The policy documents US processing via Cloudflare and Google services for the vendor's website, relying on the EU-US Data Privacy Framework or standard contractual clauses, and I found no subprocessor list for the testing product or a published DPA covering the visitor data the script collects. The captured pages also name the company differently — Varify Software GmbH in the imprint, Varify GmbH as controller in the privacy policy — at the same Grünwald address. 1 2 3
The Product Engineer
A German GmbH registered in Munich, Frankfurt hosting claimed on the vendor's own pages and a data protection officer via heyData, but the privacy policy names neither the hosting provider nor the subprocessors for the testing product itself, and the website chain includes Cloudflare and HubSpot, both US companies, with transfers relying on Data Privacy Framework certification or standard contractual clauses. The captured pages also name the entity differently — Varify Software GmbH in the imprint, Varify GmbH in the privacy policy, same Grünwald address — and we found no public information on a data processing agreement covering the visitor data the script collects. 3 2 1 10
The CRO Consultant
The contracting entity is German with a Munich register number and a named DPO, and Frankfurt hosting is claimed as EU-only — though the imprint and the privacy policy name the controller slightly differently, and the residency claim sits in marketing copy while the privacy policy describes the website's AWS Luxembourg hosting separately from the hosted testing product, whose provider we found no public information naming. The published subprocessor list covers the vendor's own website and includes US processing such as Cloudflare and Google, and we found no public information on a DPA covering the visitor data the script collects or on the chain that delivers the snippet. 3 2 1 10
The Data Protection Officer
The contracting entity is German, hosting is claimed as Frankfurt for the product, and EU processors are named for some functions — but the residency statement sits in marketing copy while the privacy policy shows the website chain processing data with US providers, including Cloudflare processing in the USA. We found no public information on a subprocessor list for the hosted testing product itself, on its hosting provider, or on a data processing agreement covering the visitor data the script collects; SOC 2 is marked only as coming soon, and the imprint names Varify Software GmbH while the privacy policy names Varify GmbH as controller. 1 2 3 4 10
The Skeptic
A German contracting entity in Grünwald, a Frankfurt hosting claim, and the privacy policy explains DPF-or-SCC safeguards for the US providers used on the vendor's own website. But the Frankfurt claim lives in marketing copy: we found no public information in the privacy policy on where product data is stored, on the hosting provider of the testing product, or on subprocessors of the hosted product, and the captured pages name the contracting entity differently — Varify Software GmbH in the imprint, Varify GmbH in the privacy policy. 1 2 3 10
Pricing transparency
Show reasoningHide reasoning
How this is scored
A category priced by traffic — monthly tracked users, visitors or impressions — where the tier a site lands in depends on numbers the buyer has to estimate. Whether a buyer can compute the real annual cost including traffic limits, overage, server-side or personalisation modules and seats — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price or a free tier exists, but the traffic metric, the limits and what happens above them are unstated — the invoice is unknowable.
5 — Tier prices public with the traffic metric and its limits defined, but at least one commonly needed piece (server-side SDKs, personalisation, overage) is unpriced or "contact sales".
8 — Every tier priced publicly with the traffic metric defined, limits, overage rates, module prices, minimum term and VAT treatment stated.
10 — Complete price computability: annual invoice derivable for a given traffic volume, set of modules and team size, with overage and every add-on published.
The Growth Lead
Tiers are public with defined limits — Growth at 249 € monthly or 199 € billed annually with five active experiments and one website, Pro with unlimited active experiments, and Enterprise from 799 € per month — and unlimited traffic with a flat-rate model means no overage arithmetic, which I appreciate when budgeting. But AI features are billed in AI credits without published credit prices, multiple domains and Enterprise services are quoted on request, VAT treatment and minimum term are unstated, and the captured pages give different figures for the entry price — 119 € per month on the homepage, 199 € in German pages, 249 € or 199 € on the pricing page — so I cannot tell which number a new buyer would actually pay. 4 1 6 10
The E-Commerce Manager
Tier prices are public with their limits (five active experiments and one domain on Growth, unlimited experiments on Pro) and the flat-rate claim of unlimited traffic with no tier jumps is exactly the December insurance I want. But the captured pages give different figures for the entry price — "€119 per month" on the homepage against "249 €" monthly or "199 € per month billed annually" on the plans page — and the AI-credit package gating Pro features is unpriced, multiple domains are "get in contact", and I found no public information on VAT treatment, minimum term, or what the double-asterisked footnote on "Unlimited traffic (MTU)" says. 1 4 6 10
The Product Engineer
Tier prices, annual totals, trial terms and per-tier limits are public — one domain, unlimited subdomains, unlimited traffic, five active experiments on Growth — and the flat rate means the invoice does not depend on traffic estimates. The captured pages give different figures for the entry price — '€119 per month' on the homepage, a starting price of 199 €, and 249 € as the Growth monthly price on the plans page — while AI credits are priced only as 'a monthly credit package or with your own API key', Enterprise services are 'quoted separately', and we found no public information on VAT treatment or minimum term. 4 1 10 6
The CRO Consultant
The flat model removes the traffic estimate entirely — unlimited traffic and experiments are stated, and annual figures are published exactly: 2.388 € per year for Growth, 2.988 € per year for Pro, Enterprise "from 9,588 € per year" with services quoted separately, plus a 15-day full-product trial without a credit card. The captured pages give different figures for the starting price (€119 per month, 199€/Monat and 249 € monthly all appear), AI features are billed in credits without published prices, and we found no public information on VAT treatment or minimum term, with extra domains on request. 4 1 10 6
The Data Protection Officer
Tier prices are public with the traffic metric defined as unlimited monthly tracked users, limits for websites and active experiments stated, and a 15-day full-product trial without a credit card. Multiple domains are on request, AI features are billed in credits without a published price, VAT treatment is not stated, and the captured pages give different figures for the entry price — "For just €119 per month" on the homepage, "ab 199€/Monat" on the German page and 249 € monthly on the plans page. 1 4 10
The Skeptic
Flat pricing with unlimited traffic removes the estimation game entirely: Growth and Pro prices are published monthly and annually, domain and active-experiment limits are stated, and a 15-day trial needs no credit card. Deductions at the edges: the captured pages give different figures for the entry price — €119 per month on the homepage, a starting price of 199 € per month on the pricing page — AI features are billed in AI credits whose package price we found no public information on, Enterprise services are quoted separately, and minimum term and VAT treatment are unstated. 4 1 10 6
European sovereignty — proven facts
3 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in DE ⚠ unverified | 3/3 pts | 3 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU only ⚠ unverified | 3/3 pts | 1 Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 2 Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 22 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. The imprint names "Varify Software GmbH" whereas the privacy policy names the controller "Varify GmbH"; both use the same Grünwald address.
- Weak sourcing — Data residency. The residency claim sits in marketing copy on the homepage, and the privacy policy itself does not confirm where product data is stored and even describes transfers of website data to US providers (Cloudflare, HubSpot).
- Weak sourcing — Subprocessors. The policy states HubSpot processes this chat data in the EU, but HubSpot, Inc. is US-headquartered; there is no subprocessor list for the hosted testing product itself, whose hosting provider is never named.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage varify.io Checked 22 Sep 2026 Details →
- 2 Privacy policy varify.io Checked 22 Sep 2026 Details →
- 3 Legal notice varify.io Checked 22 Sep 2026 Details →
- 4 Pricing page varify.io Checked 30 Sep 2026 Details →
- 5 Experiment types & delivery — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 6 Experiment types & delivery — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 7 Statistical method & guardrails — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 8 Statistical method & guardrails — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 9 Consent & visitor tracking — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 10 Consent & visitor tracking — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 11 Snippet performance & flicker — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 12 Snippet performance & flicker — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 13 Analytics, data export & integrations — found from sitemap varify.io Checked 1 Oct 2026 Details →
- 14 Analytics, data export & integrations — found from sitemap varify.io Checked 1 Oct 2026 Details →