Web Analytics
Fathom Analytics
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Conva Ventures Inc. · usefathom.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Fathom Analytics at a glance
- Vendor
- Conva Ventures Inc.
- Headquarters
- Incorporated in Canada source, captured 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Starting price
- “Plans from $15/month” (vendor’s words) source, captured 29 Oct 2026
- Panel verdict
- The AI panel rates Fathom Analytics 3/5, the mean of 6 judges. Fathom Analytics is a cookieless web analytics product from Conva Ventures Inc., a Canadian company. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Fathom Analytics is a cookieless web analytics product from Conva Ventures Inc., a Canadian company. The bench scores it strongest on consent and privacy and pricing transparency, and weakest on conversions and events. Judges credit a published counting method — a site-specific signature whose salt rotates daily — argued against Article 5(3) of the ePrivacy Directive, personal data limited to IP address and user agent and deleted within 24 hours, and public tiers at $15/month up to 100,000 monthly pageviews, $25/month up to 200,000 and $45/month up to 500,000. Sovereignty splits the bench: one judge prized the EU chain — EU visitor data processed on infrastructure of BunnyWay d.o.o. in Slovenia, EU IP addresses hashed before any US-controlled infrastructure, AWS restricted to non-EEA data subjects — while another scored down the Canadian contracting entity under British Columbia governing law and the privacy policy's statement that further processor names are not published. Traffic reporting lands at 6-7, implementation at 4-5, and data ownership at 6, where judges note exports are aggregated and the vendor states it is a hosted product.
Speaks for it
- Consent-free counting method is published, with personal data limited to IP address and user agent and held no longer than 24 hours
- Three public tiers from $15/month with occasional traffic spikes never charged and no account shutoff at the limit
- EU visitor data is processed on EU infrastructure operated by BunnyWay d.o.o. in Slovenia, where EU IP addresses are hashed before reaching US-controlled infrastructure
- Custom CSV export with dimensions, metrics and date groupings, a documented API, GA4 history import and export before cancelling
- One-line JavaScript install with named integrations including WordPress, Ghost, Webflow, Next.js and Nuxt, and at least 50 sites on every plan
Held against it
- We found no public information on funnels with drop-off per step, product-level e-commerce tracking, cohorts or conversions sent back to ad platforms
- The contracting entity is Conva Ventures Inc. of Victoria, Canada under British Columbia governing law, non-EU visitors' requests go to US infrastructure, and the privacy policy states it does not publish names of further processors
- No ISO 27001 or SOC 2 certification is stated on the captured pages
- The vendor states it is a hosted product, and we found no public information on a raw event-level export or a data-warehouse sync
- The 7-day free trial requires a card, and we found no public information on VAT treatment, users per plan, or pricing above 500,000 monthly pageviews beyond an email about a larger plan
Best for
- You run content or marketing sites and want traffic, referrer, UTM campaign and Search Console reporting without a consent banner
- You manage a portfolio of client sites — every plan includes at least 50 sites sharing one pageview pool, plus an all-sites view and password-protected shared dashboards
- You need EU visitor data processed in the EU and can accept a Canadian contracting entity
- You want a yearly cost computable from public pages, with occasional traffic spikes never charged and no account shutoff at the limit
Avoid if
- You need checkout or signup funnels with drop-off per step, product-level e-commerce tracking, or conversions passed back to Google Ads or Meta
- You must self-host or stream raw event-level data into a warehouse — the vendor states it is a hosted product with no self-hosting option
- Your procurement requires an EU contracting entity, published names of all processors, or a stated ISO 27001 or SOC 2 certification
- You exceed 500,000 monthly pageviews — pricing above the largest public tier resolves to an email about a larger plan
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 3.5 of 5 |
| Goals, events, funnels & e-commerce | 2.5 of 5 |
| Consent-free operation & data minimisation | 3.5 of 5 |
| Data access, export & self-hosting | 3 of 5 |
| Installation, integrations & performance | 2.5 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Traffic, sources & campaign reports
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
The dashboard covers pages, referrers, UTM campaigns broken down by campaign, source, medium, content and term, countries, regions, cities, devices, browsers and operating systems, plus a real-time view, date comparisons, saved views, shared dashboards, scheduled email reports and an all-sites view, with Search Console data shown alongside. I found no public information on custom dashboards or a report builder, on channel grouping I could reconfigure for my own buckets, or on whether reports are sampled. That is a solid step above the standard package but not a custom-reporting machine. 10 11 2 1
The Data Protection Officer
The dashboard documentation covers pages, referrers, UTM campaigns broken down by all five parameters, countries, devices, browsers, entry and exit pages, a real-time count, date comparisons, saved views and milestones, with Search Console data shown beside the traffic and an all-sites view for every site on the account. We found no public information on custom dashboards or a statement that reports run unsampled. 10 11 2 1
The Agency Developer
The dashboard documentation covers pages with entry and exit pages, referrers grouped into Direct, Paid/Campaign, Organic, Social and AI, UTM campaigns broken down by campaign, source, medium, content and term, countries through to cities, devices, operating systems and browsers, a real-time count, date comparisons, milestones, and Search Console data sits beside the traffic. For client work there are saved filter views, public or password-protected shared dashboards, weekly or monthly email reports across one or several sites, and an all-sites overview with totals. I found no public information on custom dashboards, configurable channel grouping, or whether reports are sampled. 10 11 2 1 17
The Growth Analyst
The dashboard documentation covers pages, referrers, entry and exit pages, countries, regions, cities, devices, browsers, operating systems and UTM campaigns broken down by campaign, source, medium, content and term, plus a real-time count, date comparisons, saved views, shared and password-protected dashboards, scheduled email reports, an all-sites roll-up view, milestones on the chart and Search Console data beside the traffic. We found no public information on custom dashboard builders, on configuring the channel grouping (the Sources buckets have fixed definitions), or on report sampling. 10 11 2 1 17
The Public-Sector Site Owner
The dashboard documentation shows pages, referrers grouped into Direct, Paid/Campaign, Organic, Social and AI, UTM campaigns broken down to term and content, countries, regions, cities, devices, browsers and operating systems, entry and exit pages, a real-time view, date comparisons, milestones on the chart, saved views, password-protected shared dashboards and scheduled email reports, with Search Console data shown beside the traffic and an all-sites view across the account. We found no public information on custom dashboards, report builders or a statement that reports are unsampled, which keeps this below the top band. 1 2 10 11
The Skeptic
The dashboard documentation covers pages, referrers, countries/regions/cities, devices, browsers and operating systems, UTM campaigns broken into campaign, source, medium, content and term, entry and exit pages, a live count updated in 5-minute intervals, date comparisons against several periods, saved views, and milestones marked on the chart, alongside a Search Console connection and an all-sites view with totals. We found no public information on custom dashboards or report builders, configurable channel grouping, or sampling behaviour, and the traffic buckets are fixed vendor definitions rather than ones the customer configures. 10 11 2 1
Goals, events, funnels & e-commerce
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Events cover signups, form submissions, purchases with a value in cents, outbound links, downloads and 404 pages, and I can filter an event by referrer or start from a UTM campaign and see which events its visitors completed — the source of my orders is at least answerable. But I found no public information on funnels with drop-off per step, which is exactly the checkout funnel I need, and none on product-level or cart tracking, a Shopware or WooCommerce plugin, several attribution models, or conversion data sent back to Google Ads or Meta. Revenue attaches to events and campaigns, so the middle of the range with the funnel gap priced in. 12 4 6
The Data Protection Officer
Custom events with a value in cents, per-event and wildcard currencies, guides for ecommerce conversions, form submissions, outbound links and 404 pages, and conversions broken down by source and UTM campaign are all documented. Funnels with drop-off per step and product-level e-commerce with shop plugins are not described on the captured pages. 12 4 11
The Agency Developer
Events are a line of JavaScript fired wherever something happens — signups, form submissions, outbound links, downloads, 404s, purchases with a value in cents and per-event currency settings — each with a conversion rate I can base on pageviews or visitors, and I can filter by a UTM campaign to see which events its visitors completed. That covers most of what my clients call a goal. I found no public information on funnels with drop-off per step, product, cart and checkout tracking with plugins for named shop systems, compared attribution models, cohorts and retention, or conversions passed back to ad platforms. 12 4 6
The Growth Analyst
Custom events with a value in cents, per-event currencies, a configurable conversion-rate basis and guides for link clicks, external links, form submissions, 404s, ecommerce conversions and downloads are documented, and events can be cross-filtered with UTM campaigns and referrers. But the pages we read describe no funnel report with drop-off, no cohorts or retention, no product-level e-commerce and no send-back of conversions to ad platforms, so for tracing a signup from first campaign click to paid invoice I get campaign-level completions and revenue totals, not a multi-step funnel. 12 4 11 6
The Public-Sector Site Owner
Custom events carry values and currencies, and signups, form submissions, purchases, clicks, downloads, outbound links and 404 pages are documented with one line of JavaScript and setup guides; completions can be filtered by page, referrer and UTM campaign. We found no public information on funnels with drop-off per step — precisely what I need to see where residents abandon the vehicle-registration or daycare forms — nor on cohorts, user journeys or conversions sent back to ad platforms. 4 12
The Skeptic
Events are real and priced in: any action fires a named event with a value in cents, currencies are settable per site or per event-name pattern, and events can be filtered against pages, referrers and UTM campaigns, with guides for outbound links, downloads, form submissions, e-commerce conversions and 404 pages. We found no public information on funnels with drop-off per step, cohorts or retention, attribution beyond the fixed Paid/Campaign bucket, or conversions sent back to ad platforms, and events carry a name and a value rather than properties. 12 4 11
Consent-free operation & data minimisation
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
This is the product's core promise and it is well documented: no analytics cookies, no consent banner needed, visitors counted with a temporary site-specific signature whose salt rotates daily, raw IP addresses not stored alongside browsing activity, EU IPs hashed with salt on EU servers before anything reaches US infrastructure, DNT honoured, and a stated reading of Article 5(3) of the ePrivacy Directive plus awareness of the EDPB guidance, backed by a 2020 GDPR project with a European consulting firm. It falls short of the top of the range on details: no per-data-type retention settings, no supplied wording for my privacy policy, and the vendor itself notes hashing is not by itself a legal guarantee and this is not a universal exemption from consent — my lawyer still has work to do. 14 7 13 8 9 2
The Data Protection Officer
The consent-free position is stated against named law — the privacy policy puts its IP handling outside Article 5(3) of the ePrivacy Directive — and the counting method is published: a site-specific signature with a salt that rotates daily, personal data limited to IP address and User-Agent, cut within 24 hours and never stored beside browsing activity, with Do Not Track and a per-browser opt-out. The vendor is candid that its design is not a universal consent exemption and that hashing alone is no legal guarantee; we found no supplied wording for the customer's own privacy policy. 14 9 8 7 13 2
The Agency Developer
The consent-free position is argued against named law — Article 5(3) of the ePrivacy Directive — with the counting method published: a temporary, site-specific signature with a salt that rotates daily, no tracking cookies, raw IP addresses not stored with browsing activity, EU IP addresses hashed on EU servers, Do Not Track honoured and a one-line in-browser opt-out. The processing agreement limits personal data to IP address and user agent, processed no longer than 24 hours and deleted automatically on termination, and there are compliance guides for GDPR, ePrivacy and PECR plus a data-isolation explanation. I found no public information on a reading of the German TDDDG or the CNIL exemption, an external audit of the consent-free mode itself, or supplied wording for the site's privacy policy, and retention is stated rather than a setting I configure per data type. 13 7 8 14 9 2
The Growth Analyst
The cookie-free mode is documented with the counting method published — temporary, site-specific signatures with a daily-rotating salt — raw IP addresses are not stored alongside browsing activity, EU IP addresses are hashed on EU servers before any US-controlled infrastructure, and there is no cross-site profile or ad network. The consent position is argued against named law (the ePrivacy Directive's Article 5(3), EDPB guidance) with stated caveats that the design is not a universal exemption and hashing alone is no legal guarantee, and opt-out paths exist via Do Not Track, IP blocking and a console command; we found no public information on a customer-configurable retention setting or supplied privacy-policy wording. 14 13 7 8 9 2 18
The Public-Sector Site Owner
The consent-free position is argued against named law — Article 5(3) of the ePrivacy Directive — with the visitor-counting method published (a site-specific signature whose salt rotates daily, so it cannot become a lasting cross-site identifier), EU IP addresses one-way hashed with salt on EU servers, personal data limited to IP address and user agent and deleted within 24 hours, plus Do Not Track support and a browser-console opt-out. The vendor is candid that hashing alone is not a legal guarantee of anonymity and the design is not a universal exemption from consent; we found no public information on customer-configurable retention periods or wording supplied for our privacy policy. 7 8 9 13 14
The Skeptic
The consent-free position is argued against named law — the privacy policy puts IP addresses outside Article 5(3) of the ePrivacy Directive — and the counting method is published as a site-specific signature with a daily-rotating salt, with personal data stated as limited to IP address and User-Agent held at most 24 hours under the processing terms and EU IP addresses salt-hashed on EU servers before any US-controlled infrastructure. The vendor itself cautions that hashing is not by itself a legal guarantee and the design is not a universal exemption from consent — a candour I rarely see. Retention is vendor-set rather than configurable per data type, and we found no public information on a named authority recognising the mode or on privacy-policy wording supplied to customers. 13 14 8 7 9
Data access, export & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
There is a documented API for sites, events and custom reports, CSV exports that respect my dashboard filters including all-time data, an importer for my GA4 history, unlimited retention while subscribed, and automatic deletion of personal data within 24 hours of termination — the data is clearly mine to take. But the custom export is grouped data I configure, not raw event-level rows, I found no public information on streaming to a warehouse like BigQuery or Snowflake or on sampling limits, and the vendor states it is a hosted product with no self-hosted edition. Good custody, no keys to the cellar. 5 15 2 8 6 1
The Data Protection Officer
A documented API covering reports, sites and event sending, a custom CSV export across every dimension that respects dashboard filters and covers all time, a GA4 history import, and automatic deletion of personal data within 24 hours of termination under the data processing agreement. The vendor itself states it is a hosted product with no self-hosted edition, and no raw event stream to a named data warehouse is described. 15 5 8 2 1
The Agency Developer
There is a documented API for pulling reports and managing sites and events, a custom CSV export where I choose metrics, dimensions and grouping, and a ZIP export of the dashboard's CSVs that respects filters and can cover all time; history is unlimited while subscribed, GA4 history can be imported, and the processing agreement commits to deleting all personal data within 24 hours of termination. For agency handovers that is workable. I found no public information on a raw per-event export or a sync to a warehouse or BI tool, and the vendor describes Fathom as a hosted product, with no self-hosted or on-premise edition on the captured pages. 5 15 2 8 6
The Growth Analyst
A documented reporting and management API, a flexible CSV export with dimensions, metrics and date groupings, filter-respecting dashboard ZIP exports with an all-time option, GA4 history import, unlimited retention on every plan and automatic deletion of personal data within 24 hours of termination are all stated. What I need most — a raw event-level export or a scheduled sync into our warehouse — is not described anywhere we read, the exports are aggregated report data, and self-hosting is explicitly not offered, so our history lives in their dashboard and nowhere else. 15 5 2 6 8 16
The Public-Sector Site Owner
There is a documented API to manage sites and events and pull custom reports, custom CSV exports with dimensions, metrics and date groupings including all-time, GA4 history import, full analytics history while subscribed, and export before cancelling with personal data automatically deleted within 24 hours of termination. The vendor states Fathom is a hosted product with no self-hosted edition, so nothing runs on our municipal data centre, and we found no public information on raw event-level export or a sync to a data warehouse or BI tool. 2 5 6 8 15
The Skeptic
The custom CSV export is unusually granular — data type, dimensions, metrics, groupings down to hourly, an All-Time range, a preview before running, and a dashboard ZIP that respects filters — with a documented reporting API, a GA4 history importer, and personal data auto-deleted within 24 hours of termination. But the exports are aggregates by dimension and metric, and we found no public information on raw event-level export, a warehouse or BI sync, open-source code, or a self-hosted edition — the vendor states it is a hosted product. The captured pages describe retention as ongoing on every plan and full history while subscribed, and the vendor's own advice is to export before cancelling. 15 5 2 6 8
Installation, integrations & performance
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Installation is one asynchronous line of JavaScript, with plugins or integrations for WordPress, Ghost, Webflow, Next.js and Nuxt, documented Google Tag Manager use, and sensible hygiene like filtering local and staging environments and excluding my own IP. For my shop specifically I found no public information on a Shopware plugin or any shop system integration, no script size stated in numbers, and nothing on team roles, single sign-on, mobile SDKs or a status page. Easy to install on a blog, thinner for an organisation. 2 17 12 18 1 4
The Data Protection Officer
One line of JavaScript loading asynchronously, a WordPress plugin and integrations for named platforms including Next.js and Nuxt, Google Tag Manager support with documentation, and an EU-specific script endpoint for extreme EU isolation. We found no public information on script size in figures, team roles and permissions, single sign-on, mobile SDKs or a public status page. 17 2 3 12 4
The Agency Developer
Installation is one line of asynchronous JavaScript from a global CDN, with a WordPress plugin and named integrations for Ghost, Webflow, Next.js and Nuxt, Google Tag Manager supported but not required, a documented EU-specific script endpoint, and staging and local exclusion so test traffic never touches client data or quota. The agency story is genuinely good: every plan carries at least 50 sites sharing one pageview pool, plus an all-sites view, client-facing email reports and password-protected shared dashboards. My TYPO3 and Shopify installs would fall back to the generic script since only those five platforms are named, the script is described as small and lightweight without a size in kilobytes, and I found no public information on team roles or per-client logins, an own tracking domain against ad blockers, mobile SDKs, single sign-on or a public status page. 17 2 3 12 18 6 1
The Growth Analyst
One line of JavaScript, plugins or guides for WordPress, Ghost, Webflow, Next.js and Nuxt, Google Tag Manager support with its own documentation, a global CDN with an EU-specific script endpoint, and documented firewall, allowed-domain and IP-exclusion settings to keep staging traffic out of the quota. We found no public information on the script's file size, team roles and permissions, mobile SDKs, single sign-on, or a public status page. 17 2 12 18 3
The Public-Sector Site Owner
Installation is one line of JavaScript in the header, with a WordPress plugin and named integrations including Ghost, Webflow, Next.js and Nuxt, an optional Google Tag Manager route, real-time verification that the script is working, and documented exclusion of local, staging and test domains; every plan includes at least 50 sites with shared pageviews. We found no public information on the script's size in figures, team roles and permissions, single sign-on, mobile SDKs or a public status page with uptime history. 2 6 12 17 18
The Skeptic
Installation is a one-line asynchronous script described as small and lightweight, with named integrations for WordPress, Ghost, Webflow, Next.js and Nuxt, optional Google Tag Manager, an EU-specific script endpoint for Extreme EU Isolation, firewall settings with allowed domains, and local/staging exclusion so test traffic does not count against quota. We found no public information on the script's size in figures, team roles or permissions, single sign-on, mobile SDKs, server-side collection, or a public status page. 17 2 12 3 18
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
My German and Austrian visitors are protected well: their data is processed in the EU automatically on infrastructure of BunnyWay d.o.o. in Slovenia, raw EU IP addresses never reach US infrastructure, AWS handles only non-EEA data subjects, and a data processing agreement with subprocessor locations is published. But the contracting entity is Conva Ventures Inc. in Canada with the agreement governed by British Columbia law, ownership is not confirmed, no ISO 27001 or SOC 2 certification is named, and the privacy policy states further processor names are not published. A strong EU data chain run by a non-EU company — the visitor data stays close, the contract does not. 7 8 3 2 9
The Data Protection Officer
EU visitor data runs on EU-owned infrastructure — BunnyWay d.o.o. in Slovenia — and EU IP addresses are hashed on EU servers before they reach any US-controlled infrastructure, under a published data processing agreement with a 24-hour personal data cap. But the contracting entity is Canadian with no EU representative on record, no ISO 27001 or SOC 2 certification is stated, and the vendor declines to publish the names of its remaining processors for email, support, AI and payment, so the chain beyond visitor data cannot be verified end to end. 8 3 7 2 9
The Agency Developer
EU visitor data provably stays on EU-owned infrastructure: collection runs through BunnyWay d.o.o. in Slovenia, EU IP addresses are hashed there before any onward movement, raw EU IPs and user agents never reach the US systems, the protected region includes the UK, Switzerland, Norway, Iceland and Liechtenstein, and a processing agreement is published naming subprocessor locations, with AWS in the USA restricted to non-EEA data subjects. Against that, the contracting entity is Conva Ventures Inc. of Victoria, British Columbia under British Columbia law, non-EU visitors default to US infrastructure, the privacy policy declines to name most processors, and I found no public information on ISO 27001 or SOC 2 certification; the stated transfer safeguard is Canada's EU adequacy decision. 3 8 7 1
The Growth Analyst
The contracting entity is Canadian (Conva Ventures Inc., British Columbia, also the governing law of the data processing agreement), EU visitor data is routed automatically to EU-owned infrastructure operated by BunnyWay in Slovenia where EU IP addresses are hashed before any US-controlled infrastructure, AWS handles only non-EEA data subjects, and Canada's EU adequacy decision is cited. The agreement publishes a subprocessor list, but the privacy policy states the names of other processors (email, accounting, support, AI support) are not published, and we found no ISO 27001 or SOC 2 certification and no self-hosted edition. 7 8 3 1 2 9
The Public-Sector Site Owner
EU visitor data is processed automatically on EU-owned infrastructure: the data processing agreement names BunnyWay d.o.o. in Slovenia as the CDN, EU IP addresses are hashed on EU servers before any US-controlled infrastructure is reached, and AWS is restricted to non-EEA data subjects; a data processing agreement with GDPR terms and breach notification is published. But the contracting entity is Conva Ventures Inc. of Victoria, Canada under British Columbia law, the privacy policy states it does not publish the names of further processors, no ISO 27001 or SOC 2 certification is stated, and the vendor states there is no self-hosted edition that could run in our own data centre. 1 2 3 7 8
The Skeptic
EU visitor data is documented to run on EU-owned infrastructure operated by BunnyWay d.o.o. in Slovenia, with EU IP addresses anonymised on those servers before reaching US-controlled infrastructure, a published processing agreement, 14 days' notice of subprocessor changes, and a claim of coverage by Canada's EU adequacy decision. But the contracting entity is Conva Ventures Inc. of Victoria, British Columbia under British Columbia governing law, other visitors' requests go to US infrastructure on AWS, the business chain (email, accounting, support, the AI drafting replies) is disclosed only by category with names withheld, and we found no public information on security certifications such as ISO 27001 or SOC 2. 3 8 7 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
I can compute my annual cost from public pages alone: plans at $15/month for up to 100,000 monthly pageviews, $25/month for 200,000 and $45/month for 500,000, with custom events and API requests counting towards the same allowance, occasional traffic spikes never charged, extra site packs at $10/month per 50 sites, two months free on yearly billing, no contracts and data export before cancelling. What is left open is the cost above 500,000 pageviews beyond an email suggesting a larger plan, the number of users per plan, and VAT treatment for a German buyer. Nearly fully computable. 6 5 12 1 14
The Data Protection Officer
Three tiers are priced publicly per pageview band — $15, $25 and $45 per month — with the same analytics features on every plan, extra site packs at $10/month or $100/year for 50 sites, events and API requests counted into the same allowance, and a stated tolerance for traffic spikes with no account shutoff. Plans above 500,000 monthly pageviews are arranged by email and VAT treatment is not stated. 6 5 14
The Agency Developer
From public pages alone I can budget a year for my portfolio: $15/month up to 100,000 monthly pageviews, $25/month up to 200,000 and $45/month up to 500,000, every plan with at least 50 sites, extra packs of 50 sites at $10/month or $100/year up to 15 packs, custom events and API requests counted against the same pageview allowance, two months free on yearly billing, no contracts, and the stated policy that occasional traffic spikes are never charged and an account is never shut off for hitting its limit — exactly the viral-client scenario I care about. Prices are in USD, the 7-day trial requires a card, and there is no free plan. The pricing page shows no tiers above 500,000 monthly pageviews — the stated handling there is an email about a larger plan — and I found no public information on VAT treatment or per-user costs, which keeps full computability out of reach. 6 5 1
The Growth Analyst
Three tiers are public with exact prices — $15/month up to 100,000 monthly pageviews, $25/month up to 200,000, $45/month up to 500,000 — plus extra site packs at $10/month or $100/year per 50 sites (up to 15 packs), no charge for occasional traffic spikes, no shutdown at the limit, two months free on yearly billing, and the stated rule that custom events and API requests count toward the monthly pageview allowance. What is missing for a complete annual computation: pricing above 500,000 monthly pageviews is only an email about a larger plan, and VAT treatment is not stated. 6 1 5 14
The Public-Sector Site Owner
The pricing page publishes three tiers — $15/month up to 100,000 monthly pageviews, $25/month up to 200,000, and $45/month up to 500,000 — each including at least 50 sites, with extra 50-site packs at $10/month or $100/year, occasional traffic spikes never charged, events and API requests counted against the monthly pageview allowance, no contracts, 2 months free on yearly billing, and a 7-day free trial requiring a card. We found no public information on the number of users per plan, VAT treatment, or a published tier above 500,000 monthly pageviews beyond being contacted about a larger plan. 5 6 12 14
The Skeptic
Three tiers are public — $15/month Up to 100,000 monthly pageviews, $25/month Up to 200,000, $45/month Up to 500,000 — with the counting rules stated (custom events and API requests count towards the pageview allowance), extra sites in packs of 50 at $10/month or $100/year, a stated overage policy of never charging for occasional spikes or shutting accounts off, no contracts, a 7-day trial with card required, and export before cancelling. What keeps it from the top tier: VAT treatment is not stated, pageview volumes beyond the largest public tier resolve to an email about a larger plan, and there is no self-hosted edition to price because the product is hosted only. 6 5 14
European sovereignty — proven facts
1 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in CA ⚠ unverified | 0/2 pts | 7 Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Fathom Analytics
Is Fathom Analytics European?
No. whats-best.ai classifies Fathom Analytics as Rest of world. Its vendor, Conva Ventures Inc., is incorporated in Canada, per the vendor’s page captured 29 Oct 2026.
Where does Fathom Analytics store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Fathom Analytics have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Fathom Analytics?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Fathom Analytics alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. The country appears only in a contact address in the privacy policy (plus a self-description as 'a Canadian company' on the homepage); no company register entry is cited.
- Weak sourcing — Hosting location. EU visitors' personal data is automatically isolated on EU servers (BunnyWay d.o.o., Slovenia) and anonymized before reaching US-controlled infrastructure, but US hosting is the default for everyone else and no EU region is offered as a customer choice.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage usefathom.com Checked 29 Oct 2026 Details →
- 2 Features page usefathom.com Checked 29 Oct 2026 Details →
- 3 Features page (EU data isolation) usefathom.com Checked 29 Oct 2026 Details →
- 4 Documentation (events) usefathom.com Checked 29 Oct 2026 Details →
- 5 API documentation usefathom.com Checked 29 Oct 2026 Details →
- 6 Pricing page usefathom.com Checked 29 Oct 2026 Details →
- 7 Privacy policy usefathom.com Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) usefathom.com Checked 29 Oct 2026 Details →
- 9 Security / trust page (compliance) usefathom.com Checked 29 Oct 2026 Details →
- 10 Traffic, sources & campaign reports — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 11 Traffic, sources & campaign reports — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 12 Goals, events, funnels & e-commerce — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 13 Consent-free operation & data minimisation — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 14 Consent-free operation & data minimisation — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 15 Data access, export & self-hosting — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 16 Data access, export & self-hosting — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 17 Installation, integrations & performance — found from sitemap usefathom.com Checked 29 Oct 2026 Details →
- 18 Installation, integrations & performance — found from sitemap usefathom.com Checked 29 Oct 2026 Details →