# Fathom Analytics — Web Analytics

Fathom Analytics by Conva Ventures Inc. holds a panel rating of 3/5 from 6 AI judges (category median 2.5/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: 1 of 6 dimensions proven.

- Vendor: Conva Ventures Inc. (https://usefathom.com)
- Category: [Web Analytics](https://whats-best.ai/software/web-analytics.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/web-analytics/fathom
- Alternatives: https://whats-best.ai/software/web-analytics/fathom/alternatives ([markdown](https://whats-best.ai/software/web-analytics/fathom/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Conva Ventures Inc.
- Headquarters: Incorporated in Canada [S7]
- Data hosting: Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 29 Oct 2026
- Starting price: “Plans from $15/month” (vendor’s words) [S3]

## The panel's verdict

Fathom Analytics is a cookieless web analytics product from Conva Ventures Inc., a Canadian company. The bench scores it strongest on consent and privacy and pricing transparency, and weakest on conversions and events. Judges credit a published counting method — a site-specific signature whose salt rotates daily — argued against Article 5(3) of the ePrivacy Directive, personal data limited to IP address and user agent and deleted within 24 hours, and public tiers at $15/month up to 100,000 monthly pageviews, $25/month up to 200,000 and $45/month up to 500,000. Sovereignty splits the bench: one judge prized the EU chain — EU visitor data processed on infrastructure of BunnyWay d.o.o. in Slovenia, EU IP addresses hashed before any US-controlled infrastructure, AWS restricted to non-EEA data subjects — while another scored down the Canadian contracting entity under British Columbia governing law and the privacy policy's statement that further processor names are not published. Traffic reporting lands at 6-7, implementation at 4-5, and data ownership at 6, where judges note exports are aggregated and the vendor states it is a hosted product.

**Speaks for it:**
- Consent-free counting method is published, with personal data limited to IP address and user agent and held no longer than 24 hours
- Three public tiers from $15/month with occasional traffic spikes never charged and no account shutoff at the limit
- EU visitor data is processed on EU infrastructure operated by BunnyWay d.o.o. in Slovenia, where EU IP addresses are hashed before reaching US-controlled infrastructure
- Custom CSV export with dimensions, metrics and date groupings, a documented API, GA4 history import and export before cancelling
- One-line JavaScript install with named integrations including WordPress, Ghost, Webflow, Next.js and Nuxt, and at least 50 sites on every plan

**Held against it:**
- We found no public information on funnels with drop-off per step, product-level e-commerce tracking, cohorts or conversions sent back to ad platforms
- The contracting entity is Conva Ventures Inc. of Victoria, Canada under British Columbia governing law, non-EU visitors' requests go to US infrastructure, and the privacy policy states it does not publish names of further processors
- No ISO 27001 or SOC 2 certification is stated on the captured pages
- The vendor states it is a hosted product, and we found no public information on a raw event-level export or a data-warehouse sync
- The 7-day free trial requires a card, and we found no public information on VAT treatment, users per plan, or pricing above 500,000 monthly pageviews beyond an email about a larger plan

**Best for:**
- You run content or marketing sites and want traffic, referrer, UTM campaign and Search Console reporting without a consent banner
- You manage a portfolio of client sites — every plan includes at least 50 sites sharing one pageview pool, plus an all-sites view and password-protected shared dashboards
- You need EU visitor data processed in the EU and can accept a Canadian contracting entity
- You want a yearly cost computable from public pages, with occasional traffic spikes never charged and no account shutoff at the limit

**Avoid if:**
- You need checkout or signup funnels with drop-off per step, product-level e-commerce tracking, or conversions passed back to Google Ads or Meta
- You must self-host or stream raw event-level data into a warehouse — the vendor states it is a hosted product with no self-hosting option
- Your procurement requires an EU contracting entity, published names of all processors, or a stated ISO 27001 or SOC 2 certification
- You exceed 500,000 monthly pageviews — pricing above the largest public tier resolves to an email about a larger plan

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The E-Commerce Marketing Lead | The Data Protection Officer | The Agency Developer | The Growth Analyst | The Public-Sector Site Owner | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Traffic, sources & campaign reports | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Goals, events, funnels & e-commerce | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 | 2/5 |
| Consent-free operation & data minimisation | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 4/5 |
| Data access, export & self-hosting | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Installation, integrations & performance | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2/5 |
| European sovereignty | 3/5 | 3/5 | 3.5/5 | 2/5 | 3/5 | 3/5 |
| Pricing transparency | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3.5/5** | **3/5** |

### The judges

- **The E-Commerce Marketing Lead** (v1.0): Runs marketing for a Shopware shop selling outdoor gear in Germany and Austria, with a monthly ad budget split between Google, Meta and two price comparison sites. Since the consent banner went live, a third of the orders no longer show a source. Wants revenue per campaign that matches the shop backend, a checkout funnel that shows where carts are left, conversions sent back to the ad platforms, and numbers that hold without a click on "accept".
- **The Data Protection Officer** (v1.0): External data protection officer for eleven mid-sized companies, three of which still ran Universal Analytics when the Austrian authority ruled on it. Reads the data policy before the feature page: which fields are stored, how a visitor is counted without a cookie, whether the IP address is cut before it is written, who the subprocessors are and where. Signs off a site without a banner only when the vendor states its reading of §25 TDDDG in writing.
- **The Agency Developer** (v1.0): Lead developer at a twelve-person web agency that runs forty client sites on WordPress and TYPO3 and a few Shopify shops. Installs the analytics once per site and answers for it for years. Wants a small script or server-side collection, a plugin per CMS, an own tracking domain so ad blockers do not cut the numbers in half, client accounts with their own logins, and a price that does not jump when one client goes viral.
- **The Growth Analyst** (v1.0): Product and growth analyst at a B2B SaaS in Munich with a marketing site, a web app and a mobile app. Needs signups traced from the first campaign click to the first paid invoice, funnels and cohorts on custom events, and the raw events in the company's warehouse every night. Has moved tracking twice and knows that a tool without a raw export means starting the history again from zero.
- **The Public-Sector Site Owner** (v1.0): Web editor for a district administration whose site serves 400,000 residents, from vehicle registration to daycare places. The state data protection authority publishes guidance on analytics, and the council will not show a cookie banner on a public service. Needs to know which pages people search for and where forms are abandoned, with data that stays in Germany or on the municipal data centre's own servers, and a contract the procurement office can sign.
- **The Skeptic** (v1.0): Has seen "no cookie banner needed" on a tool that fingerprints every visitor, "EU-hosted" on a proxy in front of a US data store, and "unlimited" data history that ends with the subscription. Reads that a product is "GDPR-compliant" and asks which ruling the vendor means, what is stored per visit, whether the history can be exported in a format another tool imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 6 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Incorporated in CA | 0/2 | [S7] |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Aws eea restriction: yes [S8]
- Breach notification: 72 · yes [S7]
- Canada adequacy: yes [S3]
- Documentation: yes · yes [S14]
- DPA audits: yes · yes [S8]
- DPA available: yes · yes [S3]
- DPA available: yes · yes · yes [S9]
- DPA breach notification: without undue delay [S8]
- Edpb guidelines 2 2023: EDPB Guidelines 2/2023 cover technologies beyond cookies including pixels, identifiers, and some IP-based tracking [S13]
- Eprivacy article 5 3: Article 5(3) of the ePrivacy Directive covers storing/accessing information on a user's device, generally requiring consent with exceptions [S13]
- Eprivacy no consent: yes [S7]
- Eprivacy regulation withdrawn: The proposed ePrivacy Regulation was withdrawn in 2025 [S13]
- EU ip anonymization: one-way SHA256 hashing with salt · EU servers (EU Isolation) · BunnyWay d.o.o. [S8]
- GDPR: yes · yes · yes · yes [S2]
- GDPR project: 2020-05 [S7]
- Guides offered: GDPR · ePrivacy · EU-US data transfers · PECR · CCPA/CPRA · COPPA [S9]
- Lawful bases: consent · contract · legal obligation · legitimate interest [S7]
- No cookies or ad profiles: no · no [S3]
- Regulations: GDPR · CCPA · ePrivacy · PECR [S1]
- Subprocessor changes: yes · yes [S7]

**Data**
- Anonymisation: yes · yes [S2]
- Communications retention: 2 · 6 [S7]
- Custom export CSV: CSV · yes [S15]
- Dashboard export domains file: conditional on multi-domain tracking [S15]
- Dashboard export refs file: conditional on enabling Refs tab [S15]
- Dashboard export respects filters: yes [S15]
- Dashboard export zip: dashboard export · ZIP of multiple CSV files [S15]
- Data ownership: data downloadable at any time, not held hostage [S15]
- DPA retention: 24 · yes [S8]
- Export: yes [S1]
- Export all time: yes [S15]
- Export before cancel: no · yes [S6]
- Export completion email: yes [S15]
- Export data types: Pageviews · Events · Imported Data [S15]
- Export date groupings: hourly · daily · weekly · monthly · yearly [S15]
- Export dimensions: Browser · Country/Region/City · Device Type · Operating System · Page · Referrer · AI Source · UTM Parameters · Event Name [S15]
- Export metrics: Completions · Unique Completions · Pageviews · Site Visitors · Bounce Rate · Avg Time on Site [S15]
- Export preview: yes · 10 [S15]
- Ownership: yes [S2]
- Retention: unlimited while customer [S1]
- Retention: yes [S2]
- Retention canadian tax: Canadian Income Tax Act · 6 [S7]
- Shared dashboard export: no · yes [S15]
- Support AI: yes · yes · yes · yes [S7]
- Trial retention: 2 [S7]

**Hosting**
- EU data processing: yes [S2]
- EU infrastructure: yes [S7]
- EU routing: yes · Canada · yes [S1]
- Self hosting: yes · no [S2]

**Integrations**
- API: Analytics API available on all plans [S6]
- API: yes [S14]
- API AI fields: referrer_source · ai_source [S11]
- API available: yes [S3]
- API documentation: yes [S17]
- Cms frameworks: yes [S1]
- CSV export API: yes · yes [S2]
- Ga4 import: yes · yes [S2]
- Gtm: no · yes [S12]
- Platforms: WordPress · Ghost · Webflow · Next.js · Nuxt · yes [S2]

**Legal**
- Address: 26 Bastion Square, Third Floor Burnes House, Victoria, British Columbia, V8W 1H9, Canada · Canada [S7]
- Canadian company: Canada [S3]
- DPA GDPR applicability: yes · yes [S8]
- DPA governing law: courts of British Columbia · Province of British Columbia, Canada [S8]
- DPA government access requests: yes [S8]
- DPA last updated: 2025-06-20 [S8]
- DPA operator entity: Conva Ventures Inc. [S8]
- Entity: Fathom Analytics · Conva Ventures Inc. [S7]
- No data sales: no · no · no [S7]
- Not legal advice: no [S9]
- Not legal advice: Compliance guides are general information, not legal advice [S13]
- Privacy officer: yes [S7]
- Updated: 2026-10-02 [S7]

**Pricing**
- API counts towards pageviews: yes [S5]
- Currency: USD · yes [S6]
- Custom events count: custom events count towards pageview allowance [S6]
- Event quota: yes [S12]
- Extra site pack annual: USD · 15 · 100 · 10 [S6]
- Extra site packs: USD · 10 · 50 [S6]
- Free plan: no [S6]
- Free trial: yes · 7 [S3]
- Free trial: yes · 7 [S8]
- Free trial days: Fathom Analytics · 7 [S13]
- Minimum sites: yes · 50 [S2]
- Multi site plans: yes · yes [S1]
- Overage policy: yes · yes [S1]
- Pageview limit behavior: traffic spikes tolerated; over-limit users contacted about upgrade; data kept collecting before dashboard/API pause [S6]
- Plan1: 15 · USD · 100000 [S6]
- Plan2: 25 · USD · 200000 [S6]
- Plan3: 45 · USD · 500000 [S6]
- Starting price: Plans from $15/month [S3]
- Starting price: yes · 15 · month · USD [S14]
- Trial: yes · 7 · 15 [S1]
- Trial: 7 [S2]
- Trial: 7 · free_trial [S6]
- Trial card required: 7 · yes [S6]
- Trial days: 7 [S9]
- Trial days: 7 · yes · 15 [S12]
- Yearly discount: 2 months free with yearly billing [S6]

**Product**
- Accuracy limits: no [S14]
- AI filters: AI filterable via Referrer Source or AI Source in Advanced Filters [S11]
- AI measurement limit: Measures visits, not AI mentions or prompts; unattributed AI visits show as Direct [S11]
- AI referrer reporting: ChatGPT · Gemini · Perplexity · Claude [S10]
- AI retroactive: yes [S11]
- AI tab: yes [S11]
- AI tools: ChatGPT · Perplexity · Claude · Gemini · Microsoft Copilot · DeepSeek · Grok · Meta AI · You.com · Poe [S11]
- All sites view: all-sites view with totals for current visitors and bounce rate [S1]
- Allowed domains filtering: site firewall settings · yes [S18]
- Allowed domains subdomains: root domain and subdomains must each be added individually [S18]
- API: yes [S1]
- API aggregation first run delay: first run of unique aggregation has a short delay while database builds a query plan [S5]
- API base URL: https://api.usefathom.com/v1 [S5]
- API purpose: manage sites, events and milestones, or pull custom reports [S5]
- Async script: yes [S2]
- Avoid pii in urls: no names, emails, account IDs, or sensitive info in URLs and event names [S9]
- Block tracking console: fathom.blockTrackingForMe() [S18]
- Bot filtering: yes · yes [S2]
- Bot filtering: Automatic bot filtering [S6]
- Browsers dimension: yes [S10]
- Chart types: Area chart · Bar chart [S10]
- Company ownership: no · yes [S1]
- Comparison mode: yes [S10]
- Conversion formula setting: event completions / total people · yes · event completions / total page views [S4]
- Conversion rate basis: pageviews, changeable to site visitors in settings [S12]
- Cookie checker tool: yes [S9]
- Cookie checker tool: shows the cookies, browser storage and trackers a page sets before visitors make a choice [S13]
- Cookie free: yes [S2]
- Cookieless: no [S1]
- Cookieless: no · no [S14]
- Cookieless events: yes · yes [S12]
- Custom events integrations: yes · yes [S9]
- Custom events js: Any action with a line of JavaScript can be measured as an event [S12]
- Dashboard dimensions: yes [S10]
- Dashboard features: traffic · pages · referrers · events · filter by country [S3]
- Dashboard sharing: yes · yes [S2]
- Data isolation: yes · yes [S7]
- Data journey documentation: processing steps and limitations documented in the data journey [S13]
- Date grouping options: Auto · Hourly · Daily · Weekly · Monthly · Quarterly · Yearly [S10]
- Default routing US: US [S3]
- Details view rows: 100 [S10]
- Device types dimension: Desktop · Mobile · Tablet [S10]
- Direct definition: Direct = visitor without a referrer [S11]
- DPA ip temporary storage: count traffic and prevent DDoS attacks · yes [S8]
- DPA personal data categories: IP address · User-Agent [S8]
- Entry exit pages: yes [S10]
- EU isolation automatic: yes [S3]
- EU isolation scope: EU · UK · Switzerland · Norway · Iceland · Liechtenstein [S3]
- EU owned infrastructure: yes [S3]
- Event currency setting: site default (None initially) · yes [S4]
- Event currency wildcards: exact name over pattern; pattern with more literal characters wins · yes [S4]
- Event deletion unavailable: under maintenance · no [S4]
- Event export API: yes · yes [S12]
- Event filtering: filter by event to see completions, unique completions, conversion rate, value, pages, referrers; or filter by UTM campaign [S12]
- Event firewall: Block · Allow · yes [S4]
- Event firewall: yes · yes · yes [S12]
- Event name restrictions: special characters · emojis · yes [S4]
- Event rename: no · yes [S12]
- Event rename limitation: yes · no [S4]
- Event revenue tracking: Event and revenue tracking [S6]
- Event setup: one line of JavaScript, no dashboard pre-creation needed [S12]
- Event tracking: event tracking with values and currency [S2]
- Event tracking: Event tracking counts visitor actions beyond pageviews: signups, clicks, downloads and purchases [S12]
- Event tracking guides: link clicks · external link clicks · page load conversions · 404/error pages · ecommerce conversions · form submissions [S4]
- Event types: button clicks · form submissions · newsletter sign-ups · free trial start · product purchase [S4]

**Subprocessors**
- Aws: Amazon Web Services, Inc. (AWS) · Infrastructure hosting · USA · no [S8]
- Bunnyway: BunnyWay d.o.o. · Content Delivery Network · Slovenia [S8]
- DPA notice period: 14 [S8]
- Not published: no [S7]
- Purposes: email, calendar, digital meetings · accounting/bookkeeping · website including payment providers · transactional emails · support ticket system · AI support [S7]
- Stripe: Stripe · payment processing [S7]

**Support**
- API contact: yes [S5]
- Help centre: yes · yes · yes [S2]
- No sales calls: no sales calls or live demos; 10-minute walkthrough and live dashboard available [S6]
- Reply time: 30 [S7]
- Troubleshooting resource: Troubleshooting page available: If Fathom isn’t working on your site [S17]

73 more facts on the canonical page: https://whats-best.ai/software/web-analytics/fathom

## Questions

### Is Fathom Analytics European?

No. whats-best.ai classifies Fathom Analytics as Rest of world. Its vendor, Conva Ventures Inc., is incorporated in Canada, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12170).

### Where does Fathom Analytics store data?

Not stated on the vendor’s pages as of 29 Oct 2026.

### Does Fathom Analytics have a free plan?

Not stated on the vendor’s pages as of 29 Oct 2026.

### What are the best alternatives to Fathom Analytics?

As of 4 Nov 2026, the panel rates [Matomo (4/5)](https://whats-best.ai/software/web-analytics/matomo), [Piwik PRO Analytics Suite (3.5/5)](https://whats-best.ai/software/web-analytics/piwik-pro) and [Pirsch Analytics (3.5/5)](https://whats-best.ai/software/web-analytics/pirsch) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Piwik PRO Analytics Suite](https://whats-best.ai/software/web-analytics/piwik-pro) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Fathom Analytics alternatives](https://whats-best.ai/software/web-analytics/fathom/alternatives).

## What this page leaves out

- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://usefathom.com/ (checked 2026-10-29)
- [S2] Features page: https://usefathom.com/features (checked 2026-10-29)
- [S3] Features page (EU data isolation): https://usefathom.com/why-fathom-analytics/for-european-companies (checked 2026-10-29)
- [S4] Documentation (events): https://usefathom.com/docs/events/overview (checked 2026-10-29)
- [S5] API documentation: https://usefathom.com/api/v1 (checked 2026-10-29)
- [S6] Pricing page: https://usefathom.com/pricing (checked 2026-10-29)
- [S7] Privacy policy: https://usefathom.com/legal/privacy (checked 2026-10-29)
- [S8] Data processing agreement (dpa): https://usefathom.com/legal/dpa (checked 2026-10-29)
- [S9] Security / trust page (compliance): https://usefathom.com/legal/compliance (checked 2026-10-29)
- [S10] Traffic, sources & campaign reports — found from sitemap: https://usefathom.com/docs/start/dashboard (checked 2026-10-29)
- [S11] Traffic, sources & campaign reports — found from sitemap: https://usefathom.com/docs/features/sources (checked 2026-10-29)
- [S12] Goals, events, funnels & e-commerce — found from sitemap: https://usefathom.com/features/event-tracking (checked 2026-10-29)
- [S13] Consent-free operation & data minimisation — found from sitemap: https://usefathom.com/legal/compliance/eprivacy-compliant-website-analytics (checked 2026-10-29)
- [S14] Consent-free operation & data minimisation — found from sitemap: https://usefathom.com/why-fathom-analytics/privacy-focused-web-analytics (checked 2026-10-29)
- [S15] Data access, export & self-hosting — found from sitemap: https://usefathom.com/docs/features/exporting (checked 2026-10-29)
- [S16] Data access, export & self-hosting — found from sitemap: https://usefathom.com/api/v1/reports (checked 2026-10-29)
- [S17] Installation, integrations & performance — found from sitemap: https://usefathom.com/docs/start/install (checked 2026-10-29)
- [S18] Installation, integrations & performance — found from sitemap: https://usefathom.com/docs/script/local (checked 2026-10-29)

---

Cite as: whats-best.ai, "Fathom Analytics — Web Analytics", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/web-analytics/fathom

Corrections: https://whats-best.ai/correct/1145?target=page