Web Analytics
Mapp Digital Analytics
EU origin, foreign-owned Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Mapp Digital Germany GmbH · mapp.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Mapp Digital Analytics at a glance
- Vendor
- Mapp Digital Germany GmbH
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates Mapp Digital Analytics 2.5/5, the mean of 6 judges. Mapp Digital Analytics, the analytics module of the Mapp Marketing Cloud from Mapp Digital Germany GmbH of Munich, is strongest where documentation runs deepest: conversions and events score 6-7 for selector-level event tracking, funnel and journey visualisation, and named shop integrations for Shopify, Magento, Shopware and Salesforce Commerce Cloud; implementation scores cluster at 6 for GTM-plugin and npm installation plus first-party tracking on your own domain. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Mapp Digital Analytics, the analytics module of the Mapp Marketing Cloud from Mapp Digital Germany GmbH of Munich, is strongest where documentation runs deepest: conversions and events score 6-7 for selector-level event tracking, funnel and journey visualisation, and named shop integrations for Shopify, Magento, Shopware and Salesforce Commerce Cloud; implementation scores cluster at 6 for GTM-plugin and npm installation plus first-party tracking on your own domain. Sovereignty is weakest at 3-4: a German contracting entity with a published data processing agreement, ISO 27001 with 27017/27018 and 27701 add-ons and a sub-processor list, yet we found no public information on where analytics data is hosted, the captured pages give different copyright entities, and the group's San Diego head office appears only in independently sourced material. Traffic reporting splits 4 to 6: lower scores found no public information on country, device and browser breakdowns; higher scores credited published counting rules and custom segmentation. Consent and privacy scores 4-5 on a cookieless mode for which we found no public information on how visitors are counted. Pricing starts at "Ab €2.900/Monat (jährliche Abrechnung)".
Speaks for it
- Event tracking documented in standard, link and advanced selector modes, with automatic internal and external link clicks, shadow DOM and Ajax handling.
- Installation documented without editing site source code, via a GTM plugin with no-code configuration, npm packages for Angular and a native Shopify extension.
- A documented Analytics API with its own reference works without logging into the platform, alongside real-time streams on Apache Kafka and SFTP with Mapp Connect.
- A cookieless mode is documented for Pixel v4, Tag Integration and Smart Pixel generations, with an opt-out covering all integration methods including mobile SDKs.
- A data processing agreement, ISO 27001 with the 27017 and 27018 add-ons, ISO 27701 and a sub-processor list are published in the trust centre.
Held against it
- We found no public information on where the analytics data is hosted or where the listed sub-processors are located.
- We found no public information on how visitors are counted in the cookieless mode, on IP truncation or on configurable retention for analytics data.
- We found no public information on referrer, country, device or browser reports, a real-time view or scheduled email reports.
- We found no public information on CSV export of reports, raw-data retention or an import of historical data, so data portability is not verifiable end to end.
- Conversions are documented with a last-click view, and we found no public information on compared attribution models or conversions passed back to ad platforms.
Best for
- You run e-commerce on Shopify, Magento, Shopware or Salesforce Commerce Cloud and need deep, selector-level event tracking with a code generator and shadow DOM support.
- You deploy via Google Tag Manager or npm and want first-party collection on your own tracking domain, for resilience against ad blockers and Safari ITP.
- You pull reporting data into your own stack, through the documented Analytics API that works without logging into the platform and the Apache Kafka-based real-time streams.
- You already standardise on Usercentrics for consent management and want the tracking consent flow integrated.
Avoid if
- You must evidence the full hosting chain for visitor data before procurement — ask the vendor: the public pages we read do not show it
- You need consent-free operation you can sign off without vendor involvement — activating the cookieless mode is advised with your account manager and precludes cross-visiting behaviour analysis.
- You reconcile ad spend through server-to-server conversion feeds — the documented conversion attribution is last click.
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 2.5 of 5 |
| Goals, events, funnels & e-commerce | 3.5 of 5 |
| Consent-free operation & data minimisation | 2 of 5 |
| Data access, export & self-hosting | 2.5 of 5 |
| Installation, integrations & performance | 3 of 5 |
| European sovereignty | 2 of 5 |
Traffic, sources & campaign reports
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
The documentation shows daily traffic figures — visits, page impressions, new visit rate, average duration and bounce rate — with a comparison view for date ranges and segments, and it explains how those numbers are counted, which I value. Beyond that there is a journey-style source analysis showing the order of traffic sources before a goal is reached, custom segmentation and AI alerts on campaign metrics. We found no public information on a real-time view, scheduled email reports, dashboards shared with colleagues or clients, or country and device breakdowns. 9 10 2 3
The Data Protection Officer
The traffic analysis documents visits, page impressions, new-visitor rate, visit duration and bounce rate per calendar day, with a comparison view across date ranges and segments, published definitions of how visitors are recognised (cookies and, if passed, login information) and how the exit page is counted, and a traffic-sources path that shows every source unaggregated before a goal. Custom segmentation, dashboards and AI anomaly monitoring sit around this. We found no public information on referrer, country, device or browser reports, on email and scheduled reports, or on whether reports are sampled. 9 10 2 3
The Agency Developer
The traffic analysis docs give daily visits, page impressions, bounce rate and visit duration with the counting rules spelled out (bounce rate defined, 30-second default on the exit page, cookie-based visitor recognition), plus a comparison view across date ranges and segments and strong custom segmentation. Funnel and journey visualization, AI monitoring alerts and KPI forecasts are documented as well. The captured pages do not show referrers, countries, devices, a real-time report view or scheduled email reports, so I stop short of the fuller reporting set. 9 10 2 3
The Growth Analyst
The traffic documentation shows daily reports on visits, page impressions, new-visitor rate, visit duration and bounce rate with published definitions of how each is counted, plus a comparison view across date ranges and segments, a campaign analyses chapter, and traffic sources shown individually without aggregation including the order of sources before a goal. Custom segmentation and AI monitoring that alerts stakeholders to unusual campaign activity go beyond a basic dashboard, but we found no public information on referrer, country, device or browser reports, a real-time view, scheduled email reports or shared dashboards. 9 10 2 3
The Public-Sector Site Owner
The documentation shows daily visits, page impressions, bounce rate and average visit duration, a comparison view for date ranges and segments, custom segmentation, and traffic sources depicted individually in the order they led to a goal. For the council's monthly report I would need country, device and browser breakdowns, a real-time view and scheduled email reports, and we found no public information on any of these. 9 10 2 3
The Skeptic
The documented traffic analysis gives daily visits, page impressions, new-visitor rate, average duration and bounce rate with the formulas actually published, plus a comparison view across date ranges and segments, custom segmentation and AI alerts on unusual campaign activity. I found no public information on referrer, country, device or browser breakdowns, campaign dashboards, a real-time view, email reports or shared dashboards. Source reporting appears only as a journey view showing which traffic sources preceded a goal, each source listed individually rather than aggregated. 2 3 9 10
Goals, events, funnels & e-commerce
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Event tracking is documented in real depth (standard, link and advanced modes, automatic clicks on internal and external links, custom parameters, shadow DOM), conversions per message are reported with a last click view, and the traffic sources path shows the order of sources before a goal. Funnels and customer journeys are visualised, conversion and churn probabilities including next cart value are predicted, and named shop integrations exist — a native Shopify extension, full Magento support and Salesforce Commerce Cloud, with Shopware among the listed integrations. We found no public information on conversions passed back to Google Ads or Meta server to server, or on revenue reconciled with the shop system, which is exactly what my ad budget reporting needs. 12 11 10 2 3 4
The Data Protection Officer
Event tracking is documented in real depth — standard, link and advanced selector-based modes, custom event parameters, shadow DOM and Ajax content, a code generator — and conversions with a last-click view sit in the statistics, alongside funnel and customer-journey visualisation, RFM models and conversion, churn and next-cart-value predictions. Native extensions for Shopify and support for Magento, Shopware and Salesforce Commerce Cloud point to working e-commerce tracking; we found no public information on order and revenue fields, compared attribution models, cohorts, or conversions passed back to ad platforms. 12 11 2 4
The Agency Developer
Event tracking is thoroughly documented: automatic internal and external link clicks, selector-based tracking of any element including shadow DOM, custom event parameters, and a code generator. Website goals, conversion windows and last-click views are documented, named shop integrations exist (native Shopify extension, Shopware, Magento 1 and 2, Salesforce Commerce Cloud), and conversion/churn prediction is marketed. Cohorts and retention, downloads, scroll depth and a server-to-server feed back to ad platforms are not described on the captured pages. 12 11 4 3
The Growth Analyst
Event tracking is documented in depth — automatic clicks on internal and external links, an advanced mode that captures any element via selector, custom event parameters mapped to HTML attributes and a code generator — and funnels, customer-journey visualization, RFM/RFE models and conversion or churn probability are listed features, with e-commerce supported through named shop systems (Magento, Shopware, Salesforce Commerce Cloud and a native Shopify extension) and conversions attributed by last click and the order of sources in the journey. That is close to the signup-to-invoice tracing I run, though we found no public information on cohorts and retention as such, compared attribution models, or conversions passed back to ad platforms, and order, revenue and product field detail is not documented. 12 11 2 4 3 10
The Public-Sector Site Owner
Event tracking is documented in real depth — automatic internal and external link clicks, custom event parameters, a code generator, shadow DOM support — alongside website goals, funnel and customer journey visualisation, and e-commerce integrations named for Magento, Shopware, Salesforce Commerce Cloud and Shopify. The order of traffic sources before a goal and last-click conversions for email are shown, but we found no public information on compared attribution models, cohorts and retention, or conversions sent back to ad platforms. 12 10 11 2 4 18
The Skeptic
Event tracking is documented in real depth — standard, link and advanced modes, automatic clicks on internal and external links, custom event parameters, shadow DOM and Ajax handling — and conversions are broken down by source with a last-click view, funnel and customer journey visualisation, and named shop system support (Shopify, Magento, Shopware, Salesforce Commerce Cloud). But I found no public information on compared attribution models, cohort analysis, or conversions passed back to ad platforms, and the churn, conversion and next-cart-value predictions are marketed with no method stated. Last click alone is a modest attribution story for a product at this price point. 3 4 10 11 12
Consent-free operation & data minimisation
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
A cookieless mode is documented — available with Pixel v4, Tag Integration or the Smart Pixel, described as preventing tracking with user-identifiable information, with an opt-out for all integration methods including mobile SDKs and a Usercentrics integration for consent handling. The captured pages state that activating it precludes analysing cross-visiting behaviour and advise consulting the account manager first; we found no public information on how visitors are counted in this mode, IP truncation or configurable retention periods. The GDPR statements themselves are general. 13 14 7
The Data Protection Officer
A cookieless mode is documented and described as preventing tracking with user-identifiable information, available for Pixel v4, Tag Integration and the Smart Pixel, with an opt-out covering every integration method including the mobile SDKs, a UserCentrics consent integration, and a plugin that discloses the tracking cookie ID to a visitor on request; ISO 27701 privacy management is certified. We found no public information on how a visitor is counted without a cookie, whether the IP address is truncated before storage, retention settings for the analytics data, or the vendor's written reading of §25 TDDDG — without that statement I will not sign a site off banner-free on this material. 13 14 8
The Agency Developer
A cookieless mode is documented for Pixel v4, Tag Integration and Smart Pixel users, with an opt-out available for every integration method including mobile SDKs, a Usercentrics consent integration, and a plugin to disclose the tracking cookie ID to visitors on request. But the pages do not state how visitors are counted in that mode, how IP addresses are handled, what retention the customer can configure, or when a banner is required — activation comes with advice to consult the account manager. That is more than a bare cookie setting, yet short of a fully documented consent-free operation. 14 13
The Growth Analyst
A cookieless, anonymized tracking mode is documented for Pixel v4, Tag Integration and the Smart Pixel with a stated trade-off that cross-visiting behaviour analysis is precluded, an opt-out exists for all integration methods including mobile SDKs, and a Usercentrics consent integration is described as best practice. But the pages we read do not state how visitors are counted in that mode, whether IP addresses are truncated, retention settings for analytics data, or a position against §25 TDDDG or the CNIL exemption, so I cannot judge whether my site could run it without a banner. 13 14 7
The Public-Sector Site Owner
A cookieless mode is documented for all current pixel generations, with an opt-out for every integration method including mobile SDKs, integration with the Usercentrics consent platform, and guidance on Safari ITP restrictions. For a council that will not show a cookie banner this stops short of what I need: how visitors are counted without cookies is not stated, retention for analytics data is not described, and there is no position stated against §25 TDDDG or the authorities' rulings on when a banner can be avoided. 13 14 7 9
The Skeptic
An anonymised cookieless mode is documented for every current pixel generation, an opt-out exists for all integration methods including the mobile SDKs, and consent runs through a Usercentrics integration with legacy GDPR parameters — more substance than a banner claim. But the pages never state how visitors are counted in that mode, whether IP addresses are truncated, or what retention applies, and the legal framing is generic GDPR rather than §25 TDDDG, the CNIL exemption or a cited audit. Default visitor recognition runs on cookies, and activating the cookieless mode is something you do with your account manager, which precludes cross-visiting analysis — an honest limitation, but the buyer should read it before believing 'consent-free' on the slide. 7 9 13 14
Data access, export & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
A reporting API is documented that works without logging into the platform and has its own API documentation, the documentation contains a raw data export page, and the top plan lists data streams while the customer data platform features list SFTP and API access. We found no public information on CSV export of every report, an import of historical data from Google Analytics, or a self-hosted edition — so leaving with the data looks possible in principle but is not verifiable end to end from the public pages. 16 15 5 1
The Data Protection Officer
A dedicated Analytics API with its own documentation, real-time streams on Apache Kafka, and SFTP together with Mapp Connect and API access in the customer-data-platform features give real routes out of the platform, and the documentation includes a raw-data-export section. We found no public information on CSV export of reports, the retention period for raw data, an import of historical data, or a self-hosted edition. 16 2 5 15
The Agency Developer
There is a documented Analytics API with its own dedicated documentation that pulls information without logging into the platform, real-time streams on Apache Kafka, and a raw data export page in the documentation. We found no public information on CSV export of every report, the retention period for raw data, an import of historical data from Google Analytics, or a self-hosted edition. For an agency that wants client data portable at the end of a contract, the API is real but the rest is thin on the captured pages. 16 2 15 1
The Growth Analyst
The Analytics API is documented with its own reference and allows retrieving information without logging into the platform, real-time data streams based on Apache Kafka are listed as an Intelligence feature, and the top tier adds SFTP plus Mapp Connect and API access — that is a genuine pipe into my own stack. But we found no public information confirming a raw event export, CSV export of reports, the retention period for raw data, an import of historical data from another tool, or any self-hosted edition, and after two tracking migrations that unconfirmed history question is the one that decides it for me. 16 2 5 1
The Public-Sector Site Owner
An Analytics API to pull information without logging into the platform, real-time streams on Apache Kafka, SFTP access and Mapp Connect are documented, and a raw data export page exists in the documentation. We found no public information on CSV export of reports, stated retention periods for raw data, or a self-hosted edition — so I cannot run this on the municipal data centre's own servers. 16 2 5 15 1
The Skeptic
The Analytics API is documented with its own reference and works without logging into the platform, SFTP and Mapp Connect are listed, and real-time streams run on Apache Kafka; a raw data export page exists in the documentation, but the captured facts record nothing about what it exports or in what format. I found no public information on CSV export of reports, sampling, raw-data retention, an import of historical data from Google Analytics, or a self-hosted edition. Whether the data can genuinely leave — in a format another tool imports, and what happens to every copy on termination — is not documented, and that is the part I weigh most. 2 5 15 16
Installation, integrations & performance
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Installation is well covered: npm packages for Angular single-page apps with automatic page tracking, a Google Tag Manager plugin based on the Smart Pixel with CDN fast integration and settings managed entirely in GTM, and shop integrations including a native Shopify extension, Magento and Shopware. Custom tracking domains are documented as raising cookie acceptance, and mobile SDKs appear in the feature list. We found no public information on the script's size, team roles and permissions, single sign-on, or a public status page with uptime history. 17 18 4 13 5
The Data Protection Officer
The Smart Pixel installs via CDN or a Google Tag Manager plugin that needs no source-code changes, npm packages cover Angular single-page apps, and connectors exist for Shopify (native extension), Magento, Shopware and Salesforce Commerce Cloud, with custom first-party tracking domains documented down to the CNAME-to-A-record migration. We found no public information on the script's size, team roles and permissions, single sign-on, or a public status page. 17 18 4 13
The Agency Developer
The Smart Pixel installs via a Google Tag Manager plugin with CDN fast integration and no-code configuration, npm SDKs exist for Angular versions with automatic page tracking, and multiple track IDs can be served from one set-up. Custom track domains are documented down to the CNAME-to-A-record migration — that matters when ad blockers cut client numbers in half — alongside e-commerce integrations for Shopify, Shopware, Magento and Salesforce Commerce Cloud. We found no public information on WordPress or TYPO3 plugins, the script's size, team roles, client or agency accounts, single sign-on, or a status page. 17 18 13 4
The Growth Analyst
Installation is well documented: a Smart Pixel library with npm packages for Angular v6-v11 and v12+, automatic page tracking, a Google Tag Manager plugin with CDN fast integration and tracking managed entirely in GTM, optional extensions for content engagement and teaser tracking, and shop system integrations for Magento, Shopware, Salesforce Commerce Cloud and a native Shopify extension that feeds data without coding. A custom first-party tracking domain is supported and mobile SDKs are referenced, but we found no public information on script size, team roles and permissions, single sign-on or a public status page with uptime history. 17 18 4 13
The Public-Sector Site Owner
Installation is well documented: a Smart Pixel loadable via CDN or a Google Tag Manager plugin without editing source code, npm packages for Angular single-page apps, a native Shopify extension plus support for Magento, Shopware and Salesforce Commerce Cloud, and custom track domains giving first-party collection on our own domain. We found no public information on the script's size, team roles and permissions, single sign-on, or a public status page with uptime history. 17 18 4 13 3
The Skeptic
Integration is properly documented: an official Smart Pixel with npm packages for Angular and automatic page tracking, a Google Tag Manager plugin with CDN fast integration and no-code configuration, a native Shopify extension, support for Magento, Shopware and Salesforce Commerce Cloud, a mobile SDK, and custom track domains that put collection on the customer's own domain. I found no public information on the script's size, team roles and permissions, single sign-on, or a public status page with uptime history. The own-domain tracking is the strongest piece here; the organisational side is a blank page. 4 5 13 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
The contracting entity is Mapp Digital Germany GmbH in Munich with a German VAT number, a data processing agreement and ISO 27001 with the 27017/27018 and 27701 add-ons are published, and a sub-processor list is available in the trust center. But the captured pages give no statement on where visitor data is collected, stored and processed, the sub-processor list's contents and locations are not shown, and the group is described as headed in San Diego in the USA — for my German and Austrian shop data I cannot verify the chain. 6 7 8
The Data Protection Officer
The contracting entity and controller is Mapp Digital Germany GmbH in Munich, registered with the district court under HRB 226181, and the trust page publishes a data processing agreement, ISO 27001 with the 27017 and 27018 add-ons, ISO 27701 and ISO 22301, and points to a list of sub-processors whose contents and locations the captured pages do not show. No hosting location for the analytics data is stated, and the captured pages give different copyright entities, Germany and the United Kingdom, while the group's San Diego head office appears only in independently sourced material and not on the German pages. 6 7 8
The Agency Developer
The contracting entity is Mapp Digital Germany GmbH in Munich, registered at the District Court München, and the trust page publishes a data processing agreement, a subprocessor list and ISO 27001 with the cloud add-ons plus ISO 27701. Where the product's visitor data is collected, stored and processed is not stated on the captured pages, and the independently collected provenance note places the group's headquarters in San Diego, USA. A German entity with published agreements and certifications, but no evidenced hosting location for the data chain. 6 7 8
The Growth Analyst
The German legal notice names Mapp Digital Germany GmbH in Munich with commercial register and VAT details, a data processing agreement for the Mapp Marketing Cloud is published alongside ISO 27001 with 27017/27018 add-ons, ISO 27701, and a sub-processor list offered through the trust centre; the captured pages give different copyright entities, however, Mapp Digital Germany GmbH on the German pages and Mapp Digital UK Ltd on the trust page. What decides the score is that we found no public information on where visitor data is collected, stored or processed, so the chain a Munich buyer has to audit is not evidenced end to end. 6 7 8 2
The Public-Sector Site Owner
The contracting entity is Mapp Digital Germany GmbH in Munich, registered at the Munich district court, with a published data processing agreement, ISO 27001/27017/27018 certifications and a sub-processor list in the trust centre. But we found no public information on where analytics data is collected and hosted, ownership of the group is headed in San Diego without being stated on the German pages, and a US provider (HubSpot) appears in the vendor's own newsletter chain — I cannot assure the council that residents' data stays in Germany on this evidence. 6 7 8
The Skeptic
The legal notice names Mapp Digital Germany GmbH in Munich as the entity, and the trust centre publishes a data processing agreement, a sub-processor list, and ISO 27001 with the 27017 and 27018 cloud add-ons plus ISO 27701 — more paperwork than most vendors show. But the trust page is itself copyrighted by Mapp Digital UK Ltd, the group is headed outside Europe, and I found no public information on where the analytics data is hosted or processed, nor on the locations of the listed sub-processors. Certificates describe a management system, not a data location; until the hosting of the visitor data chain is stated, the sovereignty claim rests on the contracting entity alone. 6 7 8
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
The packages are public: 'Ab €2.900/Monat (jährliche Abrechnung)' for Essential and 'Ab €3.400/Monat (jährliche Abrechnung)' for Professional, with a 12-month minimum term, pricing based on database size and unique monthly visitors with both terms defined, and a scoping session before signing to avoid hidden costs. However, only starting prices are published, the top tier is a custom quote ('Maßgeschneidertes Angebot einholen'), and we found no public information on overage fees, VAT treatment or a free tier — so I cannot compute my real annual cost from the page alone. 5
The Data Protection Officer
Two packages are published with starting prices — ab €2.900/Monat for Essential and ab €3.400/Monat for Professional, each with annual billing and a twelve-month minimum term — and the price drivers are named as database size and Unique Monthly Visitors, with a scoping session before signature to avoid hidden costs. No price bands per traffic volume are given, so a buyer cannot compute the real annual cost for a given visitor number; we found no public information on overage handling, extra sites or users, add-on prices, a free tier, or VAT treatment. 5
The Agency Developer
Two tiers are public — Essential at Ab €2.900/Monat (jährliche Abrechnung) and Professional at Ab €3.400/Monat (jährliche Abrechnung) — with inclusions listed, a 12-month minimum term, and a named price basis of database size and Unique Monthly Visitors. But these are from-prices: no traffic bands, no overage handling, no site or user counts, no free tier, and no self-hosted edition priced anywhere on the captured pages. A buyer cannot compute the real annual cost from these pages; a scoping session before contract is offered to avoid hidden costs. 5
The Growth Analyst
The pricing page publishes bundle tiers from "Ab €2.900/Monat" (Essential) and "Ab €3.400/Monat" (Professional), each with annual billing, a 12-month minimum term, detailed feature inclusions and a stated scaling basis of database size and Unique Monthly Visitors with both terms defined. But only the floor price is computable: no traffic bands, overage rules or site and user counts are priced, Digital Analytics is not separable from the Marketing Cloud bundles, and anything beyond the entry point is a custom quote. 5
The Public-Sector Site Owner
Tiers are published with starting prices — "Ab €2.900/Monat (jährliche Abrechnung)" for Essential and "Ab €3.400/Monat" for Professional — a twelve-month minimum term, and a stated basis of database size and unique monthly visitors. These prices bundle a whole marketing cloud rather than analytics alone, there are no price bands per traffic volume, and overage handling, site and user counts and per-feature add-ons are not itemised, so my procurement office cannot compute a real annual cost from the public pages. 5
The Skeptic
Two tiers are public — "Ab €2.900/Monat (jährliche Abrechnung)" and "Ab €3.400/Monat (jährliche Abrechnung)" — with feature lists, a named price basis of database size and unique monthly visitors, a twelve-month minimum term and stated discount rules; anything above Professional is a tailored quote. There is no traffic-band price table, no overage terms, no add-on prices and no free tier, so the real annual cost is only fixed inside the pre-contract scoping session. A buyer can see the floor, not the bill. 5
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Mapp Digital Analytics
Is Mapp Digital Analytics European?
Partly. whats-best.ai classifies Mapp Digital Analytics as EU origin, foreign-owned.
Where does Mapp Digital Analytics store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Mapp Digital Analytics have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Mapp Digital Analytics?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Mapp Digital Analytics alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 13 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage mapp.com Checked 29 Oct 2026 Details →
- 2 Features page (digital analytics) mapp.com Checked 29 Oct 2026 Details →
- 3 Features page (AI-driven analytics) mapp.com Checked 29 Oct 2026 Details →
- 4 Integrations page mapp.com Checked 29 Oct 2026 Details →
- 5 Pricing page (Marketing Cloud packages) mapp.com Checked 29 Oct 2026 Details →
- 6 Legal notice mapp.com Checked 29 Oct 2026 Details →
- 7 Privacy policy mapp.com Checked 29 Oct 2026 Details →
- 8 Security / trust page mapp.com Checked 29 Oct 2026 Details →
- 9 Traffic, sources & campaign reports — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 10 Traffic, sources & campaign reports — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 11 Goals, events, funnels & e-commerce — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 12 Goals, events, funnels & e-commerce — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 13 Consent-free operation & data minimisation — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 14 Consent-free operation & data minimisation — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 15 Data access, export & self-hosting — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 16 Data access, export & self-hosting — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 17 Installation, integrations & performance — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →
- 18 Installation, integrations & performance — found from sitemap docs.mapp.com Checked 29 Oct 2026 Details →