# Matomo — Web Analytics

Matomo by InnoCraft Ltd holds a panel rating of 4/5 from 6 AI judges (category median 2.5/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: not determined.

- Vendor: InnoCraft Ltd (https://matomo.org)
- Category: [Web Analytics](https://whats-best.ai/software/web-analytics.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/web-analytics/matomo
- Alternatives: https://whats-best.ai/software/web-analytics/matomo/alternatives ([markdown](https://whats-best.ai/software/web-analytics/matomo/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: InnoCraft Ltd
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Default not stated; pages mention Europe [S7]
- Free plan: Not stated on the vendor’s pages as of 1 Nov 2026

## The panel's verdict

Matomo is web analytics from InnoCraft Ltd, sold as Matomo Cloud or free GPL on-premise download. Data ownership leads at 9: self-hosting on your own MySQL with SQL access and no data limit, APIs in CSV, JSON and XML, warehouse export to BigQuery and Snowflake. Traffic reporting and consent and privacy cluster at 8-9, implementation at 7-9, conversions and events at 7-8, attribution and cohorts as premium add-ons. Judges flag the same gaps: unpublished visitor-counting methodology, script size and status page with uptime history. Pricing transparency is the weak point at 7: the Business plan is public at 22 EUR per month (excl. tax) with overage at 5,000 hits for 2.2 EUR (excl. tax) and a 21-day trial without credit card, but captured pages show a single tier price, no minimum term and no premium-plugin prices. Sovereignty scores 7-8: cloud data sits on AWS in Frankfurt, stated as not transferred to the US, but the contracting entity is in New Zealand and US providers run support and payments; on-premise keeps data in a country of your choice, subprocessors not applicable.

**Speaks for it:**
- On-premise edition is GPL-licensed and free to download, running on your own MySQL with SQL access and no data limit
- Reporting and administration APIs return data in CSV, JSON and XML, with a Data Warehouse Connector to BigQuery and Snowflake
- CNIL approval for consent-free collection, with a one-click CNIL configuration and a published self-assessment
- Installation is documented from one-click installers and Docker to official WordPress and shop-system plugins, plus a first-party tracker proxy
- Termination terms document export within the 30-day window, deletion within 30 days and backups retained for up to 60 days

**Held against it:**
- Captured pricing pages show a single tier price, with no full tier ladder, no minimum term and no premium-plugin prices
- We found no public information on tracking script size, measured performance impact or a status page with uptime history
- We found no public information on a published methodology for how visitors are counted or on configurable channel grouping
- The vendor recommends consent before cookieless or cookie-based tracking under German law, and the BfDI requires consent for the bodies it supervises
- Cloud contracting runs through InnoCraft Ltd in New Zealand, with Help Scout in the USA handling support emails and Paddle in the UK and USA handling payments

**Best for:**
- You want to own the analytics stack outright — data ownership scores sit at 9, carried by the on-premise edition with SQL access, no data limit and migration between Cloud and On-Premise in both directions
- You want banner-free analytics in France under the CNIL exemption, using the one-click configuration and the opt-out mechanism
- You are an agency or reseller managing many client sites, using white-label resale, per-website user access and official plugins for WordPress and shop systems
- You need raw events in your own warehouse, via the Data Warehouse Connector from 5 EUR per month

**Avoid if:**
- You must compute a full annual cost before committing — the captured pages show a single tier price, no minimum term and no premium-plugin prices
- You are a Cloud buyer requiring an end-to-end European chain, since the contracting entity is in New Zealand and US providers run support and payments
- You need banner-free analytics in Germany, where the vendor recommends consent before tracking and e-commerce, heatmaps, session recording and raw data access fall outside the CNIL exemption
- Your Cloud plan must keep raw data beyond 24 months, the Business plan's stated raw-data retention, while report data is kept forever

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The E-Commerce Marketing Lead | The Data Protection Officer | The Agency Developer | The Growth Analyst | The Public-Sector Site Owner | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Traffic, sources & campaign reports | 4/5 | 4.5/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Goals, events, funnels & e-commerce | 4/5 | 4/5 | 4/5 | 3.5/5 | 4/5 | 4/5 |
| Consent-free operation & data minimisation | 4/5 | 4/5 | 4.5/5 | 4.5/5 | 4/5 | 4/5 |
| Data access, export & self-hosting | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 | 4.5/5 |
| Installation, integrations & performance | 4/5 | 4/5 | 4.5/5 | 4/5 | 4/5 | 3.5/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 3.5/5 |
| Pricing transparency | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| **Weighted verdict** | **4/5** | **4/5** | **4/5** | **4/5** | **4/5** | **4/5** |

### The judges

- **The E-Commerce Marketing Lead** (v1.0): Runs marketing for a Shopware shop selling outdoor gear in Germany and Austria, with a monthly ad budget split between Google, Meta and two price comparison sites. Since the consent banner went live, a third of the orders no longer show a source. Wants revenue per campaign that matches the shop backend, a checkout funnel that shows where carts are left, conversions sent back to the ad platforms, and numbers that hold without a click on "accept".
- **The Data Protection Officer** (v1.0): External data protection officer for eleven mid-sized companies, three of which still ran Universal Analytics when the Austrian authority ruled on it. Reads the data policy before the feature page: which fields are stored, how a visitor is counted without a cookie, whether the IP address is cut before it is written, who the subprocessors are and where. Signs off a site without a banner only when the vendor states its reading of §25 TDDDG in writing.
- **The Agency Developer** (v1.0): Lead developer at a twelve-person web agency that runs forty client sites on WordPress and TYPO3 and a few Shopify shops. Installs the analytics once per site and answers for it for years. Wants a small script or server-side collection, a plugin per CMS, an own tracking domain so ad blockers do not cut the numbers in half, client accounts with their own logins, and a price that does not jump when one client goes viral.
- **The Growth Analyst** (v1.0): Product and growth analyst at a B2B SaaS in Munich with a marketing site, a web app and a mobile app. Needs signups traced from the first campaign click to the first paid invoice, funnels and cohorts on custom events, and the raw events in the company's warehouse every night. Has moved tracking twice and knows that a tool without a raw export means starting the history again from zero.
- **The Public-Sector Site Owner** (v1.0): Web editor for a district administration whose site serves 400,000 residents, from vehicle registration to daycare places. The state data protection authority publishes guidance on analytics, and the council will not show a cookie banner on a public service. Needs to know which pages people search for and where forms are abandoned, with data that stays in Germany or on the municipal data centre's own servers, and a contract the procurement office can sign.
- **The Skeptic** (v1.0): Has seen "no cookie banner needed" on a tool that fingerprints every visitor, "EU-hosted" on a proxy in front of a US data store, and "unlimited" data history that ends with the subscription. Reads that a product is "GDPR-compliant" and asks which ruling the vendor means, what is stored per visit, whether the history can be exported in a format another tool imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit rights: no · ISO/IEC 27001 certification · Vanta compliance reports · third-party audit summaries [S8]
- Bcdr: yes [S8]
- Bfdi guideline matomo: BfDI guideline requires consent before using Matomo Analytics for supervised bodies [S13]
- Breach notification: without undue delay by email · yes [S8]
- Bug bounty: yes · yes · yes [S8]
- Childrens privacy: no [S7]
- Cnil: yes [S2]
- Cnil approval: yes · yes [S3]
- Cnil self assessment: yes [S14]
- DPA cloud: Matomo Cloud DPA available [S13]
- DPA GDPR: yes [S8]
- Dpi assessments: yes [S8]
- Encryption: yes · yes [S8]
- EU representative: ePrivacy Holding GmbH [S8]
- GDPR: GDPR compliance [S1]
- GDPR checklist: GDPR compliance checklist available [S13]
- GDPR claim: yes [S7]
- GDPR manager: yes [S4]
- GDPR manager rights: right of access · right to withdraw consent · supports do not track · right to data portability · right to object · delete historical data · right to erasure · anonymizing features · anonymize historical data [S3]
- GDPR tools: yes [S2]
- International transfers: yes · yes [S8]
- Ip anonymisation: yes · yes [S2]
- ISO 27001: yes · ISO 27001:2022 [S3]
- ISO 27001: ISO 27001:2022 [S6]
- ISO 27001: yes [S2]
- ISO 27001: yes [S8]
- ISO 27001: certified · ISO 27001:2022 [S1]
- ISO 27001: yes · ISO 27001:2022 [S4]
- Log analytics legal basis: BfDI: log analytics secondary use requires Art. 6(4) GDPR and Section 23 BDSG; legitimate interest available as legal basis [S13]
- MFA: yes [S8]
- No automated decision making: no · no [S7]
- No data sale: no · no [S8]
- No pii option: yes [S4]
- Opt out cookieless: yes · yes · yes [S2]
- Opt out scope other countries: Opt-out tracking also usable under similar exemptions in some other EU countries [S14]

**Data**
- Anonymised retention: aggregated, anonymised information · indefinitely [S7]
- Backup retention: 60 [S8]
- Deletion: 30 [S8]
- Export: yes · 30 [S8]
- Funnels archiving: FAQ addresses funnel data archiving [S11]
- Raw data export: Raw data export [S1]
- Retention: while account is active plus as necessary for legal obligations [S7]

**Hosting**
- Cloud region: Frankfurt, Germany [S6]
- Company location: yes · New Zealand [S7]
- Data location: Europe [S7]
- Data residency cloud: no · yes [S3]
- Data residency on premise: yes [S3]
- International transfers: adequacy decision · New Zealand [S7]
- Onpremise choice: customer chooses data location [S6]
- Provider: AWS · Dublin · Frankfurt [S8]

**Integrations**
- API: yes · yes · yes [S2]
- APIs: APIs & integrations [S1]
- Bi sql query: BI tools can query Matomo users data in SQL [S15]
- Cms category: yes · WordPress · Joomla 4 · Joomla 3 · TYPO3 · Drupal · Ghost · Moodle · Pimcore · Squarespace · Kirby CMS · Neos [S5]
- Cms ecommerce: yes [S2]
- Collaboration category: yes · Matomo-Slack integration · Matomo-MS Teams integration [S5]
- Community contribution: developers can submit their own integrations [S5]
- Consent category: yes · Cookiebot · OneTrust · Osano · Complianz · Tarte au Citron · Klaro · Usercentrics · CookieYes · Axeptio · CookieScript · Didomi [S5]
- Count: 100+ technologies including CMS, online shops, forums, frameworks [S5]
- CRM category: yes · Jira Cloud and Jira Server · Open-Xchange · Atlassian Confluence · Odoo ERP and CRM · Mantis [S5]
- Data export: Excel · XML · Json [S2]
- Data export category: yes · Data Warehouse Connector · Microsoft Power BI Desktop · Google Looker Studio · Snowflake · Tableau · Google BigQuery · Qlik · clicdata.com [S5]
- Data warehouse: Raw data can be imported into a data warehouse [S15]
- Data warehouse connector: yes [S1]
- Data warehouse connector: cloud · yes [S2]
- Data warehouse connector: Google BigQuery · Snowflake · yes [S7]
- Data warehouse connector official: Matomo · yes [S5]
- Download available: each integration listing offers Read more and Download links [S5]
- Ecommerce category: yes · WooCommerce (WordPress) · Adobe Commerce (Magento 2) · PrestaShop · BigCommerce · Shopify · shopware · OpenCart · Oxid esales [S5]
- Ga import: Google Analytics history import [S1]
- Ga import: yes [S2]
- Google analytics connect: import historical Google Analytics data · yes [S7]
- Google search console connect: import search keywords · yes [S7]
- Google tag manager connect: add Matomo tracking code via Google Tag Manager · yes [S7]
- Gtm serverside: Lucas Rollin · yes [S5]
- Integration count: WordPress · Google Tag Manager · 100+ [S1]
- Log import: yes [S2]
- Looker studio: export Matomo Cloud data to Looker Studio · yes [S7]
- Management APIs: websites · users · user privileges · custom dashboards · email reports · goals · funnels · custom dimensions · alerts · videos · heatmaps · session recordings · custom segments · yes [S15]
- Marketplace plugins: 100 [S2]
- Mcp: yes [S2]
- Mcp official: Matomo · yes [S5]
- Mobile sdks official: Matomo · yes [S5]
- Oauth2: yes [S2]

**Legal**
- Address: 7 Waterloo Quay PO625, 6140 Wellington, New Zealand [S7]
- DPA: yes [S6]
- DPA available: Cloud DPA document available [S1]
- DPA available: https://matomo.org/matomo-cloud-dpa/ [S7]
- DPA cloud: yes [S3]
- DPA part of tos: yes [S8]
- DPA version: 2025-10-09 · 3.0 [S8]
- Effective date: 2026-05-05 [S7]
- Entity: 6106769 · InnoCraft Limited · New Zealand [S7]
- Entity: InnoCraft Ltd · 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand [S8]
- Roles: data controller · data processor [S8]
- Transfer mechanisms: adequacy decision · EU standard contractual clauses [S7]

**Pricing**
- Annual discount: 2 months free [S6]
- Business monthly: 22 · EUR · yes · monthly [S6]
- Cloud includes: hosting · maintenance · automatic updates · security monitoring · daily backups · all features [S6]
- Data warehouse connector price: EUR · 5 [S6]
- Free trial: yes · 21 · no [S1]
- Free trial: yes · no [S6]
- Free trial cloud: yes · 21 [S3]
- Funnels availability: FAQ addresses where Funnels can be obtained [S11]
- Npo discount: non-profit organisations · yes [S6]
- Onpremise free download: yes [S4]
- Overage: 5000 · yes · 2.2 [S6]
- Plan change: yes · yes [S6]
- Transparency: tiered pricing, no hidden costs [S1]
- Trial no credit card: no [S3]

**Product**
- Ab testing personalisation: A/B testing & personalisation [S1]
- Access controls: Access controls [S1]
- Activity log audit: Activity Log for tracking changes to Matomo entities · yes [S13]
- Adaptive tracking: Cookie-based tracking with fallback to cookieless if consent not given [S14]
- Admin exclusions: yes · yes · yes [S2]
- Admin unlimited users sites: yes · yes [S2]
- AI tracking: yes [S2]
- AI traffic analytics: AI traffic sources, AI channel growth, Engagement, Human vs AI behaviour, Pages used by AI, AI search visibility [S1]
- All features included: all features included without hidden limits [S1]
- All plans included: eCommerce Tracking · Event Tracking · Content Tracking · Campaign Tracking · User Tracking · Site Search · Real-Time · Customisable Dashboard · Segmentation · Custom Logo · Tracking Spam Prevention · Row Evolution · Transitions · Overlay ·… [S6]
- Allowances: 150 · 100 · 30 · 30 · 100 · 30 · 24 months · Forever [S6]
- API access: yes [S4]
- API access control: Matomo interface and API data access restricted to authorised individuals [S13]
- API count: 4 [S15]
- Audit logs: Audit logs [S1]
- Auto archiving cron: more than a few hundred [S17]
- Automatic interactions: yes [S2]
- Campaign tracking: yes [S2]
- Cloud hosted option: Matomo Cloud pre-installed option available [S17]
- Cmp didomi cnil setting: Didomi offers a CNIL (France) configuration [S14]
- Cmp integration: CMP integration via Matomo tracking code or Matomo Tag Manager [S14]
- Cmp klaro optout: Klaro supports optOut: true to load Matomo before consent [S14]
- Cms integration guides: WordPress · Joomla · Webflow · Shopify · SquareSpace · Wix · GoDaddy Website Builder · Drupal · Jimdo [S17]
- Cniltag manager constraints: UserID tracking not permitted under CNIL exemption; tags must fire without consent-based triggers [S14]
- Consent based tracking: Cookieless or cookie-based tracking only after visitor consent [S14]
- Content tracking: yes [S2]
- Cookieless tracking: Cookieless tracking [S1]
- Cookieless tracking: yes [S14]
- Cookies: yes · yes [S2]
- Currencies: 100 [S2]
- Custom alerts: yes [S2]
- Custom dimensions: yes [S2]
- Custom reports: Matomo offers Custom Reports alongside the Events report [S12]
- Customisable dashboard: yes [S2]

**Subprocessors**
- Cloud disclosure: no · yes [S3]
- Helpscout: Help Scout, PBC · support request emails · USA [S7]
- Hubspot CRM: HubSpot, Inc. · CRM system · EU data hosting configured · yes [S7]
- Hubspot marketing: HubSpot, Inc. · marketing communications · EU data hosting configured [S7]
- List available: yes [S8]
- Listed URL: https://matomo.org/matomo-cloud-dpa/subprocessors [S7]
- Notification: yes · 30 · yes [S8]
- Paddle: Paddle Payments Limited · payments · UK and USA [S7]

**Support**
- Community paid: yes · yes [S2]
- Expert support: Matomo Experts support: setup, training, troubleshooting [S1]
- Free demo: free · yes [S1]
- GDPR resources: 10 [S3]
- Installation help: yes [S4]
- Privacy contact: privacy@matomo.org [S8]
- Privacy contacts: privacy@innocraft.com [S7]
- Resources: yes · yes · yes · yes · yes · yes [S2]
- Training videos: yes [S17]
- Troubleshooting guide: yes [S17]

183 more facts on the canonical page: https://whats-best.ai/software/web-analytics/matomo

## Questions

### Is Matomo European?

No. whats-best.ai classifies Matomo as Rest of world.

### Where does Matomo store data?

The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Europe as hosting location, per [the vendor’s page captured 29 Oct 2026](https://whats-best.ai/evidence/12331).

### Does Matomo have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

### What are the best alternatives to Matomo?

As of 4 Nov 2026, the panel rates [Piwik PRO Analytics Suite (3.5/5)](https://whats-best.ai/software/web-analytics/piwik-pro), [Pirsch Analytics (3.5/5)](https://whats-best.ai/software/web-analytics/pirsch) and [etracker Analytics (3/5)](https://whats-best.ai/software/web-analytics/etracker) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Piwik PRO Analytics Suite](https://whats-best.ai/software/web-analytics/piwik-pro) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Matomo alternatives](https://whats-best.ai/software/web-analytics/matomo/alternatives).

## Head-to-head

- [Matomo vs Piwik PRO Analytics Suite](https://whats-best.ai/compare/matomo-vs-piwik-pro.md)

## What this page leaves out

- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://matomo.org/ (checked 2026-10-29)
- [S2] Features page: https://matomo.org/features/ (checked 2026-10-29)
- [S3] Features page (GDPR and consent): https://matomo.org/gdpr-analytics/ (checked 2026-10-29)
- [S4] Features page (self-hosted edition): https://matomo.org/matomo-on-premise/ (checked 2026-10-29)
- [S5] Integrations page: https://matomo.org/integrate/ (checked 2026-10-29)
- [S6] Pricing page: https://matomo.org/pricing/ (checked 2026-10-29)
- [S7] Privacy policy: https://matomo.org/matomo-cloud-privacy-policy/ (checked 2026-10-29)
- [S8] Data processing agreement (dpa): https://matomo.org/matomo-cloud-dpa/ (checked 2026-10-29)
- [S9] Traffic, sources & campaign reports — found from sitemap: https://matomo.org/guide/reports/visitors/ (checked 2026-10-29)
- [S10] Traffic, sources & campaign reports — found from sitemap: https://matomo.org/guide/reports/real-time-reports/ (checked 2026-10-29)
- [S11] Goals, events, funnels & e-commerce — found from sitemap: https://matomo.org/docs/funnels/ (checked 2026-10-29)
- [S12] Goals, events, funnels & e-commerce — found from sitemap: https://matomo.org/docs/event-tracking/ (checked 2026-10-29)
- [S13] Consent-free operation & data minimisation — found from sitemap: https://matomo.org/faq/new-to-piwik/configure-matomo-analytics-for-tdddg-ttdsg-compliance/ (checked 2026-10-29)
- [S14] Consent-free operation & data minimisation — found from sitemap: https://matomo.org/faq/how-to/configure-cnil-exemption-opt-out-tracking-with-a-consent-manager-cmp/ (checked 2026-10-29)
- [S15] Data access, export & self-hosting — found from sitemap: https://matomo.org/matomo-api/ (checked 2026-10-29)
- [S16] Data access, export & self-hosting — found from sitemap: https://matomo.org/100-data-ownership/ (checked 2026-10-29)
- [S17] Installation, integrations & performance — found from sitemap: https://matomo.org/docs/installation/ (checked 2026-10-29)
- [S18] Installation, integrations & performance — found from sitemap: https://matomo.org/faq/how-to-install/set-up-a-tracker-proxy-on-your-domain/ (checked 2026-10-29)
- [S19] Security / trust page — found from the homepage: https://matomo.org/gdpr-timeline/ (checked 2026-11-01)
- [S20] Open-source licence page — found from the homepage: https://matomo.org/free-software/ (checked 2026-11-01)

---

Cite as: whats-best.ai, "Matomo — Web Analytics", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/web-analytics/matomo

Corrections: https://whats-best.ai/correct/1144?target=page