Web Analytics
Piano Analytics
EU origin, foreign-owned Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Applied Technologies Internet SAS · www.piano.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Piano Analytics at a glance
- Vendor
- Applied Technologies Internet SAS
- Headquarters
- Not stated on the vendor’s pages as of 29 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 29 Oct 2026
- Panel verdict
- The AI panel rates Piano Analytics 3/5, the mean of 6 judges. Piano Analytics is the web analytics suite of Applied Technologies Internet SAS, a French company controlled by Piano Software Inc. how scores are made
- As of
- Vendor pages captured 29 Oct 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Piano Analytics is the web analytics suite of Applied Technologies Internet SAS, a French company controlled by Piano Software Inc. of Philadelphia. Traffic reporting is the strongest criterion, sitting at 6: the documentation covers organic sources including a generative-AI source, UTM or Piano nomenclature, configurable source priority, CSV URL-list import, and an attribution module for comparing models. Conversions and events lands at 5-6 on the strength of the funnel module. Consent and privacy splits 5 to 6 — two judges credit the unusually granular anonymisation documentation, four hold at 5 because counting rests on cookies and terminal IDs, IP truncation is optional, and judges found no public information on a consent-free mode. Sovereignty and data ownership score 6-7, on published transfer safeguards and a thirty-day termination download window, though listed hosting regions span EU, USA and Japan and residency is not confirmed on the vendor's pages. Implementation is the weak spot, sitting at 4. Pricing transparency scores 1-2 and is not counted; persona-weighted verdicts range 5.4 to 5.8.
Speaks for it
- Traffic-source documentation runs deep — organic sources including a generative-AI source, UTM or Piano nomenclature, configurable source priority and CSV-importable URL lists
- Funnel module supports per-step filters, breakdowns, segments, visit/visitor/user scopes, drop-off and execution times per step
- Anonymisation is documented per data type, with hashed terminal IDs standard and IP truncation, visitor-ID masking and property emptying as options
- Transfer chain is published — EDPB-approved binding corporate rules, standard contractual clauses, a GDPR Article 28 DPA, ISO/IEC 27001:2022 and a subprocessor list with locations
- Exit terms are fixed by contract, with a thirty-day download window after termination and deletion of all data at contract end
Held against it
- Implementation scores a flat 4: the documented path is JavaScript tagging libraries and native-app SDKs, with no public information on plugins for named CMS or shop systems, script size or single sign-on
- We found no public information on e-commerce tracking of orders, revenue or products, or on conversions sent back to ad platforms
- We found no public information on the everyday dashboard layer — real-time views, date comparisons, country and device reports or shared dashboards
- Counting is documented to rely on cookies, mobile IDs and web beacons, with IP truncation offered as an option rather than a default
- The analytics stack's listed hosting regions span EU, USA and Japan, and where a given customer's visitor data resides is not confirmed on the vendor's pages
Best for
- You need deep traffic-source and campaign analysis — configurable sources, UTM compatibility and an attribution module to compare models beyond the default last touch
- Your procurement or privacy review requires published transfer documentation — an Article 28 DPA, EDPB-approved binding corporate rules, SCCs and ISO/IEC 27001:2022 — with EU contracting entities available
- You want firm exit terms and raw data in your own warehouse — a thirty-day download window after termination, deletion at contract end, and Data Flow export to FTP/SFTP or Amazon S3
- You measure conversions through events and funnels rather than e-commerce transactions
Avoid if
- You need counting that runs without cookies or a consent banner — the documented collection uses cookies, mobile IDs and web beacons, and IP truncation is an option
- You require confirmed EU residency for visitor data — the analytics stack's listed hosting regions include the USA and Japan, and residency is not confirmed on the vendor's own pages
- You must compute an annual cost before a sales conversation — ask the vendor: the public pages we read do not show it
- Your team expects prebuilt plugins for named CMS or shop systems — the documented installation path is JavaScript tagging libraries and native-app SDKs
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 3 of 5 |
| Goals, events, funnels & e-commerce | 3 of 5 |
| Consent-free operation & data minimisation | 2.5 of 5 |
| Data access, export & self-hosting | 3 of 5 |
| Installation, integrations & performance | 2 of 5 |
| European sovereignty | 3 of 5 |
Traffic, sources & campaign reports
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
Campaign and source reporting is documented in real depth: organic and marketing sources are distinguished, I can choose between Piano's own and UTM parameter nomenclature, add my own traffic sources with configurable priority order and custom campaign properties, import URL lists from CSV, and even see a generative-AI source alongside search engines and social. Dashboards and query results can be scheduled by email or FTP; what the captured pages do not describe is real-time views, date comparison, device and country breakdowns, or shared dashboards, so it sits above the middle but not at the reporting-suite level. 8 9 11 14
The Data Protection Officer
The traffic-source machinery is documented in real depth: six organic source types including a generative-AI source, campaigns read in both the Piano and UTM nomenclatures with custom parameters, configurable source priority, custom sources with up to ten conditions each, CSV import of URL lists, configuration per site group, and an attribution module that compares models on top of last-touch. For the standard report suite — pages, countries, devices, a real-time view, date comparison and shared dashboards — we found no public information on the captured pages, so the score sits between the middle and upper levels. 8 14
The Agency Developer
Campaign and source reporting is the deepest part of what I can see: UTM or Piano's own tracking parameters, configurable source priority, custom sources, URL lists with CSV import, a Generative AI source, and an attribution module in Explorer to compare models. But for the day-to-day client reports I found no public information on dashboards, countries, devices, a real-time view or date comparisons, so it lands mid-table despite the strong source engine. 8 9 14 11
The Growth Analyst
The campaign and source layer is genuinely deep: tagging with at_ or UTM_ nomenclature, six default organic sources including a Generative AI source, configurable source priority, custom sources, URL lists importable by CSV, configuration per site group, and an attribution module that compares models without altering the raw data. What I cannot credit is the everyday dashboard: we found no public information on page views and top pages over time, entry and exit pages, countries, devices, a real-time view, or date comparisons. 8 11 14
The Public-Sector Site Owner
The traffic-sources documentation is unusually detailed — campaigns via UTM or Piano's own at_ parameters with selectable nomenclature, configurable organic sources with priority ordering and importable URL lists, custom campaign properties, and configuration per site group — plus scheduled e-mail or FTP exports and segments applied to funnels. We found no public information on the reporting dashboards themselves: page-level reporting, real-time views, date comparisons, country and device breakdowns, or roll-up across sites. 8 11 14
The Skeptic
Traffic-source documentation is genuinely deep — seven organic source types including a generative-AI source, configurable detection priority, custom sources and CSV-imported URL lists, UTM-compatible campaign tagging, and an Explorer module that compares attribution models — with dashboards and scheduled PDF, e-mail or FTP exports behind it. But we found no public information on the captured pages about a real-time view, date comparisons, country or device reports, or whether reports are sampled. 8 14 11
Goals, events, funnels & e-commerce
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Funnels are properly documented — drop-off per step with converted and outgoing visits, average and maximum completion times, breakdowns by property, segments, and Visit, Visitor or User scope — and an attribution module in Explorer compares models beyond the default last touch. But for a shop like mine the gaps matter: the captured pages show conversion metrics without any order, revenue or product tracking, name no plugin for Shopware or any other shop system, and say only generically that integrations can push data to partner solutions, with nothing on sending conversions back to Google Ads or Meta. 10 11 8 16
The Data Protection Officer
Goal types are configurable by tagging or by processing rules, with conversion, secondary-conversion and converted-visit metrics, content properties propagated to conversion events, and a funnel engine offering visit, visitor and user scopes, per-step filters, breakdowns, segments and step-level execution times; an Explorer module compares attribution models. We found no public information on e-commerce tracking of orders, revenue and products, on outbound links, downloads, forms or scroll depth, or on conversions sent back to ad platforms, so the score rests just above the middle level. 8 10 11
The Agency Developer
Funnels are genuinely strong — steps on any events with filters, breakdowns, segments, Visit/Visitor/User scopes and drop-off per step — and conversions run through configurable goal types with campaign attribution behind them. I found no public information on e-commerce tracking of orders and revenue, cohorts, or sending conversions back to ad platforms, which caps it for my Shopify clients. 10 11 8
The Growth Analyst
Funnels are close to product-analytics grade: any event sequence with per-step filters, breakdowns by property, segments, visit/visitor/user scopes, drop-off and execution times per step, and the API call retrievable for each funnel, alongside goal types with conversion rate and converted-visit metrics and model comparison in the Explorer module. We found no public information on e-commerce tracking of orders and revenue, cohort and retention reports, or conversions sent back to ad platforms — exactly the click-to-invoice chain I need before signing anything. 10 11 8
The Public-Sector Site Owner
Conversions are configured through goal types and event properties, and the funnel module is genuinely thorough: step-level drop-off with converted and outgoing visits and execution times, breakdowns by property, segments, and visit, visitor or user scopes, with an attribution module that compares different models against the Last Touch default. We found no public information on e-commerce tracking of orders and revenue, outbound link or download tracking, or cohorts and retention. 8 10 11
The Skeptic
Goal types can be defined on events or via processing rules, conversion metrics are documented, and the funnel tool is the strongest part — multi-event steps with filters, per-step drop-off and timing, visit/visitor/user scopes, breakdowns and segments — alongside a published Last Touch model and a module to compare attribution models. We found no public information on e-commerce tracking, revenue, cohorts, or conversions passed back to ad platforms, which is why the score cannot go higher. 10 11 8
Consent-free operation & data minimisation
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
The data-minimisation documentation is thorough: hashed terminal IDs as standard, IP truncation and visitor ID masking as options, property emptying, opt-out traffic aggregated under a single visitor value, nulling for erasure requests, an Extended opt-out consent mode, and customisable retention with 25 months standard for Analytics. But counting still rests on cookie-based terminal IDs, and I found no public information on a cookieless counting mode, a stated position against German or French consent law, or wording I could drop into my privacy policy. 13 6 5 12
The Data Protection Officer
The anonymisation documentation is granular and mostly standard: terminal identifiers hashed, opt-out traffic aggregated under one visitor value, values nulled for erasure requests, GPS coordinates rounded, and IP truncation, property emptying and visitor-ID masking available as options, with a 25-month customisable retention and deletion at contract end. The product is however documented to run on cookies, mobile IDs and web beacons, IP anonymisation is an option rather than a default, and we found no public information on a cookieless mode, the vendor's reading of §25 TDDDG or the CNIL exemption, or wording for the site's privacy policy. 6 13
The Agency Developer
The data-minimisation documentation is unusually granular: hashed terminal IDs by standard, IP truncation and visitor-ID masking as options, per-property anonymisation, opt-out traffic aggregated under one identifier, a "Contains personal data" flag and a customisable 25-month retention. What I miss for client sign-offs is the legal position — the pages cite GDPR articles but I found no public information on a stated reading against named consent law or an audited consent-free mode, and the trackers list shows cookies and mobile IDs in standard use. 13 12 6 5
The Growth Analyst
The anonymisation programme is well documented: standard hashing of terminal IDs, optional IP truncation and visitor ID masking, GPS rounding, opt-out traffic aggregated under a single visitor ID, a "Contains personal data" flag, property emptying, right-to-be-forgotten nulling, and an Extended opt-out consent mode with configurable 25-month retention. The counting rests on cookies and terminal IDs though, and we found no public information on a consent-free mode, the vendor's position against named law such as §25 TDDDG, or guidance on when a banner is required. 13 6 5
The Public-Sector Site Owner
For a council that will not show a cookie banner this is the decisive question, and the captured pages do not settle it: collection works with cookies and mobile identifiers, though identifiers are hashed by default, opt-out traffic is aggregated under a single visitor value, and IP truncation, visitor-ID masking and property emptying are offered as options. Retention is configurable (25 months standard, everything deleted at contract end) and consent management including an extended opt-out mode exists. We found no public information on a consent-free mode, a position against §25 TDDDG or the CNIL exemption, or wording for the privacy policy. 5 6 13
The Skeptic
Cookies and related trackers are the documented collection method, with identification via a hashed terminal ID; IP truncation exists only as an option, retention is 25 months and customisable with deletion at contract end, and an "Extended opt-out" consent mode aggregates refusers under a single visitor ID. The per-data-type anonymisation documentation is more detailed than most vendors publish, but we found no public information stating the consent position against named law, citing an external audit, or supplying privacy-policy wording — and with IP anonymisation optional rather than standard, a banner-free deployment is not what these pages describe. 6 13 5
Data access, export & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
Raw data can leave through Data Flow or Data Sharing to FTP, SFTP or Amazon S3 on a daily or weekly schedule, and on termination my data is downloadable for thirty days and then deleted — a clean exit I value. Data Flow, however, requires a separate option subscription, the documented dashboard exports are PDF rather than CSV of every report, the reporting API is only visible indirectly through a funnel's API-call button, and the service is contracted as hosted SaaS with no self-hosted edition described. 14 15 8 7 6
The Data Protection Officer
Raw data leaves the platform through Data Flow or Data Sharing — Data Flow requires a subscribed option — and dashboards and data queries export on a schedule by e-mail, FTP/SFTP or Amazon S3; the contract grants a thirty-day download window after termination and data is deleted at the end of the relationship. We found no public information on a general reporting API, sampling behaviour, historical import from Google Analytics, or a self-hosted edition — the service is documented as hosted SaaS. 7 8 14 15
The Agency Developer
Raw data leaves the platform through a Data Flow export to FTP/SFTP or Amazon S3 and via Data Sharing, the funnel module exposes its API call, and the terms promise a download file within thirty days of termination with data deleted at contract end — exactly the exit terms I look for. I found no public information on a self-hosted edition, a statement on sampling, or an import of historical Google Analytics data. 14 15 8 7 6
The Growth Analyst
Raw data can leave the platform through Data Flow exports to FTP, SFTP or Amazon S3 on a daily schedule — the basis for rebuilding our history in a warehouse — with a Data Sharing channel named for the same purpose, query API calls retrievable per report, a 30-day download window after termination and deletion at contract end. The Data Flow capability requires a subscription to a separate option, and we found no public information on a self-hosted edition, an import of historical Google Analytics data, or a statement on sampling. 14 15 8 7 6
The Public-Sector Site Owner
Raw data can be exported via a Data Flow option and scheduled exports go out by e-mail, FTP/SFTP or Amazon S3; the 25-month retention is stated and customisable, and on termination a thirty-day download window is fixed by contract with deletion afterwards. We found no public information on a self-hosted edition, on whether reports are sampled, or on importing historical data from Google Analytics or another tool. 7 8 14
The Skeptic
Raw data is retrievable — but only through the separately subscribed "Data Flow" option — with FTP/SFTP or Amazon S3 delivery, and termination terms are explicit: a 30-day download window after which the vendor has no obligation to maintain the data, plus deletion at contract end. The captured pages describe a hosted SaaS only; we found no public information on an open-source or self-hosted edition, a documented reporting API, or import of historical data. 7 14 8 6
Installation, integrations & performance
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Collection runs through JavaScript tagging libraries on the web and SDKs for native applications, server-to-server requests are listed among the collection technologies, and there is a documented Google Tag Manager template for the SDK. Beyond a generic partner directory of validated push and import connectors, I found no public information on plugins or set-up guides for named shop systems like my Shopware, on script size, single-page apps, team roles or a status page. 6 16 17
The Data Protection Officer
Collection is documented as JavaScript tagging libraries and SDKs for native applications, alongside an integrations framework whose connectors push data to or import data from partner solutions across three partnership categories; a Google Tag Manager template page exists in the documentation. We found no public information on script size, plugins or guides for named CMS and shop systems, single-page-app support, team roles and permissions, single sign-on, or a public status page. 6 16 17
The Agency Developer
For my install workflow the picture is thin: JavaScript tagging and native SDKs are documented, a Google Tag Manager template page exists, and there is a validated partner programme with connectors that push or import data. I found no public information on plugins for WordPress, TYPO3 or Shopify, script size or loading, an own tracking domain against ad blockers, client logins with roles, or a status page. 16 17 6
The Growth Analyst
Collection is documented as JavaScript tagging libraries with SDKs for native applications, there is a Google Tag Manager template for the SDK, and a validated partner-integration framework supports pushing data to and importing from partner solutions. We found no public information on plugins for named CMS or shop systems, single-page app handling, script size or performance impact, team roles or single sign-on; an SLA document is referenced in the terms but no status page with uptime history is shown. 6 16 17 7
The Public-Sector Site Owner
Collection runs through JavaScript tagging libraries and SDKs for native apps, server-to-server requests are listed among the collection methods, a Google Tag Manager template is documented, and partner connectors are catalogued with validated partnership categories. We found no public information on script size and loading, plugins for named CMS systems, single-page app support, team roles or single sign-on. 6 16 17
The Skeptic
JavaScript tagging libraries and native-app SDKs are documented, a Google Tag Manager template page exists in the captured documentation, integrations are organised as validated partner connectors, and a public SLA document is referenced. We found no public information on script size, plugins or guides for named CMS or shop systems, single-page-app support, team roles or single sign-on. 6 17 16 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
The product comes from the French company AT Internet, contracts can run through Piano Software GmbH in Berlin or the French entity, and the chain is unusually well published: AWS and Snowflake are named for Analytics with EU among the hosting regions, shared services like Zendesk and Salesforce are listed with locations, and there is a public Article 28 DPA, ISO 27001:2022, and EDPB-approved binding corporate rules plus standard contractual clauses. What holds it back is that the group is controlled by Piano Software Inc. of Philadelphia, the data chain rests on US providers, and where my visitors' data is actually stored was not confirmed on the vendor's captured pages. 6 7 5
The Data Protection Officer
Subprocessors are listed with their locations — AWS and Snowflake carry analytics across EU, USA and Japan, Hetzner in Germany, plus Stripe, Salesforce, Zendesk and others for shared services — a data processing agreement is published, ISO/IEC 27001:2022 is stated, and transfers are covered by EDPB-approved binding corporate rules and standard clauses, with EU contracting entities including Applied Technologies Internet SAS in France. The parent is Piano Software Inc. of Philadelphia, and we found no public information confirming where visitor data is hosted by default, so the chain includes US providers under stated safeguards rather than a documented European residency. 5 6 7
The Agency Developer
The chain is documented unusually openly: contracting can run through the French, German or Norwegian entities, subprocessors are listed with their locations, safeguards are stated (EDPB-approved Binding Corporate Rules, standard contractual clauses, CISPE), and ISO 27001:2022 is published. But the group is controlled from Philadelphia, and the hosting regions shown for the analytics stack include the USA and Japan alongside the EU, so I cannot confirm visitor data stays in Europe. 6 7 5
The Growth Analyst
The chain is disclosed in unusual detail: Piano Analytics runs on AWS and Snowflake with EU hosting regions listed, contracting can run through Applied Technologies Internet SAS in France or Piano Software GmbH in Berlin, transfers are covered by EDPB-approved Binding Corporate Rules and SCCs, AWS carries the CISPE code, and ISO/IEC 27001:2022 is stated. The group is nonetheless controlled by Piano Software Inc. of Philadelphia, support, CRM and payment tools such as Zendesk, Salesforce and Stripe are US-headquartered, and we found no confirmation on the vendor's own pages of where analytics data is actually stored. 6 7 5
The Public-Sector Site Owner
Procurement could contract with Applied Technologies Internet SAS in France or Piano Software GmbH in Berlin, the subprocessor list is unusually open — AWS and Snowflake carry the analytics chain with EU regions shown, alongside Zendesk, Salesforce and Stripe — and transfers are covered by EDPB-approved binding corporate rules, a published DPA and ISO 27001:2022. The group answers to Piano Software Inc. in Philadelphia, however, and we found no public information confirming where analytics data is stored, nor on a self-hosted edition that would keep records on our own municipal servers. 5 6 7
The Skeptic
The chain is unusually well documented — a published Article 28 DPA, EDPB-approved binding corporate rules, SCCs, ISO 27001:2022, and a subprocessor list with locations — and EU contracting entities including the French developer are available. But the parent is a US company, payments run through Stripe and support through Zendesk, and the listed hosting regions for the analytics stack span EU, USA and Japan, so where a given customer's visitor data actually resides is not confirmed on the captured pages, and the captured pages describe a hosted SaaS with no self-hosted alternative. 6 7 5
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
I found no public price on any captured page: no tiers, no free edition, no per-traffic scaling — fees sit in per-customer schedules and order forms, payable in USD by default, non-cancelable, with an annual increase of the greater of seven percent (7%) or CPI and late fees at one and one-half percent (1.5%) per month. The only cost structure visible is that raw data export requires a separately subscribed Data Flow option at an unstated price, so I cannot begin to compute my annual cost before a sales conversation. 7 14
The Data Protection Officer
We found no price figure on the captured pages: fees are set in the order form or Schedule, payable in USD by default within thirty days, with an annual escalator of the greater of seven percent or CPI, late fees of one and a half percent per month compounded daily, taxes excluded, and fees non-cancelable and non-refundable. The Data Flow export requires a subscribed option whose cost we found no public information on, so a buyer cannot compute an annual cost from public pages. 7 14
The Agency Developer
No public prices on any page I read — fees live in a per-order software schedule payable in USD, with a minimum seven percent annual increase, non-cancelable and non-refundable terms, taxes excluded, and the Data Flow export behind a separately subscribed option. For an agency quoting forty client sites, that is a negotiation and a contract, not a price list I can plan around. 7 14
The Growth Analyst
We found no public information on tier prices, traffic bands, site or user limits, or a free tier — the path shown is a demo request plus a negotiated contract. The contract mechanics are published (USD default currency, 30-day payment terms, annual increases of at least "seven percent (7%)", late fees of "one and one-half percent (1.5%) per month", non-cancelable fees), and the raw Data Flow export is a separately subscribed option with no stated price, so a buyer cannot compute an annual cost from the public pages alone. 7 14 2
The Public-Sector Site Owner
The contract terms publish the mechanics — fees in USD by default, thirty days to pay, annual increases of the greater of seven percent or CPI, late fees of one and one-half percent per month, taxes excluded, non-cancelable fees — but we found no public prices, no tiers, no traffic bands and no free tier on these pages, and the Data Flow export is only flagged as a separately subscribed option. No buyer can compute an annual cost from what is published. 7 14
The Skeptic
We found no price figures on the captured pages; tiers and amounts live in negotiated Schedules, the raw-data export is a separate subscription, and at least one feature activates only on request to the support centre. What is public is contractual mechanics: fees "payable in USD unless another currency is specified", payment within thirty days of invoice, late fees of one and one-half percent per month compounded daily, and annual increases of the greater of seven percent or the CPI increase on non-cancelable, non-refundable fees — a buyer cannot compute an annual cost from these pages. 7 14 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Piano Analytics
Is Piano Analytics European?
Partly. whats-best.ai classifies Piano Analytics as EU origin, foreign-owned.
Where does Piano Analytics store data?
Not stated on the vendor’s pages as of 29 Oct 2026.
Does Piano Analytics have a free plan?
Not stated on the vendor’s pages as of 29 Oct 2026.
What are the best alternatives to Piano Analytics?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Piano Analytics alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Legal entity, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 41 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (analytics product) www.piano.io Checked 29 Oct 2026 Details →
- 2 Features page (data management) www.piano.io Checked 29 Oct 2026 Details →
- 3 Features page (data sources) www.piano.io Checked 29 Oct 2026 Details →
- 4 Security / trust page (compliance) www.piano.io Checked 29 Oct 2026 Details →
- 5 Documentation (compliance centre) docs.piano.io Checked 29 Oct 2026 Details →
- 6 Privacy policy www.piano.io Checked 29 Oct 2026 Details →
- 7 Terms of service and data processing agreement (dpa) www.piano.io Checked 29 Oct 2026 Details →
- 8 Traffic, sources & campaign reports — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 9 Traffic, sources & campaign reports — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 10 Goals, events, funnels & e-commerce — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 11 Goals, events, funnels & e-commerce — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 12 Consent-free operation & data minimisation — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 13 Consent-free operation & data minimisation — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 14 Data access, export & self-hosting — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 15 Data access, export & self-hosting — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 16 Installation, integrations & performance — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →
- 17 Installation, integrations & performance — found from sitemap docs.piano.io Checked 29 Oct 2026 Details →