Web Analytics
Umami
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Umami Software, Inc. · umami.is
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Umami at a glance
- Vendor
- Umami Software, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Umami 2.5/5, the mean of 6 judges. Umami is an open-source web analytics platform, self-hosted or as Umami Cloud, from Umami Software, Inc., a US corporation under Delaware law. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Umami is an open-source web analytics platform, self-hosted or as Umami Cloud, from Umami Software, Inc., a US corporation under Delaware law. One judge, the data protection officer, recorded zero on every criterion; the remaining scores are strongest on data ownership, at 7-8, and pricing transparency, where five judges scored 7 — the open-source edition is documented as giving complete control over where the software runs and where its data is stored, and every cloud tier is public: Hobby at $0 / month with up to 100K events, Pro at $20 / month with 1 million events and $0.00003 per additional event, Business at $200 / month with 10 million events and $0.00002 per additional event. Implementation is the weakest criterion at 4-5, with no public information found on script size, CMS and shop-system plugins, or mobile SDKs. The splits are sovereignty at 6-8 — judges crediting the self-hosted route score above those weighing the US-dominated cloud subprocessor chain — and consent and privacy at 5-7, over the absence of a stated legal position for the cookieless mode.
Speaks for it
- Every cloud tier is public with its event volume and overage rule — Hobby $0 / month up to 100K events, Pro $20 / month with 1 million events and $0.00003 per additional event, Business $200 / month with 10 million events and $0.00002 per additional event — with website, team-member and retention limits listed per tier
- The open-source edition runs self-hosted, documented as giving complete control over where the software runs and where its data is stored
- Counting is cookieless by an anonymous session identifier, with IP addresses not stored in analytics records and only processed transiently
- The API is documented as exposing any operation available in the application, for cloud and self-hosted instances alike, with a streaming API on Business
- Funnels report visitors, conversion rate and drop-off at each step, with goals, journeys, cohorts and retention included on all plans
Held against it
- Implementation scores top out at 5, with no public information on script size, plugins for named CMS or shop systems, single-page-app or mobile SDK support, or a public status page
- We found no public information on order-level e-commerce tracking with shop-system plugins, or on conversions sent back to Google Ads or Meta
- The cloud path is a US corporation under Delaware law with a published subprocessor list dominated by US providers, Hetzner the only EU entry, and cloud data residency not confirmed on the captured pages
- The security page states ISO 27001 and SOC 2 are not currently certified and an independent penetration test is not yet completed
- We found no public information stating the cookieless mode's position against named law such as §25 TDDDG or the CNIL exemption, nor vendor-supplied wording for a site's privacy policy
Best for
- You run a public-facing site and want banner-free, cookieless traffic and funnel reporting your editors can use directly
- You can self-host the open-source edition and want every visitor record on infrastructure you control, outside the cloud subprocessor chain
- You want to compute analytics costs in advance from published tiers and per-event overage prices
- Your conversion questions are signups, form submissions and funnels rather than order-level e-commerce
Avoid if
- You need order-level e-commerce tracking of products, carts and orders with shop-system plugins, and conversions sent back to Google Ads or Meta — we found no public information on these
- Your deployment depends on named CMS plugins, mobile SDKs or single-page-app guidance — we found no public information on any of these
- Your procurement requires ISO 27001 or SOC 2 certification or a completed independent penetration test, which the vendor states it does not currently hold
- You must use the cloud service under an EU contracting entity and EU subprocessors — the contracting entity is a US corporation under Delaware law and the published subprocessor list is dominated by US providers
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 3 of 5 |
| Goals, events, funnels & e-commerce | 3 of 5 |
| Consent-free operation & data minimisation | 3 of 5 |
| Data access, export & self-hosting | 3.5 of 5 |
| Installation, integrations & performance | 2 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Traffic, sources & campaign reports
panel disagrees
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
The dashboard shows pageviews, visitors, bounce rate and average visit time with filters by country and device, breakdowns by referrer, path, country, device and UTM source, realtime events, email reports, custom dashboards, a period-over-period compare view, and saved segments and cohorts that apply to other reports. That covers my daily campaign check; I found no public information on roll-up reporting across sites, annotations, or a configurable channel grouping. 1 2 4 9
The Data Protection Officer
Pages, referrers, countries, devices and UTM-tagged campaigns appear as breakdowns on a dashboard of pageviews, visitors, bounce rate and average visit time, with a realtime view, email reports, custom dashboards, and a Compare insight overlaying two periods. Segments and cohorts can be saved and applied to other reports. We found no public information on configurable channel grouping, roll-up reporting across several sites, or whether reports are sampled. 1 2 4 9
The Agency Developer
The dashboard covers pages, referrers, countries, devices and UTM campaigns, plus a realtime view, period-over-period comparison, custom dashboards, email reports and new-versus-returning visitors, and I can save segments and cohorts and apply them across reports — that carries my weekly client reporting. We found no public information on shared or public dashboards for client logins, roll-up reporting across several sites, or whether reports are sampled. 1 2 4 9
The Growth Analyst
The dashboard covers pages, referrers, countries, devices and UTM-tagged campaigns, with a real-time view, period-over-period comparison, saved segments and cohorts, custom dashboards, email reports and multi-site handling (up to 20 websites on Pro, unlimited on Business). We found no public information on roll-up reporting, annotations, configurable channel grouping, or ad platform and Search Console data shown beside the traffic, so this sits between a solid standard dashboard and full organisational reporting. 1 2 4 9
The Public-Sector Site Owner
The dashboard covers pageviews, visitors, bounce rate and average visit time, with referrer, path, country, device and campaign breakdowns, a compare view across two periods, realtime events, saved segments, custom dashboards and email reports — enough for our editors to see which service pages residents actually use. We found no public information on roll-up reporting across several sites, annotations, or whether reports are sampled. 1 2 4 9
The Skeptic
The captured pages document a dashboard with pageviews, visitors, bounce rate and average visit time, breakdowns by referrer, path, country, device and UTM source, a two-period Compare view, realtime events, saved segments and cohorts applied to reports, custom dashboards and email reports. We found no public information on dashboards shared with clients or colleagues, configurable channel grouping, roll-up reporting across sites, annotations, or whether reports are sampled. 1 2 4 9
Goals, events, funnels & e-commerce
panel disagrees
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
Goals, custom events with properties, funnels reporting conversion rate and drop-off at each step, cohorts and retention, journey reports and revenue tied to event amounts are all documented, with attribution and revenue among the listed reports. What decides it for me: I found no public information on full e-commerce tracking of products, carts and orders with plugins for named shop systems, nor on conversions being sent back to Google Ads or Meta server to server — the two things my campaign reporting lives on. 1 2 4
The Data Protection Officer
Goals on a page or event, custom events with properties, funnels with conversion rate and drop-off per step inside a set time window, revenue tied to events, journeys of three to seven steps, cohorts, retention and attribution are all documented. We found no public information on full e-commerce tracking with plugins for named shop systems, side-by-side attribution models, or conversion data passed back to ad platforms. 1 2 4 9
The Agency Developer
Goals, custom events with properties via a data attribute or a track call, funnels with conversion rate and drop-off per step, revenue tied to dollar amounts, user journeys, cohorts and retention are all documented, with attribution listed among the reports. We found no public information on order-level e-commerce with plugins for named shop systems, compared attribution models, or conversions sent back to ad platforms. 1 2 4 9
The Growth Analyst
Custom events with properties, goals, funnels with per-step drop-off and time windows, journeys, retention and cohorts are included on every plan, revenue can be tied to dollar amounts on events, conversions break down by UTM source, and distinct IDs connect a logged-in user's sessions — that covers most of my click-to-signup-to-invoice funnel. We found no public information on shop-system e-commerce tracking, compared attribution models, or conversions sent back to Google Ads or Meta server to server, which is where the campaign loop closes. 1 2 4 9
The Public-Sector Site Owner
Custom events with properties, goals, funnels reporting visitors, conversion rate and drop-off at each step, revenue tied to events, user journeys of three to seven steps, cohorts and retention are all documented — the funnel report is precisely what we need to find where vehicle-registration and daycare forms are abandoned. We found no public information on e-commerce suite tracking, comparative attribution models, or conversion export to advertising platforms. 1 2 4 9
The Skeptic
Goals, custom events with properties via a data attribute or umami.track(), funnels with per-step conversion and drop-off, journeys of three to seven steps, cohorts, retention and revenue tied to dollar amounts on events are all documented, with attribution named in the feature list. We found no public information on plugins for named shop systems, compared attribution models, conversion data sent back to ad platforms, or order- and product-level e-commerce tracking. 1 2 4
Consent-free operation & data minimisation
panel disagrees
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
Cookieless counting with an anonymous session identifier, no cross-site tracking, no use for advertising and no data sale are stated, and the privacy policy says IP addresses are not stored in analytics records, only processed transiently to deliver requests, calculate identifiers and derive approximate location. I found no public information on a stated position against named law such as §25 TDDDG or the CNIL exemption on when a banner is required, and beyond an owner-enabled Do Not Track setting on the tracker I found no described visitor opt-out. 1 2 5 8
The Data Protection Officer
The pages document a cookieless default where visitors are counted by an anonymous session identifier, IP addresses are processed only transiently and not stored as fields in analytics records (operational logs keep them separately), with no cross-site tracking, no advertising use, an owner-enabled do-not-track option in the tracker, session replays disabled and masked by default, and retention set per plan. GDPR and PECR are named in the marketing claims, but we found no public information on a written reading of the German telemedia provision or the CNIL exemption, a consent mode for distinct IDs or session replay, or wording the vendor supplies for the site's privacy policy. 1 2 4 5 8
The Agency Developer
Cookieless operation is the default and the counting method is published — an anonymous session identifier, IP addresses processed transiently and never stored in analytics records, no cross-site tracking, no advertising use and no sale of data — with an optional Do-Not-Track setting on the tracker and retention tied to the plan. We found no public information on a consent position stated against named law such as §25 TDDDG or the CNIL exemption, or supplied wording for a site's privacy policy. 1 2 5 8
The Growth Analyst
Cookieless by default with the counting method stated (an anonymous session identifier, so a device or browser switch reads as a new visitor), no cross-site tracking, no use for advertising, IP addresses not stored as fields in analytics records, an optional do-not-track setting in the tracker, and session replays off by default with input masking. The pages claim GDPR, CCPA and PECR support from day one, but we found no public information positioning the mode against named law such as §25 TDDDG or the CNIL exemption, no legal opinion, and no guidance on when a banner is required. 1 2 5 8
The Public-Sector Site Owner
Cookieless by default with an anonymous session identifier, IP addresses not stored in analytics records but processed transiently, no cross-site tracking, no advertising use of the data, an optional do-not-track setting in the tracker, and the statement that nothing personally identifiable is stored — that supports a banner-free public service site. We found no public information on a stated position against German law or the data protection authorities' rulings, wording for our privacy policy, or an external audit of the consent-free mode; the vendor states it has not completed an independent penetration test. 1 2 5 8
The Skeptic
Cookieless operation is documented with the counting method stated — an anonymous session identifier, with the vendor plainly noting a person switching device or browser appears as a new visitor — and IP addresses are not stored in analytics records, only processed transiently; no cross-site tracking, advertising use or data sale is claimed, session replay is disabled by default with inputs masked, and an optional tracker-level Do Not Track setting exists. We found no public information stating the consent position against named law such as §25 TDDDG or the CNIL exemption, no cited legal opinion or external audit of the consent-free mode, and no supplied wording for a site's privacy policy. 1 2 5 8
Data access, export & self-hosting
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
The API is documented as covering any operation the application offers, with endpoints for both the cloud and a self-hosted instance, the open-source platform can be run on my own infrastructure with complete control over where data is stored, and the DPA promises deletion or return of personal data on termination. I found no public information on CSV export of reports, an import of historical data, or raw export to a named warehouse or BI tool. 1 3 6 8
The Data Protection Officer
A documented API covers every operation the application offers, on the cloud and on self-hosted instances alike, and the open-source edition runs self-hosted with stated control over where data is stored; the published data processing agreement commits to deleting or returning data on termination, and retention periods are stated per plan. We found no public information on CSV export of reports, a raw event export to a named warehouse or BI tool, or import of historical data from Google Analytics. 1 3 4 6 8
The Agency Developer
The open-source edition runs self-hosted on our own infrastructure with its own API endpoints and documentation, the API exposes everything the application can do, termination terms state data is deleted or returned, and event retention is stated per plan with a streaming API on the Business tier. We found no public information on CSV export of reports or a raw export to a named warehouse or BI tool, and the open-source licence is not named. 1 3 4 6 8
The Growth Analyst
The open-source edition runs self-hosted with feature gates by version, the API exposes any operation the application can do (cloud and self-hosted endpoints documented), Business adds a streaming API, retention per tier is published, and the DPA promises deletion or return of data on termination. For a nightly raw feed into my warehouse this is close but not complete: we found no public information on a named warehouse or BI destination, CSV export of every report, an import of historical Google Analytics data, or the licence under which the code is published. 1 2 3 4 6 8
The Public-Sector Site Owner
The open-source platform can be self-hosted on our own infrastructure with complete control over where the data is stored, a documented API exposes everything the application can do for cloud and self-hosted instances alike, retention limits are stated per tier, and the data processing agreement promises deletion or return of data at termination. We found no public information on CSV export of reports, an import of historical data from another analytics tool, or streaming raw events to a named warehouse. 1 3 4 6 8
The Skeptic
An open-source self-hosted edition is offered with published API documentation covering both cloud and self-hosted instances and stated to expose any operation available in the application, and the data processing agreement promises deletion or return of data on termination — while also stating residual copies may remain in backups under ordinary retention cycles. We found no public information on CSV export of reports, raw event export to a named warehouse or BI tool, an import of historical data from Google Analytics, or whether reports are sampled, and the open-source licence is not named on the captured pages. 1 3 4 6 8
Installation, integrations & performance
panel disagrees
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Setup is described as minutes, events work via data attributes and script calls, team members are included per plan, SAML single sign-on and an uptime SLA sit under Enterprise, and self-hosting is documented. I found no public information on plugins or setup guides for named CMS and shop systems, the script's size, single-page apps, mobile SDKs, or a public status page with uptime history — for my Shopware shop the integration path stays unclear. 1 2 4 9
The Data Protection Officer
Installation is a tracking snippet set up in minutes, with custom events added through a data attribute and separate recorder scripts for heatmaps and session replay; plans scale websites and team members, Business adds white-labeling, and Enterprise carries SAML single sign-on, an uptime SLA and onboarding support. We found no public information on plugins or guides for named CMS and shop systems, single-page app support, script size, mobile SDKs, or a public status page. 2 4 9
The Agency Developer
Setup is a tracking script with a data attribute for events and separate recorder scripts for heatmaps and replay, and plans carry team-member limits, white-labeling on Business, an audit log and SAML SSO on Enterprise — the agency basics are covered. We found no public information on plugins for WordPress, TYPO3 or Shopify, the script's size or measured performance impact, single-page-app or mobile SDK support, or a public status page with uptime history. 2 4 9
The Growth Analyst
Installation is a snippet with events via a data attribute or JavaScript call, heatmaps and session replay use a separate recorder script, team seats scale per plan with permissions respected by the MCP tools, white-labelling sits on Business and SAML SSO on Enterprise. We found no public information on script size, plugins for named CMS or shop systems, single-page-app or mobile SDK support, first-party proxying against ad blockers, or a public status page with uptime history. 1 2 4 8
The Public-Sector Site Owner
Tracking is described as set up in minutes with a data attribute for events, team-member limits per plan, SAML single sign-on on the top tier, and a separate recorder script for heatmaps and session replays. We found no public information on the tracking script's size, plugins for named CMS systems such as TYPO3 or WordPress, single-page-app support, mobile SDKs, or a public status page. 1 2 4 8
The Skeptic
Set-up is described as tracking in minutes with code APIs for events and identity, self-hosted documentation exists, and plans include team member limits, white-labeling on Business, SAML SSO and an uptime SLA on Enterprise, plus an MCP server for AI clients that respects website and team permissions. We found no public information on the tracking script's size or measured performance impact, plugins for named CMS or shop systems, single-page app support, mobile SDKs, a tag manager integration, first-party proxying, or a public status page. 1 2 3 4
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
Umami Software, Inc. is a US contracting entity under Delaware law and the published subprocessor list runs mostly through US providers, though Hetzner appears as EU infrastructure, geographic data-region selection is offered, and the DPA relies on EU Standard Contractual Clauses and the UK Addendum, with ISO 27001 and SOC 2 explicitly stated as not certified. The documented open-source self-hosted edition, which the DPA excludes from its processing scope and which gives complete control over where it runs and where data is stored, would let me keep the whole visitor chain on my own European servers. 1 6 7 8
The Data Protection Officer
The contracting entity is a US corporation under Delaware law; it publishes a data processing agreement with EU standard clauses and a subprocessor list naming each provider and its country, but the cloud chain runs overwhelmingly through the USA — hosting (AWS, Vercel), CDN (Cloudflare), database (ClickHouse), logging (Axiom), email (Resend, Google), support (Discord, Salesforce), payments (Stripe) and generative AI (OpenAI, Anthropic) — with Hetzner the only EU provider named. Geographic data-region selection exists for cloud accounts and the self-hosted edition keeps data on the customer's own infrastructure, but the selectable regions are not enumerated and neither ISO 27001 nor SOC 2 certification is held. 1 6 7 8
The Agency Developer
The contracting entity is Umami Software, Inc. under Delaware-governed terms and the cloud subprocessor chain runs almost entirely through US providers — Cloudflare, Vercel, AWS, Stripe, Resend, Google, Salesforce — with EU SCCs under Irish law as the stated safeguard and the security page stating ISO 27001 and SOC 2 are not currently certified. What redeems it for us is the documented self-hosted edition that keeps every visitor record on the customer's own servers, which the data processing agreement explicitly excludes from its scope; geographic data-region selection exists for cloud accounts but the regions are not named. 1 6 7 8
The Growth Analyst
The cloud chain is a US company whose published subprocessor list runs overwhelmingly through US providers — Vercel hosting, AWS, Cloudflare CDN, Google email, Stripe payments — with EU SCCs under Irish law, optional data-region selection for cloud accounts, and a stated position of not currently holding ISO 27001 or SOC 2. The documented self-hosted open-source edition keeps processing on the customer's own infrastructure and is excluded from the DPA where Umami receives no data; that is the route I would run on my own European servers, though we found no public information confirming the self-hosted edition makes no calls home. 1 6 7 8
The Public-Sector Site Owner
The self-hosted open-source edition would keep every visitor record on our own servers in the municipal data centre, and the data processing agreement expressly excludes self-hosted use where the vendor receives no data — a route our procurement office could defend. The cloud path is different: a US corporation whose terms are governed by Delaware law, with a listed subprocessor chain dominated by US providers including the database, CDN, hosting, email and support services, no ISO 27001 or SOC 2 certification, and we found no public confirmation of where cloud visitor data is stored, though a data-region selection for cloud accounts exists. 1 6 7 8
The Skeptic
The contracting entity is a US corporation under Delaware law, and the published subprocessor list is dominated by US providers — hosting on Vercel, AWS and Upstash, CDN on Cloudflare, email on Google and Resend, support on Discord and Salesforce, AI on OpenAI and Anthropic, payments on Stripe — with Hetzner the only EU entry; data residency is not confirmed on the vendor's own captured pages, though region selection for cloud accounts, EU SCCs with Irish governing law and a published DPA are documented. The self-hosted open-source edition documented as giving complete control over where the software runs and its data is stored is the only sovereign path here, and no ISO 27001 or SOC 2 certification is held — which the vendor states plainly. 6 7 8
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
Every cloud tier is public with its scaling rule: Hobby at $0 / month up to 100K events, Pro at $20 / month with 1 million events included and $0.00003 per additional event, Business at $200 / month with 10 million events included and $0.00002 per additional event, replays at $0.005 per replay, plus websites, team members and retention per tier. What I could not compute from the pages: the self-hosted edition's cost or licence terms, the minimum term, VAT treatment, and Enterprise is listed as "Custom — Contact us". 4
The Data Protection Officer
Every self-serve tier is public with its traffic rule: a free tier at up to 100,000 events a month for one website, Pro at $20 per month with one million events included and $0.00003 per additional event, Business at $200 per month with ten million included and $0.00002 per additional event, and extra replays at $0.005 per replay. Enterprise is priced "Custom, Contact us" for single sign-on and the uptime SLA, and we found no public information on minimum term, VAT treatment, or paid support for the self-hosted edition. 4
The Agency Developer
Hobby is free with 100K events a month, Pro is $20 / month with 1 million events and $0.00003 per additional event, Business is $200 / month with 10 million events and $0.00002 per additional event, additional replays are $0.005 per replay, and website, team-member and retention limits are listed per tier — so I can compute what a client going viral will cost me. Enterprise is Custom, Contact us and carries SSO and the uptime SLA, and we found no public information on the self-hosted edition's cost or licence, minimum term, or VAT treatment. 1 4
The Growth Analyst
Every cloud tier is public with its event volume and scaling rule — Hobby at $0 with up to 100K events, Pro at $20 / month with 1 million events and $0.00003 per additional event, Business at $200 / month with 10 million events and $0.00002 per additional event — plus site, seat and retention limits, replay overage at $0.005 per replay, and self-hosting of the open-source platform for free. Enterprise is priced on contact, and we found no public information on VAT treatment, minimum terms, or the cost of support for a self-hosted deployment. 1 2 4
The Public-Sector Site Owner
Every cloud tier is public with its event limit and per-event overage price — Pro at $20 / month with 1 million events per month included and $0.00003 per additional event, Business at $200 / month with 10 million events per month included and $0.00002 per additional event — plus website and team-member counts, retention per tier, and additional replays at $0.005 per replay. Single sign-on and an uptime SLA sit in an Enterprise tier priced only on request, and we found no public information on minimum term or VAT treatment. 2 4
The Skeptic
Hobby at $0 / month with up to 100K events, Pro at $20 / month with 1 million events and $0.00003 per additional event, and Business at $200 / month with 10 million events and $0.00002 per additional event are public with websites, team members and data retention per tier, and additional session replays are priced at $0.005 per replay. Single sign-on, uptime SLA and Enterprise support sit behind "Enterprise Custom Contact us", and we found no public information on minimum term, VAT treatment, or the self-hosted edition's licence or support cost. 2 4
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Umami
Is Umami European?
No. whats-best.ai classifies Umami as Rest of world.
Where does Umami store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Umami have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Umami?
As of 4 Nov 2026, the panel rates Matomo (4/5), Piwik PRO Analytics Suite (3.5/5) and Pirsch Analytics (3.5/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Umami alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. The page does not say which region is the default for new accounts; the security page only references a 'Cloud data regions' selection whose dedicated page is not among the excerpts.
- Weak sourcing — Legal entity, Hosting options, Open source, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage umami.is Checked 29 Oct 2026 Details →
- 2 Features page (events, funnels, retention) umami.is Checked 29 Oct 2026 Details →
- 3 API documentation docs.umami.is Checked 29 Oct 2026 Details →
- 4 Pricing page umami.is Checked 29 Oct 2026 Details →
- 5 Privacy policy umami.is Checked 29 Oct 2026 Details →
- 6 Data processing agreement (dpa) umami.is Checked 29 Oct 2026 Details →
- 7 Subprocessor list umami.is Checked 29 Oct 2026 Details →
- 8 Security / trust page umami.is Checked 29 Oct 2026 Details →
- 9 Traffic, sources & campaign reports — found from sitemap umami.is Checked 29 Oct 2026 Details →
- 10 Terms of service — found from the homepage umami.is Checked 1 Nov 2026 Details →
- 11 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →