# Umami — Web Analytics Umami by Umami Software, Inc. holds a panel rating of 2.5/5 from 6 AI judges (category median 2.5/5), as of 2026-10-30. Provenance: Rest of world; sovereignty: not determined. - Vendor: Umami Software, Inc. (https://umami.is) - Category: [Web Analytics](https://whats-best.ai/software/web-analytics.md) - Provenance (editorial classification): Rest of world - Canonical page: https://whats-best.ai/software/web-analytics/umami - Alternatives: https://whats-best.ai/software/web-analytics/umami/alternatives ([markdown](https://whats-best.ai/software/web-analytics/umami/alternatives.md)) - Data as of: 2026-11-04 · evaluated 2026-10-30 · oldest source captured 2026-10-29 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: Umami Software, Inc. - Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026 - Free plan: Not stated on the vendor’s pages as of 1 Nov 2026 ## The panel's verdict Umami is an open-source web analytics platform, self-hosted or as Umami Cloud, from Umami Software, Inc., a US corporation under Delaware law. One judge, the data protection officer, recorded zero on every criterion; the remaining scores are strongest on data ownership, at 7-8, and pricing transparency, where five judges scored 7 — the open-source edition is documented as giving complete control over where the software runs and where its data is stored, and every cloud tier is public: Hobby at $0 / month with up to 100K events, Pro at $20 / month with 1 million events and $0.00003 per additional event, Business at $200 / month with 10 million events and $0.00002 per additional event. Implementation is the weakest criterion at 4-5, with no public information found on script size, CMS and shop-system plugins, or mobile SDKs. The splits are sovereignty at 6-8 — judges crediting the self-hosted route score above those weighing the US-dominated cloud subprocessor chain — and consent and privacy at 5-7, over the absence of a stated legal position for the cookieless mode. **Speaks for it:** - Every cloud tier is public with its event volume and overage rule — Hobby $0 / month up to 100K events, Pro $20 / month with 1 million events and $0.00003 per additional event, Business $200 / month with 10 million events and $0.00002 per additional event — with website, team-member and retention limits listed per tier - The open-source edition runs self-hosted, documented as giving complete control over where the software runs and where its data is stored - Counting is cookieless by an anonymous session identifier, with IP addresses not stored in analytics records and only processed transiently - The API is documented as exposing any operation available in the application, for cloud and self-hosted instances alike, with a streaming API on Business - Funnels report visitors, conversion rate and drop-off at each step, with goals, journeys, cohorts and retention included on all plans **Held against it:** - Implementation scores top out at 5, with no public information on script size, plugins for named CMS or shop systems, single-page-app or mobile SDK support, or a public status page - We found no public information on order-level e-commerce tracking with shop-system plugins, or on conversions sent back to Google Ads or Meta - The cloud path is a US corporation under Delaware law with a published subprocessor list dominated by US providers, Hetzner the only EU entry, and cloud data residency not confirmed on the captured pages - The security page states ISO 27001 and SOC 2 are not currently certified and an independent penetration test is not yet completed - We found no public information stating the cookieless mode's position against named law such as §25 TDDDG or the CNIL exemption, nor vendor-supplied wording for a site's privacy policy **Best for:** - You run a public-facing site and want banner-free, cookieless traffic and funnel reporting your editors can use directly - You can self-host the open-source edition and want every visitor record on infrastructure you control, outside the cloud subprocessor chain - You want to compute analytics costs in advance from published tiers and per-event overage prices - Your conversion questions are signups, form submissions and funnels rather than order-level e-commerce **Avoid if:** - You need order-level e-commerce tracking of products, carts and orders with shop-system plugins, and conversions sent back to Google Ads or Meta — we found no public information on these - Your deployment depends on named CMS plugins, mobile SDKs or single-page-app guidance — we found no public information on any of these - Your procurement requires ISO 27001 or SOC 2 certification or a completed independent penetration test, which the vendor states it does not currently hold - You must use the cloud service under an EU contracting entity and EU subprocessors — the contracting entity is a US corporation under Delaware law and the published subprocessor list is dominated by US providers ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The E-Commerce Marketing Lead | The Data Protection Officer | The Agency Developer | The Growth Analyst | The Public-Sector Site Owner | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Traffic, sources & campaign reports | 3/5 | 0/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | | Goals, events, funnels & e-commerce | 3/5 | 0/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | | Consent-free operation & data minimisation | 2.5/5 | 0/5 | 3.5/5 | 3/5 | 3/5 | 3.5/5 | | Data access, export & self-hosting | 3.5/5 | 0/5 | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | | Installation, integrations & performance | 2/5 | 0/5 | 2.5/5 | 2/5 | 2/5 | 2.5/5 | | European sovereignty | 3.5/5 | 0/5 | 3.5/5 | 4/5 | 3/5 | 3/5 | | Pricing transparency | 3.5/5 | 0/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | | **Weighted verdict** | **3/5** | **0/5** | **3.5/5** | **3/5** | **3/5** | **3.5/5** | ### The judges - **The E-Commerce Marketing Lead** (v1.0): Runs marketing for a Shopware shop selling outdoor gear in Germany and Austria, with a monthly ad budget split between Google, Meta and two price comparison sites. Since the consent banner went live, a third of the orders no longer show a source. Wants revenue per campaign that matches the shop backend, a checkout funnel that shows where carts are left, conversions sent back to the ad platforms, and numbers that hold without a click on "accept". - **The Data Protection Officer** (v1.0): External data protection officer for eleven mid-sized companies, three of which still ran Universal Analytics when the Austrian authority ruled on it. Reads the data policy before the feature page: which fields are stored, how a visitor is counted without a cookie, whether the IP address is cut before it is written, who the subprocessors are and where. Signs off a site without a banner only when the vendor states its reading of §25 TDDDG in writing. - **The Agency Developer** (v1.0): Lead developer at a twelve-person web agency that runs forty client sites on WordPress and TYPO3 and a few Shopify shops. Installs the analytics once per site and answers for it for years. Wants a small script or server-side collection, a plugin per CMS, an own tracking domain so ad blockers do not cut the numbers in half, client accounts with their own logins, and a price that does not jump when one client goes viral. - **The Growth Analyst** (v1.0): Product and growth analyst at a B2B SaaS in Munich with a marketing site, a web app and a mobile app. Needs signups traced from the first campaign click to the first paid invoice, funnels and cohorts on custom events, and the raw events in the company's warehouse every night. Has moved tracking twice and knows that a tool without a raw export means starting the history again from zero. - **The Public-Sector Site Owner** (v1.0): Web editor for a district administration whose site serves 400,000 residents, from vehicle registration to daycare places. The state data protection authority publishes guidance on analytics, and the council will not show a cookie banner on a public service. Needs to know which pages people search for and where forms are abandoned, with data that stays in Germany or on the municipal data centre's own servers, and a contract the procurement office can sign. - **The Skeptic** (v1.0): Has seen "no cookie banner needed" on a tool that fingerprints every visitor, "EU-hosted" on a proxy in front of a US data store, and "unlimited" data history that ends with the subscription. Reads that a product is "GDPR-compliant" and asks which ruling the vendor means, what is stored per visit, whether the history can be exported in a format another tool imports — and what leaving would cost. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - Assistance dsr: yes [S6] - Assistance fees: yes [S6] - Audit costs: yes [S6] - Audit frequency limit: 30 · 1 [S6] - Breach notification: yes [S8] - Bug bounty: no [S8] - Custom assessments: yes [S8] - DPA auto acceptance: yes [S6] - DPA availability: yes [S8] - DPA cloud: Umami Cloud analytics processing on behalf of customers [S5] - DPA no signature required: no [S6] - Encryption rest: yes [S8] - Encryption transit: yes · yes [S8] - GDPR: yes · yes · yes [S1] - GDPR CCPA posture: yes [S8] - ISO 27001 status: not certified [S8] - Liability aggregated: yes [S6] - MFA internal: yes [S8] - Minors policy: 18 [S5] - No certification claims: yes [S8] - No data sale: yes · yes [S6] - No sale of data: no [S5] - No sensitive info: no [S5] - No third party info: no [S5] - Pentest status: no [S8] - Privacy rights regions: EEA · UK · Switzerland · Canada [S5] - Scc docking clause: yes [S6] - Scc governing law: courts of Ireland · Ireland [S6] - Scc modules: Module Two Controller to Processor · Module Three Processor to Processor [S6] - Scope limitation: Umami Cloud [S8] - Security incident notification: without undue delay [S6] - SOC 2 status: not certified [S8] - Subprocessor termination refund: yes [S6] - Tom encryption: where supported · yes [S6] - Tom MFA: yes [S6] - Tom security page: https://umami.is/security [S6] - Transfer mechanisms: adequacy decision · EU SCCs · UK Addendum · other approved mechanisms [S6] - UK addendum: yes [S6] - US state privacy role: processor · service provider · contractor [S6] - US states rights: California · Colorado · Connecticut · Utah · Virginia [S5] - Vulnerability disclosure: security@umami.is [S8] **Data** - Backup deletion: yes [S6] - Backup residual copies: yes [S8] - Deletion on termination: yes [S5] - Deletion on termination: yes [S6] - No purpose retention beyond account: duration of user account [S5] - Personal info collected: email addresses · names · usernames · passwords · contact preferences [S5] - Retention policy: as long as necessary for stated purposes unless law requires longer [S5] **Hosting** - Payment processor: https://stripe.com/privacy · Stripe [S5] **Integrations** - API availability: JSON · yes · yes [S3] - Cloud API base: API key · https://api.umami.is/v1 [S3] - Compare docs: Compare and Breakdown have dedicated documentation pages [S9] - Self hosted API base: http:///api · yes [S3] **Legal** - Company: Umami Software, Inc. [S2] - Copyright holder: 2026 · Umami Software, Inc. [S9] - DPA last updated: 2026-08-02 [S6] - Entity: Umami Software, Inc. · 2026 [S1] - Entity: Umami Software, Inc. [S4] - Entity: Umami · Umami Software, Inc. [S5] - Entity: Umami Software, Inc. [S7] - Last updated: 2026-10-19 [S5] **Pricing** - Additional replays: 0.005 [S4] - Business: Business · 200 · 14 [S4] - Business limits: unlimited · unlimited · 10000000 · 2.0E-5 · 5 [S4] - Cloud custom events: All plans · yes [S2] - Cloud distinct ids: All plans · v2.18 [S2] - Cloud funnels retention: All plans · yes [S2] - Cloud heatmaps: Business · Enterprise · v3.2 [S2] - Cloud mcp access: Pro · Business · Enterprise · yes · v3.4 [S2] - Cloud segments cohorts: All plans · v3.0 [S2] - Cloud session replay: Business · Enterprise · v3.1 [S2] - Enterprise: Enterprise · custom [S4] - Enterprise features: yes · yes · yes · yes [S4] - Hobby: Hobby · 0 [S4] - Hobby limits: community · 1 · 100000 · 6 [S4] - Mcp availability: Pro · 3.4 [S1] - Pro: Pro · 20 · 14 [S4] - Pro limits: 20 · 1000000 · 10 · 3.0E-5 · 2 [S4] **Product** - Analytics features: Reports: breakdown, funnel analysis, user retention, UTM parameters, goals, user journey, revenue, attribution [S4] - Analytics ip handling: deliver requests · calculate visitor identifiers · derive approximate location · no [S5] - Breakdown dimensions: Referrer · Path · Country · Device · UTM source [S9] - Cohorts segments: yes [S2] - Community stats: 30M+ · 400+ · 39K+ [S1] - Compare insight: Umami has a Compare insight that overlays two periods with percentage-change metric cards and an overlaid views/visitors graph; options include Previous period and Previous year. [S9] - Cookieless: yes [S9] - Core modules: acquisition · behavior · conversion · retention · revenue [S1] - Custom events: data-umami-event attribute · umami.track() · yes [S2] - Dashboard metrics: pageviews · visitors · bounce_rate · average_visit_time [S1] - Data isolation: logical separation [S8] - Data regions: yes [S8] - Distinct ids: yes [S2] - Dnt own services: no [S5] - Dnt tracker option: tracker only, enabled by website owner · yes [S5] - DPA processing features: analytics features include dashboards, reports, funnels, journeys, cohorts, retention analysis, heatmaps, session-related functionality [S6] - DPA scope exclusion self hosted: yes [S6] - DPA special categories prohibited: yes [S6] - Event tracking: button clicks · form submissions · signups · downloads · yes [S1] - Free tier: yes [S1] - Funnels: yes [S1] - Funnels: yes · yes · yes [S2] - Goal tracking: Umami supports tracking goals such as signups [S9] - Heatmaps: clicks · scroll depth · yes [S2] - Journey report: yes [S1] - Journey report: three to seven steps [S2] - Mcp read only: read-only [S2] - Mcp server: yes · yes [S1] - Monitoring features: Monitoring: realtime events, custom dashboards, email reports [S4] - New returning visitors: Umami distinguishes new versus returning visitors [S9] - No cookies: yes [S1] - Open source: yes [S1] - Open source: Umami is an open-source web and product analytics platform measuring traffic, events, funnels, and retention without cookies. [S9] - Open source: MIT · yes [S8] - Open source platform: yes [S2] - Operational ip logging: yes · yes [S5] - Optional features: distinct_ids · custom_event_or_session_properties · revenue_tracking · session_replays · heatmaps [S8] - Privacy defaults: no · no · no · no · no [S8] - Privacy no cookies: no [S2] - Retention report: yes · yes [S1] - Retention report: one month · first arrival day [S2] - Retention report: yes [S9] - Revenue tracking: yes [S1] - Security features: yes · yes [S4] - Self hosted control: yes [S8] - Self hosting: yes · yes · no [S1] - Session replay: events · user_journeys · heatmaps · session_replay [S1] - Session replay: yes [S2] - Session replay default: yes · yes [S8] - Utm campaign tracking: Umami tracks UTM-tagged campaign traffic [S9] **Subprocessors** - Anthropic: Anthropic PBC · USA · Generative AI services [S7] - Aws: Amazon Web Services, Inc · USA · Cloud computing infrastructure and services [S7] - Axiom: Axiom, Inc. · USA · Logging and observability [S7] - Clickhouse: ClickHouse, Inc. · USA/EU · Database provider for real-time analytics [S7] - Cloudflare: Cloudflare, Inc · USA · CDN, security, and DNS services [S7] - Discord: Discord Inc. · USA · Communication and support services [S7] - Google: Google, Inc. · USA · Email and collaboration services [S7] - Hetzner: Hetzner Online GmbH · EU · Cloud computing infrastructure and services [S7] - List updated: 2026-04-24 [S7] - List URL: https://umami.is/subprocessors [S5] - List URL: https://umami.is/subprocessors [S6] - Notice period days: 15 [S6] - Objection window days: 10 [S6] - Openai: OpenAI, Inc. · USA · Generative AI services [S7] - Resend: Resend, Inc. · USA · Transactional email delivery [S7] - Salesforce: Salesforce, Inc. · USA · Communication and support services [S7] - Stripe: Stripe, Inc. · USA · Payments processing and subscription management [S7] - Stripe payments: Stripe · payment processing · no [S8] - Upstash: Upstash, Inc · USA · Cloud computing infrastructure and services [S7] - Vercel: Vercel, Inc. · USA · Hosting and deployment services [S7] **Support** - DPA contact email: privacy@umami.is [S6] - Guides: 6 [S2] - Plan matrix: Support tiers: community, email, email and chat, uptime SLA, enterprise support, onboarding assistance, designated support engineer [S4] ## Questions ### Is Umami European? No. whats-best.ai classifies Umami as Rest of world. ### Where does Umami store data? Not stated on the vendor’s pages as of 1 Nov 2026. ### Does Umami have a free plan? Not stated on the vendor’s pages as of 1 Nov 2026. ### What are the best alternatives to Umami? As of 4 Nov 2026, the panel rates [Matomo (4/5)](https://whats-best.ai/software/web-analytics/matomo), [Piwik PRO Analytics Suite (3.5/5)](https://whats-best.ai/software/web-analytics/piwik-pro) and [Pirsch Analytics (3.5/5)](https://whats-best.ai/software/web-analytics/pirsch) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Piwik PRO Analytics Suite](https://whats-best.ai/software/web-analytics/piwik-pro) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Umami alternatives](https://whats-best.ai/software/web-analytics/umami/alternatives). ## What this page leaves out - 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. - 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. ## Sources - [S1] Vendor homepage: https://umami.is/ (checked 2026-10-29) - [S2] Features page (events, funnels, retention): https://umami.is/product-analytics (checked 2026-10-29) - [S3] API documentation: https://docs.umami.is/docs/api (checked 2026-10-29) - [S4] Pricing page: https://umami.is/pricing (checked 2026-10-29) - [S5] Privacy policy: https://umami.is/privacy (checked 2026-10-29) - [S6] Data processing agreement (dpa): https://umami.is/dpa (checked 2026-10-29) - [S7] Subprocessor list: https://umami.is/subprocessors (checked 2026-10-29) - [S8] Security / trust page: https://umami.is/security (checked 2026-10-29) - [S9] Traffic, sources & campaign reports — found from sitemap: https://umami.is/guides/website-traffic-analysis (checked 2026-10-29) - [S10] Terms of service — found from the homepage: https://umami.is/terms (checked 2026-11-01) - [S11] Code repository (open-source licence) — found from the homepage: https://github.com/umami-software/umami (checked 2026-11-01) --- Cite as: whats-best.ai, "Umami — Web Analytics", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/web-analytics/umami Corrections: https://whats-best.ai/correct/1146?target=page