Umami

The Public-Sector Site Owner

The dashboard covers pageviews, visitors, bounce rate and average visit time, with referrer, path, country, device and campaign breakdowns, a compare view across two periods, realtime events, saved segments, custom dashboards and email reports — enough for our editors to see which service pages residents actually use. We found no public information on roll-up reporting across several sites, annotations, or whether reports are sampled. 1 2 4 9

Report an error

The Public-Sector Site Owner

Custom events with properties, goals, funnels reporting visitors, conversion rate and drop-off at each step, revenue tied to events, user journeys of three to seven steps, cohorts and retention are all documented — the funnel report is precisely what we need to find where vehicle-registration and daycare forms are abandoned. We found no public information on e-commerce suite tracking, comparative attribution models, or conversion export to advertising platforms. 1 2 4 9

Report an error

The Public-Sector Site Owner

Cookieless by default with an anonymous session identifier, IP addresses not stored in analytics records but processed transiently, no cross-site tracking, no advertising use of the data, an optional do-not-track setting in the tracker, and the statement that nothing personally identifiable is stored — that supports a banner-free public service site. We found no public information on a stated position against German law or the data protection authorities' rulings, wording for our privacy policy, or an external audit of the consent-free mode; the vendor states it has not completed an independent penetration test. 1 2 5 8

Report an error

The Public-Sector Site Owner

The open-source platform can be self-hosted on our own infrastructure with complete control over where the data is stored, a documented API exposes everything the application can do for cloud and self-hosted instances alike, retention limits are stated per tier, and the data processing agreement promises deletion or return of data at termination. We found no public information on CSV export of reports, an import of historical data from another analytics tool, or streaming raw events to a named warehouse. 1 3 4 6 8

Report an error

The Public-Sector Site Owner

Tracking is described as set up in minutes with a data attribute for events, team-member limits per plan, SAML single sign-on on the top tier, and a separate recorder script for heatmaps and session replays. We found no public information on the tracking script's size, plugins for named CMS systems such as TYPO3 or WordPress, single-page-app support, mobile SDKs, or a public status page. 1 2 4 8

Report an error

The Public-Sector Site Owner

The self-hosted open-source edition would keep every visitor record on our own servers in the municipal data centre, and the data processing agreement expressly excludes self-hosted use where the vendor receives no data — a route our procurement office could defend. The cloud path is different: a US corporation whose terms are governed by Delaware law, with a listed subprocessor chain dominated by US providers including the database, CDN, hosting, email and support services, no ISO 27001 or SOC 2 certification, and we found no public confirmation of where cloud visitor data is stored, though a data-region selection for cloud accounts exists. 1 6 7 8

Report an error

The Public-Sector Site Owner

Every cloud tier is public with its event limit and per-event overage price — Pro at $20 / month with 1 million events per month included and $0.00003 per additional event, Business at $200 / month with 10 million events per month included and $0.00002 per additional event — plus website and team-member counts, retention per tier, and additional replays at $0.005 per replay. Single sign-on and an uptime SLA sit in an Enterprise tier priced only on request, and we found no public information on minimum term or VAT treatment. 2 4

Report an error