OpenReplay

Session Replay You Can Actually Host Yourself

Most session-replay tools, Hotjar included, are cloud-only: your visitors' sessions leave your infrastructure the moment they're recorded. OpenReplay's core pitch is that this is optional. The project is open-source, and self-hosting is a first-class deployment path, not an afterthought bolted onto a SaaS product.

Three Ways to Run It

• Open-Source (Self-Hosted): free to deploy on your own infrastructure. You manage hosting, storage and maintenance, and nothing leaves your servers.
• Dedicated (Cloud-Managed): starts from $199/mo, billed hourly, fully managed by OpenReplay in their cloud or yours (BYOC), with no user, recording or retention limits, SSO, custom data retention and a choice of 50 regions.
• Enterprise: custom pricing on multi-year contracts, on-premises deployment, SAML/SCIM, audit logging and dedicated support.

What It Captures

Beyond standard session replay (clicks, scrolls, rage clicks), OpenReplay leans into the developer side: network requests, console logs, and application state (Redux, VueX, MobX, NgRx, Zustand) alongside the visual replay. It also ships co-browsing, product analytics, journey/funnel analysis and heatmaps, positioning it against Hotjar, FullStory and LogRocket at once.

The Paris Entity, and a US Name in the Background

The Terms of Service name the contracting party plainly: "ASAYER SAS, CREATOR OF OPENREPLAY", governed by French law, with "the federal and state courts sitting in Paris, France" as the agreed venue. That makes Asayer SAS, Paris, the operating entity for anyone signing up.

The same documents also carry a second name: the site's schema.org markup and footer trademark notice both read "Asayer, Inc.", consistent with press coverage of a $4.7M seed round led by Runa Capital. That pattern, a Paris SAS running day-to-day operations under what reads as a US-incorporated Inc., is why this listing is recorded as EU-HQ'd with a foreign parent rather than fully EU-owned; nothing in the public documents resolves the corporate structure further than that.

Hosting Is Stated Plainly for the Cloud Service

The privacy policy states without qualification: "the Website is hosted in the European Union (EU) and information we collect will be stored and processed on our servers (hosted by Amazon AWS) in the European Union (EU)." AWS is still a US company, so CLOUD Act exposure applies to the data it holds regardless of the EU region, the same reasoning as SEO.AI and Vainu. Neither the privacy policy nor the terms mentions a DPA, names a sub-processor list, or references Standard Contractual Clauses, which is the main compliance gap here: for a company selling to European teams handling visitor session data, that documentation would normally be expected.

The Honest Way Out of the Gap

For a team that wants EU processing without relying on any vendor's documentation, self-hosting removes the question entirely: nothing is sent to OpenReplay's infrastructure at all, only your own. That is the strongest answer this category has to the Schrems II problem, and it is worth weighing against the operational cost of running the platform yourself.

Where It Fits

The direct comparison is Hotjar itself, cloud-only and now processing through non-EU infrastructure. See also heatmaps and session recording for the rest of the category.