PostHog
Partially CompliantUS-owned open-source product analytics with session replay, feature flags and experiments. EU Cloud runs in Frankfurt, but the parent is American.
Subject to the US CLOUD Act: a US parent company can be compelled to disclose data it holds, including data stored in the EU.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | United States |
| Ownership | Non-European |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European Union“PostHog offers an EU Cloud region hosted in Frankfurt, Germany, alongside its US Cloud.” |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Notes | Terms of Service name PostHog Inc, San Francisco, United States. The privacy policy additionally names PostHog GmbH and Hiberly Ltd within the group, and AWS as infrastructure. An EU Cloud region in Frankfurt is offered, so data residency in the EU is achievable, and a DPA is published. Ownership remains American, which means the CLOUD Act reaches the data through the parent regardless of which region you pick. Choose the EU region deliberately: the default on signup is not necessarily EU. Self-hosting removes the vendor from the processing chain entirely, which is the only configuration where US ownership stops mattering. |
About PostHog
PostHog is an open-source product analytics platform that bundles what would normally be four tools: product analytics, session replay, feature flags and A/B testing, plus surveys and error tracking. It offers an EU Cloud region hosted in Frankfurt, and it can be self-hosted. The company is American, so the EU region addresses data residency but not jurisdiction.
Key Features
Pros & Cons
PostHog GDPR & data protection: common questions
Is PostHog GDPR compliant?
Partly. PostHog meets some of the requirements, with caveats worth reading before you commit. PostHog is based in United States, outside the EU/EEA, data is hosted within the European Union.
Where does PostHog store data?
PostHog states: "PostHog offers an EU Cloud region hosted in Frankfurt, Germany, alongside its US Cloud.". Data is hosted within the European Union.
Does PostHog offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for PostHog. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is PostHog a European company?
No. PostHog is based in United States, outside the EU/EEA. It may still be a sound choice (EU hosting and a signed DPA matter more than a flag) but the ownership is not European.
Is PostHog subject to the US CLOUD Act?
Yes. US authorities can compel disclosure of data held by a US company or its subsidiaries, regardless of the country the servers sit in. EU hosting alone does not remove this, the question is who controls the data, not where the disk is.
Schrems II compliance checklist →Related Tools
Plausible Analytics
Lightweight, open-source, cookie-free web analytics. Fully GDPR compliant with EU data hosting.
Matomo
Leading open-source web analytics. Self-host in the EU or use cloud with EU hosting.
Mouseflow
Heatmaps, session replay, and behavior analytics. Danish company with EU-only data processing.
Spot an error in the compliance data? Get in touch