PostHog
Partially CompliantUS-owned open-source product analytics with session replay, feature flags and experiments. EU Cloud runs in Frankfurt, but the parent is American.
Subject to the US CLOUD Act: a US parent company can be compelled to disclose data it holds, including data stored in the EU.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | United States |
| Ownership | Non-European |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European Union“PostHog offers an EU Cloud region hosted in Frankfurt, Germany, alongside its US Cloud.” |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place |
How we reached this
Terms of Service name PostHog Inc, San Francisco, United States. The privacy policy additionally names PostHog GmbH and Hiberly Ltd within the group, and AWS as infrastructure. An EU Cloud region in Frankfurt is offered, so data residency in the EU is achievable, and a DPA is published. Ownership remains American, which means the CLOUD Act reaches the data through the parent regardless of which region you pick. Choose the EU region deliberately: the default on signup is not necessarily EU. Self-hosting removes the vendor from the processing chain entirely, which is the only configuration where US ownership stops mattering.
About PostHog
PostHog is an open-source product analytics platform that bundles what would normally be four tools: product analytics, session replay, feature flags and A/B testing, plus surveys and error tracking. It offers an EU Cloud region hosted in Frankfurt, and it can be self-hosted. The company is American, so the EU region addresses data residency but not jurisdiction.
Key Features
Pros & Cons
PostHog GDPR & data protection: common questions
Is PostHog GDPR compliant?
Partly. PostHog meets some of the requirements, with caveats worth reading before you commit. PostHog is based in United States, outside the EU/EEA, data is hosted within the European Union, and a Data Processing Agreement is published.
Where does PostHog store data?
PostHog states: "PostHog offers an EU Cloud region hosted in Frankfurt, Germany, alongside its US Cloud.". Data is hosted within the European Union.
Does PostHog offer a Data Processing Agreement (DPA)?
Yes. PostHog publishes a DPA at https://posthog.com/dpa. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is PostHog a European company?
No. PostHog is based in United States, outside the EU/EEA. It may still be a sound choice (EU hosting and a signed DPA matter more than a flag) but the ownership is not European.
Is PostHog subject to the US CLOUD Act?
Yes. US authorities can compel disclosure of data held by a US company or its subsidiaries, regardless of the country the servers sit in. EU hosting alone does not remove this, the question is who controls the data, not where the disk is.
Schrems II compliance checklist →Related Tools
Plausible Analytics
Lightweight, open-source, cookie-free web analytics. Fully GDPR compliant with EU data hosting.
Matomo
Leading open-source web analytics. Self-host in the EU or use cloud with EU hosting.
Mouseflow
Heatmaps, session replay, and behavior analytics. Danish company with EU-only data processing.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at PostHog and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.