Rybbit
Web Analytics
Open-source analytics with session replay and an EU-hosted cloud on Hetzner. Widely adopted, but it never names the company behind it.
What is Rybbit?
Rybbit is an AGPL-licensed analytics platform covering autocapture, session replay, funnels, user journeys and Core Web Vitals behind a single script, with an MCP server for querying it from an AI assistant. Its cloud is described as EU-hosted and its DPA names Hetzner and Cloudflare as sub-processors. Customers listed include Bosch, Texas Instruments and GOV.UK. What it does not publish is who operates it.
Key Features
Ready to try Rybbit?
From $13/mo
Pros & Cons
Company and data
Who you are buying from, and where your data goes.
- Company based in
- Not stated on its own site
- Ownership
- Not verified yet
- Data hosted
- In the EU
- Data processing agreement
- Published
Full privacy and compliance record (show)
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Not disclosed |
| Ownership | Not yet verified |
| Foreign Disclosure Exposure | Not yet verified |
| Data Hosting Location | European UnionRybbit's site states "EU-hosted cloud", and its DPA names Hetzner for "Servers and storage" and Cloudflare for "Object storage and security". |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Unknown |
| SCCs in Place |
How we reached this
No legal entity is published anywhere: not on the website, not on the GitHub organisation, and not in the Data Processing Agreement, which identifies the counterparty only as "Rybbit ('Processor', 'we', 'us')" with no company name, address or registration number. That matters practically rather than pedantically, because a DPA is a contract and you cannot establish whose law governs it or who is liable under it. The DPA does name sub-processors: Hetzner (servers and storage), Cloudflare (object storage and security), Stripe, Resend and Maxmind. The site states the cloud is EU-hosted, and Hetzner is German, so EU data residency is plausible but rests on the vendor's word. AGPL-3.0 licensed and self-hostable, which is the configuration where the unknown ownership stops mattering. Ownership and exposure recorded UNKNOWN rather than assumed.
Categories
Alternatives to Rybbit
Matomo
Leading open-source web analytics. Self-host in the EU or use cloud with EU hosting.
Mouseflow
Heatmaps, session replay, and behavior analytics. Danish company with EU-only data processing.
Plausible Analytics
Open-source, cookie-free web analytics hosted in Germany (Hetzner). Self-funded, no investors. From €9/month.
Dreamdata
Danish B2B revenue attribution, joining CRM, ad and web data to show which touchpoints actually produced pipeline.
Fathom Analytics
Simple, fast web analytics with EU data isolation option. Cookie-free and privacy-focused.
Friendly Analytics
Swiss Matomo-based analytics with a tag manager and cookieless tracking. Swiss, so outside the EU but covered by an adequacy decision.
Questions about Rybbit
Is Rybbit GDPR compliant?
Partly. Rybbit meets some of the requirements, with caveats worth reading before you commit. data is hosted within the European Union, and a Data Processing Agreement is published.
Where does Rybbit store data?
Rybbit states: "Rybbit's site states "EU-hosted cloud", and its DPA names Hetzner for "Servers and storage" and Cloudflare for "Object storage and security".". Data is hosted within the European Union.
Does Rybbit offer a Data Processing Agreement (DPA)?
Yes. Rybbit publishes a DPA at https://rybbit.com/dpa. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is Rybbit a European company?
We have not verified Rybbit's ultimate ownership.
Some links on this page are affiliate links. If you sign up through one we may earn a commission, at no extra cost to you. It never affects which tools we list, how we rank them, or what we report about their compliance, see our terms.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Rybbit and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.