Rybbit
Partially CompliantOpen-source analytics with session replay and an EU-hosted cloud on Hetzner. Widely adopted, but it never names the company behind it.
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Not disclosed |
| Ownership | Not yet verified |
| Foreign Disclosure Exposure | Not yet verified |
| Data Hosting Location | European UnionāRybbit's site states "EU-hosted cloud", and its DPA names Hetzner for "Servers and storage" and Cloudflare for "Object storage and security".ā |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Unknown |
| SCCs in Place | |
| Notes | No legal entity is published anywhere: not on the website, not on the GitHub organisation, and not in the Data Processing Agreement, which identifies the counterparty only as "Rybbit ('Processor', 'we', 'us')" with no company name, address or registration number. That matters practically rather than pedantically, because a DPA is a contract and you cannot establish whose law governs it or who is liable under it. The DPA does name sub-processors: Hetzner (servers and storage), Cloudflare (object storage and security), Stripe, Resend and Maxmind. The site states the cloud is EU-hosted, and Hetzner is German, so EU data residency is plausible but rests on the vendor's word. AGPL-3.0 licensed and self-hostable, which is the configuration where the unknown ownership stops mattering. Ownership and exposure recorded UNKNOWN rather than assumed. |
About Rybbit
Rybbit is an AGPL-licensed analytics platform covering autocapture, session replay, funnels, user journeys and Core Web Vitals behind a single script, with an MCP server for querying it from an AI assistant. Its cloud is described as EU-hosted and its DPA names Hetzner and Cloudflare as sub-processors. Customers listed include Bosch, Texas Instruments and GOV.UK. What it does not publish is who operates it.
Key Features
Pros & Cons
Rybbit GDPR & data protection: common questions
Is Rybbit GDPR compliant?
Partly. Rybbit meets some of the requirements, with caveats worth reading before you commit. data is hosted within the European Union.
Where does Rybbit store data?
Rybbit states: "Rybbit's site states "EU-hosted cloud", and its DPA names Hetzner for "Servers and storage" and Cloudflare for "Object storage and security".". Data is hosted within the European Union.
Does Rybbit offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Rybbit. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover āIs Rybbit a European company?
We have not verified Rybbit's ultimate ownership.
Related Tools
Plausible Analytics
Lightweight, open-source, cookie-free web analytics. Fully GDPR compliant with EU data hosting.
Matomo
Leading open-source web analytics. Self-host in the EU or use cloud with EU hosting.
Mouseflow
Heatmaps, session replay, and behavior analytics. Danish company with EU-only data processing.
Spot an error in the compliance data? Get in touch