Back to Tools
Tracklution logo

Tracklution

Partially Compliant

Finnish server-side tracking platform from Tracklution Oy that plugs into Google Ads, Meta, TikTok and more with a managed setup, EU (Stockholm) hosting and a published DPA.

🇫🇮Finland🇪🇺EU Hosted🇪🇺 European

Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.

Freemiumfrom €0/month free tier; Grow from €39.20/month billed annually
Tracklution website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
Partially Compliant
HQ CountryFinland
OwnershipEuropean-owned
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
European Union"Your data is stored in the European Economic Area (Stockholm, Sweden)" (privacy policy, updated 21 February 2025) and "Tracklution's platform is hosted on Amazon Web Services (AWS), with primary data centers located in Northern Europe (Stockholm). Additional data residency options are available upon request" (www.tracklution.com/privacy-and-security/, read raw 2026-09-07).
EU Servers Available
Data Processing AgreementNot verified
Sub-processor ListNot verified
Schrems II Risk
Medium Risk
SCCs in Place
Last Verified7 September 2026

How we reached this

Finnish legal entity: Tracklution Oy, Company ID 2775435-5, VAT FI27754355, Ruoholahdenkatu 14, 00180 Helsinki (Terms) / Simonkatu 6 A, 00100 Helsinki (footer), read raw 2026-09-07. Terms governed by Finnish law, arbitration under the Finland Chamber of Commerce, seat Helsinki. PARTIAL rather than COMPLIANT for two reasons. First, hosting is on AWS: the security page names AWS explicitly with the Stockholm region stated, so dataHostingLocation is EU, but AWS is a US company and the CLOUD Act reaches data it physically holds independent of region, so extraterritorialExposure is US_CLOUD_ACT, the same shape as Vainu's AWS/MongoDB Atlas hosting. Second, the site footer lists a New York office (307 W 38th St, NY 11105) alongside the Helsinki address, but no US legal entity is named anywhere in the Terms, DPA or Privacy Policy -- every document defines "Tracklution" as Tracklution Oy alone. That is consistent with a Finnish company operating a US sales/support office rather than a US-parented structure, but the site does not explain the office's function or whether it has access to customer data, so this is flagged rather than resolved. A Data Processing Agreement is published at its own URL (www.tracklution.com/policies/dpa/) and as Appendix 1 to the Terms, naming Tracklution Oy as processor and the client as controller, so dpaEvidence is PUBLISHED. The privacy policy states international transfers outside the EEA rely on "the standard contractual clauses adopted by the European Commission," so sccInPlace is true; schremsIIRisk is MEDIUM given the AWS/CLOUD Act exposure despite the SCCs and named EU region. SOC2 and ISO27001 certification are claimed on the security page ("independently audited and certified for SOC2 and ISO27001 standards") and listed as Enterprise-plan features; no audit report or certificate was independently verified.

About Tracklution

Server-Side Tracking Without the sGTM Maintenance

Google Tag Manager's server-side container gives you the plumbing; you still own the tags, triggers, DNS, scaling and every API change Google, Meta and TikTok ship. Tracklution's pitch is to be the managed layer on top: install a CNAME, connect your ad accounts, and it keeps every connector current as platforms change their APIs.

What It Does

  • Server-side connectors for Google Ads, Meta, TikTok, LinkedIn, Snapchat, Pinterest, Microsoft (Bing) and Stripe conversion tracking, plus platform-specific setups for Shopify, WooCommerce, WordPress and GA4
  • First-party CNAME on the customer's own domain, resistant to ad blockers and ITP's cookie-lifespan limits
  • Offline conversion tracking via webhooks and CRM integrations
  • Attribution engine and event transformation on the Grow plan and above
  • MCP access on every plan, including the free tier, for AI-agent installation and querying
  • Clients report 34.2% more conversions on average versus browser pixels alone, per the vendor's own FAQ

Pricing

Free covers 5,000 events/month, one website and MCP access with no credit card. Grow is €39.20/month billed annually (50k events/month included), adding all connectors, offline conversions and the attribution engine. Enterprise and Agency are custom-quoted and add SOC2/ISO27001 features, dedicated servers, custom data location and (for agencies) unlimited client websites and white-label.

Finnish Entity, Stockholm Hosting, AWS Underneath

Operated by Tracklution Oy, Company ID 2775435-5, VAT FI27754355, Helsinki. Terms are governed by Finnish law, disputes settled by arbitration under the Finland Chamber of Commerce, seat Helsinki.

The privacy policy states plainly: "Your data is stored in the European Economic Area (Stockholm, Sweden)." The security page names the provider: "Tracklution's platform is hosted on Amazon Web Services (AWS), with primary data centers located in Northern Europe (Stockholm)." Because AWS is a US company, the CLOUD Act reaches data it physically holds regardless of region, the same reasoning applied throughout this directory to Vainu's AWS/MongoDB Atlas hosting: EU location, US infrastructure provider.

A Data Processing Agreement is published as its own page and as Appendix 1 to the Terms, a rarer thing in this category than it should be. SOC2 and ISO27001 certification are claimed on the security page and the Enterprise plan explicitly lists them as included.

The New York Office

The site footer lists two office addresses: Helsinki, and 307 W 38th St, New York. Nothing in the Terms, DPA or Privacy Policy names a US legal entity, however: every contract document defines "Tracklution" as Tracklution Oy alone, under Finnish law. Read at face value that makes this a Finnish company with a US sales or support presence rather than a US-parented one, but the site does not spell out what the New York office does or whether US staff can access customer data, so a buyer who needs that answered should ask directly rather than assume.

Where It Fits

Against Tracklution's own comparison pages, Stape and a self-managed Google Tag Manager server container are the closest alternatives: Tracklution trades DIY control for a fully managed connector layer. See also TAGGRS, also server-side and also Grow-tier priced from broadly comparable money, and the wider Tag Management category.

Key Features

Server-side connectors for Google Ads, Meta, TikTok, LinkedIn, Snapchat, Pinterest and Microsoft Ads
First-party CNAME tracking resistant to ad blockers and ITP
Offline conversion tracking via webhooks and CRM integrations
Attribution engine and event transformation on Grow and above
MCP access on every plan, including free
Plug-and-play setup for Shopify, WooCommerce, WordPress and GA4
Works alongside an existing GTM setup rather than requiring its removal

Pros & Cons

Free tier covers 5,000 events/month with no credit card and includes MCP access
Published Data Processing Agreement at its own URL, rarer than it should be in this category
Handles ongoing API maintenance across platforms rather than leaving that to the customer
SOC2 and ISO27001 certification claimed, with EU (Stockholm) hosting region named explicitly
34.2% average conversion recovery claimed versus browser-pixel tracking alone
Hosted on AWS, so US_CLOUD_ACT exposure applies despite the EU (Stockholm) region
A New York office is listed in the footer with no explanation of its role or data access, alongside a Finnish-only legal entity in every contract document
Grow-tier pricing (€39.20/month annually) still caps at 50k events before overage
"Additional data residency options are available upon request" implies the Stockholm default is not the only possible location
All sales final with no refunds, including on auto-renewed subscriptions not cancelled in time

Categories

Tracklution GDPR & data protection: common questions

Is Tracklution GDPR compliant?

Partly. Tracklution meets some of the requirements, with caveats worth reading before you commit. Tracklution is a European company headquartered in Finland, data is hosted within the European Union.

Where does Tracklution store data?

Tracklution states: ""Your data is stored in the European Economic Area (Stockholm, Sweden)" (privacy policy, updated 21 February 2025) and "Tracklution's platform is hosted on Amazon Web Services (AWS), with primary data centers located in Northern Europe (Stockholm). Additional data residency options are available upon request" (www.tracklution.com/privacy-and-security/, read raw 2026-09-07).". Data is hosted within the European Union.

Does Tracklution offer a Data Processing Agreement (DPA)?

We could not locate a published DPA for Tracklution. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.

What a DPA has to cover

Is Tracklution a European company?

Yes. Tracklution is headquartered in Finland and, as far as we can establish, European-owned.

Is Tracklution subject to the US CLOUD Act?

Indirectly. Tracklution itself is European-owned and headquartered in Finland, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.

Schrems II compliance checklist

Spotted something wrong?

Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.

If you work at Tracklution and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.