Umami
Partially CompliantPopular open-source, cookieless analytics. MIT licensed and easy to self-host, but the company behind the hosted cloud is registered in Delaware.
Subject to the US CLOUD Act: a US parent company can be compelled to disclose data it holds, including data stored in the EU.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | United States |
| Ownership | Non-European |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | Unknown |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Notes | Terms of Service state verbatim: "We are Umami Software, Inc., doing business as Umami ('Company,' 'we,' 'us,' 'our'), a company registered in Delaware, United States", and the terms are governed by Delaware law. The privacy policy names the same entity. No hosting region is published for Umami Cloud and no DPA document was located. The software is MIT licensed and straightforward to self-host, which is the configuration most users choose and the one where the Delaware incorporation becomes irrelevant, because no data reaches the company at all. |
About Umami
Umami is one of the most widely used open-source alternatives to Google Analytics, with a simple cookieless tracker and a clean single-page dashboard. It is genuinely easy to self-host, which is how most people run it, and there is a hosted cloud for those who would rather not. The project is MIT licensed; the company operating the cloud is American.
Key Features
Pros & Cons
Categories
Umami GDPR & data protection: common questions
Is Umami GDPR compliant?
Partly. Umami meets some of the requirements, with caveats worth reading before you commit. Umami is based in United States, outside the EU/EEA.
Where does Umami store data?
We could not locate a clear statement of where Umami hosts data. Ask the vendor directly, or check their privacy policy and sub-processor list before signing.
Does Umami offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Umami. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is Umami a European company?
No. Umami is based in United States, outside the EU/EEA. It may still be a sound choice (EU hosting and a signed DPA matter more than a flag) but the ownership is not European.
Is Umami subject to the US CLOUD Act?
Yes. US authorities can compel disclosure of data held by a US company or its subsidiaries, regardless of the country the servers sit in. EU hosting alone does not remove this, the question is who controls the data, not where the disk is.
Schrems II compliance checklist →Related Tools
Plausible Analytics
Lightweight, open-source, cookie-free web analytics. Fully GDPR compliant with EU data hosting.
Matomo
Leading open-source web analytics. Self-host in the EU or use cloud with EU hosting.
Mouseflow
Heatmaps, session replay, and behavior analytics. Danish company with EU-only data processing.
Spot an error in the compliance data? Get in touch