Web analytics for EU data sovereignty

The analytics team should keep a written inventory of every place visitor data goes, including hosting location, backups, support access and any third country where someone can view the data. The analytics platform itself produces the technical inventory: the self-hosted instance, its database and any archive or export storage. Your records of processing under GDPR Article 30 are the controller's document, so your privacy office owns the final version. Remote access from outside the EEA counts as a transfer under EDPB Guidelines 05/2021, so support access must be logged too. DeployOpen can prepare the technical inventory from the deployed architecture, but the controller decides what goes into the register and whether each entry is lawful.

Network egress test results are the evidence: captured traffic from a browser loading your pages, showing which domains receive requests and confirming that none are outside your approved list. The CDN configuration and the tag manager export also belong in the file, because a CDN that serves the tracking script or a plugin that loads external fonts or pixels can create a transfer you did not intend. DeployOpen runs these tests as part of security testing and records the methodology, dates, tools and results. Ask the testing team to repeat the test after each release, since plugin updates change what the page loads.

You need a signed data processing agreement with each processor, plus the current sub-processor list for each one, covering the hosting provider, any managed database or backup service, and any CDN or email provider in the chain. The hosting provider contract and its data location commitments are produced by that provider, so ask for written confirmation of the regions where backups and logs are stored. The analytics platform vendor's documentation covers what the software sends, if anything, to its own servers. Your legal team owns the contracts. The DPA, and any supervisory authority that reviews your file, decides whether the arrangement is adequate.

The assessment should state the transfer tool you rely on for each third-country flow, such as standard contractual clauses under Commission Implementing Decision (EU) 2021/914, or the EU-US Data Privacy Framework only where the recipient is on the DPF List. Commission Implementing Decision (EU) 2023/1795 covers only US organizations on that list, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P, so record its status and the date you checked it. Schrems II held that the Privacy Shield decision was invalid while standard contractual clauses remained valid, which you should explain in your own words. Your legal team and DPO produce this assessment. Independent auditors and the data protection authority decide whether your reliance holds.

Document whether the processor or its parent is subject to third-country law that could compel disclosure, such as the CLOUD Act provision at 18 U.S.C. 2713, and whether that exposure is acceptable for your data. EDPB Guidelines 05/2021 (Example 12) say that using an EU processor subject to such law is not itself a transfer, but complying with a third-country authority request would be, so the controller should assess that exposure before engaging the processor. Under EDPB Recommendations 01/2020, no effective technical measure may exist where access in the clear goes beyond what is necessary and proportionate. The controller's legal team produces this assessment, and the hosting provider supplies the facts about its ownership, support access and government request policy. DeployOpen can document the technical setup so the assessment rests on facts.

The file should show the configured retention period for raw visit data and aggregated reports, the method used to delete or anonymize old records, and proof that backups follow the same policy. The analytics platform produces this evidence through its settings export and a test that confirms old data is removed. Backup retention is set in the backup tooling, so the operations team must document it separately. Keep the settings and test results dated so they match the records of processing. Your DPO sets the retention periods themselves, and an auditor checks whether the configured behavior matches what your privacy notice promises.

No. Hosting the server in the EU removes one transfer, but not every one. EDPB Guidelines 05/2021 (version 2.0) treat remote access from a third country as a transfer, even when someone only views data on a screen for support or administration. A CDN that serves your tracking script, a support vendor with access to the server, or a plugin that sends events to a US endpoint can all move personal data outside the EEA. Map every script, host and administrator login the page loads or uses, then decide which ones stay inside the EU. The EDPB guidelines set out the test in detail.

The cost has four parts: infrastructure, the implementation itself, ongoing operations, and internal staff time. Infrastructure recurs and depends on pageview volume, the number of sites and the hosting model, whether in-house or with a provider. Implementation is usually one-time and covers installation, tag and plugin review, consent setup, data migration and documentation. Operations recurs and covers updates, backups, monitoring and security patches. The biggest drivers are site count, the number of tags and plugins to review, how much history must move, and whether your team already runs similar services. Ask any provider for a quote built from a written scope that lists each of these items separately.

Three inputs shape almost every scope. First, a site inventory: every domain, subdomain, tag, tag manager container, embedded widget and third-party script on each page. Second, administrator access to the web servers, DNS, the CDN account and the chosen hosting environment, with named owners for each. Third, a sign-off path with your data protection officer, who should confirm the data map, retention periods, legal basis and any transfer assessment before go-live. Also identify who will own the platform after handover, because a fixed-scope project ends and someone still has to apply updates. Missing inputs are the most common reason a schedule slips.

A small team can often self-host Plausible Community Edition for one or a few sites, provided it is comfortable with Docker and Docker Compose and the server meets the stated requirements, including at least 2 GB of RAM and a CPU supporting SSE 4.2 or NEON. Plausible's self-hosted page notes that the operator handles installation, upgrades, capacity, uptime, backups and security, and that security fixes arrive only when the operator applies the release. Matomo On-Premise is free to use but takes more work at scale, because its published sizing separates app and database servers once traffic reaches millions of pageviews a month. Consider outside help if no one on the team can own patching, restore testing and on-call duties.

The duration depends on the scope, so no fixed figure applies. The main variables are the number of sites, how many scripts and plugins must be reviewed, whether historical data must be imported, whether consent configuration is needed, and how many internal approvals the DPO and security teams require. A single site on Plausible with no history to import is a much smaller task than a multi-site Matomo estate with a Google Analytics import. Ask for a timeline tied to written milestones, and check which steps depend on your staff, such as access approvals and sign-offs, since those often set the pace.

It supports avoiding reliance on the Data Privacy Framework where an EU-hosted option exists. Commission Implementing Decision (EU) 2023/1795 finds adequate protection only for US organizations on the Data Privacy Framework List, and an appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P. The outcome is not known yet, so a transfer that depends on that decision carries legal uncertainty. Self-hosting in the EU with EU-only administration avoids the question for the analytics stack, though you should still check every US-based subprocessor. Your counsel should record the decision and the reasoning in your transfer documentation.

Keep a record of processing that names the analytics tool, the hosting location, every administrator and support route, and every subprocessor. Add a transfer assessment for any remaining third-country exposure, including CDNs, plugins and vendor remote access. Where a US provider still handles data, keep the standard contractual clauses under Commission Implementing Decision (EU) 2021/914 and your supplementary measures record. Also keep the retention settings, access review logs and the reasoning behind any decision not to use an EU option. Your DPO and counsel decide what is sufficient, and independent auditors assess the evidence, since DeployOpen prepares these records but does not issue assessments or attestations.