Web analytics requirements checklist

Yes for some platforms, but the depth of the import differs. Plausible Community Edition documents a Google integration configured with GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET that enables Search Console keyword data and GA4 historical import from the site's Imports and Exports settings. Its import brings in historical GA4 stats as daily aggregates up to the first native Plausible visitor, supports up to 5 GA properties per site, cannot import ecommerce revenue, and approximates unique visitors by summing daily uniques. Matomo's Google Analytics Importer is a free plugin for On-Premise, but it imports only aggregated report data, so the Visitor Log, Ecommerce Log, Custom Reports and Segmentation do not work for imported reports and some reports such as Funnels are not imported. Test with a copy of one real property, compare totals for a fixed date range, and confirm with the vendor which reports you lose before you retire the old property.

Test that the analytics script loads only when the rules you have chosen allow it, and that the consent state reaches the analytics configuration correctly. Check three things: the tag manager fires the analytics tag only after the agreed consent state, the consent banner or its absence matches the legal position you have documented, and any feature that adds personal data collection, such as User ID, heatmaps or session recording, is disabled or moved behind consent. Matomo's ePrivacy guidance notes that adding such features can remove the audience measurement exemption that some regulators grant in France, Italy, the Netherlands and Spain. Ask your legal or privacy team to confirm the applicable position, and record the test results as evidence.

Confirm the single sign-on method each edition supports before you plan the work, because the answer changes by product and edition. Plausible's self-hosted page lists single sign-on among features missing from Community Edition compared with Plausible Cloud, so an SSO requirement may point toward a different edition or an approved workaround. For Matomo and Umami, confirm with the vendor whether SAML, OpenID Connect or LDAP support is built in or provided by a plugin, and whether it is free or paid. Test that disabling a user in the identity provider blocks dashboard access, that group membership maps to the correct site-level roles, and that break-glass local administrator access is documented and tested.

Test the export paths you actually need, not the ones in the brochure. Typical paths are a scheduled export of aggregated reports, a raw event export, a reporting API, and a direct database connection. Confirm for each platform whether the export is aggregated or event-level, how it handles late-arriving data, and whether the export format is documented. Test one month of data end to end: export it, load it into the warehouse, and reconcile totals against the dashboard. Ask the vendor or implementation partner to document the schema and any licence limits on reuse of exported data, since some editions restrict API or streaming access.

Confirm this with each vendor before you commit, because the answer depends on edition. Plausible's self-hosted page lists the Looker Studio connector among features missing from Community Edition compared with Plausible Cloud, so a Looker Studio dashboard on Community Edition will need another route, such as an export into a warehouse. For Matomo and Umami, check the current documentation and plugin listings for a supported connector and whether it works with a self-hosted instance and a private network. Test that the connector can reach your server through your network controls, that the data refreshes on the schedule you need, and that the user who authorizes it has only the access the dashboard needs.

Test the ecommerce tracking path end to end, because platform plugins vary in what they capture. Confirm which plugin or tag your store platform needs, whether it sends order, revenue and product data to the analytics server, and whether it respects the consent state from your banner. Plausible's Community Edition does not include ecommerce revenue goals, so an order revenue requirement needs to be checked against Matomo or Umami's ecommerce support. Place a test order in a staging store, confirm the revenue and order count match the store back end, and check that no customer personal data such as names or addresses reaches the analytics server. Ask the plugin vendor for its licence terms and supported platform versions.

Test whether the API covers the reports and write operations you need, and whether the self-hosted edition has the same access as the cloud service. Umami's pricing page states that Umami Cloud adds features the self-hosted version lacks, including email reports and a streaming API, so a streaming requirement may need to be confirmed as unavailable on self-hosted. Check the API authentication method, rate limits on your own server, and whether tokens can be scoped and revoked. Confirm retention settings in your own environment: Umami Cloud plans list retention periods, while self-hosted retention is set by your own backup and deletion procedures. Test that a deletion request removes data from the database and from backups within your documented window.

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For integrations, that can include connecting analytics to your identity provider, tag manager, consent platform, warehouse and ecommerce plugins, and running test cases against each. Most engagements are fixed-scope, so the integrations, test cases and acceptance criteria are agreed in writing before work starts. DeployOpen does not publish a price list, and a quote follows from that written scope. Ask any partner which integrations are in scope, who owns the test evidence, and what happens to the integrations when the platform is upgraded.

The honest answer depends on which costs you count, so compare the same line items on both sides. A SaaS subscription is a recurring fee that scales with traffic or events. Self-hosting removes the subscription but adds server hosting, storage, backups, upgrades, monitoring and staff time, plus any implementation work. Published vendor prices are a starting point: Umami Cloud lists Pro at $20 per month for 1 million events, Plausible Cloud lists Starter at $9 per month for 10k monthly pageviews, and Matomo Cloud starts at 29 (excluding tax) per month. Matomo On-Premise Community is free to download, but that does not make operations free. Ask any partner for a written quote that separates one-time setup from recurring hosting and support, and state the traffic tier it assumes.

Timing depends on scope, not on the tool alone. A single-site install on a prepared server can be simple, while multi-site rollouts, identity integration, consent configuration and data migration add work. Traffic volume matters because Matomo's published sizing moves from one server for up to 1 million pageviews a month to separate app and database servers for up to 10 million. Data migration is another variable: Plausible's Google Analytics import stores historical GA4 data as daily aggregates, and Matomo's importer brings in only aggregated reports. Confirm the timeline in the written, fixed-scope agreement, and ask which milestones depend on your team's access and approvals.

Your team provides the environment, access and decisions. Expect to supply hosting in an approved location, container or server access, DNS and TLS certificates, database resources, an identity provider for staff logins where required, and a named owner who can approve the tracking scope. Plausible's Community Edition requires Docker, Docker Compose and at least 2 GB of RAM, and Umami's source install requires Node.js 18.18 or newer with PostgreSQL 12.14 or newer. Ask the partner to list every prerequisite, who owns each one, and which items must be ready before the work starts.

Yes, many teams run these platforms in house, but the work continues after launch. Plausible states that Community Edition operators manage installation, upgrades, capacity, uptime, backups and security themselves, and that Community Edition is community supported only. Plausible also notes that security fixes arrive only when the operator applies the release, and a security release, v3.2.1, was published on May 15, 2026. Matomo's pricing lists forum support for its free edition. Decide who applies upgrades, who watches uptime and who answers when a release breaks tracking before you choose between in-house operation, a retainer or a partner.

Regulated organizations add evidence, access and data location requirements to the checklist. Hosting inside your own cloud account or data center keeps visitor data under your control, but you still need documented retention settings, access reviews for the analytics admin console, backup encryption and a record of configuration decisions. Consent is a legal question, so the analytics setup alone does not settle it. Matomo's ePrivacy guidance says a consent exemption can be lost when features such as User ID, heatmaps or session recordings are added. Ask counsel and your auditors which evidence they expect, and treat any partner as preparing that evidence, not certifying it.

Ask for a written, fixed-scope quote that lists each deliverable and the exact platform and version to be installed. The quote should name the environment, the number of sites, the expected traffic tier, the integrations in scope such as Google Search Console or identity providers, and the data migration method. Ask how one-time implementation is separated from recurring support, upgrades and backups, and whether testing, documentation and handover are included. Ask which items the client must provide, how changes to scope are priced and approved, and what happens if a vendor release changes behavior during the project. Ask whether the partner will document compliance-relevant settings for your auditors.

Licence terms decide what you may modify, distribute and sell to others, so check them before you shortlist. Matomo's repository is under GPLv3, Plausible Community Edition is under AGPLv3 or any later version, and Umami is under MIT. Plausible's self-hosted edition also omits features found in Plausible Cloud, including single sign-on, the Sites API and the Looker Studio connector, so confirm each feature you need in the edition you plan to run. Ask your legal team whether any paid add-on, such as Matomo's Heatmap and Session Recording plugin under the InnoCraft EULA, changes your obligations.