Matomo Cloud
Analytics · matomo.org · last read 2026-10-12
Identity
| Legal entity | InnoCraft Limited |
|---|---|
| HQ | NZ |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 213800XNVEM3HLMNDX92 |
| US CLOUD Act reach | Not determined from the sources read |
| Source | matomo.org · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | matomo.org | 2026-10-08 |
EU: Matomo Cloud data is hosted in Frankfurt, Germany; the document gives no customer choice, plan requirement or extra cost for this location.
Subprocessor chain
4 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services EMEA SARL, Luxembourg | — | Secure CDN (Content Delivery Network) to store and deliver JavaScript files. |
| Amazon Web Services EMEA SARL, Luxembourg | DE, IE | Secure infrastructure for servers and databases and logs. |
| Oblivion Cloud Control B.V (part of Xebia Group B.V) | NL | AWS solution provider: secure infrastructure management; IT consulting services, support services |
| Tideways GmbH | DE | Application Performance Monitoring (APM) |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · matomo.org
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | Email notice before the sub-processor list changes; list updated within 30 days of notice if no legitimate objection |
| If you object to one | Objection must give reasonable, documented grounds of the sub-processor's non-compliance with data protection law; if InnoCraft considers it legitimate, customer may terminate the Agreement by written notice; no objection means authorisation |
| Breach notification | without undue delay |
| Breach notification | without undue delay, by email |
| Audit | information to demonstrate compliance (certifications, written information, interviews; ISO/IEC 27001, Vanta reports, third-party audit summaries as primary evidence); audits by Customer, its mandated auditor or supervisory authority; physical/system access only where required by Data Protection Laws or a supervisory authority, subject to reasonable notice |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
No certification claims transcribed yet.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | INNOCRAFT LIMITED · INNOCRAFT LIMITED | ISSUED | NZ | 2027-03-25 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
- Data Privacy Framework List (US): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under InnoCraft Limited; Matomo Cloud
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Matomo | — | Declared | unknown | matomo.org | 2026-10-11 |
Vulnerability reporting: the well-known path returns an HTML page, not a security.txt (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-09 |
| lifecycle | Public | full | 200 | 2026-10-11 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.