Piwik PRO
Analytics · piwik.pro · last read 2026-10-12
Identity
| Legal entity | Piwik PRO SA |
|---|---|
| HQ | PL |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | piwik.pro · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | piwik.pro | 2026-10-08 |
EU: Clients can choose data centers in Germany, the Netherlands and Sweden (Elastx), but the document names no plan and no cost for this choice.
Subprocessor chain
4 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Cookie Information A/S | DK | Assists in relation to Support and delivery of CMP |
| Elastx | SE | Cloud supplier hosting the SaaS services and related components and content provided online |
| Elastx AB | SE | Data center provider |
| Microsoft | EU | Cloud provided by the sub processor |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · piwik.pro
| Term | What the agreement says |
|---|---|
| Notice of new subprocessors | At least 30 days in advance, in writing to the data controller (longer periods for specific services may be set in Appendix B) |
| If you object to one | Customer may object to the addition or replacement of a sub-processor before it is engaged; no consequence of an objection is stated in this part |
| If you object to one | If parties cannot agree on an alternative sub-processor or workaround after good-faith negotiation, the vendor may choose either not to use the sub-processor for the customer or to terminate the Clauses and the agreement for the affected service |
| Breach notification | without undue delay; if possible within 48 hours of becoming aware |
| Audit | Customer may request access to sub-processors' security audit reports, certifications or declarations; processor audits sub-processors by reviewing such reports; further compliance measures at customer's cost, with fees notified in advance; sub-processor audits may be subject to sub-processors' restrictions and standard terms |
| Audit | Physical on-site inspection of processing locations and systems by controller or its representative; start date, scope and duration agreed in advance; at the controller's cost; processor may object to an unsuitable third-party auditor; sub-processors audited by reviewing their available audit reports and certifications |
| Audit | information necessary to demonstrate compliance; audits including inspections by controller or mandated auditor; procedures in Appendix D |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| DORA | Claimed | — | piwik.pro | 2026-10-12 |
| HIPAA | Claimed | all information processed within our company, in every form and place of our operations | piwik.pro | 2026-10-12 |
| ISO 27001 · ISO27001 | Claimed | all information processed within our company, in every form and place of our operations | piwik.pro | 2026-10-12 |
| EBA’s guidelines for using cloud service providers | Claimed | — | piwik.pro | 2026-10-12 |
| SOC 2 · SOC2 | Claimed | all information processed within our company, in every form and place of our operations | piwik.pro | 2026-10-12 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Piwik PRO; Piwik PRO SA
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Piwik PRO (service) | — | Service only | unknown | piwik.pro | 2026-10-11 |
Vulnerability reporting: piwik.pro, [email protected] (security.txt, expires 2027-12-16; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-12 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-12. Changes appear here only after a human has reviewed them.