Matomo
What Matomo publishes, measured on their own site. Every result below links the page we found it on, or lists the addresses we checked.
- 70out of 100
- 10/10Criteria measured
- 2026-08-31Checked
Vendor site: matomo.org · category: Web analytics
Data processing agreement
Published and readable without a login.
Source: https://matomo.org/blog/2023/10/dpa-gdpr/ · checked 2026-08-31
Subprocessor list
The actual list is published, not just a promise to keep one.
Source: https://matomo.org/matomo-cloud-dpa/subprocessors/ · checked 2026-08-31
Data location stated
The hosting location is stated on a public page.
Source: https://matomo.org/privacy-policy/ · checked 2026-08-31
Status page with history
No public status page found.
Checked 3 addresses on 2026-08-31.
Show the 3 addresses we checked
https://status.matomo.org/– The name "status.matomo.org" could not be resolved.https://matomo.org/status– reached, no match (HTTP 404)https://matomo.org.statuspage.io/– Could not be fetched: fetch failed.
Public pricing
Actual numbers on a public page.
Source: https://matomo.org/pricing/ · checked 2026-08-31
Certifications named
SOC 2 or ISO 27001 named on a public page.
Source: https://matomo.org/security/ · checked 2026-08-31
Uptime SLA with a figure
No uptime figure found.
Checked 6 addresses on 2026-08-31.
Show the 6 addresses we checked
https://matomo.org/legal/sla– reached, no match (HTTP 404)https://matomo.org/sla– reached, no match (HTTP 404)https://matomo.org/legal/service-level-agreement– reached, no match (HTTP 404)https://matomo.org/trust/sla– reached, no match (HTTP 404)https://matomo.org/uptime– reached, no match (HTTP 404)https://matomo.org/legal/uptime-sla– reached, no match (HTTP 404)
HTTPS enforced with HSTS
HTTP redirects to HTTPS and the HSTS header is set.
Source: https://matomo.org/ · checked 2026-08-31
No third-party tracking before consent
No consent-free first load found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://matomo.org/– third-party requests before any interaction: app.usercentrics.eu, consent-api.service.consent.usercentrics.eu, m-img.org, privacy-proxy.usercentrics.eu, uct.service.usercentrics.eu, v1.api.service.cmp.usercentrics.eu, web.cmp.usercentrics.eu
security.txt (RFC 9116)
No security.txt found.
Checked 1 address on 2026-08-31.
Show the 1 address we checked
https://matomo.org/.well-known/security.txt– reached, no match (HTTP 404)