Matomo
Verified“New Zealand-owned, EU-hosted, sovereignty is BYO.”
- Product model
- Open source (GPL) + Cloud
- Cloud hosting
- AWS Frankfurt / Dublin
- Reach
- ~1M+ installations
- Founders
- Aubry (FR) + Steur (DE)
37 = midpoint of Control 28 & Data 45
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 12 sourced facts across 6 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
30
The legal entity behind Matomo is InnoCraft Limited, incorporated and registered in Wellington, New Zealand (company #6106769), with its registered office and sole director in NZ. Matomo is the product/brand; InnoCraft is the operating company. EU law (GDPR) reaches it as a data processor serving EU customers, and EU data is contractually stored in Europe — but the controlling legal entity is neither incorporated nor headquartered in the EU. This is a non-EU company under NZ jurisdiction, scoring in the foreign-incorporated band with partial credit for genuine EU operational/contractual reach.
Why 30? 3 sourced facts · click to expand
Legal entity incorporated in New Zealand
New Zealand Companies (companiesnz.com) record #6106769 · as of 2026-06-12
InnoCraft is the legal entity / maker of Matomo
Matomo FAQ — Who is InnoCraft · as of 2026-06-12
Matomo Cloud customer data contractually stored in Europe
Matomo Cloud Privacy Policy · as of 2026-06-12
Control & Ownership
25
InnoCraft Limited is 100% owned by INNOCRAFT HOLDING LIMITED, also a New Zealand company, with Matthieu Aubry as sole director — a privately held, NZ-controlled structure. Voting control and the economic majority both sit in New Zealand, not the EU. The founders are European by origin (Aubry French, Steur German) and the team is Europe-heavy, but ownership and control are unambiguously non-EU. No EU listing or EU voting majority. Scores in the foreign-control band.
Why 25? 3 sourced facts · click to expand
100% owned by a NZ holding company
New Zealand Companies (companiesnz.com) record #6106769 · as of 2026-06-12
Privately held; sole director is co-founder
New Zealand Companies (companiesnz.com) record #6106769 · as of 2026-06-12
Founders European by origin, but company NZ-domiciled
Matomo FAQ — Who is InnoCraft · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
38
Two very different stories. Matomo Cloud runs on Amazon Web Services (AWS EMEA SARL, Luxembourg): primary servers/databases in Frankfurt, Germany; backups in Dublin, Ireland. EU data residency is real, but AWS is a US-controlled hyperscaler, so US CLOUD Act exposure persists — a pure EU-region-on-US-cloud posture (≈20-40 band). The decisive mitigant: Matomo is GPL open-source and fully self-hostable on any infrastructure (e.g. EU-sovereign clouds like OVH/Scaleway/Hetzner), which can push real sovereignty to 80+. Score sits above the raw Cloud band to credit the self-host escape hatch that defines this product.
Why 38? 3 sourced facts · click to expand
Matomo Cloud primary host is AWS, Frankfurt DE
Matomo Cloud DPA — Sub-processors list · as of 2026-06-12
Self-hosted On-Premise edition is free GPL open source
Matomo On-Premise page · as of 2026-06-12
No non-US EU-sovereign cloud in the Cloud stack
Matomo Cloud DPA — Sub-processors list · as of 2026-06-12
Operations & People
55
Operations are genuinely distributed with a strong European center of gravity despite the NZ legal HQ. The team spans New Zealand, Germany, Austria, France, the USA and India; co-founders are French and German; and the Feb 2026 reorg added dedicated Country Sales Leads for Germany and France, signaling European market focus. New CEO Adam Taylor (Feb 2026), founder Aubry now CPO. Registered HQ remains Wellington, NZ. This mixed, EU-leaning-but-NZ-anchored profile lands mid-band.
Why 55? 3 sourced facts · click to expand
Distributed team across NZ, DE, AT, FR, US, IN
Matomo FAQ — Who is InnoCraft · as of 2026-06-12
Feb 2026 reorg: new CEO + DE/FR sales leads
Matomo blog — leadership/international expansion · as of 2026-06-12
Registered HQ in Wellington, New Zealand
New Zealand Companies (companiesnz.com) record #6106769 · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Where is INNOCRAFT HOLDING LIMITED's ultimate beneficial ownership held, and is any of it EU-based?
If founders hold the holding company personally from EU residences it could nudge ownership/operations EU-ward, but control remains NZ-domiciled regardless.
- ?
Exact split of revenue/users between free self-hosted and paid Cloud, and how many Cloud customers actually use EU-only configuration.
The infra score hinges on this — most users self-host (sovereign-capable), but Cloud's default is AWS EU regions with US CLOUD Act exposure.
- ?
Whether Matomo Cloud offers a non-US-hyperscaler / EU-sovereign-cloud hosting option for customers who need to avoid the CLOUD Act.
Currently the DPA lists only AWS for Cloud; a sovereign-cloud option would materially raise the infra score for the managed product.
EU Cloud Sovereignty Framework lens
SEAL was designed to rate cloud service providers; applying it to Matomo is an analogous mapping (not a certification), and ratings differ sharply between the self-hosted GPL edition and the managed Matomo Cloud.
Strategic
Privacy-first, open-source mission with growing EU sales focus, but the strategic owner is a New Zealand company, not an EU entity.
Legal & jurisdictional
Operating entity InnoCraft Ltd is incorporated and controlled in New Zealand; EU reach is contractual (GDPR/DPA), not jurisdictional.
Data & AI
Cloud stores EU data in Frankfurt (EU residency real) but on AWS, a US hyperscaler — CLOUD Act exposure. Self-host removes this entirely.
Operational
Distributed team with strong DE/FR/AT presence and EU country leads, but registered operations and HQ sit in Wellington, NZ.
Supply chain
Cloud's critical infrastructure dependency is AWS (US); supporting subprocessors (Oblivion/Xebia NL, Tideways DE) are EU but the core host is American.
Technological
Fully open-source GPL codebase, self-hostable on any infrastructure including EU-sovereign clouds — maximal technological independence and auditability.
Security & compliance
GDPR-compliant DPA, EU data residency for Cloud, data-ownership guarantees; compliance posture is solid but not an EU-jurisdiction guarantee.
Environmental sustainability
No primary-source data found on Matomo/InnoCraft environmental or energy disclosures during this review.
EU alternatives
EU-incorporated (Estonia), EU-hosted on Hetzner (Germany), open-source — privacy analytics with genuine EU jurisdiction and infra.
Polish company, EU/private cloud hosting options; a Matomo fork lineage, but enterprise tiers and US/Azure hosting choices warrant checking the chosen region.
The same GPL product self-hosted on an EU-sovereign cloud (OVH, Scaleway, Hetzner) gives full EU data sovereignty — the vendor stays NZ but your data and infra are EU.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology