🩺 Vitals
- 🟢 Last active: 2026-08-05
- 📦 Latest release: 5.12.0 (2026-07-14)
- 🐞 Open issues: 2567
- 🌟 Stars: 21.7k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: matomo.org
- Source: github.com/matomo-org/matomo
- License: GPL v3 (Core) | Proprietary (Premium)
- Deployment: Docker | SaaS
- Data Model: MySQL / PHP / Redis
- Jurisdiction: New Zealand 🇳🇿 (InnoCraft Limited)
- Compliance (SaaS): ISO 27001 | GDPR
- Compliance (Self-Hosted): GDPR Ready | HIPAA Eligible
- Complexity: Medium (3/5) - PHP / MySQL stack
- Maintenance: Low (2/5) - Professional, established company (InnoCraft).
- Enterprise Ready: High (4/5) - GDPR Manager, ISO 27001 (SaaS), and multi-user RBAC
1. The Executive Summary
What is it? Matomo is an enterprise-grade web analytics platform designed to be the "legal antidote" to Google Analytics (GA4). Developed by InnoCraft in New Zealand (a jurisdiction with a formal EU "Adequacy Decision"), it provides 100% data sovereignty and is explicitly engineered to satisfy the strictest GDPR and HIPAA requirements.
The Strategic Verdict:
- 🔴 For Regulated Industries (Health/Finance): Approve for Self-Hosting Only. InnoCraft does not sign BAAs for Matomo Cloud. Deploying the open-source core within your own VPC is the only path to elite compliance.
- 🟢 For General Corporate Marketing: Strong Buy. Matomo Cloud is an excellent, low-risk deployment that immediately resolves the legal liabilities associated with US-based big tech trackers while providing a familiar, powerful analytics experience.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | GA4 (SaaS) | Matomo (Self-Hosted) |
|---|---|---|
| Data Ownership | Google Property (High Risk) | 100% Sovereign (VPC) |
| Privacy Banner | Mandatory (Cookie-Based) | Optional (Cookieless) |
| Support/SLA | Limited (Free Tiers) | In-house / Paid SLA |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Primarily deployed via Docker Compose or a standard LAMP/LEMP stack. Its architecture is mature and robust, capable of handling high-traffic enterprise web properties.
- Scalability: Highly scalable through distributed database configurations and the use of Redis for high-frequency tracking queues.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (New Zealand): InnoCraft Limited is incorporated in New Zealand, which holds a formal EU GDPR adequacy decision under Article 44. This structurally shields the entity from US CLOUD Act exposure and permits data transfers from EU organizations without additional contractual mechanisms, a meaningful structural advantage over US-headquartered analytics vendors.
- The Compliance Shift: Self-hosting transfers InnoCraft's ISO 27001 ISMS controls entirely to the enterprise. The September 2025 ISO 27001 certification applies to Matomo Cloud only, not on-premise deployments. The enterprise must independently manage infrastructure security, penetration testing, and database encryption. In exchange, self-hosting grants direct MySQL access to raw analytics data, which simplifies compliance reporting for regulated environments.
- License Risk (Open Core Trap): The core platform is GPLv3, safe and copyleft-protected. However, enterprise features including Heatmaps, A/B Testing, SAML/LDAP integration, and Data Warehouse connectors are sold as proprietary Premium Plugins under the InnoCraft EULA. These plugins cannot be freely modified or redistributed. Enterprises must audit which features require proprietary licenses before committing to the self-hosted path.
4. Market Landscape
🏢 Proprietary Incumbents
- Google Analytics (GA4): The industry standard, but faces mounting legal challenges in the EU regarding cross-border data transfers and user privacy.
- Adobe Analytics: An enterprise-grade analytics suite with high TCO and complex implementation cycles; organizations switch to Matomo to reclaim data ownership and eliminate per-hit licensing costs.