DISCLAIMER: This page is for information only. It is not legal, financial or procurement advice and does not replace your own due diligence. Licenses, ownership, features and certifications can change: confirm what your decision rests on with the official sources.
🩺 Vitals
- 🟢 Last active: 2026-10-26
- 📦 Latest release: v2.9.2 (2026-10-24)
- 🐞 Open issues: 225
- 🌟 Stars: 13.2k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent stable version the maintainers published as a release on the forge. Some healthy projects publish only tags, or publish their versions elsewhere.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: rybbit.com
- Source: github.com/rybbit-io/rybbit
- License: AGPL-3.0-only
- Deployment: Docker Container
- Jurisdiction: United States 🇺🇸 (Tomato.gg LLC)
- Compliance (SaaS): Rybbit Cloud security and compliance page
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Five services on one node: the backend, the web client, ClickHouse, PostgreSQL and Redis
- Maintenance: Moderate (3/5) - Frequent updates through a script that recreates every container, migrations at each start; two databases to back up, replay retention tuned by hand
- User Management: Moderate (3/5) - Five roles with per-site access, passwords with Google and GitHub sign-in, TLS through the bundled Caddy in the free build; no SAML or OIDC sign-in, no audit log
What the scores mean: Reading the Scores
1. The Executive Summary
What is it? Rybbit is a web and product analytics tool that measures visits to an organisation's websites without cookies. It covers goals, retention, user journeys, funnels, session replays and error tracking, for any number of sites. Some of the vendor's cloud views, such as web vitals, and its email reports are not in the self-hosted build.
The Strategic Verdict:
- 🔴 For teams that need an audit trail or single sign-on: Caution. The free build keeps no log of who changed what, and signs users in only by password, Google or GitHub (User Management).
- 🟢 For teams that want their visitor data on their own servers: Strong Buy. A self-hosted install keeps the collected data on the operator's servers, with no paid edition and no license fee (Deployment, Cost of Ownership).
2. Cost of Ownership
| Cost Component | Rybbit (Self-Hosted) |
|---|---|
| Pricing Model | No license fee |
| Operations | Single VM, several services (ClickHouse, PostgreSQL, Redis), grows with events and session replays; plus your team's time to run it (Maintenance, in the Profile) |
| Support | From the vendor: Rybbit Cloud, a managed service, and paid support for self-hosted installs (enterprise support); elsewhere, a paid service provider |
| Exit | Events API (JSON), or the databases directly (ClickHouse, PostgreSQL) |
What each row covers: Total Cost of Ownership
3. Risk Assessment
- Jurisdiction: Tomato.gg LLC, the project's vendor, is registered in the United States, under US law. The vendor runs Rybbit Cloud, a hosted service where your data can live; its hosts include a party domiciled in or controlled from the US. Data in Rybbit Cloud is within reach of the US CLOUD Act wherever it is stored, since its operator is based in the US. A self-hosted install sends usage data to the vendor unless the operator switches it off. US law can compel the recipient to hand over that usage data.
- The Compliance Shift: Sign-up is open by default, so anyone who reaches a new install can create an account until the operator turns sign-up off. Self-hosting moves the security and compliance duties of running the software to the operator (the operator's compliance checklist). Any audit of Rybbit Cloud (such as SOC 2 or ISO 27001) covers the vendor's own systems, never your install.
- License Risk: Rybbit is under AGPL-3.0-only, an OSI-approved network copyleft license (what it allows and requires). Contributors keep the rights to their code and no agreement transfers them, so moving future versions to terms without copyleft would need every holder's consent.
4. Market Landscape
🏢 Proprietary Incumbents
- Google Analytics: Google Analytics is a hosted service that measures visitors to a company's websites and apps.
Data held by: Google LLC, United States 🇺🇸 (controlled by Alphabet Inc.), subject to the US CLOUD Act for the data it holds, wherever it is stored.
Why teams leave: No plan, free or paid, lets a customer choose its data region.
Exit: BigQuery Export of raw events (BigQuery tables), partial export (the modeling Google Analytics adds to its reports)
With Rybbit: The data is stored wherever the operator runs it (Deployment, in the Profile).
🤝 Open-Source Alternatives
- Plausible Analytics: AGPLv3-licensed, cookie-free web analytics built in the EU. No consent banners required, sub-1KB script. SSO and automated exports gated behind the Enterprise tier.
- Umami: Cookie-less web analytics with no PII collected and no consent banners required. All visitor data stored in your own PostgreSQL or MySQL database.