Vendor category

Analytics vendors

Analytics vendors — product analytics, web analytics, and session replay tools — collect behavioral data about your users. This data includes browsing patterns, feature usage, and potentially form inputs, raising PII and GDPR concerns.

Risk profile for this category

Moderate to high PII sensitivity depending on configuration. Web analytics vendors (Mixpanel, Amplitude) typically have access to user event data. Session replay vendors (FullStory, Hotjar) can capture UI interactions. GDPR consent and data minimization are critical.

Sample vendors in this category

Mixpanel

mixpanel.com

SOC 2 Type II, GDPR DPA available.

View profile →

Amplitude

amplitude.com

SOC 2 Type II, ISO 27001.

View profile →

FullStory

fullstory.com

SOC 2 Type II. Input masking required for PII.

View profile →

This is a sample of vendors in this category. Search the full TrustVendor graph for comprehensive coverage including posture scores, certifications, and subprocessor counts.

Search all Analytics vendors →

Common questions

Do I need GDPR consent before loading analytics scripts?

For analytics that involve personal data processing (almost all web analytics), GDPR requires a lawful basis. Consent is the most common basis, requiring explicit opt-in before analytics loads. Some privacy-preserving analytics tools (Plausible, Fathom) operate without personal data and may not require consent.

Monitor your Analytics vendors.

Get continuous posture scores, subprocessor monitoring, and certification tracking for every Analytics vendor in your portfolio.

Book a demo