Open-source analytics tools — auditable code, owned data

What "open-source" should mean for analytics

Half the tools advertised as "open-source" in this category are open-core teasers: a stripped public repo, a vendor-managed cloud, and the features that actually matter living behind a proprietary EE license. That's a valid business model, but it's not what an open-source-first developer is buying. Below are the tools where the source on GitHub IS the product — whether you self-host or use the vendor cloud.

The four facts checked for each: (1) the public repo runs the same code the vendor cloud runs; (2) the license is a recognized OSI license (AGPL-3.0, MIT, GPL-3.0, EUPL-1.2) without a brand-restriction trojan clause; (3) there's real commit activity from people other than the founder; (4) a self-host deployment is a documented first-class path, not a footnote.

The license spectrum, ranked by your freedom

1. MIT / Apache-2.0 (Umami, Litlyx) — Most permissive. You can fork, modify, ship as part of a closed product, sell. The license barely constrains you.
2. EUPL-1.2 (GoatCounter) — EU-equivalent of GPL-3.0 but explicitly compatible with GPL/AGPL/CDDL/etc. Copyleft, but with clean compatibility. Solo-dev favorite.
3. AGPL-3.0 (Plausible, Matomo, OpenPanel) — Strongest copyleft. If you self-host AGPL software on a public service, you must publish your modifications. Locks vendors into open-source forever; some commercial users back away.
4. AGPL with brand restriction (Countly, some forks) — A real AGPL with a clause prohibiting commercial use of the brand name. Technically still OSI-compliant; ethically debated.

The maintenance reality

Going open-source is a license decision, but the production decision is bus factor. Here's what that means in practice:

• Multi-maintainer projects — Matomo (15 years, dozens of contributors), Plausible (active team), OpenPanel (early but well-resourced). If the founder leaves, the project survives.
• Solo-developer projects — Umami, GoatCounter, Ackee. Excellent code, but the bus factor is 1. If the maintainer burns out, your self-host stays running but stops getting security patches. Mitigate with a fork-friendly license + a backup plan.
• Vendor-led with public source — Plausible CE, OpenPanel. The cloud is the business; the source is the trust signal. You'll get security patches because the vendor needs them for their own SaaS, but expect feature gates between CE and EE.

The honest cost of self-hosting OSS

The "free" in "open-source and free" only covers the license. Self-hosting any of these tools costs you ops time, infrastructure, and an upgrade cadence. Realistic numbers for a 100k-pageview/mo site:

• Cheap path: Umami on a $5 VPS + managed Postgres ($15/mo) = $20/mo + ~2 hours/month of ops. Total cost: $20/mo + $200/year of your time at $100/hr.
• Standard path: Matomo on a Hetzner CX21 ($7/mo) + dedicated MariaDB + nightly backups = $20/mo + ~6 hours/month for archive cron + plugin updates.
• Scaled path: Plausible CE on ClickHouse cluster needs 4+GB RAM minimum = $30-50/mo VPS + ClickHouse tuning expertise. Significant ops.

When NOT to pick OSS

Open-source is the wrong call if any of these are true: you have zero ops capacity, you need vendor support with an SLA, your buyers (legal/procurement) require a real DPA from a real legal entity. The vendor-managed cloud version of these tools (Matomo Cloud, Plausible Cloud, etc.) gives you the OSS code path with managed ops — at a price. Most teams should pay it.