---
title: "Open-Source Sovereign Web Analytics with HitKeep | HitKeep"
description: "Use HitKeep for sovereign open-source analytics with self-hosting, managed EU/US cloud, cookie-free tracking, governed MCP access, and exports."
canonical: "https://hitkeep.com/use-cases/open-source-sovereign-web-analytics/"
---

# Open-Source Sovereign Web Analytics with HitKeep

HitKeep is open-source sovereign web analytics for teams that want useful reporting without handing the whole analytics workflow to an ad-tech platform, hosted-only vendor, or opaque assistant integration. You can self-host the same product as one binary, or start in managed EU/US cloud when you want HitKeep to run the operational layer.

## What sovereign analytics means

Sovereign analytics means the deployment model, data location, access model, and export path stay explicit. In HitKeep, that means self-hosting is a first-class path, managed cloud has an EU or US region choice, the public tracker is cookie-free by default, and exports remain available in open formats.

It does not mean compliance is automatic. HitKeep reduces the tracking surface and keeps deployment choices clear, but your legal basis, notices, retention policy, and transfer analysis still depend on your organization and jurisdiction.

## Who it is for

Use this path when you need:

- open-source privacy-first web analytics that security and engineering teams can inspect
- self-hosted analytics with no required PostgreSQL, ClickHouse, Redis, Kafka, or hosted analytics service
- managed EU or US cloud analytics with a visible region choice
- optional Google, GitHub, and Microsoft sign-in with explicit account-linking and verified-email rules
- cookie-free pageviews, automatic events, goals, funnels, ecommerce, UTM reporting, and scheduled reports
- country, city, provider, and ASN audience context without storing raw visitor IP addresses
- Google Search Console aggregate import for mapped site properties
- AI visibility analytics for crawler fetches and AI-referred visits when you wire the needed signals
- governed analytics for AI assistants through read-only MCP and scoped API client tokens
- open exports for migration, audit, archive, or internal analysis

## Deployment choices

Use [single-binary self-hosted analytics](https://hitkeep.com/use-cases/self-hosted-analytics-single-binary/) when direct control over the runtime, network policy, backup process, and data directory is the deciding factor. HitKeep keeps the database and internal queue embedded in the same Go process.

Use [EU or US cloud analytics](https://hitkeep.com/use-cases/cloud-analytics-eu-us/) when the first blocker is operations. HitKeep Cloud handles updates, backups, SMTP, monitoring, and day-two work while keeping the same dashboard, API, MCP option, and export story.

## Sovereignty facts

Use [Facts and Limits](https://hitkeep.com/reference/facts-and-limits/) for current runtime, RAM, storage, export, and MCP details.

| Fact | HitKeep detail |
| --- | --- |
| Source | MIT-licensed application source on GitHub |
| Self-hosting | One about-100 MB Linux binary with embedded DuckDB and NSQ |
| Managed regions | EU Frankfurt or US Virginia cloud option |
| Storage boundary | DuckDB files under the configured data directory, including tenant-local tenants/*/hitkeep.db files |
| IP metadata | Stores derived country, region, city, provider, and ASN fields for analytics reporting, not raw visitor IP addresses |
| Exports | JSON, CSV, Parquet, NDJSON, and XLSX where supported |
| API and MCP | REST API plus optional read-only MCP with scoped API client bearer tokens |
| Limits | Does not replace legal review, CMPs, SIEMs, CRMs, warehouses, feature flags, or experimentation suites |

## Privacy defaults

The public tracker is cookie-free by default and supports Do Not Track behavior. Automatic events record interaction types such as outbound clicks, file downloads, and form submissions without storing form field values.

Read the [privacy-first web analytics guide](https://hitkeep.com/use-cases/privacy-first-web-analytics/), [digital sovereignty guide](https://hitkeep.com/compliance/sovereignty/), and [PECR and ePrivacy guide](https://hitkeep.com/compliance/pecr-eprivacy/) before treating any analytics setup as complete.

## AI assistant access

HitKeep keeps human dashboards and assistant access in the same permission model. The optional [read-only MCP server for web analytics](https://hitkeep.com/use-cases/read-only-mcp-server-web-analytics/) accepts scoped API client bearer tokens, does not accept dashboard cookies, and exposes read-only aggregate analytics.

Use MCP when an approved assistant or internal reporting tool needs to answer traffic, event, ecommerce, AI visibility, Search Console, or docs questions. Use [open exports and takeout](https://hitkeep.com/guides/data/takeout/) when the job needs portable files instead of live assistant queries.

## FAQ

### Is HitKeep open source?

Yes. HitKeep’s application source is MIT licensed and available on GitHub, so engineering, security, and procurement teams can inspect the product foundation before running it.

### Can I self-host HitKeep?

Yes. HitKeep can run as one Go binary with embedded DuckDB and embedded NSQ. Core analytics do not require PostgreSQL, ClickHouse, Redis, Kafka, or a separate queue.

### Does HitKeep use cookies?

HitKeep’s public tracker is cookie-free by default. It uses sessionStorage for an opaque session tuple, so PECR and ePrivacy analysis can still depend on your jurisdiction and consent approach.

### Can AI assistants query HitKeep analytics?

Yes, when MCP is enabled and an approved assistant uses a scoped API client bearer token. The MCP surface is read-only and aggregate-only.

### What makes HitKeep sovereign analytics?

HitKeep gives you control over deployment, region, retention, exports, and assistant access. You can self-host it, choose managed EU or US cloud, and keep analytics portable through open exports.

Managed option

## Start with sovereign analytics in cloud, or self-host when control is the main requirement.

Use HitKeep Cloud when you want managed hosting with a region choice on signup. Self-host when infrastructure control matters more than operational speed.

[Start free in HitKeep Cloud](https://cloud.hitkeep.eu/signup?utm_source=hitkeep_docs&utm_medium=website&utm_campaign=cloud_signup&utm_content=content_cta&plan=free&billing=monthly)[Self-host instead](https://hitkeep.com/guides/installation/)

## Related

- [Privacy-first web analytics](https://hitkeep.com/use-cases/privacy-first-web-analytics/)
- [Single-binary self-hosted analytics](https://hitkeep.com/use-cases/self-hosted-analytics-single-binary/)
- [Facts and Limits](https://hitkeep.com/reference/facts-and-limits/)
- [Social Sign-In](https://hitkeep.com/guides/security/social-sign-in/)
- [EU or US cloud analytics](https://hitkeep.com/use-cases/cloud-analytics-eu-us/)
- [Cookieless event tracking](https://hitkeep.com/use-cases/cookieless-event-tracking/)
- [Read-only MCP Server for Web Analytics](https://hitkeep.com/use-cases/read-only-mcp-server-web-analytics/)
- [Open exports and takeout](https://hitkeep.com/guides/data/takeout/)
- [Digital sovereignty](https://hitkeep.com/compliance/sovereignty/)