Self-hosting your analytics stack used to mean accepting trade-offs: either a bloated PHP application that needs a dedicated sysadmin, or a stripped-down tool that can barely tell you which pages your users are actually visiting. That gap has closed substantially. By 2026, there's a genuinely strong set of open-source analytics platforms that developers can run on their own infrastructure — each with different performance characteristics, licensing terms, and feature depth.
This breakdown covers the tools that are actually worth deploying, with specific technical details on stack requirements, resource sizing, and compliance posture — so you can match the platform to your workload instead of just picking whatever shows up first in a GitHub search.
Why self-host at all?
Self-hosting gives your team deployment control and responsibility for access, retention, recovery and security. Infrastructure, backup and support suppliers may still process data; review those relationships rather than assuming there is no third-party processor.
There's also the compliance side-effect that many developers don't initially anticipate. Tools like Matomo using first-party cookies still need a consent banner in most EU jurisdictions. Cookieless alternatives running on your own server often don't. If you want to ditch cookie consent forms entirely, the tracking methodology matters as much as the hosting model.
Compare infrastructure, storage growth, backups and maintenance time with the managed-service bill. This guide has not benchmarked a fixed-price VPS at a stated traffic volume.
The major platforms, compared honestly
Umami — the developer's default
Umami offers a self-hosted website analytics workflow. Its installation documentation describes supported source and container setups using PostgreSQL. Include database operation, upgrades, and backups in the evaluation, and measure browser cost on your enabled build.
The stack is Node.js + PostgreSQL, which most developers already know how to operate. v3, released in late 2025, improved the data collection pipeline and added more reliable session handling. The MIT license is permissive: you can fork it, modify it, embed it, or ship it as part of a commercial product without restriction.
Umami doesn't need a cookie consent banner because it collects no personally identifiable information. All visitor data is anonymized and aggregated. The GitHub project's maintainers have explicitly confirmed GDPR and CCPA compliance in public discussions, and the design of the system — no cross-site tracking, no persistent identifiers — backs that up structurally.
Resource requirements: A 1-2 vCPU VPS with 1-2GB RAM runs Umami comfortably for sites under ~1M pageviews/month. PostgreSQL is the only dependency, and it's well-understood at every scale.
What it lacks: No heatmaps, no session recording, no A/B testing, and no retention cohort analysis. If you need behavioral analytics beyond pageviews, events, and basic user journeys, you'll hit the ceiling quickly. You can explore how Umami compares to Databuddy if you need more depth alongside cookieless compliance.
Matomo — the feature-complete enterprise option
Matomo is the most feature-rich open-source analytics platform available. Heatmaps, session recordings, A/B testing, funnel analysis, e-commerce reporting, SEO metrics — it's essentially a full GA4 replacement. The European Commission uses it. If depth of reporting is the requirement, Matomo delivers.
The tradeoffs are real, though. The stack is PHP + MySQL/MariaDB, which means more moving parts and higher operational overhead compared to modern Node or Go-based tools. Matomo's own documentation recommends a minimum of 4 CPU cores and 8GB RAM for production deployments, though lower-traffic sites can run on a 2 vCPU / 2GB VPS. High-traffic installs need a dedicated database server and a Redis cache.
Matomo supports configurable collection and optional reports. Check the installed edition, required plugins and each enabled feature; disabling cookies is not a certification that the installation needs no consent.
Best fit: Regulated industries, agencies managing multiple client sites, or teams that genuinely need the full GA4 feature set and have an ops team to maintain it. For teams comparing infrastructure cost, see the detailed Matomo vs Databuddy breakdown.
Plausible CE — lightweight and privacy-native
Plausible Community Edition is a self-hosted option to evaluate separately from the hosted service. Review its current license, installation requirements, and feature coverage in the official documentation. Do not assume that every hosted feature or plan entitlement applies to your installation.
The backend runs on Elixir with ClickHouse handling the analytics data store. That's where the complexity lives. ClickHouse has substantial memory requirements: Railway's deployment documentation specifies a minimum of 1GB RAM just for ClickHouse, with 2-4GB recommended, plus additional resources for the Plausible app and PostgreSQL metadata store. On a 2GB VPS you're right at the edge; 4GB is the practical floor for comfortable operation.
Review the current license for the exact Plausible Community Edition version and your intended use. Source availability and the right to modify or redistribute software are governed by its terms.
Note: Plausible's team has historically been somewhat ambiguous about the long-term trajectory of the CE (community edition) versus their cloud product. Community discussions on Elixir Forum in mid-2025 raised questions about CE's official support status. Worth verifying the current documentation before committing to a production deployment.
Best fit: Developer-led teams wanting a clean, fast dashboard with no cookies. Works well when you have the VPS headroom for ClickHouse and don't need heatmaps or session replay.
PostHog — if you need product analytics, not just web analytics
PostHog offers a Docker Compose self-hosting path. Its current documentation describes self-hosted deployments as officially unsupported; use that support status and the current requirements in your operating decision.
The catch is operational responsibility. PostHog's self-hosting documentation recommends a Linux machine with roughly four vCPUs, 16GB RAM and more than 30GB storage. Self-hosted deployments are officially unsupported: your team owns upgrades, scaling and recovery. Confirm the current requirements before choosing infrastructure.
For teams with the infrastructure to support it, though, PostHog's value proposition is compelling. You get feature flag management with controlled rollouts, session recordings with console log capture, and direct integration between your feature experiments and behavioral analytics. If your analytics requirements go well beyond pageviews into full product instrumentation, check how PostHog stacks up against Databuddy for a clearer picture of the trade-offs.
Best fit: Product teams at well-funded startups or mid-size companies who need the full stack and have dedicated infrastructure. Not appropriate for lean VPS deployments.
GoatCounter — when simplicity is the priority
GoatCounter gets less press than the others, but it solves a specific problem well: it's a single compiled Go binary with SQLite or PostgreSQL as the datastore. No Docker Compose file with six services. No database migrations to manage. You download the binary, point it at a database, and it runs. The script is tiny, cookieless by default, and the dashboard is minimal.
GoatCounter currently provides free donation-supported hosting for reasonable public usage, including personal sites and small-to-medium businesses. Self-hosting is another option. Check the usage policy rather than treating all commercial hosted use as excluded.
Choosing based on your actual constraints
Here's a pragmatic decision framework:
| Constraint | Best fit |
|---|---|
| A team already operating Node.js and PostgreSQL | Umami |
| Broad reporting, with required features and plugins verified | Matomo |
| Focused website reporting, with the installed edition verified | Plausible CE |
| Product analytics + feature flags | PostHog |
| Single binary, minimal infrastructure | GoatCounter |
| Cloud-hosted privacy-first alternative | Databuddy |
A managed service such as Databuddy can delegate infrastructure operations while still requiring a collection, access and reporting review. Use its collection reference and Google Analytics comparison to evaluate the intended workflow.
The GDPR picture across all tools
Cookieless operation and GDPR compliance are different questions. Review actual device access, identifiers, data, purpose, retention and processing arrangements; using cookies does not by itself establish that an implementation is unlawful.
A self-hosted installation still needs a documented processing arrangement, including infrastructure suppliers, support access and backups. Choose the location and controls required by your organization instead of assuming one hosting model is universally safest.
For more detail on how these platforms compare under actual regulatory frameworks, the GDPR compliance guide for web analytics covers the key requirements across tool categories. The 7 privacy-first Google Analytics alternatives guide also provides a broader comparison that includes cloud-hosted options alongside self-hosted ones.
What developers actually care about: deployment experience
For day-two operations, use each product’s current installation and upgrade instructions. The points below are evaluation checks, not measured capacity results.
- For Umami, confirm the supported Node.js and PostgreSQL versions, database migrations and restore procedure in its installation guide.
- For Matomo, review current installation, report archiving and plugin requirements in its official documentation; size infrastructure for your actual collection.
- For Plausible CE, use the current deployment instructions for the selected release and its application/database requirements.
- For PostHog, use the current self-hosting requirements and unsupported-service disclaimer; this guide does not establish a smaller memory configuration as sufficient.
Choose a supported edition that answers the required report and can be maintained by a named owner. A broader feature set increases the number of collection and operating decisions to verify.
Before replacing GA4, inventory advertising, historical reports and event definitions. A new tracker does not automatically replace those dependencies or capture every visit.
For a wider shortlist before taking on operations, compare open-source Google Analytics alternatives. If your main requirement is control of collection, export, and retention, also review the data-ownership platform comparison before choosing a deployment model.