Status
We replaced Google Analytics with Matomo, an open-source web analytics platform that we run on our own infrastructure in Switzerland. In this article, we describe why we made this move, how we implemented the migration technically, which Nine services we used, and what we gained and lost in the process.
Why We Replaced Google Analytics
Google Analytics is the default web tracking solution for many companies. We used it for years. Still, we had long been uncomfortable with the fact that all visitor data from our website was being transferred to Google servers in the US.
This is not merely a philosophical question. As a Swiss managed services provider that advocates data sovereignty and transparency to customers, it was difficult to explain why our own analytics data ended up with a US corporation. Specifically, these were the factors we weighed:
- Data ownership: Visitor data from nine.ch, docs.nine.ch, Cockpit, and deplo.io was transferred to Google in the US, without us having any direct control over retention periods or usage.
- Cookie consent requirement: GA4 sets tracking cookies, which requires explicit user consent. This meant a relevant share of visitors declined analytics, leaving our data incomplete.
- GDPR compliance: The legal situation around GA4 and GDPR has been contested in the EU and Switzerland for years. Several data protection authorities have classified GA4 as non-compliant.
- Consistency: We recommend that customers run their infrastructure in Switzerland. Our own analytics solution should meet that same standard.
The decision in favour of Matomo came quickly: open source, self-hostable, operable without cookies, actively developed, and with comparable functionality for our needs.
What We Track: Four Properties
We operate four digital properties for which we need analytics:
| Property | Technology |
|---|---|
| Website (nine.ch) | Hugo (Static Site) |
| docs.nine.ch | Docusaurus v3 |
| Cockpit (Customer Portal) | Ruby on Rails |
| deplo.io (Deploio Landing Page) | Google Tag Manager (Matomo added additively) |
Each property has its own dashboard in Matomo, and user permissions can be granted granularly per property.
The Technical Implementation
Server and Infrastructure
Matomo 5.10.0 runs on a virtual Nine Managed Server on our Swiss infrastructure. The following Nine services are used to run it:
- Managed Server with Nginx and PHP-FPM (PHP 8.5.6)
- Managed MySQL (version 8.0 on Ubuntu 24.04 LTS, support until May 2029)
- Daily backups (included in the Managed Server offering)
- Puppet for all server configuration and deployment
- Nginx hardening via Puppet: sensitive Matomo directories (
tmp/,config/,lang/,misc/,vendor/) are blocked from external access, and PHP execution is restricted to the root directory
The entire server configuration, including the Nginx rules, is managed via Puppet. This means no manual configuration on the server – everything is versioned and reproducible.
Cookieless and Without Consent
Matomo offers a cookieless operating mode that sets no tracking cookies. This has an important consequence: since no cookies are set, no visitor consent is required. The cookie banner on nine.ch no longer contains an analytics category, and data is complete regardless of whether a visitor accepts or declines cookies.
Analysis is based on anonymised data. The last two bytes of the IP address are removed before storage, making personal identification technically impossible. The data never leaves our servers.
The legal basis is Art. 6(1)(f) GDPR (legitimate interests).
Integration Across the Four Properties
nine.ch (Hugo): The Matomo tracking snippet is embedded directly in <head> via the Hugo template. A hugo.IsProduction guard ensures that no tracking occurs on staging or local environments. At the same time, the GA4 initialisation and analytics category were removed from the cookie consent script. Existing GA cookies (_ga, _gid) are cleared on the first page load.
docs.nine.ch (Docusaurus v3): The GA4 preset was removed from docusaurus.config.ts. The Matomo snippet is embedded via Docusaurus’s headTags mechanism, also with a NODE_ENV === "production" guard. GA cookie cleanup is integrated in the same script.
Cockpit (Ruby on Rails): The snippet is embedded in the application layout (application.html.erb), with a Rails.env.production? guard and the correct CSP nonce to avoid violating the Content Security Policy header.
deplo.io: The Deploio landing page is maintained by our colleagues at Renuo. Renuo continues to use Google Analytics for their own reporting. They added the Matomo tag additively in GTM, so visitor data now flows into our Matomo instance as well.
Content Security Policy
Since Matomo runs on its own subdomain, the CSP headers of the website had to be updated. The Matomo subdomain was added to script-src, img-src, and connect-src. This covers loading matomo.js, the tracking pixel (fallback), and the XHR/Beacon requests to matomo.php.
Privacy Policy
The privacy policy on nine.ch was updated: the section on Google Analytics was replaced with a section on Matomo, explaining the cookieless operation, the Swiss data location, and the anonymisation of IP addresses.
What We Gained Compared to Google Analytics
- Complete data: No sampling, no data thresholds (GA4 hides values below 10 events), no gaps caused by consent refusals.
- Unlimited data retention: GA4 defaults to 14 months, with a maximum of 26. With Matomo, the decision is ours.
- Individual visitor logs: Matomo allows viewing individual sessions, which is not possible in GA4.
- Data sovereignty: All data stays on our own infrastructure in Switzerland.
- No third party involved: Google had access to our visitor data. That is no longer the case.
- GDPR compliance without effort: No consent dialog for analytics, no dependency on third-party rulings.
What We No Longer Have
Honesty matters here: there are features GA4 offers that Matomo does not have in its base version.
- Search Console Integration (Keywords): GA4 could be connected to Google Search Console, making organic keywords visible. This feature is a paid add-on in Matomo. For us, it is the only relevant gap, and one we plan to close with the plugin in the medium term.
- Google Signals / Demographics: GA4 could collect demographic data from logged-in Google users, something we will also add later via plugin.
- Predictive Metrics: GA4’s machine learning predictions require a data volume that is not relevant for us.
- BigQuery export: Not needed for our purposes.
Conclusion
The migration was technically manageable and worth the effort. We now have an analytics solution that aligns with our values: data on our own infrastructure, in Switzerland, without third parties. The cookieless operation is a bonus that makes our data more complete than before.
If you have similar requirements – data sovereignty, GDPR compliance, and complete data without consent friction – we recommend Matomo on a Managed Server as a straightforward and low-maintenance approach.
If you have questions about the implementation, feel free to reach out.
