Digital sovereignty
100% EU.No fine print.
The entire fastmon data path runs in the EU, on infrastructure operated in Germany, with no US-jurisdiction provider anywhere in it. No cookies*, no fingerprinting, the IP gone before any code sees it. This is the difference between a tool from the EU and one with an EU region.
What EU hosting really means
From the EU, not just with an EU region.
Most tools that call themselves privacy-friendly are US companies with a data center in Frankfurt. The servers sit in Europe, but the company answers to US law, and the US CLOUD Act reaches its data wherever it lives. An EU region is not the same as EU jurisdiction.
fastmon is different by construction. fastmon labs UG is a German company registered in Hannover, and all customer and monitoring data is processed exclusively in the EU and stored in Germany (Hetzner, Falkenstein data center). Every provider in the data path, meaning every system that processes customer or monitoring data, is a German or EU company: no Cloudflare, no AWS, no GCP, no Vercel, no US-owned sub-processor. Because neither fastmon nor any sub-processor is subject to US law, the US CLOUD Act cannot reach that data.
Sovereignty is only half of it. The tracker is privacy-first by design: it sets no cookies* in the default mode, uses no fingerprinting, and the visitor's IP and User-Agent are removed at the edge before any application code sees the request. What is left is field data you can defend to your data protection officer.
Infrastructure
No US provider in the data path.
Where your data is processed decides who can compel access to it. fastmon keeps every step inside EU jurisdiction.
Operated in Germany
All customer and monitoring data is processed exclusively in the EU and stored in Germany (Hetzner, Falkenstein data center). Nothing leaves that path.
No US-owned sub-processor
No Cloudflare, no AWS, no GCP, no Vercel. Every provider in the data path is a German or EU company.
The CLOUD Act cannot reach fastmon
Because neither fastmon nor any sub-processor is subject to US law, the US CLOUD Act cannot reach it.
EU region is not EU jurisdiction
A US company with a Frankfurt region is still a US company. Sovereignty means no US law is in play, not just servers in Europe.
Sub-processors
Every provider, on the table.
The full data path, from hosting to email to AI. Every one is a German or EU company. No US provider in the data path.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting, storage, backup | Germany, Falkenstein |
| smoxy GmbH | Ingress | Germany, Berlin |
| sevdesk GmbH | Accounting and invoicing | Germany, Offenburg |
| All Quiet GmbH | On-call tooling for engineering | Germany, Berlin |
| ScaleCommerce GmbH | Hosting | Germany, Berlin |
| Lettermint B.V. | Transactional email | Netherlands, Zwolle |
| Soverin B.V. | Business email | Netherlands, Rotterdam |
| BunnyWay d.o.o. | Authoritative DNS | Slovenia, Tržič |
| Mistral AI SAS | AI inference, only if you opt in | France, Paris |
From the AVV, as of 17 July 2026. Five of the nine are in Germany, the rest in the EU. Internal business tools that never process customer or monitoring data are listed transparently on the providers page. See every provider in detail
What we collect
The whole payload, and what is not in it.
fastmon collects field data, not identities. No setting turns on fingerprinting, a cross-site identifier or a per-person profile; the presets only change how much context is captured, never whether you can be recognized across sites or over time.
What fastmon sees
- Core Web Vitals and diagnostics from real page loads
- Country only, 2-letter ISO, derived at the edge from the IP
- Device, browser, OS, connection and viewport as buckets
- Error type, count and stack frames (no message text by default)
- A per-domain, 24-hour stitch signal for unique-visitor counts
What it never does
- No cookies* in the default mode
- No canvas, font, Client Hints, battery, sensor or audio fingerprinting
- No session replay, no reading of page content, no scroll or form capture
- No cross-site identifiers, no third-party enrichment
- No raw IP or User-Agent reaches the backend, ever
Counting without cookies*
Recognized for a visit, not tracked for life.
fastmon counts unique visitors without a cookie* or a device ID. Instead the edge computes a short pseudonymous signal, the stitch, under a secret salt it throws away every 24 hours.
- The salt is a 32-byte random value, held only in the active edge's RAM, rotated every 24 hours and never stored, distributed or logged
- The domain is mixed into the hash, so the same visitor gets a different signal on every site: identifiers never cross domains
- HMAC-SHA256 is one-way and cannot be inverted. And to tie a signal back to an IP, someone would have to brute-force every IP with the live salt, which is gone after a rotation (forward secrecy)
- We treat the stitch as personal data and rest it on the legitimate-interest basis in GDPR Art. 6(1)(f), documented
# rotating_salt: 32 bytes, edge RAM only, rotated every 24h# never stored, never logged stitch = HMAC-SHA256( rotating_salt, IP | User-Agent | collector_hash | domain) # raw IP and User-Agent are discarded here,# before any application code sees the request
Collection presets
You choose how much is collected.
Three presets, from performance-only to full session context. Standard is the default. In Minimal and Standard nothing is stored on the device; only Full places a tab-bound session ID, which expires when the tab closes.
| Minimal | Standard | Full | |
|---|---|---|---|
| Web Vitals, device and connection class | |||
| Error type and count | |||
| Stitch visitor signaledge-derived, for unique counts | |||
| Fetch / XHR aggregates | |||
| Query key names | |||
| Full error stack frames | |||
| Error message text | |||
| Session idwritten to sessionStorage._fms |
Standard (the default) writes nothing to the visitor's device. Only the Full preset writes a single tab-scoped session id that dies with the tab.
Consent and the TDDDG
What we do, and what follows from it.
Whether embedding an analytics tool needs consent under § 25 TDDDG turns on one question: is anything stored in the device, or is anything accessed that is already stored there? Cookies are only the best-known case, not the trigger.
In the default mode nothing is written to the visitor's device, no cookie and no sessionStorage; the write path is removed from the shipped bundle at build time. What gets read are status values the browser itself produces during the page view: timings, viewport class, connection class. In our assessment that is not access to stored information within the meaning of § 25; a stricter reading sees it differently. Only the Full preset writes a session id, and for that you need consent, deferrable until your consent tool calls grantConsent().
The assessment for your own site, though, is yours to make, ideally with your data protection officer. § 25 TDDDG covers the device access; the GDPR covers the processing that follows, and both are assessed in parallel.
Not legal advice. This mirrors how fastmon is built and documented; your deployment is your responsibility.
The data sheet
The facts, without the marketing.
Everything on this page, condensed. All of it comes from the public documentation.
Verified against docs.fastmon.eu. Retention and collection are configurable per site; the stitch is treated as personal data, with the legitimate-interest basis in Art. 6(1)(f) as its legal ground.
Privacy data sheet
- Company
- fastmon labs UGHannover, Germany
- Hosting
- Germany (Hetzner)No Cloudflare, AWS, GCP, Vercel
- IP address
- Removed at the edgeNever reaches the application
- Geo
- Country only, ISO-2Derived at the edge from the IP
- Cookies
- None by default*Opt-in consent mode only
- Fingerprinting
- NoneNo canvas, font, sensor, audio
- Retention
- 90 days defaultUp to 13 months on Enterprise
- CLOUD Act
- No accessNo data-path provider under US law
- DPA
- Public at /en/dpa/Lists every sub-processor
FAQ
EU and privacy, answered.
The questions a data protection officer asks first.
Do I need a cookie banner for fastmon?
No, not in Minimal and Standard mode. Nothing is stored on the device, and the values that get read were not there beforehand: they come into being at the moment of the page view. Naming fastmon in your privacy policy is enough. In Full mode you do need consent, because an identifier is written into sessionStorage. This classification has been reviewed with our external data protection officer; a residual risk remains, because no court has ruled on this constellation.
The full derivation, with the statutory text and the opposing readingWhere is the data stored?
Exclusively in the EU, on infrastructure operated in Germany. No Cloudflare, no AWS, no GCP, no Vercel, no US-owned sub-processor anywhere in the data path. No provider in the data path is subject to US law, so the US CLOUD Act cannot reach it.
How do you count visitors without cookies?
The edge computes a short pseudonymous signal, the stitch, as an HMAC-SHA256 of the IP, User-Agent, a site-specific hash and the domain, under a salt that rotates every 24 hours and never leaves edge memory. It is a one-way HMAC, per-domain and bounded to about 24 hours; it cannot be inverted, and once the salt rotates it cannot be tied back to an IP at all. We treat it as personal data and rest it on the legitimate-interest basis in GDPR Art. 6(1)(f).
What do you collect, and what do you refuse to collect?
Field data: Core Web Vitals, error type and count, device and connection buckets, and country from the IP at the edge. No fingerprinting, no session replay, no reading of page content, no scroll or form capture, no cross-site identifiers, no third-party enrichment. No setting turns on fingerprinting or a cross-site identifier; the presets only change how much context is captured, never whether you can be recognized across sites or over time.
Do you offer a DPA or AVV?
Yes. The Data Processing Agreement is public at fastmon.eu/en/dpa/ and lists every sub-processor in the data path. Questions: privacy@fastmon.eu.
How long is data retained?
90 days by default; on Enterprise configurable per site up to 13 months. Statistics are kept for 13 months. When retention runs out the rows are dropped, not archived.
Can I sign up with Google or GitHub without data going to the US?
Signing in with Google or GitHub is optional. It concerns your login only, never your monitoring data: that always stays on our infrastructure in Germany, no matter how you sign in. If you use social login, you authenticate directly with Google or GitHub, a request you make to their service; we do not route your measurement data there, and the monitoring data path stays US-free. If you would rather not touch a US provider at all, register with email and password; for signing in, your account also supports passkeys, which are device-bound, involve no third party and no password, making them the most private option.
100% EU,
hosted in Germany.
No Cloudflare, no AWS, no GCP. Read-only by default: no cookies*, no long-lived identifiers.
Light
€29/month
200,000 pageviews included.
Need debugging and all features? Standard from €99 for 1M pageviews. Enterprise on request. See all plans