Session recording tools

hotjar

Session recordings and heatmaps from Malta

MaltaEUFree plan Ownership reviewed, controller unresolved

Scope verdict

Ownership reviewed, controller unresolved

This service remains visible for context, but it is not counted or recommended as a European-controlled option.

How we classify services

Hotjar is a session recording tool from Malta. It records how visitors move through a site, turns that into heatmaps and adds surveys, so product and design teams can see where people hesitate instead of guessing from numbers alone.

The company is based in Malta and therefore in the EU, which makes it a European alternative to the American analytics suites, although the service itself appears to run on Amazon Web Services. It suits teams that want a qualitative picture of how a website is actually used.

Pricing

The free plan covers up to 1,000 pageviews, three heatmaps and 300 recordings.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Public website

Amazon Web Services

US-controlled cloud
Observed
A 18.65.39.77, 18.65.39.121, 18.65.39.85 · AS16509

Why this matters

This public website route ends on Amazon Web Services, whose European seller is wholly owned by Amazon.com, Inc. An EU region can provide European data residency but remains under US ultimate ownership. DNS does not reveal the AWS region, the core service's host, or use of the separately operated AWS European Sovereign Cloud.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 10 aspmx.l.google.com · 20 alt1.aspmx.l.google.com · 30 alt2.aspmx.l.google.com · 40 aspmx2.googlemail.com · 50 aspmx3.googlemail.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked: