Google Analytics turned into a certification program. Plausible stays minimal on purpose. You want product analytics — funnels, events, maybe session replay — without shipping every page view to a US ad-tech graph.
Umami is the polished middle path: ~40k GitHub stars, MIT license, cookieless web and product analytics you self-host or run on Umami Cloud. One script tag, PostgreSQL under the hood, dashboards for traffic, campaigns, behavior, conversions, and revenue — with v3 adding journeys, segments, boards, and optional MCP for AI assistants.
What it actually does
Umami is not warehouse BI (use Superset or Redash for that). It is the analytics layer for sites and apps:
- Acquisition — pageviews, visitors, referrers, geography, devices, real-time views, UTM and link tracking.
- Behavior — custom events, funnels, retention, cohorts, segments; session replay and heatmaps in the v3 line when enabled.
- Conversion — goals, attribution hints, revenue values on events for "which campaign paid for itself."
- Collaboration — teams, shareable stats, API keys, boards for focused dashboards.
Privacy positioning: no cookies and no cross-site tracking by default; you still choose what you send in event properties and must document that for Canadian visitors (PIPEDA cares about purpose and retention, not vendor slogans).
Why self-host?
Data stays in-country. Event payloads and replay data on a Canadian VPS beat default US cloud regions when contracts or public-sector rules require it.
Full v3 feature set. Umami's docs contrast cloud vs self-host; open source on your metal avoids SaaS tier gates for sites, teams, and advanced views — you pay Postgres and ops instead.
Simple stack. Compared to PostHog's hobby Docker zoo or Rybbit's ClickHouse, Umami is Node + Postgres + docker compose up. Agencies running many client sites appreciate one predictable pattern.
MIT license. Embed-friendly for client projects without AGPL surprises.
What running it takes
Fastest path: pull docker.umami.is/umami-software/umami:latest and use upstream docker compose with bundled Postgres. Source installs need Node 18.18+, pnpm, DATABASE_URL, then pnpm build and pnpm start (default port 3000).
Production checklist:
- Change defaults — first build creates admin / umami; rotate immediately.
- TLS — reverse proxy nginx or Caddy; analytics scripts should load over HTTPS.
- 2FA — set
TWO_FACTOR_ENCRYPTION_KEY(64-char hex) before requiring 2FA for staff. - MCP — optional
MCP_ENABLED=1plus API keys; disable if you do not want AI tools touching stats. - Backups — snapshot Postgres before
git pull && pnpm buildupgrades.
Point analytics.yourdomain.ca at the instance; add the tracking snippet from the Umami UI per site.
Who it's for (and who should skip it)
Good fit: SaaS marketing sites, Canadian SMBs leaving GA4, product teams needing events and funnels without PostHog weight, privacy-conscious publishers who still want replay occasionally.
Maybe skip it: if you only need raw access logs, GoAccess is lighter. If you need SQL dashboards on your warehouse, Umami will frustrate you. If you will not patch Node apps, Umami Cloud may be cheaper than incident response.
Hosting it in Canada
Umami fits a 2–4 GB VPS or Docker host with managed Postgres backups — same playbook as other Swift Host client stacks in Beauharnois or Toronto.
Tell us site count, expected traffic, and whether you need replay or MCP if you want a compose template before production DNS goes live.
Want analytics without the surveillance bundle? Talk with Swift Host — we are in St. Albert and actually answer the phone.
