Capability Assessment Radar
An empirical multi-axis evaluation comparing Mesa Analytics, Shynet, and Google Analytics 4 across data sovereignty, site speed overhead, core telemetry, and operational complexity.
Key Takeaway
Shynet operates 100% cookieless with daily salted IP hashes, DNT header compliance, and self-hosted PostgreSQL custody under the Apache-2.0 license. Mesa guarantees domestic Jakarta data sovereignty under Indonesian PDP Law, while GA4 forces data into US cloud silos with cross-border liabilities.
Benchmark
An empirical, feature-by-feature evaluation comparing Mesa Analytics, Shynet, and Google Analytics 4 (GA4). Built for developers, CTOs, and designers evaluating JavaScript-free pixel beacons, Django/PostgreSQL stack, script payload, and domestic data residency.
← Scroll horizontally to view full matrix →
| Platform Features | Description & Scope |
Recommended
Mesa Analytics
Jakarta Server (UU PDP)
|
Shynet
Python & Django / Apache-2.0 (Postgres)
|
Google Analytics 4
US Cloud
Google Analytics 4 (GA4) does not allow you to choose specific data storage locations. Google Support Discussion |
|---|---|---|---|---|
| Core Telemetry & Metrics | ||||
| Real-time Analytics | Live stream of visitor events without 24-48h processing lag | Yes (0s Latency) | Yes (Recent Hits Counter) docs | 30m Only |
| JS-Free 1x1 Pixel Tracking | Transparent 1x1 GIF beacon tracking without JavaScript (works in emails, RSS, AMP) | No (Requires JS Script) | Native 1x1 Pixel Beacon docs | No (Measurement Protocol Only) |
| Page Load Time Auditing | Capture browser page rendering latency and resource timing diagnostics | Yes (Web Vitals / INP & LCP) | Yes (Navigation Timing API) docs | Yes (User Timing) |
| Average Session Duration | Time elapsed between initial entry and user departure | Yes (Heartbeat Ping) | Yes (Session Load Delta) | Yes (User Engagement) |
| Bounce Rate Measurement | Percentage of single-page sessions without secondary interactions | Yes (Direct Metric) | Yes (Built-in Calculation) | Yes (100% - Engagement Rate) |
| Origin Domain Whitelisting | Restrict telemetry ingestion to authorized hostnames to block spam hits | Yes (Origin Guard) | Yes (Strict Host Allowlist) docs | Partial (Filter Rules) |
| Custom Event Metadata | Track custom actions (button clicks, downloads) with dynamic key-value properties | Yes (Full Metadata Attributes) | No (Hits & Pageviews Only) | Yes (25 Custom Dimensions) |
| UTM Campaign Parameters | Automatic parsing and attribution breakdown for marketing campaigns | Yes (Source, Medium, Campaign) | Partial (Raw Query String Ingestion) | Yes (Full Attribution Models) |
| Device, Browser & OS Breakdown | Automatic hardware and software breakdown derived from user-agent strings | Yes (Desktop, Mobile, OS, Browser) | Yes (Device, OS, Browser, Screen) docs | Yes (Hardware Diagnostics) |
| Advanced Analytics & Behavioral Modeling | ||||
| Conversion Funnels | Multi-step user journey and drop-off rate tracking across conversion paths | Yes (Built-in Funnel View) | No (Omitted by Design) | Yes (Funnel Exploration) |
| Retention & Cohort Analysis | Track user return frequency, churn periods, and cohort lifecycles | No | No | Yes (Cohort Exploration) |
| Session Replay & Recordings | Visual playback of user mouse movement, rage clicks, and DOM scrolls | No (Excluded for Privacy) | No | No |
| Individual User Profiles | Persistent cross-session timelines of individual user interaction histories | No (Omitted for Privacy) | No (Zero Personal Tracking) | Yes (User Explorer) |
| Privacy, Compliance & Data Sovereignty | ||||
| Cookie-less Tracking | Zero browser cookies, persistent identifiers, or cross-domain fingerprinting | 100% Cookieless | 100% Cookieless docs | No (Persistent Cookies) |
| Cookie Consent Banner Exemption | Legally operates without intrusive GDPR / ePrivacy cookie banner popups | 100% Zero Banner | 100% Zero Banner | No (Mandatory Popups) |
| Indonesian PDP Law (UU No. 27/2022) | Domestic sovereign data residency avoiding foreign cross-border sanctions | 100% Compliant (Jakarta VPS) | Compliant via Self-Host (Your Server) | Cross-border Risk |
| Do Not Track (DNT) Compliance | Automatically respects browser DNT signals without logging visitor data | Yes (Configurable DNT Guard) | Yes (Built-in DNT Respect) docs | No (Ignores DNT Headers) |
| 100% Data Custody | Customer maintains exclusive database custody without third-party ad profiling | Isolated DB | Self-Hosted PostgreSQL | Google Ads Training |
| Open Source Codebase | Complete application repository publicly auditable for security backdoors | Auditable | 100% Open Source (Apache-2.0) github | Closed Proprietary |
| Self-Hostable Infrastructure | Deployable on private bare-metal servers, Docker Compose, or Kubernetes | Managed VPS | Docker / Django / Postgres / Redis install | SaaS Only |
| Architecture, Performance & Integration | ||||
| Tracker Script Weight | Payload size transferred to user browser on initial page load | < 3 KB Ultra-light | < 1 KB (~700B) or 0 KB Pixel docs | 45–50 KB+ (gtag.js) |
| Ad-Blocker Bypass (Custom Ingress) | First-party subdomain endpoint to bypass generic ad-block filters | 98%+ Subdomain Proxy | 95%+ Custom Ingress URL | 30-40% Blocked |
| Zero-Sampling Data Precision | Queries return 100% exact raw rows without algorithmic statistical estimation | 100% Exact Raw Hits | 100% Exact Hits | Heavy Estimation |
| Page Speed Execution Latency | Impact on Core Web Vitals (INP, LCP, Total Blocking Time) | < 5ms Zero Lag | Sub-millisecond Non-blocking (~2ms) | 40–80ms+ Blocking |
| Database Architecture & Scaling | Underlying database engine optimized for massive analytics throughput | ClickHouse Columnar (100M+ Hits) | PostgreSQL Relational DB (Scales with Postgres IOPS) | Google Cloud Pre-aggregates |
| Commercials, Cost & Ownership | ||||
| Base Software License Cost | Software acquisition expense for self-hosting core platform capabilities | Zero Fee Grant | 100% Free Open Source (Apache-2.0) | $0 (Ad-supported) |
| Cloud Managed SaaS Option | Availability of an official hosted cloud tier managed by the platform creators | Managed Jakarta VPS | Self-Host Only | Google Cloud SaaS |
| Telemetry Monetization Policy | Commercial reuse of client traffic data for advertising network intelligence | Zero Resale | Zero Resale (In-Situ) | Feeds Google Ad Network |
| Direct Engineering Support & SLA | Availability of dedicated platform engineers for setup and incident response | YPYM Engineers | GitHub Community | Self-Serve Community |
Start Using Mesa Analytics
Available with zero licensing fees for internal YPYM divisions, partner organizations, and verified institutions in Indonesia. Enter your organization email to receive tenant credentials.
Your information is protected under the YPYM Privacy Policy and PDP Law No. 27/2022.