PostHog

PostHog offers self-hosting and customer-controlled deployment instead of forcing all product data into vendor-managed infrastructure.

The product is fundamentally an analytics and experimentation platform rather than a consumer AI service that thrives on user prompts.

Customers can govern what events, recordings, and product data even enter the system.

Recordings, experiments, and AI-adjacent features can still process sensitive event data if customers configure the platform poorly.

PostHog Cloud, exports, integrations, and service providers can still create meaningful data flows.

Self-hosting can keep analytics data under the customer's own infrastructure and governance.

Customers control projects, exports, and integrations rather than accepting all sharing paths by default.

The privacy materials document cloud-service handling rather than pretending that no third parties exist.

Analytics and observability tools can collect identifiers, events, session replays, logs, traces, device data, and usage metadata.

Teams can reduce exposure with masking, consent mode, sampling, log scrubbing, retention controls, and restricted access.

Backups, exports, and cloud-service settings can still preserve analytics data longer than teams expect.

Customers can govern retention and deletion through project settings and hosting choices.

Self-hosting lets teams own backups, storage, and deletion timing directly.

Project access controls help limit how long and how broadly sensitive analytics data remains available.

Admins can manage projects, member access, capture, recordings, retention, and integrations.

Customers choose what events and properties they instrument in the first place.

Self-hosting and data-masking options let privacy-conscious teams tighten the setup significantly.

End-user privacy still depends heavily on how each customer configures capture, masking, and access.