Run it on our EU cloud, or run it yourself
Every capability on this page ships in both deployments. The managed cloud runs on EU infrastructure (Germany and Finland) and your consent database never leaves EU hosting. The self-hosted option is not a crippled community edition: it is the same open-source core our cloud runs, installed with one command on your own servers, where your data never touches our infrastructure at all. For regulated industries that sentence usually ends the vendor-risk discussion.
Accessibility you can verify, not just a claim
The consent banner meets WCAG 2.1 AA: full keyboard operation, correct dialog semantics for screen readers, visible focus, labelled switches, and default colors that pass contrast requirements. We do not ask you to take that on faith. Every built-in layout is tested automatically with axe-core on every release and every night, and the banner settings warn you if your own brand colors would drop below the AA contrast threshold. An accessibility statement that names its verification method is one your legal team can actually sign off on.
Built for the day something breaks
Most consent banners silently depend on their vendor's uptime. Ours is designed so an outage on our side never becomes a compliance breach on yours:
- Blocking fails closed. If the consent service is unreachable, blocked trackers stay blocked. No outage ever releases scripts without consent.
- Repeat visitors keep a working banner. The banner boots from state cached in the visitor's browser and works normally through an outage.
- No consent record is ever lost. Choices made during an outage are stored in the visitor's browser and delivered to the server exactly once when it is reachable again, stamped with the time the consent actually happened.
Current availability is public on the status page.
Audit-grade consent records
Consent logs are append-only by design: nothing in the dashboard can edit or rewrite a recorded consent. Visitor IP addresses are pseudonymized at the moment of writing with a keyed hash, so the log stays correlatable for audit purposes without storing raw addresses. Retention is configurable with automated deletion beyond your chosen window, exports go to CSV straight from the dashboard, and a one-click full account export delivers everything we hold in the same public schema the open-source core uses. The day a supervisory authority asks for records is the day this page was written for.
A real developer surface
Your engineering team gets a first-class integration path, not a paste-this-snippet black box:
- TypeScript SDK on npm: @getconzent/consent, with React hooks and a Next.js component.
- A documented, stable JavaScript API (
window.Conzent) with consent events your own code can subscribe to. - Strict Content Security Policy support: the loader picks up your CSP nonce and applies it to everything it injects.
- Async install mode for single-page apps and framework routers.
- A lean payload: the consent script ships only the visitor's language inline and lazy-loads the rest, keeping the wire cost around 100 to 125 KB even with 86 supported languages.
Compliance coverage
GDPR, CCPA and 25+ regional frameworks, IAB TCF v2.4 (2.3 + 2.2) as a registered CMP, and Google Consent Mode v2 in Basic and Advanced modes including URL passthrough and ads data redaction. The cookie register keeps itself honest too: every scan is diffed against the last one, and new, removed or recategorized cookies trigger an alert before a regulator or a customer notices them.
The paperwork
Data processing agreements, defined support response times agreed in your contract, and deployment reviews for self-hosted installations. Our subprocessor list is short and public on the trust page: what we store, where it lives, and how you leave with all of it.
Why this beats both defaults
Against the SMB banner tools, this is a ceiling you will not hit: accessibility, resilience and audit evidence they do not publish. Against the enterprise suites, it is the same checkboxes without the dependency: public pricing instead of a sales cycle, and an open-source core that makes your exit a right, not a negotiation.