HIPAA Compliant Tracking: Stape vs. Freshpaint vs. Ours Privacy

How Server-Side Tracking, BigQuery and Privacy Fit Together

If you’ve spent any time in marketing analytics lately, you’ve heard the same three phrases on repeat: server-side tracking, first-party data, and privacy compliance. Then come the tool names , Stape, Freshpaint, Ours Privacy , plus BigQuery and Google Cloud somewhere in the background.

They can sound interchangeable. They aren’t. Each one sits at a different spot in the data pipeline, solves a different problem, and talks to Google Cloud in a different way. This guide maps the whole ecosystem, from the moment someone lands on your website to the moment that data shows up in a BigQuery table or a Looker Studio dashboard.

The big picture: the privacy tracking and data storage ecosystem

Think of modern tracking as six layers. Every tool in this post lives in one or more of them.

Collection (the website or app). A tag, SDK or pixel in the browser records what happened: a page view, a form submit, a purchase. This is usually Google Tag Manager (GTM), a vendor SDK, or a consent management platform deciding what’s allowed to fire.
The first-party server (the middle layer). Instead of the browser sending data straight to Google, Meta and a dozen other vendors, it sends one stream to a server you control, often on your own subdomain (e.g. yoursite.com).
On that server, data is filtered, hashed, redacted, enriched or blocked based on consent and your rules.
The cleaned data is forwarded server-to-server to GA4, Google Ads, Meta Conversions API, TikTok, LinkedIn and so on.
Storage (the warehouse). A copy of the raw or cleaned events lands somewhere you own: BigQuery, Google Cloud Storage, Amazon S3, Snowflake.
Analysis and activation. BI tools such as Looker Studio, Looker or Power BI read from the warehouse, and reverse-ETL pushes modeled data back out to ad and analytics tools.

The traditional client-side setup looks like this:

Browser → Google / Meta / every other vendor

The server-side setup looks like this:

Browser → Your server → Vendors (and your warehouse)

That middle hop is the whole point. It creates a control layer where you can inspect, modify and restrict what each vendor receives before it leaves your hands.

Why server-side tracking matters now

There are two separate reasons businesses move to server-side tracking, and it helps to keep them apart.

Data quality. Ad blockers, Safari’s Intelligent Tracking Prevention, iOS privacy changes and short cookie lifetimes all chip away at what browser pixels can see. Routing data through a first-party server recovers a meaningful share of lost events and conversions.

Privacy and compliance. With client-side tracking, every third-party script on your page can potentially read page-level data , URLs, form fields, IP addresses. For healthcare and health-adjacent businesses, that’s where HIPAA risk comes from: HHS guidance on tracking technologies made it clear that pixels leaking protected health information (PHI) to vendors like Meta or Google is a problem, and pixel-related settlements have run past $100 million.

One important caveat before we go further: server-side tracking does not automatically make you compliant. It gives you the architecture to control data flows. Compliance still depends on your vendor agreements (BAAs), your configuration, your consent setup and your legal review.

Stape: server-side infrastructure for Google Tag Manager

What it is. Stape is primarily a hosting and tooling platform for server-side Google Tag Manager (sGTM). Google released sGTM in 2020, but running it yourself means standing up and maintaining servers on Google Cloud Run. Stape does that part for you and layers on extra features.

How it works with your website. You keep using GTM. Your web GTM container sends events to a server GTM container hosted on Stape, usually mapped to your own subdomain. Inside the server container, you decide which tags fire and what data each vendor gets , GA4, Google Ads, Meta CAPI, TikTok, Snapchat and many more.

Notable features.

Custom Loader to reduce ad-blocker interference with GTM and GA4 scripts.
Cookie Keeper to extend first-party cookie lifetime.
Anonymizer, which can remove, mask or change selected fields in GA4 requests before they reach Google.
Stape Europe, which hosts containers on EU servers from Scaleway for teams with EU data-residency needs.
Logs showing incoming (and optionally outgoing) requests for testing and auditing.

Healthcare and HIPAA. Stape now markets a healthcare setup: on its Custom plan you can sign a Business Associate Agreement (BAA) for covered services. Stape’s approach is to route only events approved by your privacy or legal team through sGTM and strip PHI before anything reaches analytics platforms. The key point is that you design those rules in GTM , Stape provides the infrastructure, not a pre-built PHI policy.

How Stape connects to BigQuery and Google Cloud. This is where Stape is the most hands-on and flexible of the three:

Write to BigQuery tag. You create a Google Cloud service account with BigQuery access, upload its JSON key to your Stape container (Power-ups → Google Service Account), then add the “Write to BigQuery” tag in server GTM. Every event (or the events you choose) streams into a BigQuery table in your Google Cloud project.
Cloud Storage first. For more control, server-side events can be written as files into a Google Cloud Storage bucket, and BigQuery queries them through external tables.
The same service-account connection supports Firestore, useful for lookups and enrichment.
Log export. Higher-tier plans can export request logs to S3 or GCS.

Because sGTM is Google-native, Stape also pairs naturally with the standard GA4 → BigQuery export.

Pricing (checked late 2026). Stape bills on incoming requests to the server container, not outgoing calls. Plans run from Free (10K requests/month) to Pro (about $17/mo billed annually, 500K requests), Business (about $83/mo, 5M requests) and Enterprise (about $167/mo, 20M requests), with Custom plans above that , the tier where a BAA is available.

Best for: teams already comfortable in GTM who want maximum control, broad destination coverage and low cost, and who have (or can hire) the technical skill to design their own data rules.

Freshpaint: a healthcare privacy platform with built-in guardrails

What it is. Freshpaint positions itself as a healthcare privacy platform , effectively a HIPAA-focused customer data platform (CDP). It signs a BAA, replaces third-party pixels on your site with its own BAA-covered tracking layer, and forwards data to destinations from Freshpaint’s servers.

How it works with your website. You install Freshpaint’s SDK (it includes an autotrack library) or deploy it through client-side GTM using Freshpaint’s GTM template. Google’s and Meta’s scripts no longer run directly on your pages, so they can’t independently collect IP addresses, clicks or form fields. Freshpaint sends them only what you’ve approved.

Governance is the product. Freshpaint’s “HIPAA Mode” is the heart of it:

A Project Allowlist defines which properties are not Anything not on the list is blocked by default.
Each server-side destination also gets its own allowlist, so GA4 can receive different fields than Google Ads.
ID masking uses irreversible hashing on user identifiers.
A consent manager, audit logs and web tracker monitoring round it out.

The trade-off: HIPAA Mode requires destinations to use server-side connections. A tool that only works client-side (Freshpaint’s own example is Hotjar) can’t be used in HIPAA Mode.

A key difference from Stape: Freshpaint’s GTM integration supports client-side GTM only. It does not plug into server-side GTM; instead, Freshpaint offers to help migrate teams off sGTM onto Freshpaint tags. In other words, Freshpaint is generally an alternative to a Stape/sGTM stack, not an add-on to one.

How Freshpaint connects to BigQuery and Google Cloud.

BigQuery as a warehouse destination. You request a warehouse from Freshpaint support, they give you a service email, and you add it as a BigQuery User in your Google Cloud project. Freshpaint then syncs data into a schema in your BigQuery.
Batch, not streaming. Freshpaint syncs to warehouses every six hours, creating one table per event (a “View Homepage” event becomes a view_homepage table). You opt in each event you want sent.
BigQuery as a source (reverse ETL). Freshpaint can also pull tables from BigQuery into its SQL engine and push that data out to analytics or ad tools.
Other supported warehouses include Redshift, Databricks, Postgres, Azure and S3. Warehouse access has historically been tied to higher-tier plans, so confirm with sales.

Best for: hospitals, health systems, telehealth and digital health companies that want a managed, safe-by-default system where PHI is blocked unless someone deliberately allows it.

Ours Privacy: a HIPAA-compliant CDP built by healthcare marketers

What it is. Ours Privacy is also a HIPAA-focused CDP, with a strong emphasis on trust credentials: signed BAAs, SOC 2 Type II, US-only hosting and a “no AI data processing” commitment. It describes itself as a privacy shield between healthcare organizations and ad platforms.

How it works with your website. Like Freshpaint, Ours Privacy replaces risky third-party pixels and captures data through its own tracking, including a Google Tag Manager integration and support for first-party domains and server-side cookies. Before data is forwarded to destinations such as GA4 and Google Ads, sensitive fields are redacted and identifiers are hashed. All destination integrations run over server-side connections.

Beyond the website. Ours Privacy leans into connecting more of the healthcare stack , including EHR systems , and offers attribution reporting (audience performance and channel ROAS against conversion events). That makes it appealing when marketing needs to tie web behavior to downstream outcomes without exposing PHI.

How Ours Privacy connects to BigQuery and Google Cloud.

BigQuery via storage. Ours Privacy’s BigQuery integration stores your event and dispatch data in BigQuery through its storage integrations: data lands as files in a bucket (S3 or Google Cloud Storage), and BigQuery reads it , Ours recommends BigQuery external tables, with partitioning to query across date ranges efficiently.
BI-ready. Its docs call BigQuery the most common warehouse path for Looker, Looker Studio and Power BI, and it also supports Snowflake and S3/Athena for Tableau-style setups.
“Dispatch data” is worth noting: it lets you analyze not only what was collected, but what was actually sent to each destination , useful for audits.

Best for: healthcare marketing teams that want a managed HIPAA platform with strong security credentials, US hosting, and reporting that connects to a warehouse-backed BI stack.

Side-by-side comparison

	Stape	Freshpaint	Ours Privacy
Category	sGTM hosting + server-side tooling	Healthcare privacy platform / HIPAA CDP	Healthcare privacy platform / HIPAA CDP
Primary audience	Any industry (ecommerce, lead gen, SaaS, healthcare)	Healthcare	Healthcare
Works with server-side GTM?	Yes , it is sGTM hosting	No (client-side GTM only)	Has a GTM integration; runs its own server-side pipeline
Who defines privacy rules	You, inside GTM (with tools like Anonymizer)	Freshpaint allowlists, block-by-default	Ours redaction/hashing rules, managed
BAA available	Yes, on Custom plan	Yes	Yes
BigQuery connection	Direct streaming via “Write to BigQuery” tag, or GCS + external tables	Warehouse sync every 6 hours; BigQuery also usable as a source	Via storage bucket (S3/GCS) read by BigQuery
Data lands in	Your own GCP project	Your own GCP project	Your own GCP project
Technical lift	Highest , you build it	Lower , managed	Lower , managed
Typical cost	From free to ~$167/mo; Custom for BAA	Quote-based	Quote-based

Where BigQuery and Google Cloud fit in

BigQuery is the storage and analysis layer underneath all three. It’s where you get a permanent, queryable, unsampled copy of your event data that no vendor can take away, change or threshold.

A few things to understand about it in a privacy context:

Google Cloud will sign a BAA. Unlike GA4 (which Google won’t cover under a BAA), Google Cloud’s BAA covers products including BigQuery, Cloud Storage, Cloud Run and Cloud Functions. That means BigQuery can be part of a HIPAA-aligned stack.
You still have responsibilities. You must keep PHI only in covered products, configure access controls, and turn on audit logging. Google recommends exporting audit logs to Cloud Storage and BigQuery.
The warehouse is your source of truth. A popular healthcare pattern is to use server-side GTM to send GA-style events into your own BigQuery table instead of (or in addition to) Google Analytics, then report in Looker Studio.
Streaming vs. batch matters. Stape’s BigQuery tag streams events in near real time; Freshpaint syncs in six-hour batches; Ours Privacy goes through file storage. For live dashboards that difference is noticeable; for weekly reporting it isn’t.

How it all connects: three example architectures

Ecommerce or lead-gen brand (non-healthcare)

Website + web GTM + consent banner → Stape sGTM (your subdomain) → GA4, Google Ads, Meta CAPI, TikTok → “Write to BigQuery” tag → BigQuery → Looker Studio

You get better data recovery from ad blockers and ITP, cheaper infrastructure, and a raw event copy in your warehouse.

Healthcare organization wanting managed compliance (Freshpaint)

Website + Freshpaint SDK + consent manager → Freshpaint (BAA, allowlists, hashing) → GA4, Google Ads, Meta (server-side only) → BigQuery warehouse sync every 6 hrs → BI tool

PHI is blocked by default; only allowlisted properties reach each destination.

Healthcare organization wanting managed compliance with BI focus (Ours Privacy)

Website + Ours Privacy tracking (+ EHR/CRM sources) → Ours Privacy (BAA, redaction, hashing) → GA4, Google Ads, other destinations → GCS/S3 → BigQuery external tables → Looker / Looker Studio / Power BI

You get attribution and dispatch-level audit data in your own warehouse.

A hybrid also exists: a healthcare team with strong technical resources might use Stape with a BAA on a Custom plan and build its own PHI rules in sGTM. That’s more flexible and often cheaper, but the burden of getting the rules right sits entirely with your team.

Other players in the ecosystem

Stape, Freshpaint and Ours Privacy are three popular options, but they aren’t the only ones. Here’s where other names you’ll run into fit, organized by the same layers we started with.

Server-side GTM hosting (alternatives to Stape). If you like the server-side GTM approach but want a different host, Addingwell and TAGGRS are the most direct competitors, Cloudflare Zaraz handles the basics at the edge, and JENTIS targets enterprise compliance needs. You can also self-host sGTM on Google Cloud Run , the baseline every managed host is measured against, though managed hosting is often cheaper once you account for multiple servers and logging. One thing to watch: Stape, Addingwell and TAGGRS all bill by incoming requests, which isn’t the same as GA4 events or orders, so estimate carefully. Teams with EU data-residency requirements often look at TAGGRS or Addingwell.

HIPAA-ready analytics platforms (replace GA4 instead of protecting it). A different strategy from Freshpaint and Ours Privacy is to swap Google Analytics for an analytics tool that signs a BAA itself , for example Piwik PRO, Matomo, Mixpanel or Amplitude, with Tealium, Heap, Adobe Customer Journey Analytics and Piano Analytics also appearing in HIPAA comparisons. The trade-off: this solves analytics, but not ad-platform conversion tracking, embedded videos, maps or forms.

Other healthcare privacy layers. Blotout and Hipalytics also position themselves as compliant middle layers for healthcare marketing. Hipalytics, for instance, anonymizes PHI before it reaches GA4 and GTM and stores data on US-based servers. Expect vendors in this space to critique one another’s approaches , compare BAA scope and data flows rather than marketing claims. Budget is a real factor too: one agency estimates healthcare privacy platforms at roughly $25K–$150K per year, a very different price point from sGTM hosting.

General-purpose CDPs. Segment and RudderStack aren’t healthcare-specific, but they’re common in warehouse-first stacks and show another BigQuery pattern: RudderStack, for example, stages events as files in Google Cloud Storage and then loads them into BigQuery on a schedule.

Consent management platforms. Tools such as OneTrust, Cookiebot and Osano sit in the collection layer and decide what is allowed to fire in the first place. Every server-side setup still depends on getting consent right at the browser.

No-code and ecommerce-focused tools. For marketers who don’t want to manage GTM at all, tools like Elevar, TrackBee and Tracklution offer more turnkey server-side tracking, especially for Shopify stores. Remember that Stape hosts server-side GTM , it doesn’t remove GTM , so if GTM itself is the pain point, one of these may be a better fit.

How to choose

Ask these questions in order:

Do you handle health information? If not, Stape (or self-hosted sGTM) is usually the most cost-effective and flexible path.
If you do, who will own the privacy rules? If you want a vendor whose product is designed to block PHI by default, look at Freshpaint or Ours Privacy. If you have a skilled in-house or agency team that wants to own the logic in GTM, Stape with a BAA is an option.
How important is GTM continuity? Teams heavily invested in server-side GTM fit Stape naturally. Freshpaint expects you to move off sGTM.
How fresh does warehouse data need to be? Near-real-time streaming favors Stape’s BigQuery tag; batch is fine for most reporting.
What does your security team require? SOC 2, US-only hosting, EU hosting, audit logs and BAA scope differ by vendor and plan. Get them in writing.
What’s the total cost? Remember to include Google Cloud storage and query costs, not just the tracking vendor’s fee.

The bottom line

Stape, Freshpaint and Ours Privacy all move tracking off the browser and onto a server , but they make different bets. Stape gives you powerful, affordable server-side GTM infrastructure and lets you build whatever you want, including direct pipelines into BigQuery. Freshpaint and Ours Privacy give healthcare teams a managed, privacy-first layer with BAAs and guardrails built in, and both hand you a copy of your data in your own warehouse.

BigQuery ties the ecosystem together. Whichever collection layer you choose, owning your event data in your own Google Cloud project , under a BAA if you’re in healthcare , is what turns tracking from a vendor dependency into a durable first-party data asset.

Learn more about how we work with healthcare companies, bringing together digital marketing expertise and analytics to drive patient acquisition.