Stape, tested from the configuration side

Rhobin

August 27, 2026

7 min read

Stape is a mature, agency-grade server-side tagging platform with a five-tier pricing ladder and an unusually deep set of operational tools, IP blocking, request scheduling and multi-domain support among them. The maturity shows up as more configuration surface to get right, not less specialist work, and one certification claim on its own marketing page does not hold up against its own compliance statement.

The symptom

Type "stape review" into Google and the top results are Stape's own pricing page restated in different words, a listicle ranking six or seven server-side vendors on feature count, or a star rating on a review aggregator with no detail underneath it. None of them have configured a Stape container for a paying agency client and said what that was actually like.

That leaves an agency owner comparing marketing pages against marketing pages. The pricing page says what ships on each tier, not what changes once the wizard ends and someone has to decide what a specific client's container should do with each event.

This is that review, written from the side of the table where Archon Labs actually sits: configuring server-side tagging tools for agency clients, Stape included, not evaluating it from a demo account for a listicle.

Why every other review reads the same

Server-side tagging vendors are all selling the same underlying mechanic, so their marketing pages converge. Google's own documentation is explicit that the server container "has to run on the same domain" as the website to behave differently from a third-party script, and that on the default endpoint the server "runs in a third-party context" and "can only set Javascript cookies" (Google, custom domain setup). Every vendor's "resilient to blockers" or "extended cookie lifetime" line, Stape's included, describes that one requirement, not a proprietary trick.

The reason a whole feature category exists around it: a JavaScript-set cookie in Safari is capped at seven days (WebKit), a correctly configured first-party, server-set cookie can reach up to 400 days (Chrome for Developers), covered in more depth in the cookie lifetime piece. Ad blockers strip 30-40% of events before they leave the browser, on top of the 15-30% of conversions that go consistently uncaptured regardless of blockers. That is why a feature checklist is the wrong way to judge these tools. Stape has a mature version of nearly every item on it, so does its closest competitor. The difference worth reviewing sits one layer deeper.

Stape's five-tier pricing page, annotated to separate features that exist on nearly every server-side vendor's tool from the ones that are specific to Stape's tier structure

What good looks like: Stape on the configuration side

Stape's tier structure is more granular than most competitors', and that granularity is the first sign of a more mature product. Free runs to 10,000 requests a month, with a custom loader, analytics, a setup assistant, a global CDN and an anonymizer. Pro, at $17 a month, raises the ceiling to 500,000 requests and adds three-day logs, a Cookie Keeper for standard cookies, bot detection, ad blocker info and 24/7 support. Business, at $83 a month, reaches 5,000,000 requests and adds multi-zone infrastructure, custom cookies, up to 20 domains, monitoring, a file proxy, IP blocking, and request scheduling or delay. Enterprise, at $167 a month, reaches 20,000,000 requests and adds an account manager, up to 50 domains, and log export to S3 or Cloud Storage.

That Business tier is where the maturity verdict lands. IP blocking, request scheduling and request delay are not features a small tool bothers building, they are what an agency running many client containers eventually needs once volume and edge cases pile up. Stape's own tier documentation confirms the gating directly: moving up a tier "can unlock three different things: more requests/events, more pixels or domains on gateways, and access to features that lower tiers can't use" (Stape, plan tiers and limits), and log export is available "only from the Enterprise plan." That reads as a platform built for an agency's operational reality, not just a single site owner's.

The documentation backs that up. Stape's getting-started guides walk through creating containers in Google Tag Manager and Stape, adding a custom domain, sending data to the server and testing the configuration, and Stape Academy adds free structured training through integrating Google Analytics, Google Ads and Meta (Stape, documentation). That is broader than a single getting-started page, but it does not remove the work: the guides teach the standard container flow, they do not make the mapping, consent-gating and cookie-domain decisions a specific client's stack needs.

On EU hosting, the checkable claim holds up: Stape Europe runs on Scaleway, a named European cloud provider, across four zones in Italy, the Netherlands, Poland and France, and states it does not share user data with US companies (Stape, EU hosting). Its own FAQ adds the honest caveat that Stape Europe alone does not make Google Analytics GDPR compliant.

One claim does not hold up on inspection, worth naming since an agency owner would otherwise take it at face value. Stape's homepage carries structured data listing a broad set of certifications, ISO 27001, SOC 2, HIPAA, DORA, GDPR, US Data Privacy and CCPA among them. Stape's own GDPR statement page describes those same standards only as criteria Stape uses to evaluate its third-party vendors, not as certifications Stape itself holds (Stape, GDPR statement). The two pages, from the same company, disagree. Until that is cleared up, treat the homepage certification list as unverified rather than repeat it to a client.

a simple before/after of a client's cookie lifetime, 7 days on the default endpoint versus 400 days on a correctly configured custom domain

Whether the vendor choice matters as much as a comparison table suggests is answered in more depth in whether the sGTM tool matters. What Stape earns on its own merits is the more mature platform reviewed so far on this site: deeper documentation, a more granular tier ladder, and operational features built for an agency managing several client containers at once. None of that changes what still has to happen after signup, mapping each event correctly, gating on consent, and configuring the cookie domain to reach anywhere near 400 days.

That configuration work is what Archon Signal is built to do properly on top of whichever vendor an agency already pays for. For one performance agency, getting that layer right recovered 38% of the client traffic affected by tracking prevention, lifted measured conversions by 26% on average, and saved 14 hours per project that used to go into manually reconciling numbers across platforms. Stape, or any comparable tool, gets an agency a working container. It does not get them that result on its own.

FAQ

Questions a skeptical agency owner asks before trusting Stape with a client account.

Is Stape actually GDPR compliant, or is that just a page on its site?

The EU hosting claim checks out: Stape Europe runs on a named European provider across four EU regions and states it does not share data with US companies. The broader certification list on Stape's homepage, however, is not repeated on Stape's own GDPR statement page, which treats those standards as vendor-evaluation criteria rather than credentials Stape holds. GDPR compliance also depends on how consent is configured client-side, which no hosting choice settles by itself.

Is the free tier usable for a real client, or is it a trial in disguise?

For a small client under 10,000 requests a month, yes, though the free tier lacks Cookie Keeper and bot detection, which only arrive on Pro at $17 a month. Most agency clients outgrow the free tier's request volume once server-side event volume ramps up, and the jump to Pro is inexpensive relative to what an unconfigured Cookie Keeper costs in recovered conversions.

If I set up Stape myself, do I still need a specialist?

The tool gets a container running and, from Business tier up, gives you the operational knobs, IP blocking, request scheduling, multi-domain support, to run it at agency scale. Whether each event is mapped to the right ad platform, whether consent gating matches the client's actual banner, and whether the cookie domain reaches anywhere near 400 days, are decisions the tool presents as options rather than makes for you.

How does Stape compare on price to what agencies typically already pay?

Published tiers run from free up to $167 a month for 20,000,000 requests, with a custom Enterprise-plus tier above that. Where that lands relative to a specific agency's spend depends on request volume and billing cycle, both worth checking against Stape's current pricing before committing, since plans change without notice.

Is Stape actually the more mature tool, or is that just a preference?

By the checkable evidence, yes: a five-tier structure, deeper documentation and a free academy, and operational features, request scheduling, request delay, IP blocking, that read as built for an agency running several client containers rather than one site. That maturity is a reason to prefer it over a comparable EU-hosted alternative, not a reason to skip the configuration work either tool still requires.

An audit shows exactly how much of a client's current tracking setup a tool like Stape would actually recover, and how much still depends on the configuration around it. Request a free audit.