whats-best.ai
Search Sign in

Content Marketing

Strapi

EU-Made Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Strapi Solutions SAS · strapi.io

Report an error on this page Is this your product? →

Link to this page

Strapi: AI-assisted analysis on whats-best.ai Strapi: AI-assisted analysis on whats-best.ai (dark)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

Strapi at a glance

Vendor
Strapi Solutions SAS
Headquarters
Not stated on the vendor’s pages as of 13 Oct 2026
Data hosting
Not stated on the vendor’s pages as of 13 Oct 2026
Free plan
Yes, per the vendor’s own page source, captured 13 Oct 2026
Panel verdict
The AI panel rates Strapi 2.5/5, the mean of 6 judges. Strapi is an open-source headless CMS from Strapi Solutions SAS of Paris, named as data controller in the privacy policy, self-hosted under the MIT licence or as Strapi Cloud. how scores are made
As of
Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources

Strapi alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The Data Protection Officer

Weighted verdict

Signs off every tool that stores the company's drafts, author profiles and campaign data. Wants the contracting entity and hosting region named, the subprocessor list with the AI providers on it, prompt retention in days, and training on customer content excluded in the terms rather than in a blog post.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Data Protection Officer

Panel median The Data Protection Officer This judge’s scores over the panel median. Each label opens its reasoning below.
Scores per criterion, in stars out of 5
Criterion Panel median The Data Protection Officer
Planning, editorial calendar & briefs 1 of 5 2 of 5
Creation, review & approval 3.5 of 5 3.5 of 5
Structured content, localisation & export 3.5 of 5 3.5 of 5
Publishing, distribution & integrations 3 of 5 3 of 5
AI assistance & content rights 1 of 5 1 of 5
European sovereignty 1.5 of 5 1.5 of 5
Pricing transparency 2.5 of 5 3 of 5

Planning, editorial calendar & briefs

How this is scored

Turning a content strategy into scheduled work: topics and campaigns, an editorial calendar across channels, briefs that carry the goal, audience and keywords to the writer, and a view of what is due, late or missing.

0 — No planning features; content is created as standalone entries with no calendar, status or owner.

3 — A shared calendar with publish dates and simple statuses, but no briefs, no campaigns or topics to group work under, and no notion of who owns a piece.

5 — An editorial calendar across channels with owners, due dates and custom statuses, briefs attached to each piece, and content grouped by campaign or topic cluster.

8 — Strategy is connected to the plan: topics or personas defined once and assigned to pieces, configurable workflows per content type, workload and deadline views per person, and recurring formats scheduled as series.

10 — The plan is accountable: every published piece traces back to its brief, topic and campaign, gaps in coverage per topic or funnel stage are reported, and plan-versus-published is visible over time without a spreadsheet.

Report an error

The Data Protection Officer

Custom review stages with named owners and releases for publishing batches of content together are the only planning-adjacent capabilities the captured pages show, and the captured campaign-management page itself carries hosting and framework material rather than planning detail. I found no public information on an editorial calendar, due-date or workload views per person, briefs carrying goals and keywords, or grouping of work under campaigns or topic clusters. 5 6 7 2

Report an error

Creation, review & approval

How this is scored

Writing and reviewing content together: editing with comments and suggestions, roles and permissions for internal and external contributors, and an approval trail that records who released which version.

0 — Single-user editing with no comments, no roles beyond admin, and no record of changes.

3 — Comments and a version history exist, but every user can publish, external writers need a full seat, and approval is a status anyone can set.

5 — Roles that separate writing from publishing, inline comments and suggested edits, a version history with restore, and guest or freelancer access limited to assigned pieces.

8 — Configurable multi-step approval per content type or market, mandatory reviewers (legal, product, brand), scheduled publishing that waits for approval, and an audit log of every edit, approval and publish with user and timestamp.

10 — Approval is evidence: the exact version each approver released is preserved and exportable, permissions reach down to field and locale level, and the audit trail is retained for a stated period and available after the contract ends.

Report an error

The Data Protection Officer

Configurable multi-step review per content type with per-stage role permissions, assigned owners, a required stage that blocks publishing, and automatic audit-log capture of workflow, stage and assignee changes are all evidenced, with SSO and audit logs on the Enterprise plan. I found no public information on inline comments or suggested edits, scheduled publishing tied to approval, or a stated retention period and export path for the approval trail after the contract ends. 6 7 7 2 1

Report an error

Structured content, localisation & export

How this is scored

Whether content is stored as reusable structure rather than pages: a content model, components shared across channels, German and other locales managed side by side, and the whole repository exportable in a documented format.

0 — Content stored as formatted pages with no structure, one language per entry, and no export beyond copy and paste.

3 — Custom fields or templates exist, but localisation means duplicating entries, assets live elsewhere, and the only export is HTML or a CSV of titles.

5 — A configurable content model with reusable components, field-level localisation with fallback languages, a media library with alt text, and an export of entries and assets in JSON or a similar documented format.

8 — References between entries, variants per market or audience, translation workflows with status per locale and connectors to translation services named, and a full export of content, model, locales and assets documented and self-service.

10 — The repository is portable by design: model and content exportable together and re-importable, migration tooling or a CLI documented in both directions, version history included in the export, and no feature that only works while the content stays.

Report an error

The Data Protection Officer

A no-code content model with components, dynamic zones and six relation types, per-content-type internationalization with unlimited locales, and a self-service export command covering schemas, content, relations and assets in documented formats make the repository genuinely portable, and the terms commit to self-service export in an industry-standard format. I found no public information on field-level locale fallback, per-locale translation workflow status, or named connectors to translation services, and version history is not stated to be part of the export. 8 9 8 2 12 10

Report an error

Publishing, distribution & integrations

How this is scored

Getting approved content to where it is read: publishing to websites and channels, a documented API and webhooks, and named connections to the CMS, CRM, analytics, SEO and translation tools a marketing stack already runs.

0 — Content leaves only by copy and paste; no API, no webhooks and no named integrations.

3 — Publishing to one CMS through a plugin, a handful of named integrations, and an API that is mentioned but not publicly documented.

5 — Publishing to websites and several channels from one place, a publicly documented REST or GraphQL API, webhooks on publish and change, and integrations named for at least the common CMS, CRM and analytics tools.

8 — A versioned API with published rate limits and SDKs, preview environments, a marketplace or integration directory with maintained connectors, performance data per piece pulled back from analytics, and a public status page.

10 — The platform is a dependable source for every channel: API deprecation policy published, CDN and delivery SLA stated, scheduled and event-driven publishing documented end to end, and content performance attributed per channel without a separate tool.

Report an error

The Data Protection Officer

REST and GraphQL APIs are publicly documented with an OpenAPI specification, a client library and bearer-token authentication, webhooks fire on publish, change, unpublish and media events with payload and security detail, and a reviewed plugin marketplace plus named framework connectors are shown. I found no public information on published API rate limits, a public status page, per-piece analytics performance data pulled back into the platform, or an API deprecation and delivery policy. 10 11 5 1 2

Report an error

AI assistance & content rights

How this is scored

What the platform's AI does with the customer's content and what the customer may do with the AI's: the models and where they run, whether content trains them, opt-out, labelling of generated text, and who holds the rights to output.

0 — AI writing features with no statement on which model is used, where content is sent, or whether it is used for training.

3 — An AI page that names a provider but leaves open whether customer content trains models, where prompts are processed, or whether the features can be switched off.

5 — The model providers named as subprocessors, customer content excluded from training stated in the terms, AI features switchable per workspace by an admin, and ownership of generated output assigned to the customer.

8 — EU processing for AI features stated or selectable, retention of prompts and outputs given in days, generated or AI-edited content markable for EU AI Act transparency, and brand voice or terminology rules applied without uploading content to train a shared model.

10 — AI is governed and documented: per-feature list of model, provider and processing location, admin controls per role and content type, an audit trail of AI-generated changes, and the output rights and any indemnity written into the contract terms.

Report an error

The Data Protection Officer

The AI terms say the features run through a third-party AI provider's API and price credits explicitly ("+$1.50 per 100 credits", "1,000 credits / month" on Growth, Enterprise "Not yet available"), but they name no provider, state no processing location, and give no retention of prompts and outputs in days. I found no public information on training on customer content being excluded in the terms, output ownership or indemnity, EU AI Act labelling, or admin switches per feature — a "Bring your own AI key" topic exists, but that is documentation, not the contractual exclusion I require. 12 2 13 13 8

Report an error

European sovereignty

How this is scored

Who the contracting entity is, where content, assets and AI prompts are stored and processed, and which subprocessors touch them. Independently sourced by the sovereignty pipeline.

0 — Non-EU contracting entity, no statement on where content is hosted, and subprocessors unnamed.

3 — Content hosted in the EU on request or on a higher plan only, or the subprocessor list is absent, or AI and analytics features send content outside the EU without an explained safeguard.

5 — EU hosting stated for content and assets, a DPA available, but the contracting entity or significant parts of the chain (CDN, AI, support) are non-EU without a stated safeguard.

8 — EU contracting entity, content, assets and backups stored in the EU on named infrastructure, subprocessor list published with locations and purposes, and AI processing location stated.

10 — Sovereign end to end and evidenced: European ownership, EU entity, every hosting, CDN, AI and support subprocessor European or optional, self-hosting or a European cloud offered, and certifications published.

Report an error

The Data Protection Officer

Self-hosting on your own servers for full control over data residency and compliance, cloud region selection, and claimed GDPR compliance with SOC 2 are real levers, and the provenance pipeline names a French entity as data controller. The captured pages themselves confirm neither the contracting entity nor any hosting region for cloud content and assets, publish no subprocessor list with the AI providers on it, and state no AI processing location — I found no public information on these. 5 1 2 3

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the annual cost for their team, locales and traffic from public pages alone — seats and contributor roles, locales, content records, API calls and bandwidth, AI credits, and the plan where approval workflows or SSO begin.

0 — No public prices at all; every plan is a sales conversation.

3 — A starting price per month, but what it includes is vague and the limits that drive the real cost (locales, records, API calls, AI credits) are unstated.

5 — Plans priced per seat with their main limits listed, but at least one commonly incurred cost (extra locales, overage on records or API calls, AI credits, guest contributors) is missing or "on request".

8 — Every plan priced with seats, locales, records, API and bandwidth limits and overage rates stated, AI usage priced or included explicitly, and the plan that unlocks approval workflows, SSO and audit logs named.

10 — Complete cost computability: annual cost derivable for a given team, locale count and traffic, every add-on and overage priced publicly, contract term and renewal conditions stated, and the cost of exporting or leaving the platform zero or published.

Report an error

The Data Protection Officer

Additional seat pricing of "$15 / seat" on Growth, AI credits priced at "+$1.50 per 100 credits" with "1,000 credits / month" included, unlimited locales, content types, roles, entries and API calls, and Enterprise named as where SSO, review workflows and audit logs begin give a buyer most of the cost picture. The captured pages show no base price for the Growth or Enterprise plans and no contract term, renewal conditions or cost of leaving, so the annual cost for a given team cannot be computed from public pages alone. 2 2 12

Report an error

European sovereignty — proven facts

0 of 4 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Ownership Not determined — uncited Report an error
Data residency Not determined ⚠ unverified — uncited Report an error
Subprocessors Not determined — uncited Report an error

Questions about Strapi

Is Strapi European?

Yes. whats-best.ai classifies Strapi as EU-Made.

Where does Strapi store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

Does Strapi have a free plan?

Yes. Strapi has a free plan, per the vendor’s page captured 13 Oct 2026.

What are the best alternatives to Strapi?

As of 15 Oct 2026, the panel rates CoreMedia (3/5), Storyblok (2.5/5) and Contently (2.5/5) highest among the other 14 Content Marketing products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is CoreMedia (EU origin, foreign-owned). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Strapi alternatives.

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Strapi? Tell us Report an error on this page

Sources (13)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage strapi.io Checked 13 Oct 2026 Details →
  2. 2 Pricing page strapi.io Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
  3. 3 Privacy policy strapi.io Checked 13 Oct 2026 Details →
  4. 4 Terms of service strapi.io Checked 13 Oct 2026 Details →
  5. 5 Planning, editorial calendar & briefs — found from sitemap strapi.io Checked 13 Oct 2026 Details →
  6. 6 Creation, review & approval — found from sitemap strapi.io Checked 13 Oct 2026 Details →
  7. 7 Creation, review & approval — found from sitemap docs.strapi.io Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
  8. 8 Structured content, localisation & export — found from sitemap docs.strapi.io Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
  9. 9 Structured content, localisation & export — found from sitemap docs.strapi.io Checked 13 Oct 2026 Details →
  10. 10 Publishing, distribution & integrations — found from sitemap docs.strapi.io Checked 13 Oct 2026 Details →
  11. 11 Publishing, distribution & integrations — found from sitemap docs.strapi.io Checked 13 Oct 2026 Details →
  12. 12 AI assistance & content rights — found from sitemap strapi.io Checked 13 Oct 2026 Details →
  13. 13 AI assistance & content rights — found from sitemap docs.strapi.io Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →