Content Marketing
Umbraco
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Umbraco HQ A/S · umbraco.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Umbraco at a glance
- Vendor
- Umbraco HQ A/S
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 3 Nov 2026
- Panel verdict
- The AI panel rates Umbraco 3/5, the mean of 6 judges. Umbraco is a free and open-source.NET content management system. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 3 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Umbraco is a free and open-source.NET content management system. Its strength is collaboration and approval, scored 7, for configurable multi-step approval groups, approval requiring one, most or all members, mandatory comments, content locked after the first approval, and licensed external approval by secure link or email reply. Content model and reuse follows at 7-8, crediting a self-service zip export and import of content, schema and templates with validation and migration hooks across major versions. AI and content rights scores 6-7 for an opt-in, bring-your-own-key design: no provider is bundled, and with none configured no data relating to these features is sent anywhere. Distribution and integrations scores 6 on a documented read-only delivery API. Editorial planning draws the widest spread, 0 to 3, from no public information on a calendar, briefs or campaigns to a workflow history with statuses and dates. Sovereignty scores 3-4: Azure is named as cloud host without a region, and the captured pages establish no data residency, contracting-entity jurisdiction or subprocessor locations. Pricing transparency scores 3; no paid-license figures are public.
Speaks for it
- Configurable multi-step approval with groups, approval requiring one, most or all members, mandatory comments, and licensed external approval by secure email link or email reply
- Self-service zip export and import of content, media, schema and templates with validation and migration hooks across major Umbraco versions
- AI is opt-in and bring-your-own-key: no provider is bundled or enabled by default, and with none configured no data relating to these features is sent anywhere
- The CMS is free and open source under the MIT license, installable on your own Windows, Linux or macOS infrastructure with an on-premises Deploy option
- A publicly documented read-only delivery API serves published content and media per culture, with named integrations for Google Analytics, Matomo and Hotjar and the Engage add-on
Held against it
- We found no public information on an editorial calendar, briefs, campaign or topic grouping, or per-person workload and deadline views
- The captured pages establish no data residency, contracting-entity jurisdiction or subprocessor locations, and Azure is named as cloud host without a region
- We found no public information on webhooks, published rate limits, SDKs, API versioning or a public status page for the delivery API
- We found no public information on retention periods for AI prompts and outputs, the AI processing location, or output ownership written into the terms — the full-ownership claim appears in marketing copy
- We found no public information on prices for paid licenses, Cloud plans or add-ons, with unlicensed installations capped at five approval groups
Best for
- You need configurable multi-step approval chains and want external reviewers such as agencies to approve via secure email link or email reply (both behind a paid license)
- You want an open-source.NET CMS you can self-host on your own infrastructure and export from as a self-service zip
- You require AI to be strictly opt-in and bring-your-own-key, with content travelling directly from your instance to your chosen provider on your own credentials
- You deliver multilingual content through an API, requesting specific cultures with default-language fallback when none is specified
Avoid if
- You need an editorial calendar, briefs and campaign planning inside the CMS — the captured pages document only a scheduled date within the approval workflow and a workflow history
- Your multilingual workflow depends on managed translation — the delivery API serves culture variants, but we found no public information on translation status per locale or named translation-service connectors
- You must confirm a hosting region, data residency or subprocessor locations before signing — the captured pages name Azure as cloud host without a region, and transfer impact assessments are held internally and released on request
The scores
| Criterion | Panel median |
|---|---|
| Planning, editorial calendar & briefs | 1 of 5 |
| Creation, review & approval | 3.5 of 5 |
| Structured content, localisation & export | 4 of 5 |
| Publishing, distribution & integrations | 3 of 5 |
| AI assistance & content rights | 3.5 of 5 |
| European sovereignty | 2 of 5 |
Planning, editorial calendar & briefs
n/r
Show reasoningHide reasoning
How this is scored
Turning a content strategy into scheduled work: topics and campaigns, an editorial calendar across channels, briefs that carry the goal, audience and keywords to the writer, and a view of what is due, late or missing.
0 — No planning at all; the product only stores or renders content.
3 — A calendar or list view of content with publish dates and statuses.
5 — An editorial calendar across channels with owners, due dates and custom statuses, and content grouped by campaign, topic or channel.
8 — Strategy connected to the plan: briefs carrying goal, audience and keywords attached to each piece, topics or personas defined once and assigned to pieces, configurable workflows per content type, workload and deadline views per person, and recurring formats scheduled as series.
10 — The plan is accountable: every published piece traces back to its brief, topic and campaign, gaps in coverage per topic or funnel stage are reported, and plan-versus-published is visible over time without a spreadsheet.
The Head of Content
We found no public information on an editorial calendar, content briefs, or campaign and topic grouping, and no view of what is due, late or missing per writer. The nearest evidence is a scheduled date selectable when initiating an approval workflow, plus a history list and activity chart of approved, rejected and pending items — approval bookkeeping, not a plan a content desk can run on. 1 4 5
The SME Marketer
What I can see is a workflow history filterable by status, dates, requester and page language, plus a scheduling option when a change is submitted for approval — closer to tracking approvals than planning a content year. I found no public information on an editorial calendar, campaign or topic grouping, briefs carrying goal and audience and keywords, or workload and deadline views per person. 4 5
The Localisation Lead
The captured documentation shows a scheduled-date option when initiating a workflow and a workflow history filterable by status, requester, language and dates, but we found no public information on an editorial calendar, briefs carrying goal and audience, campaigns, topics or per-person workload views. As a planning story this reaches a list of content with statuses and dates and no further. 4 5
The Web Engineer
Publishing can be scheduled when initiating a workflow, and there is a workflow history list filterable by requester, dates, language, type and status — the closest thing to planned work the captured pages show. Beyond that we found no public information on an editorial calendar, briefs, campaign or topic grouping, or per-person workload and deadline views; the marketing positioning about moving fast is a tagline, not a planning feature. 4 5
The Data Protection Officer
We found scheduling only inside the approval workflow — an optional scheduled date when initiating a workflow and reminder emails every 24 hours — plus marketing messaging about launching without developer bottlenecks. We found no public information on an editorial calendar, briefs, campaign or topic grouping, or per-person workload and deadline views. 1 5
The Skeptic not rated — no public information
We found no public information on editorial planning: no calendar, brief, campaign or topic view appears in the captured pages. The one scheduling option documented is for selecting a date when initiating a workflow, and the homepage speaks of marketing speed rather than any planning capability. 1 5
Creation, review & approval
Show reasoningHide reasoning
How this is scored
Writing and reviewing content together: editing with comments and suggestions, roles and permissions for internal and external contributors, and an approval trail that records who released which version — published content is a legal statement (UWG, Heilmittelwerbegesetz, the imprint duty).
0 — A single-user tool; content cannot be shared with or reviewed by others.
3 — Several users working on content, with comments or a version history.
5 — Roles and permissions that separate writing from publishing, comments on content, a version history with restore, and an approval or review status before publishing.
8 — Configurable multi-step approval per content type or market, mandatory reviewers (legal, product, brand), inline suggested edits, guest or freelancer access limited to assigned pieces, scheduled publishing that waits for approval, and an audit log of every edit, approval and publish with user and timestamp.
10 — Approval is evidence: the exact version each approver released is preserved and exportable, permissions reach down to field and locale level, and the audit trail is retained for a stated period and available after the contract ends.
The Head of Content
Umbraco Workflow delivers multi-step approval groups configurable per node or document type, approval by one, most or all, mandatory comments on submission, content locked after the first approval, scheduled workflow initiation, reminders, and external or email-reply approval for reviewers who never log in, with a history recording who requested what and when. We found no public information on inline suggested edits, or on the exact released version being preserved and exportable — the trail shows who approved, not verbatim which version legal released. 4 5
The SME Marketer
This is the strongest area for my team: configurable multi-step approvals per document type or per node, approvals requiring one, most or all group members, mandatory comments, content locked after the first approval, and reminders every 24 hours. External approvers can release a task by secure email link without a CMS login, which is exactly how I would bring the agency in, and the history records who requested what and when. I found no public information on inline suggested edits or a stated retention period for the approval trail. 4 5
The Localisation Lead
Umbraco Workflow is documented in real depth: multi-step approval groups with explicit or implicit flows, thresholds of one, most or all, mandatory comments, content locked after the first approval, scheduling that waits for approval, and licensed external approval by secure email link or email reply. The history with filters, detail overlays and an activity chart gives an approval trail with requester and dates; we found no public information on inline suggested edits or on permissions reaching field and locale level. 4 5
The Web Engineer
Umbraco Workflow delivers configurable multi-step approval per document type with approval groups, thresholds of one, most or all, mandatory comments, content locking after the first approval, and scheduled publishing that waits for approval — with external approvers able to act from a secure email link behind a license. The history view records who requested what and when, with filters and a detail overlay. We found no public information on inline suggested edits or preserved, exportable approval versions, so I stop below the top band. 4 5
The Data Protection Officer
Umbraco Workflow gives a real approval chain: configurable multi-step workflows per document type or node, approval groups with members and permissions, approval requiring one, most or all members, mandatory comments on submission, content locked after the first approval, and external approval by secure link or email reply for people without back-office access. The history view records requester, created and completed dates, page language and workflow status, with a detail dialog and an activity chart. We found no public information on inline suggested edits, or on how long the approval trail is retained and whether it can be exported at contract end — the two things I need before signing. 4 5
The Skeptic
Configurable multi-step approval is well documented: approval groups with members and permissions, approval requiring one, most or all group members, workflows defaulting to all nodes of a Document Type, mandatory comments, content locked after first approval, external approvers acting by secure link or email reply, and a history filtered by requester, dates, page language and workflow status with a detail overlay and an activity chart. We found no public information on inline suggested edits, field- or locale-level permissions, or how long the approval trail is retained after a contract ends. 4 5
Structured content, localisation & export
Show reasoningHide reasoning
How this is scored
Whether content is stored as reusable structure rather than pages: a content model, components shared across channels, German and other locales managed side by side, and the whole repository exportable in a documented format.
0 — Not a content store; the product keeps no content of its own (for example a pure scheduling or analytics tool).
3 — Templates or custom fields for content, a media library, and content in several languages.
5 — A configurable content model or content types with reusable components, locales managed side by side for each entry, and an export of entries in JSON, CSV, XML or a similar documented format.
8 — References between entries, field-level localisation with fallback languages, variants per market or audience, translation workflows with status per locale and named translation-service connectors, and a full export of content, model, locales and assets documented and self-service.
10 — The repository is portable by design: model and content exportable together and re-importable, migration tooling or a CLI documented in both directions, version history included in the export, and no feature that only works while the content stays.
The Head of Content
Document types, data types and relation types form a configurable model, language variants sit on each page with the default language returned as fallback, and the Deploy import and export moves content, media files, schema and templates between environments as a self-service zip with migration hooks across major versions. We found no public information on named translation connectors, per-locale translation status, or version history included in the export. 6 7 9
The SME Marketer
Document types, data types and media types form a configurable model whose labels and validation messages are themselves localised, published content can be requested per language with the default language returned as fallback, and import and export moves content and schema together in both directions with migration hooks between major versions. I found no public information on named translation-service connectors or a translation workflow with status per locale, which is what I would need for German and English side by side. 6 7 9
The Localisation Lead
Document Types, Data Types and Media Types form a configurable model, published content is served per culture through the delivery API, and the Deploy import/export documentation describes a self-service zip export of content, schema including languages, and media with re-import, validation and migrations across major versions — the documented two-way export I demand before trusting any repository with three locales. What holds it back for my desk: we found no public information on field-level fallback languages, translation status per locale, named translation-service connectors, or version history inside the export. 6 7 9
The Web Engineer
Document Types with localized names, properties and validation messages, a read-only delivery API whose JSON follows the content type definition, and per-culture retrieval make this genuinely structured rather than page-shaped. The Deploy import/export moves content, media files, schema and templates together as a zip in both directions, with hooks to migrate artifacts and property data across major versions — the portability I look for. We found no public information on translation-service connectors, per-locale workflow status, or version history included in the export. 6 7 9
The Data Protection Officer
Document types, data types and templates form a configurable content model, languages are managed as first-class schema with default-language fallback when no culture is requested on the delivery API, and Deploy's import and export moves content, media, schema and templates together as a self-service zip with dependency options, validation and migration hooks across major versions. We found no public information on translation workflows with status per locale or named translation-service connectors, which is what I would look for before committing multilingual campaign content. 6 7 9
The Skeptic
The repository is portable in a way few in this category document: a self-service zip export and import of content, content files, schema and schema files with switchable dependency inclusions, a full-schema option, validation on import, and migration hooks that carry content across major Umbraco versions. Languages sit inside the exported schema and the delivery API serves culture variants with default-language fallback; we found no public information on translation workflows with status per locale, named translation-service connectors, or version history included in the export. 6 7 9
Publishing, distribution & integrations
Show reasoningHide reasoning
How this is scored
Getting approved content to where it is read: publishing to websites and channels, a documented API and webhooks, and named connections to the CMS, CRM, analytics, SEO and translation tools a marketing stack already runs.
0 — A closed tool; content leaves only by copy and paste.
3 — Publishing to one website or CMS, and a few named integrations.
5 — Publishing to websites and several channels from one place, a publicly documented API or webhooks, and integrations named for common CMS, CRM or analytics tools.
8 — A versioned API with published rate limits and SDKs, webhooks on publish and change, preview environments, a marketplace or integration directory with maintained connectors, performance data per piece pulled back from analytics, and a public status page.
10 — The platform is a dependable source for every channel: API deprecation policy published, CDN and delivery SLA stated, scheduled and event-driven publishing documented end to end, and content performance attributed per channel without a separate tool.
The Head of Content
A publicly documented read-only delivery API serves published content and media to any app or site, with language selectable via query string or Accept-Language header, and Google Analytics, Matomo, Hotjar and the Engage analytics add-on are named, Engage pulling per-page performance back into the back office alongside a package marketplace. We found no public information on webhooks, rate limits, SDKs or a public status page. 1 2 8 9
The SME Marketer
The delivery API is publicly documented and read-only for published content and media to any site or app, GA4, Matomo and Hotjar are named with setup instructions, and the Engage add-on brings analytics, A/B testing and personalisation into the back office alongside a marketplace of packages. I found no public information on webhooks, published rate limits, a status page or an API deprecation policy. 1 8 9
The Localisation Lead
A documented read-only Content Delivery API serves published content and media to any app or platform with culture selection by query string or Accept-Language header, and named analytics connections exist for Google Analytics 4, Matomo and Hotjar alongside the Engage add-on, three cloud environments and a marketplace. We found no public information on webhooks, published rate limits, SDKs, a status page or CRM connectors. 1 2 8 9
The Web Engineer
There is a publicly documented read-only delivery API for published content and media with a documented base URL and culture negotiation via query string or Accept-Language, three Cloud environments for a preview-style workflow, a marketplace, and named analytics connections for GA4, Matomo and Hotjar plus the Engage add-on pulling performance back into the back office. As an API consumer I have to stop short of the mature band: we found no public information on API versioning with published rate limits, webhooks on publish, SDKs, or a public status page. 1 2 8 9
The Data Protection Officer
A publicly documented read-only delivery API serves published content and media to any app, website or device with culture selection, and analytics integrations are named — Google Analytics, Matomo, Hotjar, plus the Engage add-on for analytics, A/B testing and personalization inside the CMS — alongside a marketplace. We found no public information on webhooks, published rate limits, SDKs, a status page or a delivery SLA, so the delivery side is documented but not to a dependable-source standard. 1 2 8 9
The Skeptic
A publicly documented read-only delivery API serves published content and media to any app, website or device, with retrieval by id, URL and tree relations, plus named and explained analytics integrations (GA4, Matomo, Hotjar), an official in-CMS analytics and testing add-on, and a marketplace. We found no public information on webhooks, published rate limits, SDKs, API versioning or a public status page. 1 8 9
AI assistance & content rights
Show reasoningHide reasoning
How this is scored
What the platform's AI does with the customer's content and what the customer may do with the AI's: the models and where they run, whether content trains them, opt-out, labelling of generated text under the EU AI Act, and who holds the rights to output.
0 — The vendor states that customer content trains its models with no opt-out, or reserves the rights to AI output for itself.
3 — AI writing features described with what they do, and a general statement on how content is handled by them.
5 — The AI model provider named, a statement that customer content does not train models, and AI features that an admin can switch off.
8 — Model providers listed as subprocessors, EU processing for AI features stated or selectable, retention of prompts and outputs given in days, ownership of generated output assigned to the customer in the terms, generated content markable for EU AI Act transparency, and brand voice or terminology rules applied without training a shared model.
10 — AI is governed and documented: per-feature list of model, provider and processing location, admin controls per role and content type, an audit trail of AI-generated changes, and the output rights and any indemnity written into the contract terms.
The Head of Content
The AI layer is bring-your-own-key end to end: nothing is bundled or on by default, the customer picks the provider from a named list, content goes directly from your instance to that provider on your own credentials, and for self-hosted installs the vendor states it does not receive, log or store those requests, with GDPR roles, an EU AI Act risk assessment and an MIT-licensed open-source AI layer published. We found no public information on retention of prompts and outputs in days, EU processing location, output ownership written into the terms, or marking generated text for AI Act transparency. 1 10 11
The SME Marketer
No AI provider is bundled or enabled by default — my organisation picks the provider, supplies its own credentials, and content goes directly from our instance to that provider, with Umbraco stating it does not receive, log or store the requests or responses on self-hosted installations. The homepage promises full ownership of my content, and the support disclosure says data is not intentionally used to train public AI models. But the pages do not state where prompts and outputs are processed, how long they are retained, or how generated text would be marked under the EU AI Act, and the ownership promise sits on marketing copy rather than shown in the terms. 1 10 11
The Localisation Lead
The AI disclosure is candid and structured: nothing is bundled or enabled by default, the organisation brings its own provider and credentials with ten providers named, requests go directly to that provider, and customer content is stated not to train public models, with GDPR roles, erasure responsibility and an EU AI Act risk assessment published and the AI layer open source under MIT. We found no public information on retention of prompts and outputs in days or on EU processing locations, and output rights appear only as a marketing claim of full ownership rather than terms we could read. 1 10 11
The Web Engineer
The architecture is the one I would build: nothing bundled or enabled by default, content sent directly from your instance to the provider you choose with your own credentials, ten providers listed, the layer open source under MIT, and a preliminary EU AI Act risk assessment with GDPR role mapping published; tone-of-voice generation runs on your chosen model rather than a shared one. We found no public information on retention periods in days for prompts and outputs, EU AI Act transparency marking of generated text, or output ownership written into the contract terms. 1 10 11
The Data Protection Officer
The AI disclosure is unusually candid: no provider is bundled or enabled by default, content goes directly from the customer's instance to a provider chosen from ten named ones using the customer's own credentials, Umbraco is not an intermediary for self-hosted deployments and does not receive, log or store the request contents, and the customer is documented as controller with the chosen provider as processor under the customer's own agreement. The vendor also publishes an EU AI Act risk assessment, states it does not develop or train the underlying models, and says support-conversation data is not intentionally used to train public models. Still missing for sign-off: prompt and output retention is not stated in days, no EU processing location for AI is given, output ownership appears on the product page rather than assigned in the terms, and we found no public information on marking generated text for AI Act transparency or an audit trail of AI changes. 1 10 11
The Skeptic
AI is bring-your-own-key and opt-in by design: no provider is bundled or pre-configured, the customer chooses from a published list including OpenAI, Anthropic, Google and Amazon Bedrock, content travels directly from the instance to that provider under the customer's own credentials, and with no provider configured nothing is sent anywhere — with GDPR roles and an EU AI Act risk assessment published alongside. We found no public information on retention periods for prompts and outputs, the processing location for AI features, EU AI Act labelling of generated text, or output ownership written into the terms; the full-ownership claim appears in marketing copy, and support-side AI subprocessors (Intercom Fin, Google Gemini) are named with purposes. 1 10 11
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where content, assets and AI prompts are stored and processed, and which subprocessors touch them. Independently sourced by the sovereignty pipeline; dimensions the evidence does not establish are unknown, not non-European.
0 — Vendor, contracting entity and hosting all shown to be outside the EU, with no data processing agreement offered.
3 — A privacy policy and a data processing agreement offered, with hosting or the contracting entity outside the EU or not established.
5 — EU hosting stated for content and assets, with a data processing agreement offered.
8 — EU contracting entity, content, assets and backups stored in the EU on named infrastructure, subprocessor list published with locations and purposes, and AI processing location stated.
10 — Sovereign end to end and evidenced: European ownership, EU entity, every hosting, CDN, AI and support subprocessor European or optional, self-hosting or a European cloud offered, and certifications published.
The Head of Content
The captured pages prove a Cloud data processing agreement exists, self-hosting on your own infrastructure as an open-source alternative, Azure as the named Cloud host, and named support subprocessors (Intercom Fin, Google Gemini) with their purposes. We found no public information on where content is stored, the contracting entity's jurisdiction, or where AI processing happens — those dimensions are unknown, not shown as non-European — and transfer impact assessments are held internally, available on request to the compliance inbox. 1 2 3 10 11
The SME Marketer
The captured pages reference a Cloud data processing agreement and document GDPR roles, an Article 17 erasure route, a transfer impact assessment available on request, and the support AI subprocessors Intercom Fin and Google Gemini. I found no public information on the contracting entity's jurisdiction or on where content, assets and backups are hosted — Azure is named as the cloud host but no region is given, so I cannot confirm European hosting. 2 10 11
The Localisation Lead
The captured pages name Azure hosting and Cloudflare TLS for Umbraco Cloud, a Cloud Data Processing Agreement exists, and the MIT licence with an on-premises Deploy option lets a customer run the whole stack themselves. The contracting entity's jurisdiction, data residency and a subprocessor list with locations remain unknown on these captures — only the support-side AI subprocessors Intercom Fin and Google Gemini are named, without locations. 2 3 10 11
The Web Engineer
The captured pages reference a Cloud Data Processing Agreement governing hosting on Azure with TLS via Cloudflare, name Intercom Fin and Google Gemini as support-side subprocessors with their purposes, offer TIA/DPIA documents on request, and the open-source core makes self-hosting on your own infrastructure a real path. We found no public information establishing EU residency for content and backups, the contracting entity's jurisdiction, or a choice of hosting region, so the location dimensions stay unproven rather than European. 2 3 10 11
The Data Protection Officer
A Cloud data processing agreement is stated to govern the hosted platform, the CMS is MIT-licensed and installable on the customer's own Windows, Linux or macOS infrastructure with an on-premises Deploy option, and the support disclosure names Intercom Fin and Google Gemini as tools used on support conversations, with a compliance contact and a TIA/DPIA available on request. However, the captured pages give no contracting-entity jurisdiction, name Azure and Cloudflare for hosting without a region, and publish no subprocessor list with locations — hosting region, backups and AI processing location remain unestablished. 2 3 10 11
The Skeptic
A Cloud Data Processing Agreement is referenced as governing the infrastructure, Azure is named as the Cloud host, an on-premises option is documented for the MIT-licensed open-source product, and transfer impact assessments are maintained internally and released on request. The captured pages do not establish data residency, the contracting entity's jurisdiction, or subprocessor locations, so the level sits above a bare policy-and-DPA posture but below stated EU hosting. 2 3 10 11
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the annual cost for their team, locales and traffic from public pages alone — seats and contributor roles, locales, content records, API calls and bandwidth, AI credits, and the plan where approval workflows or SSO begin.
0 — No public prices at all; every plan is a sales conversation.
3 — A public "from" price, a free tier, or one priced plan, with the rest on request.
5 — Prices for each plan public with the billing period (per month or per year) and the seats or main limits each includes.
8 — Every plan priced with seats, locales, records, API and bandwidth limits and overage rates stated, AI usage priced or included explicitly, and the plan that unlocks approval workflows, SSO and audit logs named.
10 — Complete cost computability: annual cost derivable for a given team, locale count and traffic, every add-on and overage priced publicly, contract term and renewal conditions stated, and the cost of exporting or leaving the platform zero or published.
The Head of Content
The core CMS is free and open source, while several approval capabilities — more than five approval groups, external approval, document-type default workflows — are marked as requiring a paid licence. We found no public information on what that licence costs, on plan prices, billing periods, or seat and usage limits, so a buyer cannot compute an annual cost from public pages. 3 4 5
The SME Marketer
The CMS itself is free and open source, but everything my team would actually buy sits behind a licence with no public price: unlicensed installations are limited to five approval groups, and external approval, approval by email reply, document-type default workflows and excluding nodes are all marked as requiring a licence. I found no price figures for Cloud, Deploy, Heartcore, Engage or Workflow in the captured pages, so I cannot compute what a year with a second language and agency guests would cost. 3 4 5
The Localisation Lead
The core CMS is documented as free and open source, and the pages are explicit about which approval features need a paid license — external approval, approval by email reply, document-type workflows — with a five-group limit on unlicensed installations. Beyond that we found no price figures at all for Cloud, Heartcore or the licenses, so an annual cost for a given team and locale count cannot be computed from these pages. 3 4 5
The Web Engineer
The core CMS is public and free under MIT, and the captures state plainly which approval features sit behind a paid license, with a five-group limit on unlicensed installations. We found no public figures for the licenses, Cloud plans or add-ons — no amounts, billing periods or included limits — so an annual cost for a given team is not computable from these pages. 3 4 5
The Data Protection Officer
The core CMS is free and open source, and the paid license is shown gating specific features — workflow groups beyond five on unlicensed installations, external and email-reply approval, document-type default workflows and node exclusion. We found no public prices for the licenses, Cloud or Heartcore plans on the captured pages, so an annual cost for a given team cannot be computed. 3 4 5
The Skeptic
The CMS itself is stated to be free and open source, and several capabilities are explicitly marked as requiring a paid license — external approval, approval by email reply, document-type workflow defaults, excluded nodes — with unlicensed installations capped at five approval groups. We found no public information on what any paid license, Cloud plan or add-on costs, so the captured pages give no figures from which an annual total could be computed. 3 4 5
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Umbraco
Is Umbraco European?
Not determined: the vendor’s pages as captured do not say where Umbraco is based.
Where does Umbraco store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Umbraco have a free plan?
Yes. Umbraco has a free plan, per the vendor’s page captured 3 Nov 2026.
What are the best alternatives to Umbraco?
As of 4 Nov 2026, the panel rates StoryChief (3/5), Kontent.ai (3/5) and Scompler (3/5) highest among the other 23 Content Marketing products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is StoryChief (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Umbraco alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Transfer impact assessment, Open source, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (11)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page umbraco.com Checked 3 Nov 2026 Details →
- 2 Self-hosting / on-premises installation docs — found from the homepage umbraco.com Checked 3 Nov 2026 Details →
- 3 Code repository (open-source licence) — found from the homepage github.com Checked 3 Nov 2026 Details →
- 4 Creation, review & approval — found from sitemap docs.umbraco.com Checked 3 Nov 2026 Details →
- 5 Creation, review & approval — found from sitemap docs.umbraco.com Checked 3 Nov 2026 Details →
- 6 Structured content, localisation & export — found from sitemap docs.umbraco.com Checked 3 Nov 2026 Details →
- 7 Structured content, localisation & export — found from sitemap docs.umbraco.com Checked 3 Nov 2026 Details →
- 8 Publishing, distribution & integrations — found from sitemap umbraco.com Checked 3 Nov 2026 Details →
- 9 Publishing, distribution & integrations — found from sitemap docs.umbraco.com Checked 3 Nov 2026 Details →
- 10 AI assistance & content rights — found from sitemap umbraco.com Checked 3 Nov 2026 Details →
- 11 AI assistance & content rights — found from sitemap umbraco.com Checked 3 Nov 2026 Details →