10up

United States · 10up.com · 27 vendors

10up is a globally distributed digital agency specializing in finely crafted websites, content management solutions, and digital tools for content creators. They leverage open-source technologies like WordPress and React to provide strategic planning, experience design, and engineering services. The company serves a diverse clientele, including major brands and government institutions, to advance their digital and marketing objectives.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 27 sub-vendors.

Insights

Last updated 2026-07-23 · revision 7

27 direct vendors, 350 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

10up exhibits strong migration readiness, largely driven by its modern and cloud-oriented tech stack. Their internal use of Docker, Elasticsearch, Node.js, React, and Next.js, coupled with their 'HeadstartWP' framework for headless WordPress, signifies a clear move towards decoupled, cloud-native architectures. The company's offering of 'Cloud Infrastructure Services' also points to internal expertise in cloud migration and management. Financially, 10up is well-positioned to fund significant migration initiatives, supported by its $40M+ revenue and substantial workforce. Furthermore, the data indicating 'Total Vendors: 0' suggests minimal direct operational vendor lock-in, which would greatly simplify migration planning and execution. Even if other vendor data is considered, the geographic diversity of vendor HQs across 5 countries implies a flexible vendor landscape. The primary challenges for migration readiness stem from complex regulatory and data residency requirements. Operating globally, 10up faces stringent GDPR and potential client-specific data residency mandates. The current 'Assessment Required' status for GDPR, SOC2, and ISO 27001 means that any migration strategy must meticulously address these compliance gaps, potentially increasing complexity, cost, and timeline. Data transfers across jurisdictions, while acknowledged in their privacy policy (e.g., EU-approved standard contractual clauses), will require careful management during a migration. While their core platform is WordPress, their adoption of headless architectures mitigates many traditional WordPress migration complexities.

Compliance

8 in-scope frameworks identified; showing 3.

ISO 27001 (source) — Assessment Required

ISO 27001 certification is increasingly expected from digital agencies managing enterprise-grade web infrastructure and sensitive client data. 10up's European operations (headquartered in London) are subject to market expectations where ISO 27001 is a common procurement requirement, particularly for public sector clients (State of California, The White House) and regulated industry clients. The risk is Medium because: (1) lack of ISO 27001 certification may create procurement barriers with government and regulated industry clients; (2) as a company handling client codebases, databases, and potentially sensitive content, information security management is critical; (3) no public evidence of certification has been found.

Evidence: https://10up.com/about/, https://www.iso.org/isoiec-27001-information-security.html, https://10up.com/our-work/white-house/, https://10up.com/our-work/california-dmv-website-redesign/

GDPR (source) — Assessment Required

10up (now operating as the WordPress practice of Fueled) has a confirmed European presence headquartered in London with a footprint throughout the EU/EEA region. They serve EU-based clients including Politico EU, The Nobel Foundation, Microsoft Europe, and Press Association, and employ staff across Europe. As a digital agency processing personal data of EU/EEA residents — including employee data, client data, and end-user data from websites they build and maintain — GDPR is unambiguously applicable. The risk level is High because: (1) non-compliance fines can reach €20M or 4% of global annual turnover; (2) as a digital services provider building and maintaining websites for major enterprises, they handle significant volumes of personal data; (3) no public evidence of a formal GDPR compliance program, DPO appointment, or privacy audit has been found; and (4) their privacy policy page was inaccessible during this assessment, preventing verification of GDPR-specific disclosures.

Evidence: https://10up.com/europe/, https://10up.com/about/, https://10up.com/our-work/politico/, https://gdpr-info.eu/, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/

HIPAA (source) — Assessment Required

10up is not a healthcare company, but they have built and maintained websites for major healthcare institutions including Mayo Clinic and Cleveland Clinic. As a web development and digital services agency working with covered entities, 10up may qualify as a Business Associate under HIPAA if their work involves access to Protected Health Information (PHI). The risk is Medium because: (1) if PHI is accessed during development/maintenance of healthcare client websites, HIPAA Business Associate Agreements (BAAs) are legally required; (2) failure to execute BAAs or implement required safeguards carries significant civil and criminal penalties; (3) the scope of PHI access during their healthcare client engagements is not publicly disclosed.

Evidence: https://10up.com/, https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html, https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html

Financials

Three-year financials

Financial Resilience Score: 7/10

10up demonstrates strong financial resilience characteristics despite limited public disclosure. The company achieved a rare feat in the services industry: bootstrapping from zero in 2011 to $40M+ in annual revenue by 2023 while remaining profitable and growing every single year without raising outside capital or debt. This 12+ year track record of consistent profitability signals disciplined cost control, strong pricing power, and durable client relationships. The company's blue-chip client roster (Microsoft, Google, Disney, Salesforce, White House, Mayo Clinic, State of California) provides revenue stability through long-tenure enterprise engagements. Recurring revenue streams from SiteWatch maintenance and ElasticPress.io SaaS further buffer against project-based volatility. Post-2023, PE backing from Insignia Capital Partners provides additional capital access for growth and downturn resilience. However, resilience is tempered by inherent services-business risks: people-driven revenue dependent on utilization rates, exposure to cyclical marketing/technology budgets, potential client concentration (undisclosed), platform concentration on WordPress facing headless CMS and AI-driven disruption, and integration risk from the Fueled merger and 2025 rebrand. PE ownership also implies future liquidity-event pressure and possible leverage from roll-up acquisitions.

Key strengths: Bootstrapped growth to $40M+ revenue with profitability every year from 2011-2023, Blue-chip enterprise client roster (Microsoft, Google, Disney, Salesforce, White House), PE backing from Insignia Capital Partners since 2023, Recurring revenue from SiteWatch maintenance and ElasticPress.io SaaS, Category leadership in WordPress ecosystem (second only to Automattic in core contributions), Diversified capability set post-Fueled merger (WordPress, mobile, UX, cloud, AI)

Risk factors: Services-business economics dependent on utilization and wage inflation, Undisclosed but likely client concentration typical of boutique agencies, Cyclical exposure to marketing/technology budgets, Platform concentration on WordPress facing headless CMS and AI disruption, PE ownership implies future liquidity event and potential leverage, Integration risk from 2023 Fueled merger and 2025 brand consolidation, No public financial disclosure limits transparency

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report