Civilized Discourse Construction Kit, Inc.

United States · www.discourse.org · 25 vendors

Civilized Discourse Construction Kit, Inc. develops and hosts Discourse, an open-source discussion platform. The company aims to raise the standard of civilized discourse on the internet by providing tools for running discussion forums with features like a trust system, notifications, and community moderation. It offers its software as a service and is used by various organizations to build and manage online communities.

Resilience scores

Technology vendors

Services catalogue

5 services in catalogue across 3 categories; runs on 25 sub-vendors.

Insights

Last updated 2026-07-29 · revision 7

25 direct vendors, 269 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Civilized Discourse Construction Kit, Inc. exhibits high migration readiness, primarily driven by its modern and flexible technology architecture. The core product's open-source nature (GPL v2-licensed) significantly reduces platform lock-in, allowing for flexible deployment across various infrastructures. The extensive use of Docker for containerization is a major advantage, enabling seamless portability and easier migration to different cloud environments. The company's existing offerings of "Discourse (Managed Hosting / SaaS)" and "Discourse Enterprise" demonstrate established expertise in cloud infrastructure and operations, which directly translates to strong migration capabilities. Furthermore, CDCK's experience with global data storage (AWS S3, Canada, EU data centers) and robust GDPR compliance, including the use of SCCs and offering enterprise customers data residency options, indicates a strong ability to manage complex data migration requirements and regulatory constraints. The company's growth in employees from 3 to 80 suggests financial stability to fund potential migration projects. A key challenge and area of uncertainty is the "Unknown" vendor lock-in risk. While "Total Vendors: 0" is reported, the existence of "Total Services: 37" from companies in 7 unique countries suggests operational dependencies. The lack of a definitive assessment of vendor lock-in for these services could introduce unforeseen complexities during a migration. Additionally, the "Assessment Required" status for SOC2 and ISO 27001, despite enterprise product claims, could necessitate additional audits or certifications during a migration to new environments, potentially adding overhead.

Compliance

7 in-scope frameworks identified; showing 3.

GDPR (source) — Partially Compliant

GDPR is explicitly acknowledged and actively addressed by CDCK. The company has published a detailed privacy notice referencing GDPR rights, uses Standard Contractual Clauses (SCCs) for international data transfers, offers a Data Processing Addendum (DPA) to customers, maintains a subprocessors list, and provides a GDPR contact address in Amsterdam, Netherlands. However, the company openly acknowledges it is 'very likely subject to section 702 of the Foreign Intelligence Surveillance Act (FISA)' — a law the European Court of Justice has found inadequately protects EU data subjects' rights. This creates a residual compliance risk that cannot be fully mitigated by SCCs alone. The company no longer participates in Privacy Shield following its invalidation. Risk is Medium rather than High because CDCK has implemented substantial mitigating controls (SCCs, DPA, transparency disclosures, GDPR contact point in the EU), but the FISA 702 exposure and cross-border data transfer complexity represent ongoing structural risk.

Evidence: https://www.discourse.org/privacy, https://www.discourse.org/forms/dpa, https://www.discourse.org/subprocessors, https://www.discourse.org/legal, https://www.discourse.org/dsa

Data Sovereignty — Compliant

CDCK has a strong and publicly documented commitment to data sovereignty and transparency. The entire Discourse codebase is open source on GitHub, eliminating vendor lock-in and enabling independent security audits. Customers can self-host or use managed hosting, with full data export capabilities. CDCK explicitly states it has never sold user data. These practices significantly reduce data sovereignty risk for customers and demonstrate a proactive compliance posture.

Evidence: https://www.discourse.org/open-source, https://github.com/discourse/discourse, https://www.discourse.org/privacy

SOC 2 (source) — Assessment Required

Discourse is a cloud-based managed hosting provider serving enterprise customers including major technology companies (Asana, OpenAI, Zoom, GitLab, Atlassian, Cloudflare, Epic Games). Enterprise customers of this caliber typically require SOC 2 Type II reports as part of their vendor due diligence and procurement processes. The absence of any public SOC 2 certification or report on Discourse's website is notable for a company of this scale and enterprise focus. If CDCK does not hold a SOC 2 report, this represents a meaningful gap in enterprise trust assurance. Risk is Medium because enterprise customers may require this certification, and its absence could affect business relationships and competitive positioning, though it does not carry direct regulatory penalties.

Evidence: https://www.discourse.org/enterprise, https://www.discourse.org/security

Financials

Three-year financials

Financial Resilience Score: 7/10

Civilized Discourse Construction Kit, Inc. (CDCK) is a private, bootstrapped US technology company operating the Discourse open-source community platform. While the company does not publish audited financials and is not SEC-registered, qualitative indicators suggest a healthy and resilient niche SaaS operator. Co-founder Jeff Atwood has publicly described the company as profitable and self-sustaining, with no significant VC overhang, eliminating typical dilution and runway pressures. The company benefits from a recurring SaaS revenue base through managed hosting subscriptions, a marquee enterprise customer roster (OpenAI, Zoom, GitLab, Atlassian, Asana, Cloudflare, Epic Games, NVIDIA, Shopify, Monzo, Mozilla), and a defensible open-source moat with 950+ contributors. Its fully remote structure with no office overhead improves operating leverage, and 10+ years of product iteration reduces replacement risk. Key risks include competitive pressure from Circle, Bettermode, Discord, Slack, Khoros, Vanilla, and Salesforce Community Cloud; the inherent monetization cap posed by the free GPL v2 codebase (customers can self-host); AI-related disruption to community/knowledge use cases; and founder/key-person dependency on Sam Saffron and Jeff Atwood. Zero public financial transparency limits external assessment. Overall, growth signals (79 employees, 22,000+ communities, steady headcount expansion) point to a stable, growing operator warranting a mid-to-upper resilience score.

Key strengths: Bootstrapped and self-funded with no VC overhang, Recurring SaaS revenue base from managed hosting subscriptions, Marquee enterprise customer base including OpenAI, Zoom, GitLab, Atlassian, Cloudflare, NVIDIA, Shopify, Open-source moat with 950+ contributors and 62k+ commits, Fully remote structure with low fixed cost overhead, 10+ years of product iteration reducing replacement risk, Steady headcount growth from 3 (2013) to 79 (2025), 22,000+ live communities as of 2025

Risk factors: Zero public financial transparency, Competitive pressure from Circle, Bettermode, Discord, Slack, Khoros, Vanilla, Salesforce Community Cloud, Open-source cannibalization - customers can self-host for free, Unknown customer concentration risk with large enterprise anchors, AI-related competitive disruption to community/knowledge use cases, Founder/key-person dependency on Sam Saffron and Jeff Atwood, Limited pricing power due to free GPL codebase alternative

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report