Divi Pixel Due Diligence

Poland · www.divi-pixel.com · 15 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 15 sub-vendors.

Insights

Last updated 2026-08-01 · revision 2

15 direct vendors, 181 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Divi Pixel demonstrates low migration readiness. The primary challenge stems from extreme vendor lock-in with Elegant Themes; the 'Divi Pixel Plugin' is 'built exclusively for the Divi Theme' and utilizes the 'Divi Builder API'. Migrating away from this core dependency would necessitate a complete re-platforming and re-development of their flagship product, incurring substantial cost and effort. The 'Internal Tech Stack' is based on 'WordPress' and 'PHP', representing a traditional monolithic architecture that is not inherently cloud-native, containerized, or microservices-based, making a modern cloud migration a complex re-architecture project rather than a simple lift-and-shift. Furthermore, critical data gaps exist for 'Regulatory Environment' and 'Data Residency Requirements', introducing significant unknowns and potential compliance hurdles that could complicate and delay any migration efforts. The absence of data on financial stability (revenue concentration, growth history) also makes it impossible to assess the company's capacity to fund a potentially expensive and complex migration. While the use of common web technologies (PHP, JavaScript, CSS) means developer skills are available, this is overshadowed by the deep architectural and vendor dependencies.

Compliance

7 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

SOC 2 risk is MEDIUM. While SOC 2 is a voluntary framework (not a legal mandate), it is increasingly expected by enterprise customers of SaaS and software providers. Divi Pixel sells a WordPress plugin on a subscription/license basis to a global customer base including businesses. Enterprise and mid-market customers increasingly require SOC 2 Type II reports from software vendors as part of their vendor due diligence. The absence of a SOC 2 report could limit Divi Pixel's ability to sell to larger enterprise customers or those in regulated industries. However, given that Divi Pixel appears to target individual web designers, freelancers, and small businesses (rather than large enterprises), the immediate commercial risk is moderate rather than high. The risk is not of regulatory penalty but of competitive disadvantage and customer trust.

Evidence: https://www.divi-pixel.com/privacy-policy/, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

GDPR (source) — Partially Compliant

GDPR risk is HIGH for Divi Pixel / Octolab OÜ for several compounding reasons: (1) The company is legally established in Estonia, an EU member state, making GDPR directly and unconditionally applicable as the primary data protection law. (2) The company operates a global SaaS/plugin subscription business, collecting personal data (names, emails, billing information, IP addresses) from customers worldwide including across the EU/EEA. (3) The publicly available Privacy Policy was last updated in March 2020 and is critically deficient — it lacks mandatory GDPR elements including: lawful basis for processing, explicit data subject rights (access, erasure, portability, rectification, restriction, objection), data retention periods, identification of the Data Protection Officer (or confirmation none is required), details of international data transfers and safeguards, and the right to lodge a complaint with a supervisory authority (Estonia's Andmekaitse Inspektsioon). (4) The cookie notice does not appear to implement a compliant consent mechanism (no cookie banner with granular opt-in for non-essential cookies was observed). (5) No DPA (Data Processing Agreement) templates are publicly available for customers who use Divi Pixel as a data processor on their own websites. (6) The Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) actively enforces GDPR. Fines can reach €20 million or 4% of global annual turnover. For a small SaaS company, even a moderate fine or enforcement action could be materially damaging. The combination of an outdated privacy policy, missing GDPR disclosures, and global data collection creates a high compliance risk profile.

Evidence: https://www.divi-pixel.com/privacy-policy/, https://www.divi-pixel.com/terms-of-service/, https://www.divi-pixel.com/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679, https://www.aki.ee/en

Estonian Personal Data Protection Act — Partially Compliant

Risk is HIGH because the Estonian Personal Data Protection Act (IKS, 2019) implements and supplements GDPR in Estonia, and the same compliance gaps identified under GDPR apply here. The IKS establishes the Andmekaitse Inspektsioon (AKI) as the supervisory authority with enforcement powers including administrative fines aligned with GDPR maximums. As an Estonian-registered company (Octolab OÜ), Divi Pixel is directly subject to AKI oversight. The outdated privacy policy and missing GDPR/IKS compliance elements create direct regulatory exposure to the Estonian supervisory authority.

Evidence: https://www.aki.ee/en, https://www.riigiteataja.ee/en/eli/523012019001/consolide, https://www.divi-pixel.com/privacy-policy/

Financials

Three-year financials

Financial Resilience Score: 6/10

Divi Pixel, operated by Octolab OÜ, is a small niche WordPress plugin business with attractive economic characteristics but material concentration risks. The recurring subscription revenue model combined with lifetime license sales provides predictable cash flow, and the digital-only product with no inventory or physical distribution keeps operating costs low. Strong customer sentiment (5-star reviews on Trustpilot), a broad international customer base, and continued active product development (including the Divi 5 migration) support ongoing business viability. The Estonian OÜ structure adds a tax-efficiency advantage since retained earnings compound without corporate tax until distribution. However, the business carries significant structural risks that cap its resilience score. The entire product depends on a single third-party platform (Divi theme by Elegant Themes), meaning any strategic change by Elegant Themes could materially impair demand. The team appears very small with key-person concentration around the founder Maciej, and the WordPress plugin market is competitive with several direct rivals. Combined with limited financial transparency (small private OÜ with minimal public disclosure) and exposure to broader WordPress ecosystem risk versus modern site-builders like Webflow and Framer, the company sits in a moderately resilient position typical of a successful but small niche software vendor.

Key strengths: Recurring subscription revenue model with predictable cash flow, Low operating cost base as digital-only product with no inventory, Strong customer sentiment and 5-star reviews across markets, Broad international customer base across North America and Europe, Active product development including Divi 5 migration, Estonian OÜ tax structure allows tax-free compounding of retained earnings

Risk factors: Single-platform dependency on Divi theme by Elegant Themes, Key-person risk with concentrated technical knowledge in small team, Competitive niche market with direct rivals (Divi Supreme, Divi Essentials, Divi Flash, Divi Booster), Currency and payment-processor risk from global USD/EUR sales, Limited public financial transparency as small private OÜ, Long-term WordPress ecosystem risk vs. modern site-builders (Webflow, Framer, Wix), Effectively single-product revenue concentration (~100%)

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report