Drupal Due Diligence
Run due diligence on Drupal: check compliance and get alerts when suppliers change.
Belgium · www.drupal.org · 30 vendors
Drupal is a free and open-source web content management system (CMS) and framework used by millions of organizations worldwide to build and manage websites and digital experiences. The Drupal Association, legally known as DrupalCon, Inc. in the U.S., is a non-profit organization that supports the Drupal project and its global community by maintaining infrastructure, empowering contributors, and organizing events.
Resilience scores
- Digital Sovereignty: 13
- Digital Resilience: 7
- Financial Resilience: 6
Technology vendors
- Cloudflare, Inc. — Technology — United States
- LinkedIn Corporation — Technology — United States
- New Relic, Inc. — Technology — United States
- and 28 more
Services catalogue
6 services in catalogue across 2 categories; runs on 30 sub-vendors.
- integration module
- Translation Services Connector
- Website builder
Insights
Last updated 2026-07-30 · revision 18
30 direct vendors, 261 subvendors
Direct vendors by controlling owner country (sample)
- Sweden: 2
- Japan: 2
- Australia: 1
Subvendors by controlling owner country (sample)
- France: 4
- Switzerland: 1
- Australia: 2
Compliance
6 in-scope frameworks identified; showing 3.
NIS2 (source) — No public evidence
Evidence: https://www.drupal.org/association, https://www.drupal.org/about, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555
CCPA — Evidence found
Evidence: https://www.drupal.org/privacy, https://oag.ca.gov/privacy/ccpa
GDPR (source) — Evidence found
Evidence: https://www.drupal.org/privacy, https://www.drupal.org/terms, https://www.eugdpr.org/
Financials
Three-year financials
- 2025:
- 2024:
- 2023:
Financial Resilience Score: 6/10
The Drupal Association is a small US-based 501(c)(3) non-profit with total FY2025 spending of approximately US $4.91M. Its financial position is moderately resilient due to a diversified revenue base spanning DrupalCon sponsorships and tickets, the Drupal Certified Partner program (114 partners in 2025), sustaining organizational members, individual donations (RippleMakers), grants ($487K+ secured in 2025), and drupal.org advertising. Sixteen consecutive years of Form 990 public filings (FY2009-FY2024) demonstrate operational stability and strong transparency for a non-profit of its size. Key strengths include a very large engaged volunteer contributor community (8,819 contributors making 350,356 contributions in 2025), 501(c)(3) tax-exempt status, and a sticky institutional user base including ~70% of top universities and many government agencies. However, the absolute scale of ~$4.9M in annual spending is small relative to the 1M+ websites depending on Drupal, meaning any single-year shortfall in DrupalCon revenue (roughly a quarter of spending) could force operational cuts. The organization successfully weathered COVID-19 disruption to in-person events (FY2020-2021) and has recovered to full operational scale by FY2025. Material risks include event concentration (DrupalCon accounts for ~25% of spending and a meaningful share of revenue), competitive pressure from WordPress at the low end and headless CMSes at the mid-market, the ongoing Drupal 7 end-of-life migration, dependency on volunteer contributors (76% of 2025 contributions came from 114 Certified Partner agencies), and key-person concentration around founder Dries Buytaert.
Key strengths: Diversified revenue base: DrupalCon, Certified Partners, Sustaining Members, RippleMakers, grants, 8,819 individual contributors and 350,356 contributions in 2025 - large volunteer workforce, 114 Drupal Certified Partners providing recurring fees, 501(c)(3) non-profit tax status with tax-deductible donations, 16 consecutive years of Form 990 public filings (FY2009-FY2024), Sticky institutional user base: ~70% of top universities, US federal/state/EU governments, $487K+ in grants secured in 2025 for security and infrastructure, Successful recovery from COVID-era DrupalCon disruption
Risk factors: Small absolute scale (~$4.9M annual spending) leaves little cushion for shortfalls, Event concentration: DrupalCon represents ~25% of spending and major revenue source, Competitive pressure from WordPress, headless CMSes (Contentful, Sanity, Strapi), and AI-native platforms, Drupal 7 end-of-life migration risk to ecosystem size, 76% of contributions dependent on 114 Certified Partner agencies, Key-person concentration around founder Dries Buytaert, No published country-by-country workforce or revenue splits
Workforce by country
- United States: 20
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.