Embedly

United States · embed.ly · 10 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 10 sub-vendors.

Insights

Last updated 2026-08-17 · revision 2

10 direct vendors, 168 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Embedly exhibits a high level of migration readiness, primarily driven by its modern tech stack. The use of AWS Lambda is a strong indicator of existing cloud adoption and a serverless architecture, which significantly streamlines the process of migrating to cloud-native environments. The API-driven nature of their products (REST API, oEmbed Protocol) also suggests a modular architecture conducive to migration. The absence of specified data residency requirements is another significant advantage, as it removes a common and complex hurdle in migration planning. While the tech stack includes some legacy components like jQuery and PHP that might require refactoring, the overall direction is cloud-friendly. Similar to resilience, the vendor data is contradictory. If 'Total Vendors: 0' is accurate, it suggests minimal vendor lock-in, which is a substantial advantage for migration flexibility. Conversely, if Embedly utilizes 10 services from vendors whose HQs are in diverse countries (Australia, United States, Denmark), the 'Unknown' vendor lock-in risk needs to be assessed. However, the geographic diversity of these vendor locations could offer some flexibility in choosing migration targets. The lack of data regarding financial stability and the regulatory environment introduces unknowns that could impact the funding and complexity of a large-scale migration.

Compliance

5 in-scope frameworks identified; showing 3.

CCPA — Partially Compliant

Embedly has published a dedicated CCPA section in its Privacy Policy (last updated 09/03/2024), demonstrating awareness of California privacy obligations. The section covers Right to Know, Right to Delete, household requests, agent requests, and explicitly states no sale of personal information. However, risk remains Medium because: (1) CCPA applicability thresholds (annual gross revenue >$25M, OR buying/selling/receiving/sharing personal info of 100,000+ consumers/households, OR deriving 50%+ of revenue from selling personal info) are not confirmed — Embedly's scale of URL processing could meet the 100,000+ consumer threshold given its millions of daily link interactions; (2) No opt-out mechanism for data sharing is prominently displayed; (3) The CPRA (CCPA amendment effective 2023) introduced additional obligations (sensitive personal information rights, data minimization, purpose limitation) not explicitly addressed.

Evidence: https://embed.ly/legal/privacy

GDPR (source) — Partially Compliant

Embedly processes personal data of EU/EEA residents (IP addresses, browser information from users interacting with third-party embeds on client sites, plus billing data from EU customers). The company has published a dedicated 'Data Protection Statement for European Union Users' within its Privacy Policy, demonstrating awareness of GDPR obligations. However, several gaps exist: (1) No Data Processing Agreement (DPA) template is publicly available for B2B customers who are data controllers; (2) No appointed Data Protection Officer (DPO) is identified; (3) The privacy policy relies on 'consent' as the legal basis for processing but does not clearly articulate all lawful bases (e.g., legitimate interests for analytics); (4) Cross-border transfer mechanisms (e.g., Standard Contractual Clauses, adequacy decisions) are not explicitly documented — the policy merely states users 'authorize' transfers to the US, which is insufficient under GDPR Article 46; (5) No EU representative under GDPR Article 27 is named. Risk is Medium rather than High because Embedly processes relatively minimal personal data (IP addresses, browser info retained only 2 weeks) and does not engage in large-scale profiling or sensitive data processing.

Evidence: https://embed.ly/legal/privacy, https://embed.ly/legal/terms

CAN-SPAM Act — Assessment Required

As a US-based company that communicates with registered users via email (account notifications, support correspondence), Embedly is subject to the CAN-SPAM Act for commercial email communications. Risk is Low because CAN-SPAM compliance is straightforward for a company of Embedly's size and email volume, and there is no evidence of non-compliance. No assessment of email marketing practices was possible from public sources.

Evidence: https://embed.ly/legal/privacy, https://embed.ly/legal/terms

Financials

Three-year financials

Financial Resilience Score: 5/10

Embedly's financial resilience is difficult to assess directly due to the complete absence of publicly disclosed financial data. As a wholly-owned subsidiary of Medium since approximately 2016, Embedly does not publish standalone financial statements, and neither Embedly nor Medium is an SEC filer. This lack of transparency prevents any quantitative assessment of solvency, profitability, or growth trends. Qualitatively, however, Embedly benefits from being backed by a larger parent company that provides funding and infrastructure, removing the need to independently raise capital. The company operates an established B2B API franchise with tier-1 publishers such as The New York Times, NPR, The Guardian, MLB, Reddit, and Microsoft, likely generating recurring subscription-style revenue. Its SaaS/API delivery model implies high gross margins typical of the category, and its support for 1,000+ providers gives it a moat in the oEmbed niche. However, significant risks exist: dependence on Medium (which has undergone multiple strategic pivots and 2023 layoffs), product commoditization as large platforms offer their own embed tools, and apparent maintenance-mode operation post-acquisition. The mid-range score reflects the balance of a durable niche product against parent dependence and lack of visibility.

Key strengths: Backed by parent company Medium since ~2016, providing funding and infrastructure, Established B2B API franchise with tier-1 publisher customers (NYT, NPR, Microsoft, Reddit, MLB), SaaS/API delivery model with high gross margins, Strong brand in oEmbed niche with 1,000+ supported providers, Recurring subscription-style revenue via tiered pricing plans

Risk factors: No public financial transparency prevents independent assessment, Dependence on parent Medium, which has undergone strategic pivots and 2023 layoffs, Product commoditization risk as large platforms (Twitter/X, Meta, YouTube) offer native embed tools, Limited apparent product development post-acquisition suggests maintenance-mode operation, Customer concentration in media/publishing sector under structural pressure

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report