Extend Studio

Romania · kubiobuilder.com · 12 vendors

Extend Studio Srl is a company that develops visual web design products, with a current focus on WordPress. Their flagship product, Kubio, is an AI-powered WordPress website builder. It enables users to create and customize websites using a block-based visual editor, ready-made sections, and starter sites.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 12 sub-vendors.

Insights

Last updated 2026-08-11 · revision 11

12 direct vendors, 142 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Extend Studio demonstrates low migration readiness. The primary challenge stems from its deep integration with the WordPress ecosystem, as its core products are a WordPress plugin and theme. This creates significant platform lock-in, making a full re-platforming a complex and costly undertaking. The tech stack, while featuring modern frontend components like React, is fundamentally built around WordPress and PHP, which is not inherently cloud-native or microservices-oriented, further complicating migration to more agile infrastructures. A major impediment is the extensive regulatory compliance debt, particularly concerning GDPR and Romanian Data Protection Law (risk_level: High), which requires addressing DPO appointment, data transfer mechanisms, and DPA frameworks. The EU AI Act (risk_level: Medium) also introduces new obligations for their AI features that would need to be integrated into any new system. These compliance requirements would add significant complexity and cost to any migration effort. Financial stability is an unknown, as revenue and employee figures are not provided, making it difficult to assess the company's capacity to fund a major migration project. Data residency for the cloud platform (cloud.kubiobuilder.com) is not publicly disclosed, which would need to be thoroughly documented and managed during any data migration to ensure GDPR compliance. While there is geographic diversity among third-party processors, the fundamental reliance on WordPress for the core product is the most significant barrier to high migration readiness.

Compliance

9 in-scope frameworks identified; showing 3.

EU AI Act (source) — Assessment Required

The EU AI Act entered into force in August 2024 with phased implementation through 2027. Extend Studio SRL has launched 'Kubio AI' — an AI-powered website builder that generates pages, images, and text based on user prompts. Risk is MEDIUM because: (1) The company is a 'deployer' and potentially a 'provider' of AI systems under the EU AI Act; (2) Kubio AI generates content (text, images, web pages) — this may trigger transparency obligations under Article 50 (AI-generated content labeling); (3) The risk classification of Kubio AI needs assessment — website building AI is likely 'minimal risk' or 'limited risk' rather than 'high risk,' but this requires formal assessment; (4) General-purpose AI (GPAI) model obligations may apply if the underlying AI models are developed or fine-tuned by Extend Studio SRL; (5) The EU AI Act's prohibited practices and transparency requirements are already partially in force (February 2025).

Evidence: https://kubiobuilder.com/ai/, https://kubiobuilder.com/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R1689, https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai

SOC 2 (source) — Assessment Required

SOC 2 is a voluntary framework developed by the AICPA for service organizations that store, process, or transmit customer data in the cloud. Extend Studio SRL operates cloud.kubiobuilder.com — a cloud-based SaaS platform — and processes customer personal data (names, emails, addresses, payment data via Fastspring). As a cloud service provider serving 250K+ websites globally, enterprise and agency customers may increasingly require SOC 2 attestation as a vendor due diligence requirement. Risk is rated MEDIUM because: (1) SOC 2 is not legally mandated but is a strong market expectation for SaaS providers; (2) Absence of SOC 2 attestation may limit enterprise sales opportunities and create reputational risk; (3) The company's global customer base (including US customers) means SOC 2 is a commercially relevant framework; (4) No SOC 2 report has been found, which is a gap for a company of this scale (6M+ downloads, 250K+ powered websites).

Evidence: https://kubiobuilder.com/, https://cloud.kubiobuilder.com/ui-route/login, https://kubiobuilder.com/privacy/, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

ePrivacy Directive — Partially Compliant

The ePrivacy Directive (implemented in Romania via Law 506/2004 and subsequent amendments) governs electronic communications privacy, including cookie consent and direct marketing. Risk is MEDIUM because: (1) The company uses behavioral remarketing cookies (Google Ads, Facebook Ads) which require explicit prior consent under ePrivacy; (2) A cookie consent banner is deployed, but the implementation's technical compliance (e.g., whether analytics/advertising cookies are blocked prior to consent) cannot be fully verified from public sources; (3) The company sends marketing emails (newsletters, promotional materials) — opt-in/opt-out mechanisms are referenced but not fully detailed; (4) The 'Do Not Track' policy explicitly states the company does not support DNT signals, which is permissible but should be clearly communicated.

Evidence: https://kubiobuilder.com/privacy/, https://kubiobuilder.com/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058, https://www.dataprotection.ro/

Financials

Three-year financials

Financial Resilience Score: 6/10

Extend Studio SRL is a small, private Romanian limited-liability company with approximately 20 years of operating history (CUI registered ~2005). While specific financial figures could not be retrieved from Romanian statutory filings (ANAF/ONRC), qualitative indicators suggest a moderately resilient business. The company benefits from a digital-native, low-fixed-cost model with a fully remote workforce, established market position in the WordPress ecosystem (250K+ websites powered, 6M+ downloads, 4.8 rating), and multiple revenue streams including licenses, AI features, and done-for-you services with favorable 50% upfront payment terms. However, resilience is constrained by significant platform concentration risk (100% dependence on WordPress), intense competition from much larger players like Elementor (10M+ installs), reliance on a single payment processor (Fastspring), and USD/RON FX exposure since pricing is USD-denominated while accounts are in RON. The 'We're Not Hiring (for Now!)' banner may signal cost discipline or a hiring freeze. As a small private SRL, the company lacks the capital buffers and diversification of larger competitors, and key-person risk is likely elevated given the small team structure typical of Romanian SRLs in this segment.

Key strengths: ~20 years of operating history since ~2005 registration, Established WordPress ecosystem position with 250K+ sites powered and 6M+ downloads, Digital-native, low-fixed-cost remote business model with high typical gross margins, Multiple revenue streams: licenses, Kubio AI, and Build My Website services, Favorable working capital terms (50% upfront + 50% on delivery for services), Recent AI pivot (Kubio AI launched late 2023/2024) aligns with current tech trends

Risk factors: 100% platform concentration on WordPress ecosystem, Highly competitive page builder segment dominated by Elementor, Divi, Bricks, Small market share (~250K sites vs Elementor's 10M+ installs), Payment processor concentration risk (Fastspring as merchant of record), USD/RON FX exposure (USD pricing, RON reporting), Hiring freeze signal ('We're Not Hiring for Now!' banner), Key-person risk due to small team size typical of Romanian SRLs, Limited public financial disclosure as a private SRL, Exposure to structural WordPress platform shifts (Automattic/WP Engine dispute, Gutenberg changes)

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report