Kirby CMS

Germany · getkirby.com · 11 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 11 sub-vendors.

Insights

Last updated 2026-05-13 · revision 2

11 direct vendors, 126 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Kirby CMS exhibits a medium-to-high level of migration readiness, primarily driven by its architectural flexibility and modern components. A significant advantage is its flat-file content storage, which eliminates the complexity of migrating traditional relational databases. The built-in REST API allows Kirby to function as a headless CMS, providing a strong foundation for decoupling frontends and enabling migration towards more distributed or microservices-oriented architectures. The core technology is modern (PHP 8+ with a proprietary PHP micro-framework and 95% test coverage), indicating a well-maintained and adaptable codebase. Explicit GDPR/DSGVO compliance is a key strength, simplifying data privacy considerations during any migration. The diverse vendor base, spread across 6 countries, also offers some flexibility in transitioning services. However, several challenges and unknowns prevent a higher score. The current tech stack does not explicitly mention cloud-native features like containerization (e.g., Docker, Kubernetes) or a native microservices architecture, which would require additional effort for a full cloud-native transformation. Data residency requirements are not specified, which could introduce complexities if strict regulations emerge. The absence of financial stability data (revenue concentration, growth history) makes it difficult to assess the company's capacity to fund a significant migration effort. Lastly, while vendor diversity is present, the specific lock-in risk for each of the 14 vendors is unknown, potentially complicating transitions away from certain services.

Compliance

3 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

While Kirby provides cloud-based services (license hub, demo platform, hosting), no SOC2 certification evidence was found. Medium risk due to handling customer data through cloud services without documented SOC2 compliance, though they demonstrate good security practices through their security policy.

Evidence: https://getkirby.com/security

ISO 27001 (source) — Assessment Required

No ISO 27001 certification evidence found despite company handling customer data and operating cloud services. Medium risk as they demonstrate good security practices but lack formal information security management system certification, which would strengthen their security posture.

Evidence: https://getkirby.com/security

GDPR (source) — Compliant

Company is located in Germany (EU) and demonstrates strong GDPR compliance through comprehensive privacy policy, explicit data subject rights implementation, lawful basis documentation, and GDPR-compliant third-party service selection. Low risk due to proactive compliance measures and transparent data handling practices.

Evidence: https://getkirby.com/privacy, https://getkirby.com/contact

Financials

Three-year financials

Financial Resilience Score: 5/10

Content Folder GmbH & Co. KG (Kirby CMS) presents a mixed resilience profile typical of a long-standing bootstrapped micro-enterprise. On the positive side, the company has been reportedly profitable for over a decade, is 100% self-funded with no external investors or debt overhang, and operates a lean cost base with a fully remote 5-person team. Its commercial per-site licensing model has produced sustained cash flow since 2012, and the 2023 launch of a partner programme adds a secondary revenue stream. A loyal niche customer base (some since the 2011 beta) and 60+ open-source contributors reduce R&D costs and customer acquisition risk. However, resilience is constrained by very small absolute scale and significant key-person concentration around founder Bastian Allgeier. As a 5-person micro-business, headroom to absorb adverse events (major customer churn, security incidents, PHP ecosystem shifts) is limited compared to larger CMS vendors. The CMS market is highly competitive with well-funded alternatives (WordPress, Sanity, Contentful, Strapi, Payload, Webflow). Revenue is also lumpy, tied to one-time license sales linked to major version release cycles. Combined with the lack of public financial disclosure (only abridged balance sheet filings under German small-entity rules), a mid-range score of 5 reflects proven longevity and profitability balanced against scale and concentration risks.

Key strengths: 100% self-funded with no external investors or debt, Reportedly profitable for over a decade (since 2012), Lean fully-remote cost base with only 5 core team members, Commercial per-site licensing model providing sustained cash flow, Secondary revenue stream added in 2023 via partner programme, Loyal niche customer base and 60+ open-source contributors, 13+ year operating history with strong brand in design/agency niche

Risk factors: Key-person concentration around founder Bastian Allgeier, Very small absolute scale (5-person micro-business), Crowded CMS competitive landscape with well-funded rivals, Lumpy license-model revenue tied to major version release cycles, Limited public financial disclosure under German small-entity rules, Technology dependency on PHP, a slower-growing language, No SaaS/recurring subscription revenue stream

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report