Moodle

Australia · moodle.org · 10 vendors

Moodle is a free and open-source learning management system (LMS) designed to provide educators, administrators, and learners with a robust, secure, and integrated system to create personalized online learning environments. It is used for blended learning, distance education, and other online learning projects in various sectors.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 10 sub-vendors.

Insights

Last updated 2026-07-29 · revision 1

10 direct vendors, 198 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Moodle exhibits a high degree of migration readiness, largely attributable to its embrace of containerization through Docker and `moodle-docker` for its development environment, which significantly streamlines deployment and portability to various cloud environments. The existence of MoodleCloud, a hosted SaaS version, further demonstrates Moodle's practical experience with cloud infrastructure and managed services, indicating a well-understood path for cloud migration. A major strength for migration readiness is Moodle's open-source nature and the stated "Total Vendors: 0" (interpreted as minimal direct vendor dependencies for core operations), which drastically reduces proprietary vendor lock-in. This provides substantial flexibility in choosing infrastructure providers and avoiding complex contract renegotiations during a migration. The absence of specified data residency requirements also offers considerable flexibility in selecting target cloud regions. While the core platform is built on PHP, which is a mature language, its integration with modern practices like AI/Machine Learning subsystems and mobile-first PWAs, alongside containerization, suggests an adaptable architecture. The assessment is limited by the lack of information on the regulatory environment and Moodle's financial stability, which could impact the funding and compliance aspects of a large-scale migration. However, the existing technological foundation and open-source model position Moodle very favorably for future migrations.

Compliance

9 in-scope frameworks identified; showing 3.

Australian Privacy Act 1988 — Compliant

As an Australian-headquartered company (Moodle Pty Ltd, West Perth, WA), Moodle is directly subject to the Australian Privacy Act 1988 and the 13 Australian Privacy Principles (APPs). The risk is Medium because: (1) Moodle processes personal data of Australian residents and employees; (2) the Privacy Act applies to organizations with annual turnover exceeding AUD $3M (Moodle clearly exceeds this); (3) proposed reforms to the Privacy Act (Privacy and Other Legislation Amendment Act 2024) introduce new obligations including a statutory tort for serious invasions of privacy and enhanced enforcement powers; (4) Moodle's cross-border data transfers must comply with APP 8 requirements. The risk is not High because Moodle's GDPR compliance framework largely satisfies APP requirements, and there is no evidence of regulatory action.

Evidence: https://moodle.com/privacy-notice/, https://www.oaic.gov.au/privacy/privacy-legislation/the-privacy-act, https://moodle.org

NIS2 (source) — Assessment Required

NIS2 targets Essential and Important Entities operating in the EU. Moodle is an Australian-headquartered open-source LMS provider. The 'digital providers' category under NIS2 (Annex II) covers online marketplaces, online search engines, and cloud computing service providers — Moodle's MoodleCloud and hosted services could potentially fall under 'cloud computing service provider' classification. However, Moodle is not in the core Essential Entity sectors (energy, transport, banking, health, water, digital infrastructure). Whether Moodle's EU-facing cloud services meet the NIS2 size threshold (50+ employees or €10M+ turnover) and whether they are classified as an Important Entity requires formal legal assessment. The risk is Low because Moodle is not in a clearly listed Essential Entity sector, and its primary product is open-source software rather than critical infrastructure. However, the cloud/digital services angle warrants assessment.

Evidence: https://moodle.com/privacy-notice/, https://moodle.org/security/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555

CPRA — Compliant

Moodle explicitly adopts the CCPA 2018 as one of its three governing privacy frameworks (alongside GDPR and UK GDPR), indicating active compliance efforts. The risk is Medium because: (1) Moodle serves US customers including California residents through MoodleCloud and Moodle US; (2) CPRA (effective January 2023) introduced enhanced obligations including a new category of 'sensitive personal information', opt-out rights for sharing, and the California Privacy Protection Agency (CPPA) as an enforcement body; (3) Moodle's privacy notice references the CPPA as the relevant supervisory authority for California, demonstrating awareness; (4) the scale of US operations means any compliance gap could result in significant CPPA enforcement action. The risk is not High because Moodle explicitly acknowledges CCPA and has implemented data subject rights.

Evidence: https://moodle.com/privacy-notice/, https://cppa.ca.gov/

Financials

Three-year financials

Financial Resilience Score: 7/10

Moodle Pty Ltd demonstrates strong qualitative financial resilience despite the absence of public financial statements. The company benefits from a highly sticky, mission-critical product embedded in universities, K-12 systems, ministries of education, and enterprises worldwide. Switching an LMS is expensive and disruptive, providing high revenue visibility. The global installed base of approximately 146,000+ registered sites across 236 countries with ~500 million learners provides an enormous funnel for paid Workplace, Cloud, and Marketplace upsell opportunities. The diverse partner ecosystem of 90+ Certified Partners globally spreads customer-acquisition costs and geographic risk. Moodle's open-source moat reduces R&D costs through community contributions while keeping the trademark and Workplace product proprietary and monetisable. Founder-led leadership, mission alignment, and B Corp certification (with score improving from 81.6 in 2021 to 111.0 in 2025) suggest strengthening governance and workforce practices. Product expansion since 2019 (Workplace, Academy, Direct Services, Marketplace) diversifies the business beyond LMS-only revenue. However, risks include cannibalization from the free open-source core, well-capitalized competition (Instructure Canvas, D2L Brightspace, Anthology Blackboard, Google Classroom, Open edX), channel concentration risk via Certified Partners, pressure on higher-ed IT budgets, potential PE ownership pressure, limited public financial transparency, and AI disruption requiring meaningful R&D investment.

Key strengths: Very sticky, mission-critical LMS product with high switching costs, Global installed base of ~146,000+ sites across 236 countries with ~500M learners, Diverse partner ecosystem of 90+ Certified Partners globally, Open-source moat reduces R&D costs via community contributions, Founder-led, mission-aligned, B Corp certified (score improved 81.6 to 111.0), Product diversification since 2019 (Workplace, Academy, Direct Services, Marketplace)

Risk factors: Free open-source core cannibalises paid revenue, Well-capitalized competition (Instructure Canvas, D2L Brightspace, Anthology Blackboard, Google Classroom, Open edX), Channel concentration risk via dependence on Certified Partners, Higher-ed IT budgets under global pressure, Private-equity ownership may pressure margins or lead to exit event, Limited public financial transparency, AI disruption reshaping LMS market requires significant R&D investment

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report