OnTheGoSystems

Cyprus · wpml.org · 21 vendors

OnTheGoSystems Limited is a fully remote software development company specializing in localization tools for WordPress. Their flagship product, WPML (WordPress Multilingual), is a popular plugin enabling users to create multilingual WordPress websites. The company also develops other WordPress plugins like Toolset and is expanding into SaaS for software translation.

Resilience scores

Disruption prediction

OnTheGoSystems has an estimated 11% probability of disruption in the next 6 months.

9 of OnTheGoSystems's 21 vendors monitored for disruptions.

Technology vendors

Services catalogue

7 services in catalogue across 3 categories; runs on 21 sub-vendors.

Insights

Last updated 2026-08-11 · revision 1

21 direct vendors, 206 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

OnTheGoSystems exhibits moderate migration readiness. A primary challenge for a full cloud-native migration lies in its core products being deeply integrated with the WordPress ecosystem. While WordPress can be hosted in cloud environments, refactoring it into a microservices or serverless architecture would likely require substantial re-engineering efforts. However, the company's tech stack includes modern elements such as LLMs for its Private Translation Cloud (PTC), CDNs, and REST APIs, which are more amenable to cloud adoption and could potentially be migrated or re-platformed independently. The absence of specified data residency requirements is a significant advantage, simplifying potential cloud deployments by removing a common regulatory hurdle. Key unknowns that impact migration readiness include the company's financial stability, which is crucial for funding a large-scale migration, and the vendor lock-in risk. While there is geographic diversity among vendors, the exact number of distinct vendors for 21 services and the complexity of these relationships are not fully clear, which could introduce complexities during a migration.

Compliance

6 in-scope frameworks identified; showing 3.

CPRA — Partially Compliant

The company's privacy policy includes a dedicated section on US residents' privacy rights, indicating awareness of US state privacy laws. The company explicitly states it does not sell personal information and has not done so in the preceding 12 months. Risk is Low because: (1) the company has addressed US privacy rights in its policy; (2) it does not sell personal data; (3) its primary business is B2B (selling to website developers/businesses) rather than B2C consumer data processing; (4) the scale of US consumer data processing appears limited relative to CCPA thresholds.

Evidence: https://wpml.org/documentation/privacy-policy-and-gdpr-compliance/

ISO 27001 (source) — Assessment Required

ISO 27001 certification is not publicly disclosed by OnTheGoSystems. Given the company's scale (1.5M+ WordPress sites, 250,000+ customers, global operations), information security management is critical. The absence of ISO 27001 certification means the company cannot formally demonstrate to customers and regulators that it has a systematic approach to managing information security risks. Risk is Medium because: (1) the company processes significant volumes of customer data including payment information (via PayPal/Stripe) and content submitted for translation; (2) enterprise customers and regulated industries increasingly require ISO 27001 from vendors; (3) NIS2 compliance (if applicable) would require security measures aligned with ISO 27001 principles; (4) however, ISO 27001 is voluntary and the company may have equivalent internal controls.

Evidence: https://wpml.org/documentation/privacy-policy-and-gdpr-compliance/, https://www.onthegosystems.com

GDPR (source) — Partially Compliant

OnTheGoSystems has demonstrated meaningful GDPR compliance efforts: a named DPO (Mercedes Barreda), a published privacy notice explicitly referencing GDPR, a DPA request mechanism, data subject rights procedures, cookie consent management, and subprocessor disclosure. However, the company's legal entity is registered in Hong Kong (not Cyprus as stated in the HQ field), which creates jurisdictional complexity. The privacy policy contact address lists Hong Kong, not Cyprus. No independent GDPR audit or certification (e.g., ISO 27701) has been publicly disclosed. The company processes personal data of EU/EEA residents at scale (250,000+ customers, 1.5M+ sites), increasing the consequence of any non-compliance. Cyprus is an EU member state and GDPR applies fully. Risk is Medium rather than High because the company has clearly invested in compliance infrastructure, but the absence of third-party audit evidence and the Hong Kong legal registration introduce residual uncertainty.

Evidence: https://wpml.org/documentation/privacy-policy-and-gdpr-compliance/, https://wpml.org/home/contact-us/dpa-request/, https://wpml.org/account/dpa/, https://wpml.org/home/contact-us/request-information-about-your-data/, https://onthegosystems.com/legal/privacy-policy-and-gdpr-compliance/

Financials

Three-year financials

Financial Resilience Score: 7/10

OnTheGoSystems Limited is a mature, privately held Hong Kong-registered software company operating since 2007 with a strong market position in the WordPress multilingual plugin niche. WPML is installed on over 1.5 million WordPress sites with 250,000+ paying customers, indicating a substantial recurring revenue base from annual subscription licenses. The company appears to be bootstrapped and profitable based on nearly two decades of continuous operation without publicly reported venture funding, suggesting healthy self-sustaining cash flows typical of high-margin SaaS licensing businesses. The fully remote operating model across 40+ countries with 100+ employees keeps fixed costs low, and product diversification via Toolset and PTC (Private Translation Cloud) reduces single-product concentration risk. However, no audited financial figures are publicly available since Hong Kong private company accounts are not viewable online, creating significant governance opacity. Key risks include platform dependency on WordPress, competitive pressure from AI/LLM translation tools (DeepL, Google, OpenAI) and rivals like Weglot, TranslatePress, and Polylang, plus geopolitical exposure from Hong Kong domicile. Overall resilience is judged solid but not verifiable without registry-level due diligence.

Key strengths: Dominant niche position with WPML installed on 1.5M+ WordPress sites, 250,000+ paying customers on recurring annual subscription model, Nearly 20 years of continuous operation since 2007 implying sustained profitability, Fully remote low-fixed-cost structure across 40+ countries, Product diversification via WPML, Toolset, and PTC, Bootstrapped with no publicly reported venture funding, High-margin software licensing business model

Risk factors: Platform dependency on WordPress ecosystem health, AI/LLM disruption commoditizing machine translation, Competitive pressure from Weglot, TranslatePress, Polylang, and Automattic, Governance opacity as private HK entity with no audited disclosures, Geopolitical and banking-access risks from Hong Kong domicile, FX exposure with USD/EUR revenue but multi-currency payroll, Risk of Automattic bundling native multilingual features into WordPress

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report