Oxygen Builder

United States · oxygenbuilder.com · 13 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 13 sub-vendors.

Insights

Last updated 2026-08-04 · revision 1

13 direct vendors, 180 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Oxygen Builder exhibits medium migration readiness. The core tech stack, centered on WordPress and PHP, is not inherently cloud-native or microservices-based, which could present challenges for a full-scale cloud migration, potentially requiring significant re-platforming or refactoring. The lack of data on financial stability and regulatory compliance requirements are major unknowns that could significantly impact the feasibility and cost of a migration. The vendor lock-in risk is also unknown, which is a critical factor in migration planning. On the positive side, the company's newer product, Oxygen 6, features a modern CSS-first design, reusable components, and AI agent integration, suggesting a more modular and adaptable architecture that could facilitate parts of a migration. The use of npm/Node.js for CLI tooling also indicates modern development practices. Crucially, data residency requirements are 'Not specified,' offering flexibility in choosing cloud regions and deployment strategies. While the vendor geographic diversity is good, the total number of services (15) implies a moderate vendor landscape, but the specific lock-in risk remains unassessed.

Compliance

5 in-scope frameworks identified; showing 3.

PCI DSS (source) — Assessment Required

Oxygen Builder operates a subscription-based business model and processes customer payments. If payment card data is processed, stored, or transmitted by Soflyy (even via third-party payment processors), PCI DSS compliance obligations apply. The risk is Medium because: (1) most modern SaaS companies use third-party payment processors (e.g., Stripe, PayPal) which reduces PCI DSS scope significantly; (2) however, if Soflyy has any direct involvement in card data handling, full PCI DSS compliance is required; (3) no PCI DSS compliance statement or SAQ (Self-Assessment Questionnaire) was found publicly.

Evidence: https://oxygenbuilder.com/terms-of-service/, https://oxygenbuilder.com/pricing

CCPA — Assessment Required

Oxygen Builder is a US-based company (Soflyy) that sells software to a global customer base including US residents. If Soflyy meets any of the CCPA thresholds — annual gross revenue over $25M, buying/selling/receiving personal information of 100,000+ consumers/households annually, or deriving 50%+ of revenue from selling personal information — CCPA compliance is mandatory. With 57,000+ customers and 180,000+ website installs, it is plausible that the company processes personal data of California residents at scale. No CCPA-specific privacy notice, opt-out mechanism ('Do Not Sell My Personal Information'), or data subject rights process was found on oxygenbuilder.com.

Evidence: https://oxygenbuilder.com/terms-of-service/, https://oxygenbuilder.com/legal/

GDPR (source) — Assessment Required

Oxygen Builder (operated by Soflyy) is a US-based company that sells software subscriptions globally, including to EU/EEA residents. As a digital product vendor with 57,000+ customers worldwide, it is highly probable that EU/EEA residents are among its customer base, triggering GDPR obligations as a data controller. The Terms of Service reference a privacy document hosted at breakdance.com (a sister product by Soflyy), suggesting shared or incomplete privacy infrastructure. No dedicated GDPR-compliant privacy policy was found on oxygenbuilder.com itself, no Data Protection Officer (DPO) appointment is disclosed, no cookie consent mechanism was observed, and no Data Processing Agreements (DPAs) are publicly offered. The risk is Medium rather than High because Oxygen Builder is a software tool (not a data processor of end-user personal data at scale), and the data it collects is primarily transactional (name, email, payment info for licensing). However, the absence of a visible, standalone privacy policy and GDPR-specific disclosures is a notable gap.

Evidence: https://oxygenbuilder.com/terms-of-service/, https://oxygenbuilder.com/legal/, https://oxygenbuilder.com/about/

Financials

Three-year financials

Financial Resilience Score: 6/10

Soflyy, the parent company of Oxygen Builder, is a small, bootstrapped, privately held US software company with no publicly disclosed financials. Based on qualitative indicators, the company appears financially stable: it operates with a lean cost structure (100% remote workforce of ~11 people), has been operating since 2008, and benefits from a cash-generative licensing model with 57,000+ customers and 200,000+ plugin installs. The diversified product portfolio (Oxygen Builder, Breakdance, WP All Import) reduces single-product risk. However, resilience is constrained by several factors. The company is entirely dependent on the WordPress ecosystem, faces intense competition from Elementor, Divi, Bricks, Webflow, and Framer, and has product transition risk with the Oxygen Classic to Oxygen 6 rewrite. Lifetime-license obligations create long-tail support costs without matching revenue. Key-person risk is significant given the tiny team and founder-led structure. The lack of financial transparency limits confidence in any resilience assessment, warranting a moderate score.

Key strengths: Diversified product portfolio across three complementary WordPress products (Oxygen, Breakdance, WP All Import), Established brand in WordPress ecosystem since 2008, Lean cost structure with 100% remote workforce (~11 employees), Cash-generative lifetime + annual-renewal license model, Bootstrapped and founder-led with no known VC dilution, Large installed base: 57,000+ customers, 180,000+ websites, 200,000+ plugin installs, Enterprise reference customers via WP All Import (Disney, Ryanair, Intel, Stanford)

Risk factors: Complete platform dependence on WordPress ecosystem, Intense competition from Elementor, Divi, Bricks, Webflow, Framer, Internal cannibalization from sibling product Breakdance, Product transition risk from Oxygen Classic to Oxygen 6 rewrite, Lifetime-license model creates long-tail support obligations, Key-person risk with small team and central founder role, No financial transparency for counterparties and partners, WordPress governance disputes (e.g., WordPress.org vs. WP Engine)

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report