Pixel & Tonic Due Diligence

Run due diligence on Pixel & Tonic: check compliance and get alerts when suppliers change.

United States · craftcms.com · 16 vendors

Pixel & Tonic, Inc. is a software company that develops Craft CMS, a flexible and user-friendly content management system. The company provides a platform for creating custom digital experiences on the web, offering structured content modeling, multilingual localization, e-commerce functionality, and a plugin store. They also offer hosting services through Craft Cloud.

Resilience scores

Technology vendors

Services catalogue

4 services in catalogue across 2 categories; runs on 16 sub-vendors.

Insights

Last updated 2026-03-26 · revision 2

16 direct vendors, 178 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

3 in-scope frameworks identified; showing 3.

GDPR (source) — Evidence found

Evidence: https://craftcms.com/privacy, https://craftcms.com/dpa, https://craftcms.com/subprocessors, https://craftcms.com/cloud

SOC 2 (source) — No public evidence

Evidence: https://craftcms.com/cloud

ISO 27001 (source) — No public evidence

Financials

Three-year financials

Financial Resilience Score: 6/10

Pixel & Tonic demonstrates meaningful financial resilience for a bootstrapped, founder-led software company with over 12 years of uninterrupted operation. Its longevity without external funding is a strong signal of sustainable unit economics, and its diversified revenue model — spanning one-time CMS licenses, annual renewal fees, Commerce add-ons, and the newly launched Craft Cloud SaaS subscriptions — reduces dependence on any single revenue stream. The large installed base of 150,000+ sites creates a substantial recurring renewal revenue floor, and the high switching costs inherent to CMS platforms support strong revenue retention. The strategic launch of Craft Cloud in August 2024 represents a structurally positive shift toward predictable monthly recurring revenue, moving the business away from lumpy one-time license sales. The pursuit of SOC 2 and ISO 27001 compliance signals deliberate upmarket enterprise positioning, which typically correlates with higher contract values and longer customer lifetimes. The rebuilt partner network of 239 certified agencies provides organic distribution and reduces customer acquisition costs. However, the company carries meaningful concentration risk given its approximately 16-person team, with key-person dependency on founder/CEO Brandon Kelly and CTO Brad Bell representing a material operational vulnerability. The absence of disclosed external capital limits visibility into the company's ability to absorb a prolonged revenue downturn or fund the capital-intensive Craft 6 / Laravel re-architecture. Craft Cloud, while strategically important, remains nascent at roughly 200 hosted projects as of late 2025. The competitive landscape adds further pressure, with WordPress retaining dominant market share and well-funded headless CMS competitors (Contentful, Sanity, Storyblok) competing aggressively. The freemium Solo tier means a significant portion of the installed base generates no direct revenue, and conversion rates are undisclosed. Overall, the business appears stable and growing but lacks the capital cushion, team depth, and financial transparency to warrant a higher resilience score.

Key strengths: 12+ years of continuous bootstrapped operation since 2013 with no known external investors, Diversified revenue across CMS licenses, annual renewals, Commerce add-ons, Craft Cloud subscriptions, and support plans, Large installed base of 150,000+ sites creating a recurring annual renewal revenue floor, High customer switching costs inherent to CMS platforms supporting strong revenue retention, Strategic shift toward recurring SaaS revenue via Craft Cloud (launched August 2024), SOC 2 and ISO 27001 compliance pursuit signaling enterprise upmarket ambitions, 239 certified agency partners providing organic distribution and reduced CAC, 8,000+ Discord community members creating a strong organic moat, WordPress/WP Engine controversy in 2024 created a migration tailwind actively capitalized upon, No dilution pressure or forced exit timeline from external investors

Risk factors: Approximately 16-person team creates severe key-person concentration risk, especially around CEO Brandon Kelly and CTO Brad Bell, No disclosed external capital limits ability to weather prolonged revenue downturns or fund major strategic pivots, Craft Cloud is nascent (~200 projects as of late 2025) and cloud infrastructure is capital-intensive to scale, Craft 6 / Laravel re-architecture carries significant execution risk, potential delays, and community fragmentation risk, Freemium Solo tier means a large portion of the 150,000+ installed base generates no direct revenue; conversion rates undisclosed, Intense competitive pressure from WordPress (~43% web market share) and well-funded headless CMS competitors, Geographic and language concentration in English-speaking markets may limit total addressable market penetration, No public financial disclosure makes independent assessment of profitability and balance sheet strength impossible

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report