RocketCDN

France · www.rocketcdn.me · 15 vendors

WP MEDIA is a French company that develops web performance optimization products. Its RocketCDN service is a custom content delivery network (CDN) designed to automatically apply optimal settings to improve website loading times and performance scores. It delivers static assets such as images, JavaScript, and CSS files from a global network of servers to visitors based on their geographical location.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 15 sub-vendors.

Insights

Last updated 2026-08-11 · revision 9

15 direct vendors, 229 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 5/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

RocketCDN exhibits medium migration readiness. A primary challenge is the significant vendor lock-in associated with Bunny.net, which powers RocketCDN's core service. Migrating RocketCDN would essentially require re-platforming the entire CDN infrastructure, a complex and costly undertaking. The company's internal tech stack and product ecosystem are heavily WordPress-centric (WP Rocket, Imagify plugin, and their own product websites), which, while widely used, can complicate migration to a fully cloud-native, containerized, or microservices architecture. Data residency requirements, driven by GDPR and French law, are complex due to Bunny.net's global network of 120+ edge locations. While legal documents state data is hosted in Denmark (EU compliant), global caching necessitates careful management of personal data flows and the implementation of appropriate transfer mechanisms (e.g., SCCs) for non-EU locations, adding significant complexity to any migration involving data movement. The lack of SOC2 and ISO 27001 certifications could also hinder migration efforts, particularly if the target environment or new vendors require higher security assurances. On the positive side, the estimated group revenue of US$15-30M suggests financial stability to fund a migration if deemed necessary. The existing use of SaaS providers like Stripe and Google Tag Manager indicates some familiarity with leveraging external services, but this does not directly mitigate the challenges posed by core infrastructure and platform lock-in.

Compliance

8 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

RocketCDN is a cloud-based CDN service provider — precisely the type of organization for which SOC 2 is designed. Customers entrust RocketCDN with their website content delivery infrastructure, making security, availability, and confidentiality trust service criteria directly relevant. While SOC 2 is not legally mandated, it is increasingly required by enterprise customers as a contractual prerequisite. The absence of any publicly disclosed SOC 2 report represents a competitive and reputational risk, particularly for customers in regulated industries. Risk is Medium because the lack of SOC 2 may limit enterprise customer acquisition and could indicate gaps in formal security controls documentation.

Evidence: https://rocketcdn.me/, https://rocketcdn.me/terms/, https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services

ISO 27001 (source) — Assessment Required

ISO 27001 is the internationally recognized standard for information security management and is highly relevant for a CDN/cloud service provider like RocketCDN that handles customer website assets, billing data, and account credentials globally. No ISO 27001 certification has been publicly disclosed. The absence of certification is a risk factor for enterprise customers and may indicate that formal ISMS controls have not been independently verified. Risk is Medium because ISO 27001 is not legally mandated but is a strong market expectation for cloud service providers, and its absence may indicate gaps in systematic security management.

Evidence: https://rocketcdn.me/terms/, https://rocketcdn.me/legal/, https://www.iso.org/isoiec-27001-information-security.html

ePrivacy Directive — Assessment Required

RocketCDN's website uses Google Tag Manager (confirmed via page source: GTM-TJMKZZJ), which typically deploys analytics and marketing cookies. The Terms reference cookies and state users can opt out via browser settings, but no cookie consent management platform (CMP) or cookie banner was observed during the website fetch. Under the ePrivacy Directive as implemented in France (enforced by CNIL), prior informed consent is required for non-essential cookies. The CNIL has issued significant fines for cookie consent violations. Risk is Medium because Google Tag Manager usage without a proper CMP is a common and actively enforced violation in France.

Evidence: https://rocketcdn.me/, https://rocketcdn.me/terms/, https://www.cnil.fr/en/cookies-and-other-trackers, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32002L0058

Financials

Three-year financials

Financial Resilience Score: 7/10

WP MEDIA SAS, the parent entity behind RocketCDN, benefits from a diversified portfolio of recurring-revenue SaaS products (WP Rocket, Imagify, RocketCDN) built on an asset-light infrastructure model. RocketCDN specifically resells Bunny.net's edge network rather than owning capex-heavy infrastructure, keeping fixed costs low and gross margins high. The flagship WP Rocket product has an installed base of 200,000+ customers, providing a strong cross-sell channel and low customer acquisition cost for RocketCDN's ~7,500 customers (implying roughly $675k ARR from RocketCDN alone). Third-party estimates place WP MEDIA group revenue in the US$15-30 million range annually, though no filed accounts have been verified. As a privately held French SAS likely operating under the confidentiality option for its filed accounts, external visibility into liquidity, leverage, and profitability is limited. Key risks include platform dependency on Bunny.net for RocketCDN's underlying infrastructure, ecosystem dependency on WordPress for the vast majority of group revenue, and intense CDN competition from scale players like Cloudflare (with its free tier), Fastly, Akamai, and AWS CloudFront. The flexible remote workforce and subscription pricing model support resilience, but FX exposure between USD-denominated revenue and mixed EUR/USD costs adds volatility.

Key strengths: Diversified product portfolio (WP Rocket, Imagify, RocketCDN) under WP MEDIA, Recurring SaaS subscription revenue model with high visibility, Asset-light infrastructure - resells Bunny.net rather than owning CDN capex, Large WP Rocket installed base (200,000+ customers) enables low-CAC cross-sell, Global remote team keeps fixed cost base flexible, Established brand credibility from WP Rocket halo effect, 7,500+ RocketCDN customers providing recurring ARR base (~$675k)

Risk factors: Platform dependency on Bunny.net for underlying CDN infrastructure, Ecosystem dependency on WordPress for majority of group revenue, Intense CDN competition from Cloudflare (free tier), Fastly, Akamai, AWS CloudFront, Financial opacity due to French SAS confidentiality option on filed accounts, FX exposure between USD-denominated revenue and mixed EUR/USD costs, Small company scale relative to hyperscale CDN competitors

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report