Umbraco A/S

Denmark · owned by Monterro Software Investment AB (Sweden) · umbraco.com · 45 vendors

Umbraco is a Danish company that develops and maintains Umbraco CMS, a leading open-source content management system built on ASP.NET Core. With over 700,000 websites powered by its platform worldwide, Umbraco offers a flexible, editor-friendly CMS used by developers and businesses globally. The company also provides cloud hosting, support, and commercial services around its open-source product.

Resilience scores

Disruption prediction

Umbraco A/S has an estimated 11% probability of disruption in the next 6 months.

19 of Umbraco A/S's 45 vendors monitored for disruptions.

Technology vendors

Services catalogue

9 services in catalogue across 5 categories; runs on 45 sub-vendors.

Insights

Last updated 2026-09-13 · revision 25

45 direct vendors, 395 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 7/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Umbraco A/S exhibits a high level of migration readiness, primarily driven by its modern and cloud-native technology architecture. The core Umbraco CMS is built on ASP.NET Core / Microsoft .NET, a contemporary framework. Its flagship Umbraco Cloud offering is a 'fully managed cloud hosting platform purpose-built for Umbraco CMS projects' and 'Powered by Microsoft Azure', indicating deep integration with a leading cloud provider. The company's adoption of a headless CMS (Umbraco Heartcore) and API-first architecture further enhances flexibility, allowing content delivery to any front-end or device, which is crucial for decoupled migrations. Integrated CI/CD pipelines (Azure DevOps-based) facilitate automated deployments and content synchronization, streamlining potential migration processes. The company's robust data residency management, offering regional hosting options via Azure and maintaining Data Processing Agreements (DPAs) and Standard Contractual Clauses (SCCs), ensures compliance with EU data protection laws and provides flexibility for customers' data location requirements during migration. Regulatory compliance, particularly with GDPR and ISO 27001 certification, demonstrates established processes for data handling and information security, which are vital for secure and compliant migrations. However, the 'Assessment Required' status for NIS2 (with a July 2025 deadline) introduces a potential future regulatory factor that could influence migration planning. The primary challenge to migration readiness stems from the deep integration and reliance on Microsoft Azure for the Umbraco Cloud platform. While beneficial for current operations, this represents a degree of vendor lock-in if Umbraco A/S were to consider migrating its core cloud infrastructure to a different provider. The provided data states 'Total Vendors: 0', which is contradictory to the 'Internal Tech Stack' listing critical services like Microsoft Azure and Cloudflare. Assuming these are key vendors, the 'Vendor Lock-in Risk' is explicitly stated as 'Unknown', but the Azure dependency is evident. The lack of available financial stability data (revenue concentration, growth history) also presents an unknown factor regarding the company's capacity to fund large-scale migration initiatives. Despite these considerations, the overwhelmingly modern and cloud-centric technical foundation positions Umbraco A/S very well for future migrations.

Compliance

3 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

Umbraco A/S is a Danish technology company providing digital infrastructure services (CMS, cloud hosting) which could qualify as 'digital providers' under NIS2 Important Entities. With 140+ employees, they exceed the size threshold. The company acknowledges NIS2 applicability with compliance required by July 1, 2025. Medium risk due to pending compliance deadline and potential classification as Important Entity.

Evidence: https://umbraco.com/trust-center/compliance-faq/

GDPR (source) — Compliant

Umbraco A/S is headquartered in Denmark (EU) and processes personal data of EU residents, making GDPR fully applicable. The company demonstrates strong compliance with ISO 27001 certification, dedicated DPO, comprehensive DPA, annual staff training, and robust data protection measures. Low risk due to proactive compliance approach and established procedures.

Evidence: https://umbraco.com/trust-center/compliance-faq/, https://umbraco.com/trust-center/privacy-and-umbraco/, https://umbraco.com/media/bxkad35l/data-processing-agreement-umbraco.pdf

ISO 27001 (source) — Compliant

Umbraco A/S has achieved ISO 27001 certification for information security management, demonstrating strong commitment to security controls and risk management. This significantly reduces information security risks and provides assurance to customers and stakeholders.

Evidence: https://umbraco.com/trust-center/compliance-faq/, https://umbraco.com/blog/iso-27001/

Financials

Three-year financials

Financial Resilience Score: 8/10

Umbraco A/S demonstrates strong financial resilience for a mid-market European SaaS company. Revenue has roughly tripled from approximately EUR 10-11M in 2020 to over EUR 30M in 2024, while the company has remained consistently profitable. The company operates a self-funded growth model, reinvesting all earnings into product development rather than paying dividends, which preserves balance-sheet strength. Backing by Monterro (Nordic B2B software-focused PE firm) since 2020 provides additional financial flexibility for M&A and product investment. The business benefits from recurring SaaS revenue through Umbraco Cloud, supported by a large open-source installed base of 700,000+ websites globally that funnels conversions into paid tiers. Customer diversification is excellent with ~3,000 unique paying customers across ~100 countries, including blue-chip references like Carlsberg, Heineken, Volvo, Mercedes-Benz, and the European Union, limiting single-customer concentration risk. Key risks include intense competition from well-funded CMS players (WordPress/Automattic, Sitecore, Optimizely, Contentful, Adobe), dependence on the Microsoft .NET/Azure ecosystem, potential AI disruption to the CMS category, and eventual PE exit uncertainty. Open-source cannibalisation also limits monetisation potential since only a fraction of users convert to paid offerings. Overall, the company's disciplined profitable growth, diversified customer base, and recurring revenue model justify a strong resilience score.

Key strengths: Continuous YoY revenue growth since at least 2015 (~3x revenue 2020-2024), Consistently profitable with reinvestment policy (no dividends), Recurring SaaS revenue base via Umbraco Cloud and subscriptions, Large open-source installed base of 700,000+ websites driving conversion funnel, Diversified customer base: ~3,000 paying customers across ~100 countries, Blue-chip enterprise references (Carlsberg, Heineken, Volvo, Mercedes-Benz, EU), Backed by Monterro PE providing balance-sheet flexibility, Strong global partner channel amplifying revenue reach

Risk factors: Intense competition from WordPress, Sitecore, Optimizely, Contentful, Adobe, Strapi, Storyblok, Dependence on Microsoft .NET ecosystem and Azure infrastructure, Open-source cannibalisation - only fraction of users monetise, FX exposure (EUR/USD/GBP revenue vs DKK/EUR costs), PE ownership horizon - eventual Monterro exit uncertainty, AI disruption to CMS category from AI-generated content and AI-native platforms

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report