WPDrift Due Diligence

Denmark · wpdrift.dk · 8 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 8 sub-vendors.

Insights

Last updated 2026-07-19 · revision 2

8 direct vendors, 148 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 8/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

WPDrift exhibits high migration readiness. A primary strength is its existing heavy reliance on cloud infrastructure, specifically Amazon Web Services (AWS) and Cloudflare CDN, indicating a mature understanding and operational experience with cloud environments. Their internal tech stack, featuring NGINX, Redis, and MariaDB, is modern and generally compatible with various cloud platforms, facilitating portability. A key indicator of high readiness is their offering of a 'Website Migration Service' to clients, which strongly suggests internal expertise, tools, and processes for executing migrations effectively. Furthermore, the absence of specified data residency requirements or complex regulatory environments (based on available data) simplifies potential migration efforts. While their reliance on AWS and Cloudflare provides a solid cloud foundation, it also implies a degree of vendor lock-in. Migrating away from these specific platforms to entirely different cloud ecosystems would require effort to re-platform or re-configure services, even if the underlying technologies are portable. The lack of financial stability data prevents an assessment of their capacity to fund a significant internal migration project. There is no explicit mention of containerization or microservices architecture, which, if adopted, would further enhance their migration flexibility and readiness.

Compliance

8 in-scope frameworks identified; showing 3.

Danish E-Commerce Act — Partially Compliant

The Danish E-Commerce Act (Lov nr. 227 af 22/04/2002) implements the EU E-Commerce Directive and requires online service providers to display certain mandatory information (company name, address, CVR number, contact details, pricing information). WPDrift displays its company name, address (Birk Centerpark 40, 7400 Herning), phone number, and email. CVR number (36467649) is mentioned in the privacy policy. Risk is LOW as the company appears substantially compliant with basic disclosure requirements.

Evidence: https://www.wpdrift.dk, https://www.wpdrift.dk/privatlivspolitik/, https://www.retsinformation.dk/eli/lta/2002/227

ePrivacy Directive — Non-Compliant

WPDrift's website uses Google Tag Manager (GTM-K9H6BPS) and Google reCAPTCHA — both of which set cookies and transfer data to Google (a US-based third party). The ePrivacy Directive (implemented in Denmark via Cookiebekendtgørelsen) requires prior informed consent for non-essential cookies. No cookie consent banner or cookie policy was identified on the wpdrift.dk website during research. This constitutes a likely violation of Danish cookie rules enforced by Erhvervsstyrelsen. Risk is MEDIUM because: fines for cookie violations in Denmark are typically lower than GDPR fines but enforcement has increased; Google Tag Manager without consent is a common enforcement target; the violation is visible and easily identified by regulators.

Evidence: https://www.wpdrift.dk, https://www.erhvervsstyrelsen.dk/cookies, https://www.retsinformation.dk/eli/lta/2011/1148

GDPR (source) — Partially Compliant

WPDrift is a Danish company (EU/EEA) that processes personal data of its own customers (name, email, address, payment data) AND acts as a data processor for its hosting clients' websites — meaning it processes end-user personal data on behalf of potentially hundreds of Danish and EU businesses. As a managed hosting provider, WPDrift holds significant volumes of third-party personal data in its infrastructure. The privacy policy demonstrates awareness of GDPR obligations (data subject rights, lawful basis, retention periods, DPA agreements with sub-processors), but several gaps exist: (1) no Data Protection Officer (DPO) is identified or mentioned, (2) the privacy policy references 'www.convey.dk' as the data controller URL — an apparent legacy error suggesting the policy may not be fully up to date, (3) no mention of data transfer mechanisms for third-country transfers (AWS SES is a US-based service), (4) no cookie consent mechanism or cookie policy was identified on the website despite use of Google Tag Manager and reCAPTCHA. GDPR fines can reach €20M or 4% of global annual turnover. Danish enforcement by Datatilsynet has been active, including fines against SMEs. Risk is HIGH due to the dual role as controller and processor, use of US-based sub-processors (AWS), and identified policy gaps.

Evidence: https://www.wpdrift.dk/privatlivspolitik/, https://www.wpdrift.dk/handelsbetingelser/, https://www.datatilsynet.dk/, https://gdpr-info.eu/, https://www.datatilsynet.dk/english/the-danish-data-protection-agency

Financials

Three-year financials

Financial Resilience Score: 6/10

WP Drift ApS operates a subscription-based managed WordPress hosting business with recurring revenue streams and high customer stickiness, which provides good revenue visibility and operational predictability. The company has a diversified mid-market Danish customer base across multiple sectors including sports (F.C. Midtjylland), fashion (BTX Group), industrial, food & beverage, non-profit foundations (Rockwool Fonden), and energy (Everfuel), reducing single-customer concentration risk. Long-term customer relationships since at least 2019 and a low capex model (Cloud VPS infrastructure, no owned data center) support financial resilience. However, as a small Danish ApS, the company likely has a limited capital buffer, and its concentration in the Danish market and single technology stack (WordPress) exposes it to competitive pressure from global managed WP hosts like WP Engine, Kinsta, and Cloudways. Dependence on upstream infrastructure providers (Cloud VPS, AWS SES) exposes gross margins to third-party pricing and reliability. Key-person risk exists around Nicolai M. Olesen as Director/Partner, and the hosting business model carries elevated cyber/security incident risk where a major breach or extended outage could be materially damaging. Actual financial figures were not retrievable in this session, limiting the precision of this assessment.

Key strengths: Recurring subscription-based revenue model with high visibility, Sticky product with low customer churn due to switching costs, Diversified customer base across multiple sectors, Long-term customer relationships (F.C. Midtjylland since 2019), Partner/agency channel provides scalable acquisition, Low capex model using Cloud VPS infrastructure

Risk factors: Small ApS structure with limited capital buffer, Geographic concentration in Danish market, Single technology stack dependence (WordPress), Competitive pressure from global managed WP hosts (WP Engine, Kinsta, Cloudways), Dependence on upstream infrastructure providers (Cloud VPS, AWS SES), Key-person risk around Nicolai M. Olesen, Elevated cyber/security incident risk inherent to hosting business

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report