Zoobu

United Kingdom · zoobu.com · 8 vendors

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 8 sub-vendors.

Insights

Last updated 2026-08-11 · revision 2

8 direct vendors, 165 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 3/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Zoobu's migration readiness is assessed as low. The primary challenge stems from its traditional internal tech stack, which is heavily reliant on WordPress, Elementor, and PHP. This architecture is not cloud-native, containerized, or microservices-based, meaning a migration to a modern cloud environment would likely necessitate a complex and costly re-platforming or re-architecture effort rather than a straightforward lift-and-shift. This creates significant platform lock-in to the WordPress/Elementor ecosystem. Critical unknowns further impede readiness: there is no data on financial stability, making it impossible to assess Zoobu's capacity to fund a potentially expensive migration project. Similarly, the absence of specified regulatory environments or data residency requirements introduces major uncertainties that could become significant blockers or add substantial complexity and cost if specific compliance needs emerge during migration planning. The data stating 'Total Vendors: 0' while using 'Total Services: 11' implies a lack of formal vendor relationships, which means Zoobu would likely not have access to vendor-provided migration support, tools, or expertise, making the process more challenging. While Cloudflare is in use, it primarily serves as an edge network and does not inherently simplify the migration of the core application stack.

Compliance

6 in-scope frameworks identified; showing 3.

UK Companies Act 2006 — Compliant

Zoobu Ltd is registered in England and Wales (Company No. 08197887) and publicly discloses its registered office address and company number in its Terms of Service. This indicates basic Companies Act compliance. Annual confirmation statements and accounts filing with Companies House are statutory requirements. Risk is Low as the company is properly incorporated and discloses required information.

Evidence: https://zoobu.com/terms/, https://find-and-update.company-information.service.gov.uk/company/08197887, https://www.legislation.gov.uk/ukpga/2006/46/contents

GDPR (source) — Partially Compliant

Zoobu Ltd is incorporated and headquartered in England and Wales, making UK GDPR and the Data Protection Act 2018 directly and mandatorily applicable. The company collects personal data from website visitors including IP addresses, names, email addresses, postal addresses, payment information, and browsing behaviour across multiple web properties. Several compliance gaps are evident from the published privacy policy: (1) The policy references charging a £10 fee for subject access requests — this is unlawful under UK GDPR, which requires SARs to be fulfilled free of charge; (2) The international data transfer section relies on user 'express agreement' as a transfer mechanism, which is not a valid lawful basis for international transfers under UK GDPR (valid mechanisms include adequacy decisions, SCCs/IDTA, or BCRs); (3) No Data Protection Officer (DPO) appointment is mentioned; (4) No lawful basis for each processing activity is explicitly stated; (5) No retention periods are specified. The ICO actively enforces UK GDPR and fines can reach £17.5 million or 4% of global annual turnover. Risk is High due to identifiable non-compliance in the published policy and the company's direct exposure to UK and EU data subjects.

Evidence: https://zoobu.com/privacy-policy/, https://zoobu.com/cookie-policy/, https://zoobu.com/terms/, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/, https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted

SOC 2 (source) — Assessment Required

SOC 2 is a voluntary framework relevant to technology and cloud service providers that store, process, or transmit customer data. Zoobu operates MusicJet (smart links SaaS for musicians and record labels) and xCrypt.com (AI content generation tool), both of which are cloud-based services that process user data. If these services have business customers (B2B) who require assurance over data security, availability, and confidentiality, SOC 2 Type II reports may be expected by enterprise clients. However, given Zoobu's apparent small size and consumer/SME-focused market, formal SOC 2 certification may not yet be demanded by customers. Risk is Medium because the absence of SOC 2 could be a barrier to enterprise sales and signals immature security governance.

Evidence: https://zoobu.com/, https://www.musicjet.com, https://xcrypt.com, https://www.aicpa-cima.com/resources/landing/soc-2

Financials

Three-year financials

Financial Resilience Score: 4/10

Zoobu Ltd is a very small UK-based private limited company operating a portfolio of affiliate and light-SaaS websites. No public financial figures are available, as the company likely qualifies as a micro-entity or small company under the UK Companies Act and files only abridged accounts with Companies House. Revenue, EBIT, and equity are not disclosed in any accessible source, limiting the ability to make a data-driven resilience assessment. Qualitatively, the business model has some strengths: a diversified portfolio across multiple niches (music tech, AI tools, WordPress plugins, health) reduces single-source risk, affiliate/content sites typically have low fixed costs and high gross margins, and at least one SaaS-style product (xCrypt.com) could provide recurring revenue. The absence of visible external funding suggests the company is likely bootstrapped with no debt or dilution pressure. However, significant risks weigh on resilience: heavy dependence on Google search algorithms (which have recently penalized similar affiliate operators), crowded and volatile AI-review niches, key-person risk given the apparent tiny headcount, no evidence of recurring enterprise contracts, and website content that appears last updated in 2023, suggesting limited ongoing investment. Overall, resilience is modest and uncertain.

Key strengths: Diversified portfolio across multiple niches (music, AI, WordPress, health), Low fixed costs and high gross margins typical of affiliate/content sites, Potential recurring revenue from SaaS-style product (xCrypt.com), Likely bootstrapped with no external debt or dilution pressure

Risk factors: Heavy dependency on Google/SEO and vulnerability to algorithm updates, Crowded and volatile AI-review affiliate niche, Key-person risk with very small presumed headcount, No recurring enterprise contracts; traffic- and affiliate-payout-dependent revenue, Website content appears last updated in 2023, suggesting limited ongoing investment, Minimal financial transparency as a small private Ltd

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report