There is no DORA-compliant CMS. There is only how much organisation you have to build around the one you buy.

Nobody certifies a CMS against DORA, and no vendor can hold your compliance for you

DORA does not certify Contentful, Directus or Estøkad. It regulates financial entities and the way they manage ICT risk, including the risk that arrives attached to a third-party supplier. There is no logo for the footer. What a product can do is move the cost: some of the work of running the system and proving how it was run sits with the vendor, and everything the vendor does not do sits with you, staffed.

So this comparison ignores the editor, the marketplace and the API fashion. All three publish a website perfectly well. What happens afterwards is the question. Where the data sits and who can reach it from where. Which subcontractors stand behind the service, and what happens on the day one is replaced. What the system logs, and whether those logs can leave it. Whether you can prove to somebody who does not trust you where the data was on a particular Tuesday. Whether an auditor can inspect the controls rather than read about them. What leaving costs when leaving is not your idea. Then the question that produces the ranking: how much organisation is left over.

The CMS is in the ICT supply chain now, and the failure that matters is not an outage

DORA has applied since 17 January 2025. For ICT services supporting critical or important functions the contractual requirements get specific — audit rights, subcontracting, data locations, continuity, exit, incident handling — and I have not had the consolidated text open this month, so no article number appears in this piece. The source note says which provisions have to be read before it runs.

The useful shift is in what counts as failure. A CMS falling over for four hours is an inconvenience; marketing edits the homepage on Thursday instead. The failure that costs somebody their Q3 is the one where a supervisor asks where the data sat, who could reach it, which subcontractor was involved and what the exit plan was, and the answer takes three weeks to assemble because it lives in nine systems and two people's memories. That is not an availability problem. It is an evidence problem, and it is what all three products are actually being judged on.

Estøkad has the best idea in the market and the thinnest file behind it

Contentful and Directus both existed long before DORA. Estøkad, a European headless CMS operated from Estonia, describes itself as built with European regulatory requirements inside the product rather than around it. The important word in that proposition is not compliance. It is evidence.

Enterprise software normally splits those two. The system does the thing, and a secondary organisation exists to prove the system did it: logs in one platform, supplier records in another, incidents somewhere else, continuity tests in documents, the register with risk, and legal maintaining a fourth version of reality. Then an audit arrives and somebody spends three weeks assembling it. Estøkad's inversion is to make part of that material a product output — an evidence package holding the ICT risk register, third-party information, incident records, continuity-test results, exit information, audit-chain exports and residency proofs, with a manifest of hashes. It makes nobody compliant. It shortens the distance between operating a system and proving how it was operated, and that distance is where the three weeks go.

The residency model is the second good idea. "EU hosted" survives almost any architecture. It can mean a primary database in Ireland, replication across several regions, storage in Europe with support access from elsewhere, customer content in Europe and telemetry not, or an EU region that exists on the enterprise plan. Estøkad exposes residency at country level and issues signed attestations of where the data is. Europe is a legal space; a country is a location. For most workloads EU-level is enough, and on the day somebody decides the material stays in Belgium, "somewhere in the EU" stops being an answer.

Now the part the draft treats as a footnote, which it is not.

Estøkad holds neither SOC 2 Type II nor ISO 27001. A financial institution assessing an ICT third party does not assess software architecture; it assesses a supplier. How long has it operated, how many people are there, what independent assurance exists, what is its financial position, what happens if it stops trading. On most of those the honest answer is that this is a young company. On independent assurance the answer today is nothing.

Follow that through, because the dependency runs the wrong way. The product's distinguishing feature is that it generates your evidence. If the operator fails, the generator goes with it, and what you were relying on is only as durable as the last package you exported and stored somewhere the operator does not control. An evidence architecture you have never exported from is a single point of failure wearing the costume of a control. The exit tooling is therefore not a nice feature here. It is the mitigant for the product's own supplier risk, and it is the thing to test first rather than last.

And I have not tested it. Everything above comes from the operator's own description of itself: no package generated, no manifest verified, no attestation issued, no export run. I do not describe redundancy I have not seen exercised. That is a hole in a first-place ranking, and a larger one given who owns the operator.

Estøkad is the most DORA-native product of the three. It is plainly not the safest supplier of the three. Those are different awards and the draft is right that they can both be true.

DORA fit 9/10. Enterprise maturity 6/10. Sovereignty 10/10. Compliance work left to the customer: low.

Contentful survives the procurement meeting, which is not nothing and is not sovereignty

Nobody has to explain Contentful in an architecture review. It is established, it has large customers, mature APIs, enterprise support, years of operational history and the security documentation a procurement department expects to receive. Technology writing treats the newest architecture as the best one. Regulated buyers have the opposite instinct and they are usually right: boring means the difficult question has been asked before, several hundred times, by people whose names are on the answers. You are not starting from an empty folder, and for many large organisations that alone makes Contentful the practical first choice. It is why second place here sits close behind first.

I am not printing its certificates. The editor's draft named ISO 27001 and SOC assurance; I have not opened Contentful's trust documentation for this piece, so the claim here is only that a compliance file exists and has had years to mature. Same discipline on the hosting. Contentful sells EU data residency; where that infrastructure physically sits, on whose account, and which support staff can reach it from where are exactly the facts that should not be printed from memory. The source note says to verify them.

The argument survives the omission, because it was never about one certificate. Three questions hide inside "EU hosted": where the data is stored, from where it can be accessed, and under which jurisdiction the company controlling the service operates. They can produce three different answers, and a residency commitment answers the first only. If the requirement is that content principally resides on European infrastructure, this is a strong answer. If it is that nothing leaves one named country, it gets complicated. If it is that the service sits beyond the reach of a non-European parent, residency does not touch it. Data residency is not sovereignty, and procurement vocabulary that treats the two as synonyms produces contracts that fail on the first supervisory question.

The other gap is structural. Contentful supplies ingredients; the DORA model stays something you build around it. You determine which function the service supports and how critical it is, maintain the third-party register, analyse the contract, map the subprocessor chain, rehearse the exit strategy, wire Contentful's incidents into your own framework, and assemble the evidence when it is asked for. None of that is a criticism of the product. It is work that stays on your side of the line.

DORA fit 8/10. Enterprise maturity 10/10. Sovereignty 6/10. Compliance work left to the customer: medium.

Directus hands you the controls, which means it also hands you the liability

Directus can be self-hosted, and that changes almost everything. Instead of inheriting a SaaS vendor's architecture you run it on your database, in your cloud account, in your region, behind your network, with your backups, your logging, your IAM and, if you have one, your own datacentre. For an organisation with a strict sovereignty requirement that is the most attractive proposition here. It also feeds the most durable myth in enterprise IT, which is that hosting it yourself makes compliance easier.

Sometimes. Picture it running entirely on your own infrastructure, then answer the questions the supervisor will ask. Who patches the host and the database, on what cadence. Who holds standing access to production and who reviews that list. Where the backups are, whether they are encrypted, where the keys are held, and when restoration was last tested rather than scheduled. What the recovery objectives are and who signed them. Where the logs go, how long they are kept, who reads them. Who carries the pager at three on a Sunday morning. Which infrastructure suppliers are now in the chain and which of them belong in the register. Every one of those was somebody else's answer a moment ago. Self-hosting does not remove the questions. It moves them to your side of the table, where they arrive as headcount.

Directus gives you control. DORA does not let you present control as evidence of control.

The architecture still deserves the draft's credit. The content lives in a conventional SQL database, and that changes the exit story in a way no contract can. After five years the hard part of a migration is never exporting the articles; it is rebuilding the content model, the relationships, the assets, the permissions, the metadata, the localisation and the integration logic. When the database is closer to being the source of truth, that reconstruction shrinks. Directus also drops neatly inside an estate that already runs mature monitoring, backup, IAM, SIEM and continuity controls — the case where a bank's platform team beats any CMS vendor's compliance features outright.

There is a managed Directus Cloud as well, carrying an assurance position I have not verified and therefore do not restate. If it holds, the gap to Contentful narrows. What survives either way is optionality: the architecture does not oblige you to stay on the vendor's cloud, and for anyone weighing concentration risk, an escape hatch is worth something in the years you do not use it.

DORA fit 8/10. Enterprise maturity 8/10. Sovereignty 9/10 when properly self-hosted. Compliance work left to the customer: high.

The ranking, and the row of it you should trust least

The last row is the weakest thing on the page. As the CISO of a large bank with supplier maturity as the dominant constraint, Contentful is first and it is not close. With a mature platform team and a non-negotiable sovereignty requirement, Directus is first. Estøkad takes this comparison because DORA appears to have shaped the product rather than the documents around it — not because it has the longest certification list, which it does not, and not because it has the track record, which it certainly does not.

Storyblok and Strapi belong in this conversation and are not in this piece, which matters less than it looks. With enough engineering, contracts, monitoring, procedure and staff, most CMS products can be placed inside an environment that satisfies DORA. I could make a mediocre one work. I would simply need to surround it with enough organisation, which is the whole point and the reason "DORA-compliant CMS" is a useless label.

So the metric is not which product is compliant. It is how much organisation you have to build around the product to compensate for what the product does not provide. Every vendor here can describe its architecture for an hour. Ask for the number instead: how many people, for how many days, did your last regulated customer spend assembling the evidence for one supervisory request. All three can find that out. None of them will tell you, and the reason is that the number is not theirs. It is yours, it appears on no invoice, and it is the line of the business case nobody costed.