Brightspot

Content types are Java classes on the Dari data layer, so the schema is code by default: text, rich text, object references, embedded objects, dates, booleans, numbers, collections, maps, files and custom fields, with interfaces and abstract types and @Types/@TypesExclude for polymorphic references. Hundreds of @ToolUi annotations shape the editing form. Held below 80 because there is no UI-only modeling path for non-developers, and every type change needs a code deploy.

Dari supports referenced and embedded relationships. Any Record can be referenced, collections of references give many-to-many, and @Types allows polymorphic references. Reverse traversal is done by querying on the reference field, which needs @Indexed, and the GCA exposes relationships in its GraphQL schema. Held at 72 because inverse relationships are queries, not declared bidirectional fields.

Pages are composed of modules (list, promo, rich text and others), shared or inline, and embedded objects can be nested to any depth within a type. Rich text can embed custom elements and inline modules. Held below 75 because rich text is stored as HTML with embedded element markup rather than a portable structured format.

Built-in annotations cover required, regex, minimum/maximum, collection minimum/maximum, allowed values, MIME types and reference constraints (@Where), plus suggested min/max length hints. Because types are Java classes, beforeSave and validation hooks give arbitrary custom and cross-field rules. Held below 80 because custom rules require developer code, with no admin-configurable rule engine.

The Version History widget lets editors review, compare and restore previous revisions. Drafts, revisions of live content, scheduled drafts and scheduled revisions are all distinct states, autosaved work in progress protects edits, and each workflow status saves its own draft. Revisions are exposed through the GraphQL Content API. Held at 75 because there is no environment or dataset-level content branching.

Preview to Edit lets editors click a field or module in the live preview pane to jump to it or open it for editing, and pages are assembled from modules in the edit form with responsive preview controls. It is click-to-edit, not in-canvas drag-and-drop layout editing, and the docs state Preview to Edit is only available on non-headless implementations.

The rich text editor supports per-field toolbars, custom rich text elements, embedded inline modules and images, and Brightspot 5.0 added AI inline editing and rich text comments. Output is HTML with custom element tags, rendered through view models. Held below 75 because the stored format is HTML rather than a portable AST.

Images are first-class content with a built-in image editor for named crops, image sizes defined in code, and URL-based transforms through DIMS/ImageMagick (crop, resize, quality, brightness, format). Version 5.0 added a Media Asset Library and OpenSearch-powered asset discovery, and the DAM plugin adds format conversion and text extraction. Held below 75 because the documented DIMS format option lists only jpg, png and gif, with no documented AVIF support.

Editors see each other's avatars on an open asset, and field-level locking lets several people edit different fields of the same asset at once without overwriting each other. Version 5.0 adds contextual commenting with threads, mentions and real-time notifications, plus commenting on shared previews. Held below 80 because there is no simultaneous co-editing of the same field.

Admins build workflows per content type and site in a visual workflow editor with colored statuses, named transitions, branching paths and optional required comments, and transitions are permissionable by role. Each status keeps its own draft, and Esca Automations adds human-in-the-loop approvals and actions fired on workflow transitions. Held below 80 because conditional routing on content values needs Esca or custom code.

The GraphQL Content API auto-generates a schema from content types and view models, with full CRUD, filtering, sorting, pagination and search, editorially configured endpoints, site-level access controls and an embedded GraphQL Explorer. A REST Mapping layer and a REST Management API exist alongside it. Held at 76 because the older CDA and CMA are deprecated and delivery and management are not separated into distinct, cached delivery endpoints by default.

Brightspot's managed cloud runs on AWS and sites are typically fronted by a CDN, but the public documentation does not describe a built-in CDN, purge latency or edge capabilities for content or API delivery. Self-hosted customers configure their own CDN. Scored at the CDN-backed but not granular level because nothing documents sub-second purge or edge personalization.

Esca Automations' Content trigger fires on Published, Drafted, Revised, Merged, Scheduled, Unscheduled, Workflow Transitioned, Commented, Archived, Restored and Deleted events, filterable by type and site with fire conditions, and an HTTP Request action can call any endpoint. Execution history is logged and inbound webhooks support HMAC signing per Standard Webhooks. Held below 75 because outbound notification requires building an automation in a separate engine, with no simple configured outbound webhook with signing and retries in the core CMS.

Brightspot supports traditional, decoupled and headless delivery. JSON view models and the GraphQL Content API serve web, mobile and third-party channels, and a code generator helps build clients. Held at 64 because there are no official multi-language delivery SDKs, rich text is HTML, and Preview to Edit is unavailable in headless builds.

Brightspot ships native Audiences under Admin, defined by content type group, site and targets such as device (via CloudFront), day of week and cookies, and a premium Tealium integration imports Tealium audiences with rolling size counts. This is a real CMS-side segmentation layer, but targets are request-level rules with no behavioral history, firmographics or unified profile, and the CDP path is a paid custom build, so it stays mid-50s.

Editors create audience variations of an asset, and Brightspot serves the matching variation per audience with a default fallback, without duplicating the underlying asset. That is native variant delivery managed in the editor, but the targeting it keys on is limited to the rule-based audiences above, and there is no documented per-audience preview switcher in the preview pane.

The Experimentation plugin lets editors create variations on any asset, set traffic allocation and exposure, use mutually exclusive groups, define goals (page views, page access, clicks, scroll depth, time on site), view a site-wide Experiments dashboard and auto-promote a winner. Delivery and statistics run through the bundled Kameleoon provider with CDN edge functions, so a Kameleoon contract is required and results analysis depends on that third party, which keeps it below 70.

Related and list modules can be populated by dynamic content queries (tags, sections, recency) as well as manual curation, giving rule-based automated lists. No ML or behavioral recommendation engine is documented in the product or plugin catalog, so it sits just above manual-only curation.

Site search pages are a built-in content type with type filters, sorts, facets and per-site configuration, plus search spotlights driven by configurable dictionaries and terms; Brightspot 5.0 moved search to OpenSearch (Solr also supported). The CMS Search Boost plugin adds no-code relevance tuning with text, type and date boosts and phonetic matching, though it is documented for editor-side search. Held just under 70 because front-end relevance tuning beyond spotlights is not exposed to editors.

The Dari data layer indexes into Solr or OpenSearch and developers can customize the search experience and results in code, and Esca Automations content triggers with HTTP actions can push changes to any external index. There is no official Algolia, Coveo or Elastic connector, so integrating an external search service is custom work.

Brightspot has a Product content type with price and compare-at-price fields for showcasing products, but no cart, checkout, payment, order or inventory management. It is a content platform with no transactional commerce.

The db-http Shopify integration lets editors search and import Shopify products and collections through federated search, with optional auto-import, update and delete driven by Shopify webhooks. Sync is one-way and the auto-update handler must be implemented per project, and Shopify is the only commerce connector documented (no commercetools, BigCommerce or Salesforce Commerce), so it sits at the top of the product-picker band.

A built-in Product type carries title, description, featured image, media, options and variants, with editorial overrides of imported Shopify values and a product search results module. That is a purpose-built product pattern, but it is tied to the Shopify import model and lacks a PIM-style attribute schema, which holds it a little short of 65.

Brightspot Analytics collects page views, time on page, visit source, unique visits, video watch metrics and site search spotlight metrics, shown in dashboards, asset edit forms and the search panel with CSV export, and Content Reporting adds scheduled content inventory reports. The docs note analytics needs additional development work to enable, and there are no author productivity or time-to-publish metrics, so it lands mid-50s.

Built-in integrations cover Google Analytics 4 (data pulled back into report widgets, asset analytics and search sorting, plus custom events), Adobe Analytics, Parse.ly and Google Tag Manager, with Tealium as a premium option. Analytics data surfacing inside the CMS lifts it above a tag-only integration; no Segment or Amplitude connector holds it in the low 70s.

Multiple sites run in one instance under a Global > Site > Section > Asset hierarchy where settings, layouts and navigation inherit and can be overridden. Assets have an owner site and can be shared with all or selected sites, or a site can access all of another site's content, and roles can be site-specific. This is native multi-site with shared content; held at 80 because cross-site queries require developer care with site predicates.

The localization module tracks relationships between localized variations of an asset, derives locale-specific content, configures site languages and localizes static text through resource bundles and ICU, with directory or domain delivery strategies. Localization is document-level (linked variants), with no documented field-level localization or locale fallback chains, and the plugin docs are marked under construction.

The Translation plugin provides a request UI, Translations tab tracking, a translation log, permissions, notifications and completion actions (publish, draft or submit to workflow), with built-in services for Amazon Translate, DeepL, Google Translate and the Lingotek TMS, plus an extension API for custom services. Only one human TMS is supported out of the box (no Phrase, Smartling, Lokalise or XTM), which keeps it just below 65.

Global settings, themes, layouts and navigation inherit down to each site and can be locked by configuring them high in the hierarchy, workflows are defined per content type and site, and roles can be scoped per site. Shared content and a shared theme system support multi-brand operation, but there is no dedicated cross-brand policy enforcement or brand compliance console outside AI features.

Images, documents, audio and video are first-class assets with tags, version history, usage via references, bulk actions and asset access management (expiration date, license types, downloadable or discoverable after expiry). Version 5.0 adds the Media Asset Library with OpenSearch-powered discovery and the DAM plugin adds format conversion and text extraction, but the Media Asset Library is a premium add-on and not in the box, so it scores below the purpose-built DAM band.

DIMS provides URL-based on-the-fly crop, resize, quality and format transforms, with named crops and code-defined image sizes for responsive output and an image editor for focal crops. The documented output formats are jpg, png and gif with no AVIF or WebP option, and no built-in image CDN is documented publicly, so it sits in the basic-transforms band.

Video File, Audio File, Podcast and Episode types support upload, posters, companion content and video playlists, and editors can import from Brightcove, JW Player, Vimeo, YouTube and Vidyard. Transcoding, live streaming and ad insertion require the premium Amazon Elemental integration (MediaConvert, MediaLive, MediaTailor), so native adaptive streaming and captions are not out of the box.

Pages are assembled from modules in the edit form, with hats, headers, asides and footers inherited through the content hierarchy, Dynamic Modules to curate allowed modules per type, and Preview to Edit to click into fields from the preview pane. There is no drag-and-drop canvas, and Preview to Edit is unavailable in headless builds, which places it in the structured block editor band.

Admins build per-type, per-site workflows in a visual editor with custom statuses, named and permissioned transitions, branching and required comments, each status keeps its own draft, and Review Cycles and the Assignment Desk add review routing and assignments with due dates. Esca Automations adds human-in-the-loop approvals. Held below 80 because conditional routing on content values needs Esca or code.

Scheduled drafts and scheduled revisions, bulk scheduling, a dashboard calendar with two-way Google Calendar and Outlook sync of scheduled publications and assignment due dates, date-based preview, and asset expiration settings. No atomic release bundle for publishing many items together is documented, which keeps it below 70.

Presence avatars show who is on an asset, field-level locking lets several editors work on different fields of the same asset at once, and 5.0 adds contextual field-level comments with threads, mentions, real-time notifications and a Conversations widget for external collaborators, alongside full version history. There is no simultaneous co-editing of the same field or suggestion mode.

Native contact and custom form modules offer text, choice, file upload, captcha (reCAPTCHA, including invisible) and hidden fields populated from referrer, cookie or query parameter, with submission storage, email actions with filtering rules and external submit actions; Marketo, Pardot and HubSpot forms can also be imported with submissions. Conditional logic, multi-step forms and progressive profiling are not documented, so it stays in the solid basic band.

A Newsletter content type pushes to Mailchimp campaigns from the edit page, and the SendGrid plugin creates, targets (lists and segments), schedules, test-sends and reports on Single Send campaigns from a published asset with an audit trail and per-action permissions; Sailthru is also built in. Content push, scheduling and stats are in the CMS, but there is no Salesforce Marketing Cloud or Braze connector and no CMS-event triggered sends, so it is just under 70.

There is no native lead scoring, nurture or lifecycle management. Marketo, Pardot and HubSpot integrations are form-level (embedding forms and pulling submissions), and Esca Automations and Zapier can fire actions from content events but are content-operations tools rather than campaign orchestration, so it sits below the tight-integration band.

The only documented CDP path is the premium Tealium integration, which imports Tealium audiences for audience variations with rolling size counts, and it requires a paid custom build. There is no Segment, mParticle or Salesforce Data Cloud connector and no unified profile available to the CMS.

Brightspot documents about 25 built-in integrations (analytics, ads, SSO, Apple News, forms), around 30 plugins, db-http connectors to stock, DAM and video services, a handful of premium integrations and Zapier for iPaaS. Everything is a build dependency added by developers; there is no self-serve app marketplace or third-party listing program.

Esca Automations content triggers cover published, drafted, revised, scheduled, workflow transitioned, commented, archived, restored and deleted events, filterable by type and site, with HTTP Request actions, execution history and HMAC-signed inbound webhooks. Outbound notification means building an automation in a separate engine, with no simple configured outbound webhook or native event bus integration.

The preview pane supports date, device and context pickers, full-screen previews produce shareable URLs (with commenting in 5.0), Mirror Preview gives a QR code for mobile, and developers can configure IFrame and Content Delivery preview types for headless frontends. There are no per-branch preview environments or content environment promotion, and Preview to Edit is unavailable headless.

Custom roles with granular permissions over areas, content types, UI actions and workflow transitions, site-specific roles, combined multi-role permissions, SAML SSO with group-to-role mapping, G Suite SSO and two-factor authentication. SCIM provisioning and field-level permissions are not documented in the user guide, which keeps it below 70.

Brightspot's GraphQL Content API (GCA) is the primary delivery and management API, generated from the Java content model, with REST Mapping and a REST Management API alongside it; the older CDA/CMA endpoints are deprecated in favor of GCA. The schema-from-code approach keeps the API consistent with the model. Held below 80 because the API surface is in a migration from CDA/CMA to GCA and no public interactive playground or published pagination/filtering conventions were verified in this run.

Brightspot documents a replication cache at the database layer and Solr/OpenSearch-backed querying, but no public CDN delivery, cache-purge, rate-limit, latency or sync/delta API documentation was found. Delivery performance on Brightspot Cloud depends on the managed AWS stack, which is not publicly specified. Scored in the adequate-but-undocumented band.

Brightspot is a Java platform built on the Dari framework, so its first-class developer SDK is the server-side Java API itself. For headless consumers there are no official SDKs across JavaScript, Python, .NET, PHP or mobile; the GraphQL plugin's Code Generator and standard GraphQL clients fill the gap. Scored in the community/thin-SDK band because front-end teams get no official client libraries.

Brightspot ships a curated set of built-in and premium integrations plus roughly 33 plugins covering analytics (GA4, Adobe Analytics, Parse.ly, Tealium), DAM and storage (Aprimo, Box, Dropbox, Google Drive, SharePoint), video (Brightcove, JW Player, Vimeo, YouTube, Vidyard), translation (Amazon Translate, DeepL, Google, Lingotek), marketing (HubSpot, Marketo, Pardot, Mailchimp, SendGrid) and Zapier. There is no self-serve marketplace, several integrations are premium add-ons, and commerce and CDP coverage is thin.

Extension is code-level and deep: content types, validation and editor UI are defined in Java with @ToolUi annotations, developers can build custom field behavior, dashboard widgets, custom preview types, rich text elements and view models, and Esca Automations adds event triggers, webhooks and HTTP actions. This covers custom UI, server-side hooks and custom endpoints. Held under 78 because everything requires Java development and redeployment rather than a sandboxed app framework that can be installed without a release.

Brightspot supports SAML single sign-on with group-to-role mapping, Google Workspace SSO and two-factor authentication for CMS users. Because Brightspot is sold only on enterprise contracts, SSO is not gated behind a higher plan, but no OIDC, SCIM provisioning or OAuth-scoped API token management was documented. Scored in the functional-SSO band without the provisioning extras.

Custom roles with granular permission scopes over content types, sites and tools, site-specific roles for multi-site estates, and content-level sharing controls (Owner, Access to All Others or Some Others, Accessible Sites) give content-instance access control. Roles can also hide or restrict fields in the editor. Held below 80 because field-level controls are UI-level role settings rather than a fully documented field permission model.

Brightspot serves media, enterprise and public-sector customers and is understood to hold SOC 2 Type II attestation for Brightspot Cloud, with hosting on AWS regions that allow data residency choices. ISO 27001, HIPAA BAA availability and a public trust center could not be verified in this run. Scored at the low end of the SOC 2 plus GDPR band pending verification.

No publicly reported breaches or widely tracked CVEs for Brightspot CMS are known, and the proprietary codebase limits public exposure. No public bug bounty or vulnerability disclosure program was verified. Scored in the clean-history, basic-disclosure band.

Brightspot offers both a vendor-managed Brightspot Cloud on AWS and licensed self-hosted deployment of the Java application on customer infrastructure, which suits regulated buyers who need to run it themselves. That places it in the both-available band. Not higher because the managed option is single-cloud and private-cloud packaging is not publicly documented.

Uptime commitments for Brightspot Cloud are set in enterprise contracts and are not published, and no public status page was found. Self-hosted customers own uptime entirely. Scored between the no-SLA and 99.9%-with-status-page bands because a contractual SLA is likely but not publicly evidenced.

The Dari data layer separates a relational store from a Solr/OpenSearch query index with a replication cache, and Brightspot has long run high-traffic news and media publishing estates. That is a proven enterprise pattern. Held at 70 because scale limits, auto-scaling behavior and CDN delivery are not documented publicly.

No public documentation of backup frequency, retention, RTO/RPO or multi-region failover for Brightspot Cloud was found; these are presumably handled contractually on AWS. Content is reachable for export through the GraphQL and REST management APIs. Scored in the undocumented-DR band with credit for API export.

As a Java application, Brightspot projects build with Gradle or Maven and run fully locally, typically in Docker with the database and search index, so developers get a real local instance rather than an emulator. Not higher because setup is heavier than a single CLI command and no content-management CLI is documented.

The content model lives in Java code, so schema changes flow through normal version control, build and deploy pipelines without separate migration scripts. There are no content environments, branch-per-PR content sandboxes or environment aliasing, and content promotion between environments is not documented. Scored in the environments-without-migration-tooling band.

docs.brightspot.com covers developer, user, plugin, integration and Esca Automations topics in depth with code examples, and release product guides are published. Some sections are marked as under construction (for example localization), docs are Java-centric, and there are no framework-specific front-end getting-started guides or interactive API playground. Scored in the adequate-with-gaps band.

The GraphQL plugin includes a Code Generator, and because GCA exposes a typed GraphQL schema, front-end teams can generate TypeScript types with standard GraphQL codegen tooling. There is no official TypeScript SDK, and the core platform is strongly typed in Java rather than TypeScript. Scored at the low end of the typed-without-official-SDK band.

Brightspot runs several supported release lines at once and keeps shipping into them: the 5.0 line reached v5.0.8 (4 new features, 25 improvements, 78 bug fixes), while 4.8 reached v4.8.21. It also ships named seasonal drops with real feature work: the Fall 2025 release (October 7, 2025) with a redesigned UI, in-CMS AI and experimentation; Spring 2026 (May 27, 2026) with an MCP server and the Toolkit Chrome extension; and Esca Automations for agentic workflows (August 12, 2026). Held below 75 because the headline feature drops come roughly quarterly rather than monthly, and the patches are mostly fixes.

The docs site has a dedicated Releases section with a changelog and a product guide for each line. Each patch version gets a count summary and separate lists of new features, improvements and bug fixes, all written in plain language. Deprecations are called out, such as legacy modules moved to a deprecated repository with backward-compatibility shims. Held below 75 because the per-version entries have no visible release dates and no dedicated breaking-changes section or linked migration guides.

No public roadmap, feedback portal or community voting was found. Future direction is communicated through seasonal release announcements, the Illuminate customer event and the 'latest capabilities' marketing page, which describe what has shipped rather than what is planned. This fits the 40 to 55 band for a roadmap shared mainly with customers and in enterprise briefings.

Brightspot keeps several major lines supported in parallel (5.0, 4.8, 4.7 and 4.5 are active and 4.2 gets maintenance fixes), so customers are not forced onto new majors quickly. When modules are retired they move to a deprecated repository with backward-compatibility shims, and the vendor sells an expert-led Upgrade Program. Held near the low 60s because there is no public deprecation-window policy, no automated codemods, and moving between major lines is a services-assisted project rather than a self-serve one.

Brightspot is a proprietary Java platform with almost no public developer footprint. The perfectsense GitHub organization has 63 public repositories, its most-starred is the Gyro infrastructure tool (134 stars), and its Brightspot-specific repositories have under 10 stars each, several of them archived. No public Discord or Slack community was found, and Stack Overflow activity is very sparse. This is below the under-45 band, offset only slightly by a moderate G2 review base.

There is no open developer community to engage: no public issue tracker for the CMS core, no forum and no community chat. Users interact through vendor support, which customers rate highly (G2 quality-of-support 9.5/10 per Brightspot's own recap), and through the Illuminate customer event. Strong vendor support is not the same as community engagement, which is why this sits in the high 30s.

A formal partner program exists, but the public directory lists only eight solution partners (A&MPLIFY, Bridgenext, Deveire, HTEC, Material+, Psycle, Sevn Technologies, Waypath Consulting), mostly boutiques and mid-sized engineering firms. No global SIs like Accenture or Deloitte are named, and there is no public certification exam. Brightspot delivers most implementations through its own professional, creative and managed services teams, which reduces delivery risk but leaves buyers few third-party options.

Nearly all Brightspot learning material is first-party: docs.brightspot.com (developer guide, user guide, integrations, plugins) plus the vendor's blog and CMS selection guides. No Udemy or Pluralsight courses were found, independent tutorials and conference talks are rare, and the public tutorial and training repositories are small or archived. The first-party docs are good, but the outside content ecosystem is thin.

Brightspot experience is niche. The platform is built on standard Java, GraphQL and front-end tooling, so general Java developers can learn it, but few developers list Brightspot itself and the small partner bench limits outside staffing. No public certification program was found. Most expertise sits inside Brightspot and a handful of partners, which puts this in the 'obscure' band, slightly lifted by the transferable Java skills.

Brightspot keeps a recognizable enterprise base across media, broadcasting and government, and earned a G2 Momentum Leader badge in Fall 2026 alongside 12 G2 badges that season. Its 2025 G2 recap claims 97% year-over-year retention, though that is a vendor figure. New named logos and dated case studies are less frequent than at the leaders, and growth signals come mainly from G2 rather than independent announcements, so this stays in the high 50s.

Brightspot is the trade name of Perfect Sense, a privately held company founded in 2008 that has grown without disclosed venture rounds and has no reported acquisition or layoffs. A steady release cadence, active AI investment (Esca, MCP server, Esca Automations) and its AWS Intelligence Community Marketplace listing suggest a stable, self-sustaining business. Held in the mid 50s because there is no public financial data, no growth funding and no transparency on headcount.

Brightspot has a clear niche as a hybrid headless CMS with built-in DAM for media, publishing, broadcasting and government content operations, now framed around governed agentic AI. Analyst recognition is second-tier: Leader in the Aragon Research Globe for Content Experience Platforms 2025, a Constellation ShortList for Headless & Hybrid CMS 2025, and only a 'Notable vendor' mention in Forrester's 2024 CMS Landscape. It does not appear in the Gartner DXP Magic Quadrant or a Forrester Wave, which keeps it below 65.

Sentiment is strongly positive: Brightspot's 2025 G2 recap reports 96% of reviewers would recommend it, 9.5/10 for quality of support and 8.3/10 for ease of use, and it earned G2 badges every quarter in 2026, including 'Easiest to Do Business With'. Gartner Peer Insights reviews it quotes praise its enterprise scale and delivery team. G2 blocked automated access, so the exact rating and review count could not be confirmed, and no strong negative pattern was found on community forums. The lower ease-of-use figure and a review base that is moderate rather than large keep it from the upper 70s.

The pricing page names two packages (Hybrid and Headless) and six modular add-ons, and lists what every package includes, but publishes no prices for any tier; every path ends in 'Talk to an expert' or 'See a demo'. Scored in the sales-gated band, held slightly above its floor because the package contents and add-on structure are disclosed clearly enough to scope a conversation.

Brightspot sells a base package plus a la carte add-ons, with spend expanding along several meters: CMS user and developer seats, lower environments, site count, and storage and bandwidth limits. The 'pay for value as you grow' framing is coherent for enterprise buyers, but multiple capacity meters and undisclosed limits make the annual cost hard to predict before a quote. Not lower because there is no evidence of API-call metering or surprise overage billing.

Every package includes the items most often gated elsewhere: SSO/SAML, WAF and DDoS protection, SOC 2 Type 2 infrastructure, production and staging environments, global CDN, automatic backups and a 99.9% uptime guarantee. Against that, experimentation, the Media Asset Library, the Tealium CDP integration, bring-your-own-cloud and elevated security are paid extras, and the docs label several integrations as premium with additional cost. Fair enterprise gating overall, held below 65 because marketing capabilities a DXP buyer expects are add-ons.

No monthly billing, self-serve purchase, startup program, or nonprofit or education pricing was found; buying runs through a sales engagement and enterprise contract. Public-sector buying is supported through the AWS Intelligence Community Marketplace, which helps procurement but not flexibility. Contract terms were not publicly verifiable, so confidence is low.

There is no free tier, no self-serve trial, and no open-source edition; the only entry point is a sales demo. The legacy open-source Brightspot repositories under the perfectsense GitHub organization are archived and not a usable free product.

A developer cannot sign up and query content; access starts with a sales process, then a Java project built with Gradle or Maven running locally with its database and search index, typically in Docker. Content types are Java classes on the Dari framework, so a first working model means writing and deploying Java code. Prebuilt content types and the Design System shorten the path once a project is provisioned, which keeps it from the bottom of the band.

Implementations are largely vendor-led with in-house migration, creative and expert services, and the Hybrid package's Design System and prebuilt content types let marketing sites launch without building everything from scratch. G2 reviewers rate ease of use and support highly, and there is no pattern of public complaints about overruns. No community-reported timelines were found, and enterprise media and multi-site builds on a Java DXP commonly run several months, so this sits mid-band with low confidence.

The stack is standard Java plus GraphQL, but development depends on the proprietary Dari framework and Brightspot annotations with almost no public training outside the vendor's docs. The partner directory lists only eight boutique and mid-size firms, there is no certification program, and much delivery runs through Brightspot's own services, so buyers have little competitive pricing for expertise.

The likely path for most buyers is Brightspot's managed cloud on AWS, and every package bundles hosting with high availability, automatic scaling, a global CDN, production and staging environments, and media storage, so there is little separate infrastructure spend. Held below 75 because storage, bandwidth and extra lower environments are capacity add-ons, and the bring-your-own-cloud and self-hosted routes move infrastructure cost back to the customer.

Every package includes 24/7/365 monitoring, a 99.9% uptime guarantee, automatic backups, and vendor-managed deployments and annual platform upgrades, which removes most operational work from the customer. Not higher because the custom Java codebase still needs a development team to build, test and ship releases through Brightspot's pipeline, and self-hosted customers carry the full Java, database and search stack themselves.

Content can be read out through the GraphQL Content API and the REST Management API, so data is not trapped. But the content model, validation, editor UI and rendering are all Java code tied to the proprietary Dari framework, none of which ports to another platform, and there is no documented export or migrate-out tooling. Leaving means rebuilding the model and front end and transforming the data, a moderate-to-heavy migration.

Developers must learn the proprietary Dari data layer (Records, @Recordable and @Indexed annotations, query API, Solr/OpenSearch indexing), @ToolUi editor annotations, view models, the Global > Site > Section content hierarchy, modules and the theme/styleguide layer before they are productive. Content types do map to Java classes, which helps, but the number of overlapping proprietary abstractions puts it in the significant re-learning band rather than higher.

docs.brightspot.com is deep across developer, user, plugin, integration and Esca Automations guides with code examples and per-release product guides. There is no self-serve sandbox, interactive tutorial or public certification path, the public tutorial and training repositories are small or archived, and some sections are marked under construction, so onboarding relies on vendor-led enablement (sold as a 'Developer enablement' add-on).

The core is standard Java built with Gradle or Maven, and the GraphQL Content API is a mainstream interface for headless front ends. But all back-end work goes through the proprietary Dari framework and Brightspot annotations, and there is no first-class React or Next.js support, official JavaScript SDK or framework-specific guide, which keeps it in the proprietary-framework band.

The Hybrid package ships the Brightspot Design System with prebuilt content types, which gives a vendor-provisioned starting point for traditional builds. No public Next.js, Nuxt or Astro starters were found, and the public tutorial and styleguide repositories are archived, so headless teams start from scratch with a generated GraphQL schema.

A working project means a Java build with Gradle or Maven running alongside a relational database and a Solr or OpenSearch index, typically in Docker, plus site, theme and GraphQL endpoint configuration in the CMS. Brightspot Cloud provisions and manages environments, which offsets some of this, but there is no self-serve signup or few-env-var path to a first integration.

Content types live in Java code under version control, and Dari stores records as flexible documents, so adding fields or types ships with a normal deploy without migration scripts or field-count limits. Renames, type changes and newly indexed fields still need developer care and reindexing on live content, and there are no content environments for testing schema changes against real data, which holds it below 60.

For traditional and hybrid builds, preview with date, device and context pickers, shared previews and Preview to Edit works out of the box because Brightspot renders the page. Headless builds need a configured IFrame or Content Delivery preview type wired to the front end, and the docs state Preview to Edit is only available on non-headless implementations, so headless visual editing is not achievable.

There is no certification requirement, and general Java skills transfer, but productive back-end work needs Dari and Brightspot annotation knowledge that exists almost only inside the vendor and a handful of partners. Generalist TypeScript and React developers can only work on a headless front end, and even there without an official SDK.

A production Brightspot build typically pairs Java back-end developers, front-end developers and a solution architect with Brightspot's own professional services, which sells migration, creative, enablement and managed services alongside the license. Vendor-managed hosting and deployments remove the ops role, which keeps it above the full-DXP-project-team floor, but a solo developer or 2-person team shipping alone is unrealistic.

After go-live, editors assemble pages from shared and inline modules, inherit layouts, navigation and settings through the site hierarchy, curate allowed modules with Dynamic Modules, launch new sites from shared themes, and admins build workflows in a visual editor, all without developers. New content types, new module types and front-end changes still require Java development and a deploy, which keeps it in the mid-60s.

Brightspot upgrades are code projects against the customer's own Java codebase: the 4.8 to 5.0 path requires Java 21 and Tomcat 10.1 with a Java EE to Jakarta EE package migration, removal of legacy AI and search dependencies after a plugin rearchitecture, and fixes to overridden platform methods, each documented in a per-version Developer Upgrade Guide and Breaking Changes Guide. Brightspot Cloud packages include vendor-managed annual platform upgrades through its Upgrade Program, and a Gradle Jakarta Substitution Plugin eases the namespace change, which keeps it above the manual-migration floor. Not higher because every major version still touches custom code and needs regression testing.

Security fixes ship in frequent patch releases and are backported across supported lines: the Apache Tika XXE fix (CVE-2025-66516) landed in both v4.8.17 and v4.5.36, and the same three permission, upload-restriction and resource-consumption fixes appear in v5.0.7 and v4.8.20. Brightspot Cloud customers have patches deployed by the vendor and get managed WAF and DDoS protection. NVD lists no CVEs under the Brightspot name and there are no standalone security advisories, so disclosure is limited to one-line changelog entries, and self-hosted customers must rebuild and redeploy their own project to apply a patch.

Brightspot keeps several release lines alive at once (4.2 in maintenance, 4.5 still at v4.5.40, 4.8 at v4.8.21 alongside 5.0), so customers are not pushed onto a new major version quickly and deprecated Maven coordinates produce build-time warnings before removal. The cost is that breaking changes also arrive inside point releases: the 5.0 and 4.8 changelogs carry 15 and 23 Breaking changes sections, and 5.0 forces the Java 21, Tomcat 10.1 and Jakarta EE move. Held in the mid 50s because there is no published deprecation calendar or fixed notice window.

A Brightspot project is a Java web application on Tomcat with a relational database, a Solr or OpenSearch index, cloud storage and a Gradle or Maven build pulling a platform BOM, plus a Node-based styleguide toolchain. Release notes show steady transitive-dependency work for customers to absorb, such as Jackson alignment against the AWS and Google Cloud SDKs, a removed SolrJ pin, Tika and Zookeeper vulnerability fixes, and a Styleguide Node-version compatibility question in the community. Brightspot Cloud runs the infrastructure, but the application dependency tree still ships in the customer's build.

Every Brightspot Cloud package includes 24/7/365 vendor monitoring and a 99.9% uptime guarantee, and the product has a Performance Stats tool for SQL, Solr and HTTP throughput and latency plus a Health plugin that raises alerts, banners and notifications. No public status page could be reached, and Health conditions must be hard-coded by project developers, so customers still build application-level checks and self-hosted installs carry the full monitoring stack. Placed in the mid 50s for that mix.

Brightspot offers editorial content reports with recurring CSV exports, a Health plugin that can flag conditions such as sites with no homepage or users with no role, and a Site Archive plugin that snapshots published pages with field-level diffs. No built-in broken-link checker, orphaned-asset report or content expiry dashboard was found, and the Health conditions only exist if developers code them, so routine hygiene still leans on editorial discipline. Scored at the midpoint pending better evidence.

Brightspot Cloud provides high availability with automatic scaling and a global CDN, managed WAF and DDoS mitigation, and recent releases push more CMS assets to the CDN to cut application-server load. Custom Java code, Dari queries and the Solr or OpenSearch index remain the customer's to optimize, and fixes such as CMS assets being served from app servers instead of the CDN show performance does need attention. Self-hosted customers tune the whole stack themselves.

Customers file tickets through a dedicated Support Portal, and Brightspot reports a 9.5 out of 10 G2 rating for quality of support in its 2025 review recap, which is among the stronger support signals in the dataset. Support is bundled into every enterprise package rather than tiered on a public price list, but no response-time SLAs or support tier definitions are published, and the satisfaction figure is vendor-reported because G2 blocks automated fetches. Kept in the mid 60s for those gaps.

The only public community channel is the brightspot GitHub Discussions board, linked from brightspot.com as 'Join the conversation with expert Brightspot developers', which holds about two dozen threads with the newest dated August 2024 and several with zero or one reply. No Slack, Discord, forum or active Stack Overflow presence was found. Outside of vendor support, developers have almost nowhere to get help.

Brightspot ships high-volume patch releases on every supported line, with v5.0.8 alone carrying 78 bug fixes and v5.0.6 carrying 43, and regressions get corrected in following point releases, such as the .war packaging regression from the 5.0.4 plugin relocation. Cloud customers have fixes deployed by the vendor. There is no public issue tracker for the closed-source core, so customers cannot see the status of a reported bug outside the Support Portal.

Marketers assemble pages from modules, dynamic modules and layouts inherited through the site hierarchy, and Preview to Edit gives in-context editing on hybrid builds. There is no free-form drag-and-drop page builder, and Preview to Edit is unavailable on headless implementations, so new layouts and module types still need developers.

Scheduled drafts, bulk scheduled publishing, a publishing calendar integration and the Assignment Desk cover planning and lifecycle. There is no campaign object tying multi-channel assets and campaign analytics together.

Brightspot's publishing heritage shows in built-in SEO fields on content types, URL and vanity redirect management and sitemap generation on hybrid sites. Structured data and SEO validation depend on the front end and theme, and headless builds own much of this themselves.

A native Forms module supports field types and submission actions (data collection, email, external submit) with reCAPTCHA, and Marketo, Pardot and HubSpot integrations handle lead capture. Conversion tracking and UTM handling sit in external analytics tools.

Audiences built from targets such as device category, cookies and day of week drive audience variations of an asset. It is rule-based, with no real-time behavioral scoring or AI decisioning, and richer audiences require the paid Tealium integration.

The experimentation plugin runs edge-based tests through Kameleoon on Lambda@Edge, Cloudflare Workers or Akamai EdgeWorkers, with five goal types and winner promotion. It is a paid add-on and depends on an external provider rather than native statistics.

Shared and inline modules, configurable workflows, review cycles, bulk scheduling and inline AI editing in the rich text editor speed up production. Page layout changes and new templates still route through developers.

Structured content is delivered to web, headless front ends via GraphQL (GCA), email newsletters through SendGrid and Mailchimp, and audio and podcast feeds. Social, SMS and push channels are not native.

GA4 report widgets and an asset-level analytics cluster show performance inside the CMS, with Adobe Analytics and Parse.ly integrations alongside. Built-in analytics needs extra development work to enable.

Themes and the Brightspot Design System give pre-built content types and modules, and branding is set high in the site hierarchy so child sites inherit it. Guardrails come from the available module set rather than locked tokens with enforced overrides.

Content types carry social share and Open Graph fields typical of a publishing CMS. No documented social scheduling or push-to-social workflow was found among the integrations.

Image transforms via DIMS, an image editor, video, audio and a DAM plugin cover most marketing volumes. The Media Asset Library with expiration controls is a premium feature, and AVIF output and full rights management are not documented.

Locale-specific content derivation, site-level language settings and translation connectors to DeepL, Google, Amazon Translate and Lingotek apply to marketing content. There is no transcreation workflow or market-level campaign variant model, and the localization docs are incomplete.

Pre-built connectors span marketing automation (Marketo, Pardot, HubSpot), email (Mailchimp, SendGrid), CDP (Tealium, premium) and analytics, plus Zapier and Esca automations with webhook triggers. Salesforce CRM and ad platforms are not covered natively.

A Product content type with main, overrides and product data tabs plus options and variants lets editors enrich imported commerce data. Attribute modeling beyond that needs Java content types.

No category management, cross-sell rules or search merchandising for products exist. Site search spotlights are the closest feature.

A Shopify integration syncs products per site with auto-update settings and a webhook processor. It is the only documented commerce connector; commercetools, Salesforce Commerce Cloud and BigCommerce require custom work.

Products are content in the same repository, so editors can place them in articles and lists, and a product search results module exists. Shoppable content with inline purchase CTAs is not a first-class authoring pattern.

No cart or checkout exists, and nothing documents injecting CMS content into a commerce platform's transactional flow.

No order-event triggers or post-purchase content tooling; this lives in the commerce platform.

Site-specific roles and access controls can gate documentation, but there are no account-based catalogs, quote flows or customer-specific pricing features.

Site search pages support filters, sorts, spotlights, dictionaries and boosting with phonetic matching, and products are indexed alongside content. There is no product facet enrichment or synonym tooling specific to commerce.

Scheduled drafts and revisions plus audience variations allow time-activated banners targeted by device or cookie. Countdown timers, promo code messaging and pricing tables are custom builds.

Multi-site with content sharing across sites and per-site Shopify accounts lets one instance serve several storefronts with shared products and site-specific editorial. Commerce depth is limited to Shopify.

Image galleries, video and Amazon Elemental integration (premium) support product media. No 360-degree, AR/3D or hotspot features are documented.

Multi-author contribution and workflows exist, but there are no seller profiles or marketplace moderation features.

Generic localization and translation connectors apply to product content, including product overrides per site. There are no currency-aware blocks or regulatory label features.

Analytics integrations show traffic and engagement, but nothing ties content to revenue or commerce conversions inside the CMS.

Roles with permission scopes, site-specific roles, per-content access settings across sites and SAML SSO with group-to-role mapping give solid control over who edits what. Department-level visibility for front-end readers requires custom gating work.

Version history, workflows, review cycles, taxonomy and recurring content reports support a knowledge base. There is no review-date or expiry lifecycle specific to knowledge articles.

Brightspot ships no employee directory, personalized dashboard or employee mobile app; an intranet portal is a custom project on top of the CMS.

News publishing is a core strength and audiences allow basic targeting. Read receipts, acknowledgment tracking and mandatory reads are not available.

Person or author content types can model a basic directory, but there is no org chart or HR system integration.

Versioned content with workflows, review cycles and audit through workflow logs supports policy publishing. Acknowledgment tracking and expiry reminders are absent.

Onboarding pages can be built from content types, but there are no role-based journeys, checklists or HR triggers.

Solr or OpenSearch site search with boosting, filters and semantic phonetic matching handles CMS content well. There is no federated search across SharePoint, Confluence or Drive.

Responsive front ends and headless APIs reach mobile web; there is no native employee app, offline mode or push.

No LMS integration or learning features are documented.

Editorial collaboration (contextual comments, conversations) is strong in the back office, but reader-facing forums, polls and recognition are not provided.

Google Workspace SSO and Esca automations with HTTP request actions allow webhook-based notifications to Slack or Teams. There are no embedded content cards or bots.

Scheduled publishing and unpublishing, MAL expiration controls and recurring content reports can surface stale content. Automated review dates and ownership enforcement are not built in.

Page and site search metrics are available through analytics integrations, without department-level breakdowns or adoption dashboards.

Sites in one instance get their own settings, roles and content ownership, with access controlled per site. Content types are shared Java classes, so this is site-level isolation inside a shared schema rather than true multi-tenancy.

Content, modules and settings defined at global or parent level are shared or inherited across sites natively, with per-item access to all or selected sites.

Central administrators manage all sites in one instance, with workflows, roles and settings applied from the top of the hierarchy and site-specific overrides. Cross-brand content standards are enforced through roles and workflows rather than a dedicated policy engine.

Adding a site to an existing instance reuses infrastructure, content types and themes. Pricing is quote-based, so the per-brand cost curve is not public.

Themes can be assigned per site over shared content types and modules, so each brand keeps its identity on a common structure.

Site-level language configuration and per-site workflows let brands localize independently, but the translation workflow is shared and brand-aware approval routing is not documented.

GA4 and Parse.ly report per site and content reports can be run across sites, but there is no portfolio dashboard comparing brands.

Workflows can be configured per site and content type, with Esca automations for approvals and workflow logs for central audit.

Content owned by one site can be shared to all or selected sites, and settings cascade down the hierarchy with local overrides. Shared items update in place rather than as controlled copies with per-field override points.

Per-site settings can hold consent and legal content, but there are no publishing guardrails for regional compliance.

The Brightspot Design System and themes provide a shared base with per-site theme assignment. Versioned propagation of design system updates across brands is a development process, not a platform feature.

One user base with site-specific roles, central administration and SAML SSO group-to-role mapping supports autonomous brand teams under central control.

Content types are shared across sites, but per-brand extension of a base model means Java subclassing and a deployment.

Recurring content query reports with CSV export can be scoped across sites, leaving portfolio rollups and SLA tracking to manual aggregation.

Brightspot sells only on enterprise contracts, which in practice carry a data processing agreement, and the managed cloud runs on AWS, where EU regions are available; self-hosting gives full control over where personal data sits. No public DPA, published sub-processor list or SCC terms could be verified in this run. Held below 60 because, under the anti-pattern rule, an unverified DPA cannot earn the 60 to 78 band.

No BAA, HIPAA-eligible hosting statement or healthcare compliance guidance was found for Brightspot Cloud, and Brightspot's markets are media, broadcasting, government and corporate rather than healthcare. The self-hosted option lets a covered entity run the application on its own HIPAA-eligible infrastructure, which keeps this off the floor. Not higher without an explicit BAA.

Brightspot has a meaningful US public-sector customer base and a listing in the AWS Intelligence Community Marketplace, which points to experience with US government procurement and security review. No FedRAMP authorization, PCI DSS, HITRUST, IRAP or C5 coverage could be verified for the platform itself, and AWS's own authorizations cannot be inherited. Scored just below the GDPR plus CCPA band because even CCPA terms were not confirmed.

Brightspot is understood to hold a SOC 2 Type II attestation for Brightspot Cloud, and its pricing page bundles 'enterprise-grade security and compliance' into every package. The report's Trust Service Criteria, audit cadence and NDA availability could not be confirmed. Held below the 60 to 75 band until the attestation is verified on a trust or security page.

No ISO 27001 or ISO 27018 certificate covering Brightspot's own ISMS was found. AWS's ISO certifications cover the infrastructure but cannot be inherited by the platform. Scored in the no-ISO band, slightly above its floor because the SOC 2 programme implies a documented control set.

No CSA STAR, PCI DSS, Cyber Essentials Plus, FedRAMP, StateRAMP or IRAP certification was verified for Brightspot. The AWS Intelligence Community Marketplace listing signals work toward US intelligence-community procurement, but it is a marketplace listing rather than a certification. Scored at the base level without additional certifications.

Brightspot Cloud runs on AWS, which allows region selection per customer, and Brightspot also licenses self-hosted and bring-your-own-cloud deployment, which gives regulated buyers full control over residency. Region choices and contractual residency guarantees for the managed cloud are not publicly documented, and CDN caching may place delivered content outside the chosen region. Credit for the self-hosted route keeps it at 60 despite the documentation gap.

Content can be read out programmatically through the GraphQL Content API and the REST Management API, and content query reports export to CSV. There is no documented full-export or migrate-out tool, no published post-termination retention period, and no documented right-to-erasure workflow. Scored just below the API-export-with-retention band because retention is undocumented.

Every asset keeps a version history with who changed what and when, workflow transitions are logged, and some integrations such as SendGrid keep their own audit trail with per-action permissions. No consolidated admin audit log, configurable log retention, log export or native SIEM integration is documented. Scored in the lower part of the 50 to 70 band.

No WCAG 2.1 AA conformance statement or ATAG assessment for the Brightspot authoring interface was found in the product documentation. Brightspot's government customers make accessibility a likely procurement topic, but nothing public documents it for the editor. Scored in the no-documented-commitment band.

No public VPAT, Accessibility Conformance Report or Section 508 statement for the Brightspot CMS was found. One may be available to public-sector buyers on request, which is common for vendors selling to US government, but it is not published. Scored in the no-documentation band.

Create with Esca (formerly Create with AI, GA in the AI plugin) generates and rewrites text on fields and inline in the rich-text editor with Accept/Reject, admin-defined prompt suggestions, site-level Brand Guidelines appended to the system prompt, and author personas that mirror a named writer's style. AI-written fields get an AI Content label, a highlight toggle and a 'Contains AI?' search filter, and the fall 2025 release added social post generation and repurposing. Held in the low 70s because there is no bulk generation inside the editor (that runs through Esca Automations) and brand voice is a single prompt layer rather than a scored, multi-voice guardrail.

Media AI comes through the AWS plugin: Amazon Rekognition suggests image keywords that editors accept or reject, Textract extracts text from documents and Transcribe handles audio. No native image generation and no documented automatic alt-text generation were found in the AI or DAM plugin docs. Scored just above the no-media-AI floor because tagging is integrated into the asset workflow, though it relies on separately configured AWS services.

The translation plugin ships built-in machine translation integrations for Amazon Translate, DeepL and Google Cloud Translation, and Esca Automations offers LLM-driven content translation as a documented automation pattern. There is no in-platform translation quality scoring or locale-level brand voice preservation, and each MT engine is a separate dependency to configure, which keeps it below 70.

AI tagging comes from several directions: Amazon Comprehend suggests tags and sections from article text, Ask Esca can find articles missing tags and apply suggestions, and the fall 2025 release added SEO and LLM optimization to Create with Esca. The Brightspot Toolkit browser extension (spring 2026) adds real-time SEO and GEO analysis of live pages. Held in the high 50s because SEO title and description fields are populated from headline fields by rule rather than generated, auto alt text is not documented, and on-page scoring lives in the browser extension rather than the editor.

Esca Automations runs AI steps on content triggers (draft saved, workflow transitioned), schedules and webhooks, covering tagging, SEO optimization, accessibility review, FAQ and summary generation, social cross-posting, routing to desks and legacy content modernization, with a Content Compare action for revisions. Combined with Comprehend and Rekognition tag suggestions this is broad AI automation woven into editorial, scored mid-60s because Esca Automations is a separate service rather than part of the CMS itself and duplicate detection is something a team builds, not a shipped feature.

Brightspot ships two named agentic products: the Esca CMS agent (Ask Esca), which plans multi-step find/create/update/tag work and waits for user approval before changing anything, and Esca Automations, a no-code visual builder with AI Agent actions, read-only AI Judgment branches, Approval conditions, reusable agents with presets, MCP tool sources and dry-run rehearsals, now at v1.13. That is production-grade agentic automation with governance, held just under 80 because there is no agent marketplace and Esca Automations is a newer, separately deployed service.

Ask Esca answers coverage questions over the vector-indexed library ('How have we covered this topic before?') with cited sources, and Esca Automations can act on analytics triggers such as a weekly analytics update. There is no built-in AI content intelligence dashboard for gap analysis, topic clustering, stale content or performance scoring, so it scores in the basic band.

Esca Automations promotes brand governance automations that audit pre-published drafts against brand and compliance guidelines, uses AI Judgment to answer questions like 'Is this on-brand?', and includes accessibility review as an action. These are configurable patterns rather than a packaged audit product with scoring across thousands of pages, and the Toolkit's WCAG 2.1 AA audits are rule-based, so it lands mid-band.

The AI plugin chunks and embeds content on save into a vector database (RecursiveJsonTextChunker, EmbeddingGeneratable, @ExcludeFromEmbedding for PII) and serves semantic search and RAG answers with numbered citations through Ask Esca. The same keyword and semantic search is exposed to external agents through the MCP server. Scored 70 because native vector search is in production, though it is aimed at editors and agents and is not documented as a ready-made hybrid search for site visitors.

Brightspot added built-in A/B/n experimentation in the fall 2025 release, but no ML personalization engine, predictive segments or next-best-content recommendations appear in the product or docs. Optimization is test-based and rule-based, so it scores in the rule-based-only band.

Brightspot ships an official MCP server (com.brightspot.ai:mcp 3.4.4, Brightspot 5.0+, announced in the spring 2026 release) that lets agents discover content types, search by keyword or semantically, and create, update and delete content. It uses OAuth 2.1 with dynamic client registration or scoped API keys, every call runs under a CMS user's permissions, and the plugin can also consume external MCP servers. Not higher because it is self-installed as a Maven module and advertises tools only, with prompts and resources disabled.

The chat client and embedding generator are chosen per site from OpenAI, Azure OpenAI (custom endpoint and deployments), Amazon Bedrock (Anthropic, Amazon, Meta, Cohere) and Google Vertex AI, with Brightspot naming both BYOK and Bring-Your-Own-Account options. Esca Automations adds provider accounts per agent and a per-step model override. Data residency follows from running models in the customer's own cloud account, but there are no explicit residency controls in the product, so it stays at 80.

Developers get a documented agent framework in the AI plugin (Agent, ToolCallingEngine, ChatClient, custom agents per site) and can add tools with @ToolMethod-annotated ToolGroups that appear in both Ask Esca and the MCP server. The pipeline is built on LangChain4j with pluggable chunkers and embedding interfaces, and Esca Automations takes custom nodes, scripts and OpenAPI actions. This is a dedicated, documented AI SDK layer, though it is Java-only and not packaged for Python agent frameworks, so it scores 70.

The AI Audit dashboard widget logs every AI interaction with user, timestamp, model, tokens, the full request and response, referenced content and guard flags (Sensitive Information, Harmful Content, Denied Topic), with CSV export. AI-written fields are tracked down to the field level, including MCP and agent writes; AI tools are gated by role; brand guidelines layer onto a locked system prompt; and agents need approval before changes. Scored 78 rather than higher because no IP indemnification or hallucination confidence scoring was found.

In the CMS, the AI Audit widget gives per-user, per-model token counts and response times with exportable records. In Esca Automations, a dashboard tracks AI cost in dollars, tokens used, success rate and execution time with 7, 30 and 90 day trend charts, plus an estimated-savings figure. That is solid usage and cost visibility, held below 70 because there are no quotas, budgets or per-team credit limits and no prompt-effectiveness or quality trend metrics.