Contentstack

Broad field set (text, number, date, file, reference, JSON RTE, Group, Modular Blocks, Global Fields, Taxonomy, custom fields via apps) with nested Global Fields and Modular Blocks inside Global Fields. Content types can be exported, imported and managed through the CMA and CLI, but there is no declarative schema-as-code model and no union or polymorphic field type.

Reference fields support single and multiple references to one or more content types, the References API gives reverse lookup and Reference Map visualizes the graph. References are unidirectional with no native bidirectional field or graph traversal, so it sits in the adequate band.

Modular Blocks, Group fields, nested Global Fields and JSON RTE embedded entries give a real block-based composition model with structured AST rich text. Nesting depth is constrained and taxonomy cannot sit inside blocks, which keeps it below the top band.

Standard validations (required, unique, regex, min/max, number range, file type, custom error messages) apply to editor and API writes, and required-field checks now hold across single, bulk and release publishing. There is no cross-field or conditional validation and no pre-save validation hook.

Entry version history with compare and restore, named versions (now also for variant entries), Timeline for point-in-time review, and stack branches with compare and merge strategies plus automatic backups. Entry-level merge has no UI and branches are plan-gated, which keeps it from the 90s.

Native hierarchical taxonomies are reusable across content types, governed through taxonomy-based permissions, publishable and localizable per term, and queryable through the Content Delivery API (get taxonomies, terms, entries by term with $in queries). Caps of 10,000 terms, 10 levels and 25 terms per entry, no synonyms, and the inability to place taxonomy inside blocks hold it below the mid-80s.

Live Preview shows drafts on the customer's own headless frontend in real time, Visual Editor adds click-to-edit overlays via CSLP tags, preview sharing gives shareable links, and preview works per locale, per environment and per personalization variant. It needs Live Preview SDK and CSLP instrumentation in the frontend, which keeps it below 90.

The JSON RTE outputs a portable AST with embedded entries and assets, custom plugins and serializers, and nested embedded items now resolve to current metadata. Plugin and embed limits and a smaller plugin ecosystem than Portable Text keep it in the mid-70s.

The base asset library has folders, metadata, references tracking and the Image Delivery API with URL transforms (resize, crop, quality, WebP and AVIF output) on the CDN; focal-point presets come via the Image Preset Builder app. The richer Contentstack Assets layer (AI metadata, duplicate detection, asset types) is a paid add-on and belongs in 2.6.1, so the base library scores in the low 80s.

Presence indicators, per-field locks, Request Edit Access in Visual Editor, collaborative draft preview and workflow comments give conflict prevention with async collaboration. There is no same-field concurrent co-editing, Drafts and Auto Save remain Early Access, and @mentions are not documented.

Custom workflows of up to 20 stages per content type with role and user assignment, due dates, notifications, stage transition rules, Prevent Self-advancement, and Publish Rules with approval conditions by environment, language and action, plus an audit log. One workflow per content type per branch and no parallel approval paths stop it short of the top.

Scheduled publish and unpublish with time zone and DST handling, Releases that bundle entries and assets for atomic scheduled deployment, rescheduling, bulk actions on up to 10,000 entries, Find and Replace into releases, Timeline preview, and a Calendar app for publish events and releases. The calendar is a marketplace app and scheduling is capped at 12 months ahead.

Field-level localization with non-localizable fields, configurable fallback language chains, localized vs unlocalized entry states, locale-specific publishing, per-locale preview and locale query parameters on the CDA, with localization extending to taxonomy terms and asset variants. Locale-aware validation rules are limited, which keeps it from the top.

Custom stack roles with content-type, entry, asset-folder, language, environment, branch and taxonomy-based permissions, workflow approval authority tied to roles, SAML SSO now with up to five IdPs per organization, and SCIM provisioning. True field-level hide or lock permissions are not documented and organization-level roles are predefined.

Separate REST Content Delivery and Content Management APIs plus a GA GraphQL delivery API, with locale, filtering, sorting, pagination and taxonomy queries, and a new Assets API. GraphQL complexity caps limit large queries.

Delivery runs through a global CDN with Cache-Tag scoped purge on publish and unpublish, no rate limit on cached requests, multi-cloud regions including Azure EU, and edge functions plus Personalize Edge for edge decisions. Edge compute requires Launch rather than being available at the bare CDA layer.

Webhooks cover entry, asset, release, workflow and publish events with content-type filtering, retry policy, custom headers, 30-day delivery logs, and customer-managed HMAC-SHA256 signing with rotation and replay timestamps; Automate adds event-driven connectors. No schema-change events, no pre-save hooks and no native event streaming to Kafka or EventBridge.

Purpose-built headless with delivery SDKs for JavaScript/TypeScript, Java, .NET, Python, Ruby, PHP, Swift, Android and Dart, plus channel-agnostic JSON RTE AST output. Recent SDK releases are mostly CVE and regression fixes rather than new capability.

Contentstack Data & Insights (the Lytics real-time CDP) supplies unified first-party profiles, behavioral segments and audience insights that flow into Personalize audiences, with Edge API custom attributes for real-time evaluation. It is a separately licensed product in the suite, so the add-on ceiling applies.

Personalize delivers entry variants per audience natively in the CMS, with variant groups created in the stack, named variant versions, variant-aware Live Preview and edge decisioning. It requires a Personalize license (Starter Pro and Enterprise plans), so it is scored under the add-on ceiling.

Personalize A/B test experiences include traffic allocation, Bayesian probability-to-be-best, confidence intervals and real-time impressions and conversions. No multi-factor multivariate testing and the separate license keep it below the ceiling.

Data & Insights provides content affinity signals that can drive audience-based content selection, but there is no dedicated recommendation service with collaborative filtering in the CMS or Personalize. AI recommendations remain roadmap.

Visitor-facing search comes through the Algolia marketplace app and Automate connectors for Algolia, Coveo and Constructor that sync published content into the index. The native search is editor-side only, so the integration ceiling applies.

Contentstack has no product catalog, cart, checkout, pricing or inventory. Commerce is always delivered by an external platform.

Marketplace apps for commercetools, Shopify, BigCommerce, Salesforce Commerce Cloud and SAP Commerce provide product and category pickers with live product data in entries, plus composable commerce starters. No bidirectional sync.

Analytics covers CMS usage, Launch traffic and Personalize experience results, and Data & Insights adds audience insight. There is no per-entry content performance, content health or editorial productivity analytics in the CMS.

Data & Insights connectors and warehouse sync, the Real-time Events Tag auto-deployed on Launch, and Automate connectors give an integration path to analytics tools. There is no documented first-party GA4 or Adobe Analytics app that surfaces analytics in the editor.

Sites are run as separate stacks or as environments and locales within a stack, with organization-level management, branches and Global Fields; cross-stack content sharing needs the Interstack Reference app or a proxy. This is silo-based multi-site rather than native shared content across sites.

Official marketplace apps for Smartling, Phrase, Lokalise, Trados and XTM send entries for translation from the entry editor, with full-page translation and field management. No native translation memory or in-platform translation workbench.

Brand Kit holds brand knowledge, design standards and rulesets associated across multiple stacks, and organization-level roles, SSO and Assets spaces give central control. There is no shared component library with brand overrides or cross-brand approval workflow.

Contentstack Assets (GA May 2026, paid add-on) adds spaces and workspaces, asset types with custom metadata schemas, version history with named versions, localized variants, duplicate management, AI metadata at upload, bulk operations and a full Assets API. Rights and expiry exist only as custom metadata and there are no asset approval workflows or brand portals.

Video is handled through Brightcove, Vimeo and Cloudinary marketplace apps. There is no native transcoding, adaptive streaming, captions or player.

Visual Editor lets marketers add, reorder and edit Modular Block components in context on the headless frontend, and Contentstack Studio adds sections, templates and drag-and-bind composition published without a deploy. Studio is React-only and has no GA changelog entry, and brand guardrails are limited.

Contentstack Launch is a first-party front-end hosting product with Git and CLI deploys, per-environment URLs, custom domains with automatic SSL, apex redirection, cloud and edge functions and cache revalidation. Contentstack does not render pages itself and no site-level SLA was found, which keeps it in the 75–89 band.

Forms come from MakeForms, Form.io and Marketo Forms marketplace apps. There is no native form builder or submission storage.

Automate connectors for SendGrid, email and Twilio can trigger sends from publish and workflow events. No ESP subscriber sync, email content authoring or email preview.

Automate is workflow automation for content operations with CMS event triggers and branching, not marketing automation; nurture flows, lead scoring and campaigns require an external tool.

SEO metadata is modelled as fields, redirects are documented as a content type or Launch redirect configuration, and sitemaps, hreflang and structured data are built by the frontend team. No native SEO layer or recommendations.

No llms.txt generation, per-page Markdown endpoints, AI crawler controls or AI citation reporting were found for delivered sites; these are achievable through the frontend or Launch edge functions. Contentstack's own docs publish Markdown versions, but that is not a customer-facing feature.

The Contentstack Marketplace offers first-party and partner apps across commerce, DAM, translation, search, analytics, forms and SEO, plus Automate connectors and an App SDK. Total app count is not published, which keeps it just below the large-marketplace band.

There is no visitor identity, login or gated-content layer; Launch's authentication gates environments behind Contentstack staff SSO only. Authenticated experiences mean the frontend team integrating a CIAM provider and passing attributes into Personalize via the Edge API.

Well-designed REST CDA (v3.0.0) with downloadable OpenAPI JSON, Postman collections, and GraphQL with a GraphiQL Explorer that returns x-query-complexity and db-call headers. The Assets API (Aug 27, 2026) adds programmatic spaces, asset types, custom metadata, versioning, markups and AI-assisted search, and JSON RTE gained include_embedded_items[]=RECURSIVE with embedded_items_depth up to 5 (Sep 7, 2026). GraphQL remains explicitly read-only — the docs state it 'does not support mutations and subscriptions' — and the surface is now fragmented across CDA v3, CMA v3, GraphQL and Assets v4 on a separate host (am-api.contentstack.io) requiring an x-cs-api-version header, which keeps this short of the 85+ band.

Rate limits are now precisely documented: CDA 100 req/s per org on origin only with CDN-cached requests not rate-limited at all, GraphQL 80 req/s with a 7,500-entry complexity ceiling, and X-RateLimit-Limit/Remaining headers on both. The Sync API paginates large datasets via pagination_token, and a Sep 11, 2026 behavioral change made limit accept positive integers only — removing the limit=0 full-table fetch that used to time out large stacks. CMA at 10 req/s read, 10 req/s write and 1 req/s for bulk actions is genuinely tight for migration workloads, which caps this below 80.

Official SDKs across JavaScript/TypeScript, Python, Ruby, Java, .NET, Swift/iOS, Android, React Native and Flutter, with a release cadence few headless peers match. June–September 2026 shipped TypeScript Delivery 5.6.0 (transient-error retry, Aug 12), Java Delivery 2.8.2 / Management 1.14.1 / Utils 1.6.2, Ruby Delivery 0.10.1, Swift Delivery 2.5.1, .NET Management 1.1.1 and JS Management 1.31.1. Among the best SDK coverage in the category; held at 85 because the official changelog has drifted from actual npm releases (TS Delivery 5.6.0 was never changelogged).

The public marketplace catalog holds 214 listings, but only 71 are installable CMS apps — the 91 'Data Integrations' are Lytics CDP connectors inherited from the acquisition, plus 22 recipes, 12 starters, 10 content models and 8 accelerators. App category coverage is broad (DAM 12, translation 10, commerce 7, video 6, analytics 5, search 3, identity 3, personalization 3, A/B 2), and a new Agent Directory adds 12 pre-built agent templates. At 71 apps it sits just below the rubric's 75+ threshold, and net-new app growth is slow — only Clearwinner (May 2026) and Shopify Live Preview appear as genuinely new in the visible changelog windows, the rest being version bumps.

App Framework exposes 10 UI locations (custom field, entry/asset/content-type sidebar, stack dashboard, field modifier, full page, global full page, RTE, app config), and Advanced Settings adds encrypted variables plus Rewrites that proxy third-party APIs so credentials never reach the browser. The MCP story is the standout — an official server with 196 tools across 9 groups, an MCP Client letting Agent OS agents call any remote MCP server over OAuth 2.1, and a 21-skill agent-skills repo — and Polaris (Oct 1, 2026) now adds reusable org-governed Skills and on-demand agents that run under the invoking user's permissions, alongside per-app webhooks with customer-supplied HMAC-SHA256 signing (Jul 30, 2026). Held below 80 because there is still no serverless execution inside Developer Hub apps (server-side logic must go to Launch), Machine-to-Machine apps remain beta, no new UI location shipped in 2026, and the MCP server is pre-1.0 with a closed source repo.

SSO is SAML 2.0 only — no OIDC support is documented anywhere — but an organization can now attach up to five SAML IdPs as separate connections, each with its own certificate, session policy and role mapping (Sep 11, 2026). SCIM provisioning covers Okta, Entra ID and OneLogin with group-to-role mapping, and the new Security Manager org role removes the previous dependency on Owner for configuring SSO. MFA is TOTP-based with no documented plan prerequisite and org-wide enforcement alongside password and session policies; SSO/SCIM remain documented as 'plan-based' with the qualifying tier unstated and absent from the public pricing matrix, which holds this in the 60–75 gated band.

Correcting a prior error: Contentstack does have field-level permissions. The docs state custom roles can 'assign permissions at entry, field, and asset level… or EDIT only the SEO fields,' with a dedicated Field-Level Permissions section and worked scenarios. Granularity spans entry, field, asset and folder, locale, environment and taxonomy terms, and Unified RBAC (Jun 4, 2026) added multi-role assignment, product-scoped permissions, Security Manager and Product Analytics Viewer org roles, and Teams. Short of 85+ because field control is implemented as a deny-list exception rather than a positive grant — a newly added field is permitted by default — roles cannot differ per branch, custom roles cap at 2 on Growth, taxonomy RBAC is entitlement-gated, and management tokens still scope only to stack read/write.

The trust page lists exactly four items: ISO/IEC 27001:2022 (current revision, transition complete), SOC 2 Type II covering security/availability/confidentiality/privacy, third-party VAPT, and GDPR with DPA and transfer risk assessment. EU data residency is genuine — seven hard-isolated regions across three hyperscalers including AWS Ireland, Azure West Europe and GCP Belgium. Capped at 80 because the US/CA DPA contractually defines PHI and payment card data as 'Prohibited Data' the customer may not upload, so there is no HIPAA BAA and no PCI despite a Feb 2026 blog post marketing HIPAA readiness; ISO 27017/27018, FedRAMP and StateRAMP are absent, the SOC 2 report is request-gated, and trust.contentstack.com is NDA-gated down to the badge list.

The record itself is spotless — an NVD keyword search for 'contentstack' returns zero results, no CVE has ever been assigned against a Contentstack product, and 25 months of status-page history contain no breach, exposure or compromise event. Dependency patching is fast and systematic via Snyk in CI: the json gem use-after-free (CVE-2026-71847) shipped 10 days after NVD publication and the jsoup resource-exhaustion flaw (CVE-2026-75140) was merged across three Java repos one day after the upstream fix existed, with proactive customer comms on the 'Copy Fail' kernel flaw they did not introduce. Held to the rubric's no-bounty band because there is no bug bounty of any kind — hackerone.com/contentstack, bugcrowd.com/contentstack and the Intigriti page all 404, as does /.well-known/security.txt — leaving only a security@ inbox with a 24h ack; Contentstack has also never published a GitHub Security Advisory, so SDK consumers get no Dependabot alert, and the Security Addendum commits to only annual pentesting despite the trust page claiming twice yearly.

SaaS-only with no published self-hosted, hybrid or BYOC SKU, but the strongest regional footprint among headless peers: seven regions across three hyperscalers — AWS North America, Europe and Australia, Azure North America and Europe, GCP North America and Europe — each a separately isolated deployment rather than a logical partition. Contentstack Launch adds frontend hosting across Next.js, Nuxt, Astro, Angular, Vue, Remix, Gatsby and Analog with generic SSR/CSR fallbacks. Sits at the top of the rubric's 50–60 SaaS-only band; 2026 MCP docs do reference 'customers on dedicated or private infrastructure' with base-URL overrides, but no public SKU, pricing or documentation exists for that, and an organization's home region is fixed permanently at signup.

Correcting a prior overstatement: the Services Description commits to 99.50% on commercially-reasonable-efforts language for Start/Grow/X1/X3 and only 99.95% for Scale/X5, with 99.95% and 99.99% sold as separate High and Premium Availability add-on packages; the public pricing page shows no SLA at all on Free or Growth and 99.5% on Enterprise. Incident volume rose materially in 2026 — 28 incidents year-to-date against 16 in all of 2025, and 10 in the trailing 90 days (most recently GCP NA publishing delays on Sep 19) — with a 73-minute full AWS EU outage on Apr 11 self-attributed to an ingress controller failure during a planned EKS upgrade, and webhook dispatch a recurring weak spot. The status page is genuinely excellent (per-region, 25 components, full JSON API with published root causes), which holds this above the 60 floor, but the uptime showcase is disabled and returns empty so no uptime percentage is published anywhere.

CDN-fronted delivery scales well for read-heavy workloads — cached CDA requests are not rate-limited at all — across seven independently scaled regional deployments with intra-region multi-AZ auto-scaling groups. Scale limits are now far better documented than in prior cycles: CDA 100 req/s origin, GraphQL 80 req/s with a 7,500-entry complexity ceiling, Launch platform limits published Jun 25, 2026 (5 MB response body, 500/day cache revalidation quota on non-Enterprise), and Agent OS capacity figures. Those same published limits expose real ceilings — 5 environments and 5 branches per stack, CMA writes at 10 req/s and bulk at 1 req/s, and Asset Management 2.0 appearing NA-only in the region registry — which keeps this from the 80s.

Correcting a prior error: no RTO or RPO is published anywhere — not on the trust page, the Services Description, or the docs tree — and the trust page has no DR or business-continuity section at all. More significantly, cross-region failover is explicitly ruled out in two separate docs: 'a region doesn't work as a fallback or disaster recovery option for the other… you can't use a region as a backup of your primary region,' which the 73-minute AWS EU outage demonstrated in practice. What exists is solid but unexceptional: a Contentstack-operated backup datacenter per region, six-hourly backups with 2-day retention, daily with 7-day, weekly with 30-day, a 14-day self-serve restore window (beyond that 3–4 business days via SRE), and good export tooling in cli-cm-export-query. Lands in the rubric's 50–65 band for automated backups plus export without documented RTO/RPO, at the top of it for export quality.

CLI 2.0.0 went GA Aug 13, 2026 — a real step up, adding a dedicated asset-management plugin for Asset Management 2.0, consolidating 14 bulk-publish commands into three, retry-with-backoff on 429/5xx, and Progress and Summary managers, though it also requires Node 22+ and un-bundles the launch and migrate-html-rte plugins behind install prompts. There is still no local development server or emulator: the v2 command inventory has only auth, cm, config, launch and plugins namespaces, and the sole local runtime is csdx launch:functions for testing Launch cloud functions on port 3000 — not the CMS or content API. Content modeling and development still run entirely against the remote API, placing this in the rubric's 50–65 CLI-without-emulator band.

Branches with aliases, compare-and-merge with multiple strategies, multi-environment support, management-token auth for headless CI, and export/import that now carries publishing rules through pipelines make for a workable pipeline story, and branch creation gained selective environment cloning (Aug 19, 2026). The hard constraint is scale: a stack is capped at 5 branches and 5 environments, so a true branch-per-PR content environment pattern is not achievable beyond five concurrent PRs — this is the main reason it sits below the rubric's 75+ threshold. CLI 2.0's breaking changes to export layout, flag names and bulk commands also impose a one-time migration cost on existing pipelines.

Contentstack's docs are now among the most agent-ready in the category: every page has a Markdown twin at the same path with a last_updated field, an llms.txt index exists, and developers.contentstack.com ships a redesigned portal with an 'Ask Dex' AI search plus explicit /index.md, /agents.md and /.well-known/mcp affordances. First-party framework coverage is strong and current — Kickstart repos for Next.js, Nuxt, Astro, Angular, React and SvelteKit all pushed Sept 10–13, 2026, alongside a GraphiQL playground, downloadable OpenAPI, Postman collections and 21 packaged agent skills. Held below 80 by real freshness and consistency gaps: TS Delivery SDK 5.6.0 never reached the changelog, the Sept 11 limit change is documented in the CDA reference but not the CMA one, the backup doc is marked 'no longer maintained', and the trust page still omits AWS Australia.

The TypeScript Delivery SDK is first-class and actively maintained (v5.6.0, Aug 12, 2026, adding automatic retry of transient network errors composed with user-supplied retry conditions), and the TSGen CLI plugin generates types from content types, global fields and GraphQL schemas with flags for prefixes, namespaces, system fields and editable tags. Type generation is still a manual csdx tsgen invocation, though — there is no --watch, no daemon and no webhook-triggered regeneration documented, so keeping types in sync with a content-model change is a deliberate CI step you build yourself on the types-generator library. That manual codegen keeps it at the top of the rubric's typed-SDK band rather than the 80+ auto-generation band.

The cadence picked up again after the last scoring. Contentstack shipped a September Assets release on Sept 23 (metadata controls, duplicate-image cleanup, AI metadata at upload), then on Oct 1 a batch of Polaris capabilities: Skills, on-demand agents, building an agent from a conversation, and a full-screen workspace. The same day it launched Contentstack Canoe, an AI visibility tool and its first standalone product. That follows the June to September run of AXP and Agent OS GA, CLI 2.0.0 GA, the Assets API, Find and Replace, and multi-IdP SSO, so the platform clearly ships major features monthly. Held at 80 because SDK releases are still mostly dependency and CVE patches rather than new capability.

The changelog now explicitly labels API behavior changes — the Sept 11 2026 CDA/CMA entry opens with 'Behavioral change:' and spells out the exact before/after for the limit query parameter — and names CVE identifiers on security patches (CVE-2026-75140 jsoup across three Java SDKs Aug 31; CVE-2026-71847 json gem in Ruby Delivery 0.10.1 Aug 17). Per-SDK entries cleanly separate new features, bug fixes, and security fixes, and Contentstack Pulse adds monthly and quarterly narrative recaps. Reaches the 75+ 'surfaces per-release breaking changes' bar; not higher because there are still no consolidated per-release migration guides of the kind Contentful publishes.

Contentstack Pulse continues to publish monthly platform news plus quarterly 'what's new and what's coming' recaps and roadmap webinars, which is more forward visibility than an enterprise-briefing-only vendor, but there is still no public feature-request board with community voting (no Canny, no GitHub Discussions roadmap). The free Explorer tier markets 'shape the platform's roadmap' and beta early access, but that is vendor copy rather than a published, votable backlog. Sits between the rubric's 40–55 private-roadmap band and the 70+ public-voting band, so unchanged.

CLI 2.0.0 reached GA on Aug 13 2026 after a long, publicly versioned beta track (beta.1 through beta.23) with the 1.62.x stable line maintained in parallel throughout — a textbook migration path. Offsetting that, the Sept 11 2026 limit parameter change altered live CDA/CMA response behavior (limit=0, empty, or non-numeric values now silently return the resource default instead of the prior behavior) with changelog notice but no deprecation window, which is exactly the short-notice pattern the rubric penalizes. Still no codemods or automated migration tooling, so the net is a small step down from the May read.

Package downloads moved up modestly. The legacy npm contentstack package reached about 66K weekly downloads (from roughly 58K), the newer @contentstack/delivery-sdk adds about 46K, and @contentstack/cli about 19K. Review and GitHub proxies are flat: G2 is around 300 reviews and the SDK repos on the public GitHub org sit in the tens of stars. Open self-serve signup (Sept 16) and the free Canoe plan (Oct 1) remove the sales gate, but they have not yet shown up in community metrics. Still well behind Sanity, Strapi and Contentful on grassroots developer scale.

Vendor-side responsiveness is demonstrably strong — the jsoup advisory was patched across three Java SDKs within two weeks (1.23.1 on Aug 17, 1.23.2 on Aug 31), and Ruby, Swift, TypeScript, and .NET lines all received security or stability fixes in the same window. Contentstack runs a Discord and now extends direct product/engineering access and beta participation to free-tier users. Still vendor-driven rather than organic: outside contribution on the public GitHub org remains light and there is no visible community-answered support forum at Sanity or Strapi scale.

Partner count is flat at 120 (94 technology, 26 channel/solutions) with a dedicated partner portal at partners.contentstack.com and continued SI depth — Capgemini, EPAM, DataArt, Delaware, Switch, Datmos, SilverTech (Chief Marketer's 2026 Agency of the Year). The program formalized further in 2026 with the Contentstack Experience Awards adding Agency Partner of the Year and Technology Partner of the Year categories at ContentCon, and new technology integrations landed with Akeneo, Brightcove, and Trados. Competitive for a headless CMS but no material network growth this period, so unchanged.

Independent trade coverage picked up around the June 2026 AXP launch — CMS Critic published an analysis of the AXP vision and Gilbane covered the launch, alongside broad newswire syndication — which is more outside-the-vendor writing than the platform typically attracts. The Sept 16 2026 open free signup also removes the account barrier that previously made third-party tutorials hard to produce at all. Still low in absolute terms: no meaningful Udemy or Pluralsight catalog, thin independent YouTube coverage, and conference talks concentrated at Contentstack's own ContentCon.

Two shipped changes improve the pipeline: fully open self-serve free accounts (Sept 16 2026) mean a developer can now learn the platform without an enterprise contract for the first time, and Contentstack added free official certification on AXP and Agent OS delivered at both ContentCon events on top of Contentstack Academy. The present-day pool is still niche — roughly 46 Contentstack-mentioning roles on Indeed and ~59 on LinkedIn — and expertise stays concentrated at SI partners rather than the freelance market. Niche-but-improving, so just above the rubric's 50 floor and well short of the 70+ 'widely recognized' band.

Logo and event signals stay strong: TIME partnered with Contentstack in July 2026 for its digital publishing platform, ContentCon 2026 runs across two continents with Verizon, TIME, Land O'Lakes, MassMutual, Volvo, ASICS, and Walmart Marketplace presenting, and a new Forrester TEI study (2026) puts customer ROI at 295%. Trimmed from the May read because the G2 review count is effectively flat over seven months (~297 in Feb to ~300 in Sept), so the 'G2 review growth' that partly justified 77 did not materialize, and independent labor data shows active job postings down 72.5% in 2026.

No new capital since the $80M Series C in November 2022 ($179M total), which is now a nearly four-year gap, and independent labor data shows a sharp hiring contraction — active postings down 72.5% in 2026 to about 22, with new postings per month falling from 33 in 2023 to 9 in 2026 — while Glassdoor reviews repeatedly cite recurring layoffs. Offsetting that, headcount is roughly flat rather than collapsing (sources range 671 to 748 for 2026), the Lytics acquisition showed M&A capacity, and R&D output through AXP, Agent OS, Assets API, and CLI 2.0 is clearly funded. Stable but no longer the untroubled picture of the prior scoring, hence the step down.

The June 9 2026 AXP launch gave Contentstack a real category-creation position, combining Content Cloud, the Lytics-derived Data Cloud and Agent OS into one governed agentic stack. The Oct 1 launch of Canoe, an AI visibility tool sold as its first standalone product, extends the 'humans and agents as two audiences' story rather than switching to a new one. Analyst backing is unchanged but solid (Gartner 2025 DXP MQ Visionary, Forrester CMS Q1 2025 Leader as the only pure headless vendor, Forrester DXP Q4 2025 Strong Performer), and the 2026 Forrester TEI adds quantified proof. Held at 68 because AXP is a self-declared category that no analyst quadrant has validated yet.

G2 holds at roughly 4.4/5 across about 300 reviews, which is the top of the rubric's 4.2–4.4 / 100–300 review band (60–72). Gartner Peer Insights WCM slipped to 4.2/5 over 104 reviews (from 4.3 at the last scoring) with DXP at 4.4/5 on a thin 13 reviews. Praise is consistent on editorial UX, clean interface, preview and Timeline; recurring criticism centers on missing built-in analytics, personalization being hard at scale, no built-in site search, learning curve, and pricing — enough to hold this just inside the band rather than above it.

contentstack.com/pricing was rebuilt around Oct 1 2026 and now publishes dollar prices for three of four tiers: Free $0/month forever, Build $29/month, Growth $299/month with extra users at $25/user/month, and Enterprise at custom price. Every self-serve tier lists its included API calls, bandwidth, content types, entries, assets and users. This replaces a fully sales-gated page that scored 45, and is now in line with Contentful, Hygraph and Storyblok. Held below 70 because overage rates are not published and the FAQ says Launch and Personalize are priced separately, with the buyer told to ask their account team.

The new self-serve tiers are flat monthly fees with clearly stated included limits, and a $29 Build tier now sits between Free and Growth, so the old Free to roughly $20K/yr Starter cliff is gone. The model is still usage-metered, though: Build advertises pay-as-you-go overages at unpublished rates, Growth says to "scale usage as you grow" across bandwidth, stacks, API calls and users, and the pricing FAQ answers "Will my costs increase if traffic spikes?" with "Possibly." There is also a 10x step from Build to Growth, and Enterprise keeps the negotiated, multi-dimension metering plus AI credits.

Several things buyers used to pay for are now in Free and Build: the Visual Editor, Launch front-end hosting, Brand Kit and Agent OS. Growth at $299/month adds custom workflows, but only 2 custom roles, with 500 custom roles held for Enterprise. Personalize, Flows, the 99.5% SLA, dedicated infrastructure and data residency are Enterprise-only, which is fair gating for an enterprise tier. Held in the mid-50s because SSO is not listed on any self-serve tier and multi-IdP SAML remains an organization-level enterprise capability, and because a cap of 2 roles at $299/month still restricts governance.

Build and Growth are priced per month, and both "Start your Growth plan" and the Free/Build buttons go to the self-serve /sign-up flow instead of a sales form. A team can now go from free to a $299/month production plan without negotiating an annual contract. Enterprise stays annual and sales-negotiated. No startup, nonprofit or education program is published, and the cancellation and term details for the monthly plans have not been verified, so it stays below 70.

The free tier, launched Sept 16 2026, is now presented on the pricing page as "$0 / month, forever". It includes 1 production stack, 3 users, 100K API calls, 100 GB bandwidth, 1K entries and 1K assets, plus the Visual Editor and Launch hosting, and a $29 tier is the next step up. That is a real permanent free tier. The conflict remains, however: as of 2026-10-02 the legal Services Description still says Explorer Stacks are for "non-production use cases", limited to 50 content types, 200 entries and 10,000 API calls a month, with no SLA. A custom domain also requires Build. Raised from 55, but held below the 65–80 band until the contract matches the marketing.

A developer can sign up with no credit card or sales call and get full API, CLI and SDK access. Free now also includes the Visual Editor and Launch hosting, so a hosted working site is possible on day one with no separate host. G2 rates ease of setup 8.3/10. A first content query takes well under an hour. Not higher because production preview and workflow wiring still take longer than with the simplest headless tools.

No new evidence moves this. Mid-market implementations still run 2–4 months and enterprise migrations longer. PricingNow and Vendr put migration and custom development at $20K–$100K+ in year one, with services at $150–$250/hr, and the Pirelli reference (218 sites) took 10 months with a bespoke BFF architecture. G2 reviewers still flag "limited out-of-the-box solutions" requiring developer time. Faster than traditional DXPs, slower than the simplest headless alternatives.

Front-end work uses mainstream React and TypeScript skills through well-maintained SDKs. Free accounts plus free Academy courses and Discord let developers learn the platform without being customers. Platform-specific expertise is still needed for Agent OS, Polaris agents and Skills, Automate, Modular Blocks, Personalize and Launch, and the SI ecosystem is smaller than Contentful's. The premium over commodity headless work is moderate, and far below AEM or Sitecore rates.

Fully managed SaaS with hosting bundled into the license, and no self-hosted path. Launch front-end hosting is now included from the Free tier up, with one Launch project on Growth, so many teams need no separate front-end host. Not higher because bandwidth and API consumption above tier limits turn into overage charges at unpublished rates.

The platform itself needs no ops team. Contentstack runs, patches and monitors it, and 2026 admin tooling (Bulk Force Kill Session, Healthcheck app, Find and Replace, select-all bulk actions) cuts manual overhead further. Operational attention is limited to the front end, API quota monitoring and webhook health. Held at 80 because managed-SaaS breaking changes still create unplanned work: the Sept 11 2026 limit-parameter change altered response sizes for existing callers.

CLI 2.x (2.0.0 GA Aug 13 2026, 2.0.1 Aug 31) has documented export and import across 17+ modules, including entries, content types, global fields, assets, workflows, roles, taxonomies, Personalize and Studio. The Aug 27 2026 Assets API GA makes the media library fully scriptable. Content exports as standard JSON. Not higher because Modular Blocks, Automate flows, Agent OS and Polaris agents, Personalize experiences and CDP setup are Contentstack-specific and must be rebuilt on migration.

Core mental model is unchanged and still maps to standard web dev: Stacks, Content Types, Entries, Assets, Environments, Locales, plus Modular Blocks, Global Fields and Entry Variants. Surface area kept growing through 2026 — Agent OS reached GA in June, Studio added its own object model (projects, registered components, design tokens, Sections), and an MCP server landed — but all three are opt-in layers a team can ignore and still ship. G2 reviewers new to headless still report a learning curve on content modeling and multi-step admin workflows, which is what holds this below 75.

The Sept 16, 2026 launch of free self-serve accounts removes the sales gate that previously blocked any developer from trying the platform; the pricing page now lists Free ($0, no card, no expiration) alongside Build $29/mo and Growth $299/mo, though the legal Services Description still describes Explorer stacks as non-production with lower limits. That stacks on CLI 2.0's cm:bootstrap (clones a starter, creates the stack, imports content in one command), the Live Preview Onboarding Experience with real-time CORS/base-URL feedback, Platform Discovery, the redesigned Academy and certification paths. Not higher because G2 reviewers still flag reference documentation depth as the weak link once past the guided paths.

Plain REST/GraphQL with no proprietary templating or query language, and first-party Kickstarts for Next.js 15 (App Router/RSC), Nuxt 4 and Astro. Aug 2026 SDK work targeted mainstream toolchains directly — TypeScript Delivery 5.5.2 fixed MODULE_NOT_FOUND and 'expression is too dynamic' build failures under Next.js Turbopack and webpack, and 5.5.1 added default retry logic for transient network errors. The Sept 11 change making the limit parameter accept positive integers only is a minor behavioral break, not a paradigm shift.

Prior scoring credited only the Next.js Kickstart; the vendor also maintains a Nuxt 4 Kickstart (Contentstack plugin, composables, Live Preview and Visual Builder wired) and an Astro Kickstart (SSR, Delivery SDK, Live Preview, Visual Editor), alongside the five Next.js rendering variants, the Compass starter app and marketplace starters. CLI 2.0's cm:bootstrap and cm:stacks:seed turn setup into one command that clones the repo, provisions the stack, imports example content types/entries/assets/environments and optionally enables Live Preview, with deploy to Launch or Vercel. Not 75+ because Kickstarts are deliberately minimal scaffolds rather than polished demo sites — advanced patterns like personalization and complex workflows remain under-represented next to Storyblok's or Sanity's full example applications.

Four token types are still required for a full setup (API key, per-environment delivery token, management token, preview token), which keeps this out of the 70+ band. But zero-to-working got materially shorter in Aug 2026: cm:bootstrap handles stack creation and content import in one command, CLI 2.0 added a Progress Manager, guided install prompts for missing plugin commands, and a config namespace for regions, Launch projects accept parameters from config files for repeatable CI/CD deploys, and the Studio CLI is documented as deterministic for CI pipelines. Free self-serve signup also removes procurement from the critical path. Still no declarative config-as-code for full stack schema state — export/import and migration scripts are the mechanism, not a desired-state file.

Correcting a prior error: Contentstack does ship automated migration tooling — cm:stacks:migration runs custom JavaScript migration scripts that create/update/delete content types and entries and migrate group and global fields — and the documented change-management workflow uses branches to stage schema changes before merging, improved Aug 19, 2026 by letting you choose which environments to clone into a new branch instead of all of them. The 500-field-per-content-type ceiling stays generous versus Contentful's 50. Held in the 30-50 band because the risk profile is unchanged: field type changes and deletions still lose data on existing entries, the vendor's own guidance is to copy the content type and test in staging rather than migrate in place, and the CLI has real gaps (V1-exported global fields silently skipped on import, only main exported by default, Personalize modules rejecting management tokens).

Moves into the 'requires frontend code but well-documented' band: Live Preview SDK v4.0.0+ automates the CMS-to-site connection and edit tags, the Nuxt and Astro Kickstarts arrive with Live Preview and Visual Builder pre-wired, cm:bootstrap can enable Live Preview during stack setup, and the Live Preview Onboarding Experience gives guided steps with real-time feedback on the usual failure modes (wrong base URL, CORS, iframe blocking). Still not plug-and-play — a custom implementation means enabling Live Preview per stack, setting a base URL per environment per locale, generating a preview token off a delivery token, initialising the SDK, wiring onEntryChange, adding edit tags, and making the site iframe-compatible.

No certification is required for production work and generalist TypeScript/React/.NET developers stay productive on standard REST/GraphQL with conventional SDK idioms. The MCP server lets Claude or Cursor drive Content Management, Delivery, Analytics and BrandKit in natural language, and the free Explorer tier means a developer can self-train on a real stack without a sales conversation — both reduce dependence on platform specialists. Short of 75+ because Agent OS, Studio, Entry Variants and complex publishing workflows still reward platform-specific knowledge, and G2 reviewers report API configuration being time-consuming for teams without deep technical depth.

Contentstack now explicitly targets solo developers and startups with the free Explorer plan, and a single developer can go from signup to a running Kickstart site with one cm:bootstrap command on a cloud-hosted SaaS with no CMS ops role. Typical implementations still land at 2-3 developers, and Agent OS connector triggers absorb workflow-integration work that would otherwise need headcount. Larger teams remain necessary for complex multi-site, multi-locale enterprise rollouts, which caps this below the high 80s.

Editor and marketer self-service kept widening into Q4 2026: on Oct 1 Polaris gained on-demand agents that a non-developer builds by describing the task in plain language (Polaris interviews for inputs, picks tools and writes the instructions), plus reusable Skills that encode naming, tone and review checks, and the Sept 2026 Assets release writes AI metadata at upload and adds duplicate-image cleanup. These stack on Q3's bulk Find and Replace, Select All Records for bulk actions, named Entry Variant versions and RECURSIVE resolution of JSON RTE embeds, which removed common 'ask a developer to script it' requests. Not higher because content model and content type changes, and new page components, still require a developer.

Fully managed SaaS with zero customer-side platform upgrade effort, and the prolonged CLI 2.0 beta finally closed — CLI 2.0.0 reached GA on Aug 13, 2026 after a 10-month beta, and DotNet Management moved from 0.10.x to 1.1.x GA. Offsetting that resolution, the CLI v1→v2 breaking changes are now live and mandatory work (deprecated flags removed, global fields exported as individual files, content type schema JSON export removed, bulk commands consolidated), and TS Delivery 5.5.1→5.5.2 shipped two days apart to fix MODULE_NOT_FOUND build failures under Next.js Turbopack and webpack. Not higher because SDK and CLI major-version migrations remain real customer projects; not lower because the platform itself never requires a version upgrade.

August 2026 shows coordinated, CVE-identified patching across the whole SDK fleet: jsoup 1.23.2 for CVE-2026-75140 landed the same day in Java Management 1.14.1, Java Utils 1.6.2 and Java Delivery 2.8.2 (Aug 31), following jsoup 1.23.1 XSS fixes in Java Utils 1.6.1 and Java Delivery 2.8.1 (Aug 17), Ruby Delivery 0.10.1 json gem 2.21.2 for the CVE-2026-71847 use-after-free (Aug 17), and security dependency updates in DotNet Management 1.1.1, JS Management 1.31.1, TS Delivery 5.5.1 and DataSync 2.3.8 (Aug 3). Contentstack still has no CVEs against its own products, and it patched its infrastructure for the Linux-kernel 'Copy Fail' flaw (CVE-2026-31431) on the vendor side. Not higher because these are client SDK patches that only take effect once customers bump their own packages.

Forced-migration pressure got materially worse. The `limit` query parameter changed behavior on Sept 11, 2026 with no deprecation window: `limit=0` previously returned all matching records and now silently returns the default 100, so any integration relying on it truncates without erroring and must be rewritten to paginate with `skip` and `include_count=true`. That lands on top of legacy CMA /v1 and /v2 deprecation, the now-GA CLI 2.0 breaking changes, the stack-assets → Contentstack Assets platform transition (where the new system is a paid add-on), and the prior X-Contentstack-Signature decommission, webhook salt 222 deprecation and contentstack-express EOL. Not lower because existing CDA/CMA asset integrations keep working without code changes, new Assets adoption is optional, and every change ships with migration documentation.

The SaaS model eliminates server-side dependency management entirely — no runtime, database, search or cache to maintain — and the August 2026 patch wave shows disciplined transitive-dependency hygiene across seven SDKs in four languages (jsoup, json gem, Axios, .NET and JS packages all bumped within days of advisory). Working against that, the client dependency surface is where the friction lives: TS Delivery 5.5.2 had to fix a dynamic `require` in @contentstack/core that broke Turbopack and webpack builds outright. Not higher because every dependency fix still requires customer package updates across however many SDKs a team has adopted.

Webhook delivery health is vendor-surfaced: execution logs with 30-day retention and per-call status codes, exponential retry up to four attempts, and a Webhook Circuit Breaker that auto-disables an endpoint after 10 consecutive failures, plus an org-level Analytics dashboard for API status codes and bandwidth, the Healthcheck marketplace app and a public status page with staged investigating/identified/resolved updates. Trimmed one point because September 2026 alone logged two more publish-pipeline incidents (Azure EU publishing and webhook delays Sept 16, about 86 minutes; GCP NA delivery of newly published content Sept 19, about an hour, affecting GraphQL and asset URLs) and an Azure NA maintenance announced as emergency, so teams clearly still need their own freshness alerting on publish-to-delivery. Not lower because already-published content kept serving throughout every incident and no customer action was required.

Content hygiene tooling keeps growing: the CLI Audit plugin (`cm:stacks:audit` / `:fix`) repairs missing references across content types, global fields, entries, JSON RTE and modular blocks; Agent OS Dependency Checker flags broken references in release payloads; bulk Find and Replace (Aug 25) and Select All Records (Sept 15) cut cleanup effort; and the September 2026 Assets release adds background Duplicate Management that groups identical images for review, AI tags and alt text written at upload, and Select-type metadata fields that keep values consistent. Polaris Skills (Oct 1) also let an organization mark required checks that the assistant always applies. Not higher because Duplicate Management sits inside Assets, which is a paid add-on and still rolling out gradually, the audit plugin works on exported data rather than the live stack, and there is still no native unused-asset or content-staleness report.

CDN-fronted delivery handles the bulk of performance work with no tuning, and TS Delivery 5.5.1 (Aug 3, 2026) added default retry logic for transient network-level failures so resilience no longer has to be hand-rolled in application code. Launch cache priming with User-Agent attribution and AssetFields selective fetching across the .NET/Python/TS/Android SDKs carry over to keep payloads small. Not higher because frontend performance stays entirely with the customer, and the new positive-integer-only `limit` rule forces teams to implement explicit pagination where they previously fetched everything in one call.

Support quality is genuinely good but tier-stratified: the new free Explorer plan gets only Academy and the developer resource center, Growth ($299/mo) gets 24/5 email support on a Sunday-to-Friday business-hours window, Scale adds priority response, and dedicated CSMs, custom SLAs and the 99.5% uptime commitment stay Enterprise-only. Vendor-reported metrics are strong (97.5% CSAT, sub-two-minute average live in-app response) and 2026 G2 reviews commend responsiveness, but the Support Portal and Live Chat themselves went down in September 2026 forcing customers to email, and 'solution time could be better' persists as a critique even where first response is fast. Per rubric, good support gated behind Enterprise lands in 40-60.

Contentstack runs an official Discord promoted as a real-time channel to reach Contentstack experts, backed by an expanded Developer Hub with App Releases, Developer Pulse livestreams, the redesigned Academy with free certifications, and ContentCon 2026 developer tracks in Chicago and Amsterdam. The free Explorer tier opened on Sept 16, 2026 — removing the paywall that had kept hobbyist and open-source developers out — which should broaden public peer help over time. Not higher because Discord member counts and response times are undisclosed, Stack Overflow and public forum coverage remain thinner than Contentful or Sanity, and the free-tier community effect is prospective rather than observable today.

The bug-to-ship loop is tight and publicly dated: CLI 2.0.1 (Aug 31, 2026) fixed an OAuth token refresh crash 18 days after 2.0.0 GA, TS Delivery 5.5.2 shipped two days after 5.5.1 to repair bundler failures, jsoup was patched twice in two weeks as successive CVEs landed, and September's platform incidents were root-caused fast with staged status updates (Azure EU identified in 16 minutes and resolved in about 86 on Sept 16; GCP NA identified in 47 minutes and resolved in about 64 on Sept 19). SaaS deployment means fixes reach customers immediately. Not higher because 'solution time could be better' remains a recurring non-Enterprise critique, ticket resolution speed is tier-dependent, and the Support Portal and Live Chat outage on Sept 16 shows the escalation path itself is not always available.

Visual Builder provides drag-and-drop component placement on canvas, field modifiers on canvas without opening a form panel, real-time WYSIWYG preview, and audience-specific content variants. Developers and designers define the component set and layout rules, so authoring stays inside brand guardrails. Request Edit Access and Flexible Publishing (April 2026) add in-context permission requests and author-side publishing control. Studio remains Early Access as a visual experience builder bridging design and content composition. Scores 72 — the drag-and-drop page builder threshold is clearly met and marketers can assemble new layouts from developer-provided blocks without a ticket.

Correcting a prior error: a content calendar does exist. The Calendar Marketplace App renders assigned workflow tasks, scheduled entry publishes and Releases on a colour-coded board with month, week and timeline views plus filtering — a genuine editorial calendar, though delivered as a marketplace app rather than core. Native Timeline goes further for campaign rehearsal: it visualizes the future state of the site across scheduled publishes and Releases and lets editors preview how pages will look on a given future date. Flows orchestrates real-time journeys across web, email, mobile, social ads, SMS and webhooks with built-in analytics, A/B/n testing and goal tracking. Agent OS reached GA within the Agentic Experience Platform (June 9, 2026) with Agent Builder for custom enterprise agents and deterministic automation workflows, extending reactive campaign orchestration across connectors. Releases 2.0 handles bulk scheduled publish/unpublish. Still missing is a campaign as a first-class object: no campaign entity grouping assets, entries and experiences, and no campaign-level reporting dashboard inside the CMS. Rises from 53 to 57 — above the scheduled-publishing-only band, short of a true campaign suite.

Correcting a prior error: redirect management does exist for Launch-hosted sites. Contentstack Launch provides Edge URL Redirects and Edge URL Rewrites configured through a launch.json file in the repository and executed at the edge — real redirect infrastructure, though it is developer-managed config rather than a marketer-facing redirect UI, and it applies only when hosting on Launch. Contentstack publishes an SEO best-practices guide covering canonical handling and blocking the default contentstackapps.com domain from indexing. AI-Generated SEO Keywords via Automate extracts keywords from entry fields into a list. Still absent: any built-in SEO field set or validation (meta fields must be hand-modelled into content types), native sitemap generation (sitemap-index.xml requires a custom publish-triggered plugin), and structured-data tooling. Moves 48 to 52 — solidly in the manual-SEO-fields band, lifted by genuine edge redirect management.

No built-in form handling, CTA management, or lead capture — these remain the single largest gap and require external tools. Personalize provides A/B testing with Multi-Armed Bandit traffic optimization. Flows includes goal tracking and conversion metrics natively in the orchestration canvas. Data and Insights (Lytics CDP) adds real-time audience analytics and behavioral event tracking. Nothing in the June–September 2026 releases addresses forms, lead capture or UTM awareness. Unchanged at 42.

Personalize provides edge-optimized real-time personalization with preset attributes (City, Country, Date/Time, Device Type, Operating System) plus custom attributes, Segmented and A/B Test experience types, and Entry Variants for managing content variations per audience. Lytics CDP (integrated as Data & Insights) adds real-time behavioral event streaming, unified audience profiles and ML-driven opportunity signals. Name Versions of Entry Variants (August 19, 2026) lets teams label specific versions of a variant entry the same way base entries are named — a small but real operational improvement when many personalized variants run concurrently. Flows orchestrates personalized journeys per segment. Strong native stack for a headless CMS; Personalize and Lytics remain modular add-ons rather than core CMS capabilities, holding it just short of the 70+ band.

Multi-Armed Bandit redistributes traffic to high-performing variants every minute based on impression and conversion events (100 impressions or 30 conversions threshold, 1% exploratory traffic floor), positioned by Contentstack as ending the 'regret cost' of fixed 50/50 splits. Primary and secondary metric tracking with auto-winner selection. Clearwinner Marketplace App automates post-test cleanup of finished A/B experiences. Flows adds A/B/n testing inside journey orchestration with version control and goal tracking. Native testing with statistical traffic optimization, auto-winner and lifecycle automation keeps this at 72; no further experimentation changes landed June–September 2026.

Two meaningful bulk-editing additions landed in the period. Find and Replace Text Across Entries (August 25, 2026) updates the same text across many entries in a single operation from the entry list — previously an export-and-script job. Select All Records for Bulk Actions (September 15, 2026) lifts bulk actions off the current page to the entire result set, so a 200-entry filter can be actioned in one pass instead of page by page. These stack on Releases 2.0 bulk add with scheduled publish/unpublish, Bulk Operations v1.5.0 reference support, Switch Between Entry Status Views, Validate Required Fields across all publishing paths, entry-list pagination, Drafts and Auto Save with field-level locking, and Visual Builder layout changes with live preview. Sub-hour brief-to-publish is realistic for component-based pages. Rises 70 to 73. Polaris on-demand agents (October 1, 2026) add one more speed lever. An editor builds an agent once and runs it from a Polaris conversation whenever needed. It runs with that person's permissions, asks for inputs on each run, and waits for approval before making changes, which suits repetitive page assembly and update tasks. Polaris can also draft the agent itself from a plain-language description. Rises 73 to 74.

Headless architecture delivers structured content via CDA and GraphQL to web, mobile, IoT, kiosks and emerging surfaces, with SDKs for iOS, Android, React Native, JavaScript, Java, .NET, PHP and Ruby. Flows delivers to web, email, mobile, social ads, SMS and webhooks from a single canvas — six distinct channels. Agent OS GA extends reactive multi-channel orchestration across connectors, and the ContentCon 2026 positioning explicitly treats AI agents as a second consumption audience alongside humans. Multiple environments support phased channel rollout. Comfortably meets the 4+ structured channel threshold; unchanged at 72.

Data & Insights (the integrated Lytics CDP) provides real-time audience insights natively inside the CMS, with Opportunity Explorer surfacing ML-driven signals on content performance. Flows contributes built-in analytics and goal tracking per journey. Real-time data activation feeds personalization directly. No new analytics surfaces shipped June–September 2026, and there is still no GA4 or Adobe Analytics content-performance panel inside the entry editor. Unchanged at 65 — native in-CMS analytics dashboards meet the threshold without exceeding it.

Brand Kit is positioned as centralized brand governance that enforces voice, tone, visual rules and product knowledge on every output — human or AI-generated — before it ships, and it is now programmable: a Brand Kit Management API and a Brand Kit connector in Automation Hub let brand rules be applied inside automated pipelines rather than only in the AI Assistant UI. Knowledge Vault stores brand documents with vector conversion for AI-nuanced retrieval. Visual Builder supplies the structural half: developers define components and layouts, giving firm guardrails around what an author's page can look like. Contentstack Assets adds governance controls and AI-generated alt text for consistent media treatment. Rises 60 to 63, held below 65 because enforcement is strongest on language and component structure — locked style tokens, typography and colour palette isolation, and restricted component overrides at the platform level are still not documented. Polaris Skills (October 1, 2026) add an organization-level control for AI-assisted authoring. Admins can save named instruction sets such as naming conventions, tone and mandatory checks, share them across the organization and mark them as required so they apply to everyone. This extends brand enforcement to AI output, but it is still prompt-level guidance, not locked design tokens. Rises 63 to 64.

Social connectivity is API- and integration-based: Instagram, Facebook and X via platform APIs, Zapier for automated social workflows across 2,600+ apps, Bynder and Brightcove for social-ready asset and video supply. Flows can deliver to social ads as a channel. But there is still no native Open Graph or Twitter Card field set or preview in the CMS UI — OG fields must be hand-modelled — and no social scheduling or push-to-social composer inside Contentstack. Nothing in the June–September 2026 releases changes this. Unchanged at 38, mid-range for basic social connectivity without native card management or scheduling.

Contentstack Assets now clears the full-DAM bar on all three rubric dimensions. Transforms: the Image Delivery API performs resize, crop and format conversion across jpeg, png, webp and gif, and transformations can be applied as part of a publishing pipeline rather than asset by asset. Tagging: every asset is automatically tagged, described and made searchable the moment it is uploaded, with AI-generated alt text and no manual classification step. Rights management: custom metadata schemas authored in the UI carry business fields including SKU, campaign ID, rights holder and license expiration dates, which are then searchable and filterable to enforce compliance — this is the capability that was previously missing. The Assets API (August 27, 2026) exposes everything configured in Assets to external systems, so DAM operations can be driven from marketing ops tooling. Spaces organize libraries by brand, region or channel and let teams spin up campaign workspaces without disturbing the main library. Marketplace DAM integrations (Adobe, Bynder, Aprimo, Brightcove for video) remain for customers standardized elsewhere. Rises 60 to 66 — full DAM territory, held at the low end because usage tracking and approval-based rights workflows are thinner than in specialist DAMs. The September 2026 Assets release fills in more of the operational DAM layer. Select-type metadata fields hold values to a defined list so they stay consistent and filter together. Duplicate Management finds identical images in the background and groups them for review. Each space can now write AI tags and alt text at upload without overwriting what the uploader supplied. The Assets API returns AI-generated tags, alt text, detected objects, colours and safety flags. Usage tracking and approval-based rights workflows are still thinner than in specialist DAMs. Rises 66 to 68.

200+ pre-configured locales with fallback language inheritance and per-stack language permissions. Asset localization is the notable addition: localized variants of an asset can be created by region, language or market while preserving the original file, and localized variants plus workspace locales can be managed programmatically — so opening a new market no longer means rebuilding the creative library by hand. Taxonomy Localization supports campaign categorization across locales with fallback chains, and Java Management SDK 1.14.0 (August 24, 2026) adds localize and unlocalize for taxonomies and terms. Trados v1.1.8 provides full-page translation workflows; XTM v2.3.7 consolidates translation field scoping. Still no native locale-specific campaign scheduling, no regional promo calendar and no transcreation workflow as a distinct authoring mode. Rises 55 to 57 — top of the generic-localization band.

The Agentic Experience Platform announcement (June 9, 2026) brought Agent OS to general availability as an autonomous agent layer spanning content, data and real-time personalization, adding Agent Builder for custom enterprise agents and deterministic automation workflows on top of the Connector Triggers shipped in May. That converts the connector estate from static integrations into event-reactive orchestration. Pre-built marketplace connectors span CRM and commerce (Salesforce Commerce Cloud, commercetools, Shopify, BigCommerce), PIM (Akeneo), video (Brightcove), DAM (Bynder, Aprimo, Adobe) and translation (Trados, XTM); Lytics CDP is now native as Data & Insights; HubSpot and Marketo connect through Zapier's 2,600+ app catalog. Flows supplies event triggers and webhooks across six channels. Rises 65 to 67 — pre-built connectors across four-plus MarTech categories with genuine event-based triggers.

Product content is still modelled with generic content types, Modular Blocks and reference fields rather than a purpose-built product schema, but the surrounding tooling has thickened. The Akeneo marketplace connector fetches and displays products and categories from a real PIM via a Contentstack Custom Field, so attribute management can live in Akeneo while editorial lives in Contentstack — a cleaner division than repurposing content types for attributes. commercetools offers the same product and category picker with real-time data. Asset metadata now carries SKU natively, tying media directly to product identifiers. Entry Variants tooling continues to deepen across SDKs, and Name Versions of Entry Variants (August 2026) makes long-running variant sets legible. Still no native PIM, no variant matrix UI and no attribute management system inside Contentstack. Rises 52 to 55 — well-adapted generic modelling with credible PIM federation.

No native merchandising capabilities — no category management tools, no promotional content scheduling beyond standard Releases, no cross-sell or upsell content management, no search result merchandising, no product spotlight tooling. The June–September 2026 releases add nothing in this area. All merchandising comes from the integrated commerce platform (commercetools, Shopify, BigCommerce, Salesforce Commerce Cloud). Unchanged at 20.

The connector estate is broad and genuinely bidirectional in places: commercetools provides a product search and selection custom field plus a sidebar widget with real-time inventory and price visibility, and the partnership is formalized as a joint API connector; Shopify does two-way syncing of products and collections; BigCommerce is a listed integration covering multi-storefront, complex catalogues and B2B; Salesforce Commerce Cloud has both a marketplace connector and an AppExchange listing, with EPAM's composable commerce accelerator available. Akeneo adds PIM-side federation. These are strong product-reference integrations with picker UIs and, for Shopify, real sync — but co-authoring content and product in one unified surface, and true API-level federation of live pricing and inventory into the delivery response, remain absent. Rises 50 to 52.

Two changes make editorial commerce materially more workable. Embedded entries and assets in the JSON Rich Text Editor now resolve to their current metadata via RECURSIVE retrieval (September 7, 2026), so a product entry embedded in a buying guide renders with live title, price field and imagery instead of a stale snapshot — the classic failure mode of editorial-commerce blending in headless systems. Separately, Contentstack Assets supports hotspots and bounding boxes on images, AI-assisted by object detection returning coordinates, which is the primitive shop-the-look layouts are built from. Visual Builder composes editorial pages with product embeds from commercetools, Shopify and Akeneo. Still not first-class: there is no shoppable-content authoring pattern with inline purchase CTAs out of the box, and wiring hotspot coordinates to product references and add-to-cart remains frontend work. Rises 45 to 49.

Composable architecture technically supports checkout content customization via the delivery APIs, multi-environment deployment allows staging of checkout content, and Releases can schedule checkout banners. But no CMS-managed cart or checkout content injection framework is documented — no trust badge management, no upsell banner slots bound to transactional flows, no post-add modal tooling. Everything in the transactional path requires custom frontend work against the commerce platform's own templates. Nothing in the June–September 2026 releases addresses this. Unchanged at 32, low end of the basic-banner band.

Flows enables post-purchase customer journeys with native email, SMS and webhook steps triggered by order events, and Agent OS GA with Agent Builder and Connector Triggers extends real-time reactivity to order-related connector signals. Data & Insights supplies behavioral data for personalized follow-up. Structured content can power order confirmation emails and delivery tracking pages via API. This is better than static templates — event-driven post-purchase sequencing genuinely works — but there are no native order-confirmation content templates and no post-purchase dashboard, and it still requires integrating commerce order events plus custom frontend. Unchanged at 45.

Account-based segmentation is possible through Personalize custom attributes targeting company or account values, and RBAC custom roles give basic access control usable for dealer portals. BigCommerce's listed integration covers B2B on the commerce side, but the B2B logic lives there, not in Contentstack. No native B2B content features: no gated catalogs, no quote-request flows, no account-specific pricing display, no spec sheet management, no catalog segmentation by account. Nothing in the June–September 2026 releases changes this. Unchanged at 32.

Algolia v1.4.0 supports Stack Delivery Tokens and a configurable section fetching published data through the Content Delivery API, making blended content-and-product indexes and search landing pages practical. The composable commerce starter (Contentstack + commercetools + Algolia) demonstrates faceted search blending editorial and product. On the content side, Contentstack Assets now auto-tags and describes every asset on upload, which improves the quality of media surfaced in blended results. Global Search provides full-text matching across entries and assets inside the CMS. Still no native commerce-side search merchandising, no synonym management and no search analytics dashboard — Algolia carries the enrichment layer and requires developer implementation. Rises 44 to 45.

The planning and rehearsal layer improved. Timeline lets merchandisers see the future state of the storefront across scheduled publishes and Releases and preview exactly how a promo page will look at a given date and time before it activates, and the Calendar app shows scheduled publishes, releases and workflow tasks on a filterable month/week/timeline board — so coordinating a multi-entry promo drop is now a visual exercise rather than a spreadsheet one. Releases 2.0 handles time-activated deployment, Bulk Operations v1.5.0 covers references, Select All bulk actions speed coordinated rollouts, and Personalize targets promotional variants by audience. Still no native countdown timers, promo code messaging fields, tiered pricing table templates, or time-based channel targeting as dedicated promotional constructs. Rises 40 to 44.

The stack-per-storefront model still provides independent content models, environments, API tokens and configuration per storefront, with org-level governance and shared SSO across them. The material change is Assets Spaces: media libraries can be organized by brand, region or channel in independent spaces and reused across multiple CMS stacks, so shared product imagery no longer has to be duplicated storefront by storefront — previously a real operational tax. Localized asset variants per market handle storefront-specific creative. CLI publishing-rules support carries governance settings between stacks. Entries and content types still require duplication or CLI-driven sync, since there is no native cross-stack content federation. Rises 48 to 52 — upper half of the multi-storefront-with-some-duplication band.

The clearest single gain in the commerce block. Contentstack Assets supports visual markups — hotspots and bounding boxes — that embed metadata or URLs onto image regions, with AI automatically identifying objects such as cars or people and returning their coordinates, and these markups plus image transformations can be applied as part of a publishing pipeline instead of asset by asset. Image hotspots are named explicitly in the rubric and are now a documented native capability rather than a gap. The Image Delivery API supplies resize, crop and format conversion for zoom and responsive PDP imagery; Brightcove provides video hosting, organization and measurement with assets added directly to the stack; Bynder, Adobe DAM and Aprimo remain for customers standardized elsewhere. The Assets API makes all of it programmable. Native 360-degree spin sets and AR/3D model handling are still absent, which keeps this below the 60+ band. Rises 48 to 54.

Multi-author contribution is possible through RBAC custom roles, Teams-based permissions per content type, and workflow approval stages for moderation, and multiple SAML IdPs per organization (September 2026) would in principle let external seller populations authenticate from their own directories. But none of that is marketplace tooling: no seller profiles, no seller-contributed product description workflows, no review aggregation, no moderation queue designed for scale. Unchanged at 28 — basic multi-author without marketplace-specific features.

200+ locales with fallback inheritance per stack, Taxonomy Localization for locale-specific product categorization with fallback chains, and Enhanced Taxonomy Management across publishing, releases and permissions for governing regional product taxonomy. Java Management SDK 1.14.0 (August 2026) adds publish/unpublish and localize/unlocalize for taxonomies and terms, making regional taxonomy rollout scriptable. Asset localization creates localized creative variants by region, language or market while preserving the original file — directly relevant to market-specific packshots and regulatory-labelled imagery. Trados and XTM cover translation workflow and field scoping. Still no currency-aware content blocks, no EU or Prop 65 regulatory label templates, and no market-specific promo calendar. Rises 52 to 55 — top of the generic-localization-applied-to-product-content band.

Flows carries built-in goal tracking and conversion metrics in the orchestration canvas, giving content-to-conversion measurement per journey. Data & Insights supplies ML-driven Opportunity Explorer signals and real-time behavioral streams. Personalize's Multi-Armed Bandit optimizes against conversion events directly, which is conversion measurement in service of content decisions. What is still not documented is revenue attribution tied to specific content pages or a content-assisted conversion report inside the CMS. Nothing in the June–September 2026 releases adds one. Unchanged at 45.

Editorial RBAC strengthened again: an organization can now attach up to five SAML 2.0 identity providers, each a separate connection with its own certificate, session policy, role mapping and login URL (September 11, 2026), and SCIM automates user and group provisioning and deprovisioning from Okta, Entra ID and OneLogin. That means department- or subsidiary-specific directories can each drive their own role mappings inside one organization. On top of that sit custom roles with content type and locale permissions, taxonomy-based permissions for regional content, Enhanced Taxonomy Management across publishing and releases, Allowed Email Domains, session controls and Bulk Force Kill Session. For the intranet use case specifically, however, the gap is unchanged and decisive: this is all author-side access control. There is no audience-based content visibility and no department-level content filtering for portal end users — every end-user permission check must be built in the frontend. Rises 56 to 58, capped by that.

Taxonomy remains the backbone for knowledge structure, and it got more operable: Java Management SDK 1.14.0 (August 2026) adds publish/unpublish and localize/unlocalize for taxonomies and terms, so knowledge taxonomies can be rolled out and retired programmatically across environments, on top of Enhanced Taxonomy Management across publishing, releases and permissions. Drafts and Auto Save with field-level locking supports collaborative article editing, Content Type Version Comparison tracks schema evolution, workflows handle review, and version history gives per-article revision control. Knowledge Vault stores brand documents with vector conversion for AI retrieval — but it is brand context for AI generation, not an employee-facing knowledge base. Still no knowledge base templates, no content lifecycle or archival automation, no expiry management. Rises 52 to 53 — adequate modelling, limited lifecycle tooling.

Contentstack remains a headless CMS with zero native employee experience features. No portal UI, no news feed, no employee directory integration, no end-user notification system, no social layer, no personalized employee dashboard. The entire June–September 2026 release arc — AXP, Agent OS GA, Assets, ContentCon positioning around brands serving human and agent audiences — is explicitly customer-facing digital experience, not employee portals. Contentstack's own intranet material positions the product as the content infrastructure layer beneath an intranet, not the portal itself. Building one means custom-building every portal feature. Unchanged at 28.

Workflow stages and approvals support structured internal review, the Slack connector in Automation Hub pushes publishing notifications to team channels, and Flows can deliver to email, SMS and mobile — channels that could carry internal comms if the routing logic is built externally. None of the targeted internal-comms machinery exists: no read receipts, no acknowledgment tracking, no mandatory-read workflows, no department targeting for internal audiences, no company news feed UI. Nothing in the June–September 2026 releases moves this. Unchanged at 28, just above the no-features floor on the strength of Slack notifications and workflow alerts.

No purpose-built people directory or org chart. Employee and team pages could be modelled with content types and reference fields for reporting relationships, and SCIM synchronizes user and group data from Okta, Entra ID or OneLogin for platform access — but SCIM provisions CMS accounts, it does not produce a browsable employee directory. No HR system integration (Workday, BambooHR), no org chart visualization, no skills or expertise fields. Unchanged at 20 — low end, with a small allowance for content modelling flexibility.

Entry version history and rollback give policy documents real version control, RBAC restricts access to sensitive policy content, scheduled publish and unpublish drive rollout and retirement, and workflow approvals gate publication. Validate Required Fields across single, bulk and release publishing enforces that mandatory fields — effective date, owner, disclaimer — are present before a policy goes live. Two smaller additions help: Timeline lets compliance teams preview the exact future state of a policy set on a given date before it activates, and Contentstack Assets supports license expiration dates as a searchable, filterable metadata field for attached documents and creative. Still no mandatory acknowledgment tracking, no automated review or expiry reminders, and no readership audit trail — those remain custom builds. Rises 34 to 36.

Modular Blocks and reference fields can structure onboarding content, Releases can stage phased delivery across 30/60/90 days, localization covers multi-language onboarding, and Visual Builder can lay out interactive onboarding pages. But no onboarding-specific machinery exists: no role-specific content paths, no progressive disclosure automation, no task checklists, no HR-triggered new-hire portal. All journey logic is custom frontend. Nothing in the June–September 2026 releases changes this. Unchanged at 25.

Internal search improved on the media side: every asset is now automatically tagged, described and made searchable the moment it is uploaded, with AI-generated alt text and no manual classification, and custom metadata schemas make business fields filterable — so asset retrieval no longer depends on filename discipline. Global Search covers full-text matching across entry and asset fields, with filtering by title, URL and specific fields, and Knowledge Vault adds vector-based retrieval over brand documents. Still no federated search across SharePoint, Confluence or Drive, no AI relevance ranking for general enterprise content, and no search analytics dashboard. Rises 38 to 40 — adequate CMS-internal search, not enterprise federated search.

Delivery SDKs for iOS, Android, React Native, JavaScript, Java, .NET, PHP and Ruby support building mobile apps, GraphQL CDA keeps payloads mobile-appropriate, and Launch edge functions plus edge redirects give low-latency delivery. Swift Delivery SDK 2.5.1 (August 2026) fixed a crash in request logging and a runtime error, and TypeScript Delivery SDK 5.5.x added default retry logic for transient network failures — meaningful for flaky frontline connectivity, but still SDK hardening rather than frontline features. These remain developer SDKs for building apps, not a native mobile experience for editors or end users. No offline support, no push notifications, no native mobile editor app; content management is responsive browser only. Unchanged at 35.

No LMS product integration is documented in the marketplace or the June–September 2026 changelog. Learning content can be hosted and delivered through the APIs, and Zapier could connect to Cornerstone or Workday Learning for course assignment triggers. Contentstack Academy and the ContentCon agentic certification program are vendor training for Contentstack itself, not a customer-facing learning capability. No native course assignment, completion tracking, certification or embedded micro-learning. Unchanged at 22.

No social or collaboration layer for intranet end users. The Slack connector notifies editors; workflow approval and Request Edit Access are author-to-author collaboration inside the authoring tool; Drafts with field-level locking prevents editor collisions. None of that reaches a portal audience. No comments, reactions, discussion forums, peer recognition, polls, surveys or community spaces for end-user consumption, and nothing in the June–September 2026 releases adds any. Unchanged at 22.

The Slack connector in Automation Hub is the one first-party workplace integration, covering publishing notifications and workflow alerts. Zapier reaches the Microsoft 365 ecosystem — OneDrive, SharePoint, Teams — through its 2,600+ app catalog. Multiple SAML IdPs plus SCIM against Entra ID and Okta tighten the identity side of the workplace stack. The MCP server and Agent OS GA with Agent Builder open agentic access to Contentstack content from LLM-based assistants, which is the most plausible route to a single-pane workplace experience but is not a shipped Teams or Google Workspace surface. Still no native Microsoft Teams app, embedded content cards or bots, and no Google Workspace integration. Rises 35 to 36 — lower end of the basic-webhook-integration band.

Timeline is the real addition here: an interactive view of the future state of content across scheduled publishes, unpublishes and Releases, with per-date preview of exactly which entries and assets change — which turns scheduled expiry from a fire-and-forget setting into something a content owner can inspect and verify ahead of time. Contentstack Assets adds license expiration dates as searchable, filterable metadata, so time-bound creative can be found and retired before it lapses. Underneath sit scheduled unpublish via Releases, entry version history, workflow review stages and Content Type Version Comparison. What is still absent is automation: no automated review dates, no stale content flagging, no ownership assignment for review accountability, no archival workflow that triggers itself. Rises 35 to 38 — better visibility, same lack of enforcement.

Data & Insights provides real-time audience insights and Opportunity Explorer content performance signals, and the CMS surfaces publishing and workflow activity — but all of it is oriented to customer-facing audiences. No department-level view analytics, no failed internal search term tracking, no engagement heatmaps for internal content, no adoption dashboards for intranet ROI. Nothing in the June–September 2026 releases addresses internal measurement. Unchanged at 30.

The stack-per-tenant model gives genuine content isolation — independent content types, entries, environments, API tokens and configuration per stack, with organization-level administration across them. Control Environment Cloning During Branch Creation (August 19, 2026) adds a finer isolation control inside a tenant: teams can choose which environments to clone into a new branch rather than cloning all of them, avoiding accidental propagation of production environment configuration into experimental branches. AU and GCP Europe regions provide geographic isolation. This stays at the top of the silo-based band rather than crossing into 75+, because it remains separate stacks rather than a true multi-tenant architecture with shared infrastructure and cross-tenant primitives. Unchanged at 70.

A real native cross-stack sharing primitive finally exists, but only for one asset class. Contentstack Assets introduces dedicated Spaces for organizing and reusing media across multiple CMS stacks, which closes the long-standing 'no shared media library across stacks' gap outright — a central creative library can now serve every brand stack without duplication. Brand Kit provides shared brand identity with a Management API for programmatic distribution. Global Fields still only apply within a stack, and content types and components remain per-stack: sharing them still means CLI export/import, helped by CLI 2.0.x single-branch export layout, export-query nested global field support, and publishing rules travelling with content. Rises 50 to 55 — native sharing for assets, API and CLI workarounds for everything else, so it stays in the federation band rather than reaching 70+.

Centralized governance keeps compounding. The September 2026 multi-IdP capability is the notable addition: up to five SAML 2.0 identity providers in one organization, each with its own certificate, session policy and role mapping, means an acquired or regionally autonomous brand can keep its own directory and session rules while remaining under one governed organization — previously an organization split. SCIM automates joiner/mover/leaver across that estate. On top sit org-level admin with cross-stack custom roles, audit logs, Prevent Self-Advancement and Prevent Self-Approval, Allowed Email Domains, Bulk Force Kill Session for org-wide incident response, Validate Required Fields enforced across single, bulk and release publishing, CLI publishing rules carrying workflow settings between stacks, Enhanced Taxonomy Management across publishing and releases, and Assets governance controls on the media side. Rises 66 to 68. Still no centralized cross-brand approval chain or single policy configuration UI spanning stacks. Polaris Skills (October 1, 2026) add an organization-wide policy layer for AI work. Required organization-wide skills reach every user automatically, with Can use and Can edit permissions. The Get User Information automation action now returns a user's roles and permissions per stack, so access reviews across stacks can be scripted. Rises 68 to 69.

Cost still scales close to linearly per brand: each stack carries its own content type, entry, API call and user consumption, and no published volume discount tier for multi-brand estates exists. Paid plans remain sales-gated through a contact form. Two things soften the curve. Contentstack opened fully self-serve free account creation (September 16, 2026) — Explorer accounts are a permanent unrestricted playground rather than a trial, so provisioning a stack for a new brand pilot or a developer onboarding costs nothing until it goes live. And Assets Spaces let one media library serve many stacks, removing duplicated storage and duplicated asset operations work as brand count grows. Marketplace connectors cut implementation time per brand. Rises 50 to 52 — still linear, with lower entry and marginal operational cost. Correction: list prices are now published. The pricing page shows Free at $0, Build at $29 a month, Growth at $299 a month plus per-user charges, and custom Enterprise pricing. Smaller brand stacks can therefore be priced and bought self-serve. Costs still scale with API calls, content volume and add-ons such as Launch and Personalize, and overage rates are not published. The contractual Services Description still treats Explorer stacks as non-production. Rises 52 to 53, still linear scaling.

Per-brand identity management is now enforced on two axes. Brand Kit holds per-stack brand identity — guidelines, Voice Profiles, Knowledge Vault — and enforces voice, tone and visual rules on every output before it ships, with a Management API and Automation Hub connector for applying those rules programmatically per brand. Contentstack Assets adds the media axis: independent spaces per brand, region or channel with their own governance controls and localized variants, so one brand's creative estate is genuinely isolated from another's. Visual Builder components are configured per stack. What is still missing is the design-system axis the rubric's 65+ band asks for: no platform-level CSS theme tokens, no typography or colour palette registry applied at tenant level, no restricted-override model over shared components. Rises 45 to 50 — solid per-brand config and asset isolation, no design token federation.

The brand x locale intersection is managed through per-stack language permissions, taxonomy-based permissions for regional content, and Enhanced Taxonomy Management bringing taxonomy governance into per-brand publishing and release lifecycles. Java Management SDK 1.14.0 (August 2026) makes taxonomy localize/unlocalize and publish/unpublish scriptable, so a regional taxonomy can be rolled out per brand under version control. Asset-level localization adds a governance surface that did not exist before: localized asset variants per region, language or market, with workspace locales manageable programmatically inside each brand's space. Trados and XTM handle translation workflow and per-brand field scoping. Per-brand translation approval chains that differ from the global workflow still require configuring separate workflows per stack rather than being a governed brand-locale construct. Rises 50 to 53.

Data & Insights provides real-time audience analytics and Opportunity Explorer signals that can be pointed at multiple stacks, and org-level administration gives some consolidated visibility. Platform Discovery offers a unified view of available capabilities, not portfolio performance. No dedicated portfolio dashboard comparing content velocity, engagement or publishing cadence across brands has appeared, and nothing in the June–September 2026 releases adds one — cross-stack aggregation and brand-level benchmarking still require custom data pipelines. Unchanged at 35.

Each stack carries fully independent workflow stages, approval chains, review steps and scheduling, with Prevent Self-Advancement and Prevent Self-Approval enforcing independent review per brand and org-level audit logs providing central auditability. CLI publishing rules support lets per-brand workflow definitions travel with content during export and import. Control Environment Cloning During Branch Creation (August 2026) adds precision to per-brand release process design by letting a brand team clone only the environments its workflow actually targets when branching. Multi-IdP session policies can now differ per brand directory, so brand teams operate under their own authentication rules within one org. Rises 55 to 56 — independently configurable per-brand workflows are fully supported, but cross-brand oversight is still org-level audit logs rather than a workflow governance dashboard.

Asset syndication is now native: a corporate asset space can be reused across multiple brand stacks, with localized variants per market layered on top, so brand-approved imagery and documents propagate from a central library instead of being copied stack to stack. That is a genuine corporate-to-brand distribution primitive for one content class. Entry syndication remains script-driven — CMA for programmatic cross-stack pushes, CLI bulk export, publishing rules and nested global fields in export-query making the scripts more capable. Still no syndication UI for entries, no push-based distribution from a parent brand with controlled override points, and no version-controlled inheritance with local adaptation rules. Rises 35 to 40 — native for assets, custom automation for everything else.

Data residency is available through AU and GCP Europe regions for stack-level geographic isolation. Taxonomy-based permissions plus Enhanced Taxonomy Management govern regional content, language permissions control locale-level access, and audit logs support compliance reporting. Validate Required Fields across single, bulk and release publishing is a generic guardrail that can force disclaimer or effective-date fields before publish. New in this period: Assets license expiration dates are stored as searchable, filterable metadata so rights-limited creative can be identified and pulled per market, and localized asset variants let a brand ship market-specific regulatory imagery from one governed library. Multi-IdP session policies can differ per regional directory. Still no built-in GDPR consent enforcement, no accessibility checker, and no per-brand cookie policy controls blocking non-compliant publication. Rises 45 to 47 — top of the basic-per-brand-compliance band.

Brand Kit functions as an executable brand system rather than a static PDF, and the Brand Kit Management API plus Automation Hub connector make it distributable and enforceable programmatically across stacks — the closest thing to central maintenance with per-brand application. Contentstack Assets Spaces provide a genuinely shared, centrally governed media layer consumable by multiple brand stacks, with hotspot and transformation rules applied as pipeline policy rather than per asset. Visual Builder components form a per-stack library. What the rubric's 60+ band requires is still missing: no centrally maintained component library with versioning and update propagation across tenants, no design token federation from a single source of truth, and no brand extension model for overriding shared components without forking. Rises 38 to 43.

The September 11, 2026 multi-IdP release completes this item. An organization can now connect up to five SAML 2.0 identity providers, each a separate connection with its own certificate, session policy, role mapping and login URL — so acquired companies and regionally autonomous brand teams authenticate against their own directories while a single central admin retains org-wide oversight. Previously a portfolio with heterogeneous identity estates had to either standardize on one IdP or split into separate organizations, which broke central governance. SCIM automates provisioning and deprovisioning of users and groups from Okta, Entra ID and OneLogin. On top sit org roles (Owner, Admin, Member), Teams with team-level permissions across stacks, per-stack role differentiation, Allowed Email Domains, and Bulk Force Kill Session for org-wide session termination during a security event. Central admin across brands, autonomous brand teams, and SSO are now all genuinely present. Rises 58 to 65.

Content types remain per-stack. Global Fields give reusable field groups within a stack, Taxonomy supports cross-brand categorization, and CLI export-query nested global field support eases migration of complex shared models — but a shared global product page model that Brand A extends with video and Brand B extends with comparison tables, without forking the base, is still not expressible. Content types must be duplicated or re-created per stack, and there is no shared model registry or inheritance mechanism. Assets Spaces solved this problem for media but not for schema. Nothing in the June–September 2026 releases adds content type inheritance. Unchanged at 38.

Data & Insights gives organization-level analytics with Opportunity Explorer trend signals, and org admins have cross-stack visibility into users and stacks. Platform Discovery is a unified capability dashboard, not portfolio analytics. There is still no executive reporting surface covering content freshness by brand, publishing SLA adherence, cost allocation per tenant or capacity planning — cross-brand reporting requires custom aggregation from individual stacks. Nothing in the June–September 2026 releases addresses it. Unchanged at 30.

Two DPAs are published — EMEA/UK (Oct 7, 2025) incorporating EU SCCs and the UK IDTA, and US/CA (Jun 30, 2026) — alongside a public sub-processor list (updated May 25, 2026) with a 10-business-day objection window and 60-day termination right, a published Data Transfer Risk Assessment, and three EU region options. Not higher because the DPA is incorporated only through the Master Agreement (§1.7), while the click-through Terms of Service now governing the free self-serve signups launched Sep 16, 2026 contains no DPA — it instead tells customers to 'enter into appropriate agreements, where applicable' and bars GDPR Article 9 special-category data unless an Article 9(2) exception applies and Contentstack is notified — and there is still no automated DSR workflow tool.

Contentstack does not merely lack a BAA — its US/CA DPA (Jun 30, 2026) §7 defines 'Prohibited Data' to include payment card data, 'health information, including "Protected Health Information" as that term is defined under the United States Health Insurance Portability and Accountability Act', and CCPA 'sensitive categories' of Personal Information, all excluded from the data Contentstack will process. The trust page lists no HIPAA or BAA. Scored at the bottom of the rubric's no-coverage band rather than the middle because the contract affirmatively bans PHI rather than being silent on it; a Feb 2026 Contentstack blog marketing 'built-in support for HIPAA' is contradicted by the binding agreement.

Coverage broadened materially in 2026: a DORA FAQ page (Mar 10, 2026) plus Security Addendum §8 'Incident Management & Escalation for DORA Customers' committing to 24-hour incident notification for EU financial-entity customers; an Artificial Intelligence Addendum (Jul 27, 2026) with explicit EU AI Act (Reg. 2024/1689) classification and a no-training-on-Customer-Data commitment; and a US/CA DPA naming CCPA/CPRA, Colorado, Connecticut and Virginia privacy laws plus Canadian law. Not higher because there is still no FedRAMP authorization, IRAP, C5, ENS, PCI DSS or HITRUST, and PCI and healthcare workloads are contractually excluded outright rather than merely uncertified.

SOC 2 Type II covering four trust service criteria — security, availability, confidentiality and privacy — with Contentstack 'constantly engaged with an independent, third-party auditing firm for regular SOC 2 audits'. Report access improved in 2026 from a sales-contact request to a self-service Trust Portal (a Scrut Trust Vault at trust.contentstack.com) with NDA gating, per-user watermarked downloads and subscribe-to-updates. Above the rubric's 85 threshold because all three required TSCs plus privacy are in scope and the report is now retrievable without a sales conversation; not higher only because the attestation period and report issue date are not published publicly.

ISO 27001:2022 certification for Contentstack's own ISMS — platform scope, not inherited from AWS/Azure/GCP — remains listed on the trust page and is cited in the DORA FAQ as part of the operational resilience program. ISO 27018 for cloud PII processing and ISO 27017 for cloud security controls are still absent from every compliance surface, so the score stays below the rubric's 80+ threshold, which requires both.

Beyond SOC 2 Type II and ISO 27001:2022 the certification portfolio is unchanged through 2026 — no CSA STAR, PCI DSS, FedRAMP, Cyber Essentials Plus, IRAP or C5. Third-party VAPT twice a year plus annual code audits and at-least-annual penetration testing under the Security Addendum are sound practice but are not certifications, and the 2026 additions (Trust Portal, DORA FAQ, AI Addendum, Data Transfer Risk Assessment) are contractual and transparency artifacts rather than audited attestations. Held at the rubric's no-additional-certs base band.

Seven independent regions across three clouds — AWS North America/Europe/Australia, Azure North America/Europe, GCP North America/Europe — each with a documented primary and backup data center, no cross-region fallback, and organization data confined to a single chosen region. Lowered slightly because the sub-processor list surfaces residency caveats the regions doc does not: MongoDB holds offline production database backups in the United States, Azure and GCP are both listed with a United States processing location, AWS Australia's backup region is Singapore rather than an Australian one, and Fastly and Cloudflare cache to worldwide edges.

The post-termination retention period is now explicitly quantified: Master Agreement §7.6 (Jul 17, 2026) gives customers 30 days after termination to request a download of Customer Data and either permanent account destruction or delivery in a mutually agreed format, after which Contentstack's obligations end. The US/CA DPA additionally commits to disclosing applicable retention schedules on request, and self-service export runs through the Management API, the Assets API (GA Aug 27, 2026) and the cli-cm-export plugins. Not higher because right-to-erasure remains API-only with no self-service DSR portal and no automated redaction workflow.

Log Targets (documented Jul 15, 2026) added native scheduled log shipping — audit, publish and webhook logs exported hourly to the customer's own AWS S3, Azure Blob Storage or Google Cloud Storage with connection validation, per-type base paths and a History tab reporting status, record counts and export windows — which is the standard SIEM ingestion path and closes the previous API-polling-only gap. Underneath it sit 100+ event types across 17+ modules, branch-specific stack logs, the Organization Audit Log API and CSV export up to 5,000 rows. Not higher because platform-side retention is hard-capped at 30 days and is not configurable, only one schedule per log type is allowed, the interval is fixed at hourly, and there is no direct Splunk/Sentinel connector. The Sep 11, 2026 addition of up to five SAML identity providers per organization strengthens access control but does not change logging or retention.

The accessibility statement was refreshed Sep 8, 2026 but its substance is unchanged from the prior review: Contentstack is 'partially conformant with WCAG 2.2 Level AA', prioritizing 'the most common user interactions', supported by keyboard navigability, color contrast work, NVDA/JAWS/VoiceOver, magnifier and voice navigation, and internal audits with user feedback loops. Lowered into the rubric's stated-target-without-formal-conformance band because partial conformance is self-asserted with no third-party conformance testing published, and the same docs page states that devices using a touch interface exclusively are not supported — an explicit barrier for some assistive setups.

The published accessibility statement describes the approach and the partial WCAG 2.2 AA position and points customers to ATAG 2.0 Section B for guidance, but the Sep 8, 2026 refresh added no procurement artifact: there is still no VPAT or ACR for the authoring environment, no Section 508 conformance statement, and no formal ATAG 2.0 assessment — it is referenced as advice to customers, not as a standard Contentstack has been evaluated against. Placed in the rubric's accessibility-page-without-formal-VPAT band rather than above it, since federal and large-enterprise procurement cannot be satisfied from what is published.

Polaris, the in-platform conversational AI companion GA with Agent OS since June 9, 2026, inherits context from entries, assets, and the Visual Editor, understands content type schemas, and performs real field writes with preview-first confirmation, while AI Assistant with Brand Kit supplies rewrite/tone/summarize/custom-prompt actions grounded in Voice Profiles and the Knowledge Vault. Polaris Skills (Oct 1, 2026) add reusable, named instruction sets for tone, naming conventions, and mandatory checks that Polaris applies automatically when relevant, shareable org-wide and markable as required, which is a genuine custom prompt-template and brand-guardrail layer, and On-Demand Agents let an editor run a generation agent over a supplied input set interactively. Not higher because there is still no first-class bulk generation across hundreds of entries in one pass; scale generation still means building an agent or automation.

Contentstack Assets auto-tags, describes, and generates alt text for images, produces visual markups (bounding boxes and hotspots with object coordinates for shoppable images and focal points), and supports visual search by dominant color. The September 2026 Assets release made AI metadata at upload configurable per space without overwriting uploader-supplied values and exposed the AI-suggested tags, alt text, objects, colors, and safety flags through the Assets API. Not higher because there is still no native generative image creation inside the DAM and no AI video processing, and Assets remains a paid add-on.

The Automate + ChatGPT automatic-translation solution guide remains maintained (docs updated Sept 8 2026) and AI Assistant's Locale Translation action still translates in-editor using whichever BYOK LLM is configured; the Agent Directory lists localization among its ready-to-build agent categories, and the LILT Marketplace app offers Instant Translation and Contextual AI machine translation alongside human-verified output. Brand Kit Voice Profiles can constrain the tone of AI-translated output, which is a partial brand-voice-across-locales control. Not higher because there is still no native MT engine, no bulk AI translation across locales as a first-class feature, and no translation quality scoring — AI translation remains an Automate/connector pattern rather than a shipped localization AI product.

Contentstack Assets auto-generates alt text, tags, and descriptions, and since September 2026 a space can be configured to write that AI metadata into assets as they arrive, with the same suggestions readable through the Assets API. This combines with AI Assistant's SEO Optimization and SEO Tags actions, Automate guides for AI-generated SEO keywords and titles/descriptions, Polaris natural-language remediation (e.g. finding posts missing a meta description), and list-scale fixes via bulk Find and Replace and Select All bulk actions. Not higher because there is still no on-page SEO scoring dashboard and no schema-markup suggestion engine, both required for the 90+ band.

Agent OS (GA June 9, 2026) ships Automations as a deterministic no-code backbone plus prebuilt agents for repository-wide operations (Content Updater, Broken Link Checker, Blog Summarizer), and Assets auto-tags every upload. The September 2026 Assets release added background Duplicate Management for Images that groups identical images into sets for review, closing the prior duplicate-detection gap on the asset side, and On-Demand Agents (Oct 1, 2026) let editors trigger multi-step ops agents from Polaris with per-run inputs, alongside bulk Find and Replace and Select All bulk actions up to 10,000 entries. Not higher because smart scheduling and AI content routing are still not documented as shipped capabilities, and duplicate detection covers identical images only, not near-duplicate entries.

Agent OS, GA since June 9, 2026 as the core of Contentstack's Agentic Experience Platform, ships Polaris, Agent Builder, deterministic Automations, and a public Agent Directory, with runtime governance: confirmation on writes, RBAC enforcement, Audit Log recording, and per-run execution logs with tokens and model. The October 1, 2026 release removed much of the build friction: Build an Agent in Polaris interviews the user in plain language, selects tools, writes instructions, and drafts an agent for review in Agent Builder, and On-Demand Agents run interactively as the invoking user with live step streaming, mid-run questions, approval before changes, and a full execution log. Not higher because long-running autonomous multi-agent orchestration is still an emerging pattern and Directory agents remain templates rather than one-click installs.

Lytics is now positioned as the native Data Cloud inside AXP, supplying ML propensity scoring (likelihood to convert or churn), behavioral and affinity-based audience construction, and content classification that predicts which pieces will resonate with which audiences — surfaced editorially through Opportunity Explorer and Content Map and through the Audience Insights agent, which the Agent Directory describes as analyzing real-time performance data and recommending high-impact content opportunities. The Agent OS Dashboard adds operational intelligence over agents and automations (success rates, execution times, usage). Not higher because there is still no stale-content detector, no editorial content-gap analysis dashboard, and no content quality/health score — intelligence remains behavioral and performance-oriented rather than editorial-quality-oriented.

Brand Enforcer flags off-brand language, incorrect terminology, and inconsistent tone on publication, Broken Link Checker crawls published content for dead links, and Knowledge Vault grounds AI output in verified documents, with tiered risk-based approvals as the human gate. September and October 2026 added further audit surface: Assets Duplicate Management groups identical images, AI image analysis returns safety flags, and organization-wide required Polaris Skills can encode checks that must always run. Not higher because accessibility scanning, readability/quality scoring, and thin or near-duplicate entry detection are still absent, so the 70+ band (quality plus brand plus accessibility) is not met.

Knowledge Vault is a GA, natively operated vector database — it extracts text from uploaded documents, converts it to embeddings, and positions it in vector space by semantic meaning — and it is now programmatically addressable via the Knowledge Vault API's Ingest Content request, making Contentstack's RAG layer a first-party product surface rather than an internal mechanism. Polaris supplies natural-language querying over stack content ('find all blog posts published last month that are missing a meta description'), answering from the stack rather than the internet and respecting RBAC, while Assets adds AI-generated tags and descriptions that make every upload searchable plus visual search on dominant colors. Not higher because Knowledge Vault indexes uploaded brand documents rather than entries — Knowledge Vault sync, which would keep the vector database in step with stack content, is slated for later in 2026 and has not shipped — so site-wide semantic search over entries still requires Algolia, Elastic, or a custom pipeline.

Lytics now operates as the native Data Cloud inside AXP with real-time identity resolution and behavioral scoring, and its ML models score every profile for churn and conversion likelihood, build predictive audiences ('users likely to convert', 'users at risk of churn'), and generate lookalikes to target anonymous visitors — a genuine cold-start mechanism, not rule inference. Content classification aligns pieces to customer interests and predicts what will resonate, feeding next-best-content recommendations, while Contentstack Personalize (GA) executes A/B/n and segment-based variants at the edge with Brand Kit keeping variants on-brand; Contentstack publishes a joint reference architecture for zero-latency adaptive experiences. Not higher because personalization-performance analytics remain split between Lytics and Personalize rather than a single closed-loop dashboard, and experiment-to-model feedback is not documented as automatic.

Contentstack's official MCP server is documented at contentstack.com/docs/developers/contentstack-mcp-server (updated Sept 8, 2026) with a dedicated developers.contentstack.com section and tool definitions published as JSON from public endpoints. Coverage is broad and schema-aware: CMA (78 tools) and CMA Extended (22: audit logs, version history, workflow inspection) plus CDA, Analytics, BrandKit, Launch, Automations, Personalize, Developer Hub, and Lytics, covering read, create, update, publish, and unpublish, with most API groups authenticating via a one-time OAuth login and permissions inherited from that identity. Not higher because distribution is still stdio via npx only; the hosted URL-based, profile-scoped edition with per-call audit logging has not shipped.

LLM choice is an explicit architectural pillar of Agent OS rather than a per-app setting: the platform markets 'brand governance and LLM choice' as core to its enterprise architecture, Agent Builder takes a customer-supplied model as a primary input, and every Agent OS execution log records which AI model ran the task — so model selection is both configurable and observable. BYOK in AI Assistant with Brand Kit continues to span OpenAI, Azure OpenAI, AWS Bedrock, and Google Vertex AI (which transitively covers Anthropic, Meta, Cohere, and Stability), with Contentstack-managed keys as the default, and the AI Addendum contractually binds any 'AI Provider' against training on customer data. Not higher because self-hosted or custom fine-tuned model endpoints are still not documented as a supported configuration, and per-region AI data residency controls are not spelled out.

Contentstack shipped a purpose-built agent developer surface in 2026: developers.contentstack.com is explicitly agent-friendly — every guide, blog post, and kickstart is available as markdown, an agents.md file tells LLMs how to browse the site, and an MCP sits on top so an AI assistant can learn Contentstack directly — and Contentstack publishes roughly 21 official Agent Skills on GitHub (contentstack/contentstack-agent-skills) covering content modeling, entry queries, asset handling, Live Preview setup, Brand Kit operations, Delivery SDK code, Developer Hub apps, migrations, and Launch deployments. Tool definitions are served as JSON from public endpoints so teams can assemble their own MCP server, Agent Builder agents can call Launch tools, issue external HTTP requests, and connect to third-party MCP servers, and the SDK fleet (JS/TS, Java, Python, Ruby, Swift, .NET) stayed on a near-weekly release cadence through Aug–Sept 2026. Not higher because there are still no official Contentstack-maintained LangChain/LlamaIndex/CrewAI integration guides and the hosted OAuth MCP profile is pending.

Governance is a documented product surface: Agent OS activity lands in the Audit Log, execution logs capture every step with tokens and model, Polaris shows current-vs-proposed values and requires confirmation on writes under RBAC, and AI Credits enforces quotas. The October 1, 2026 release closed the prompt-governance gap: Polaris Skills are named instruction sets with Restricted or org-wide sharing, Can use/Can edit permissions, and a required flag that pushes mandatory checks to everyone, while On-Demand Agents run under the invoking user's permissions with the audit trail naming them and approvals before changes. The public AI Addendum bars training on customer data, assigns Input and Output ownership to the customer, and scopes products outside EU AI Act high-risk. Not higher because there is still no hallucination detection or output confidence scoring and no explicit IP indemnification for AI output.

AI Credits tracks monthly consumption with configurable excess-usage limits, the Agent OS Dashboard reports agent and automation counts, success rates, and execution times, and each Execution Log records duration, total tokens, model, and a step timeline. Since October 1, 2026, on-demand agent runs are recorded against the person who ran them, giving per-user attribution of agent activity, and the Analytics API exposes Brand Kit AI request counts. Not higher because aggregated per-user or per-team AI consumption dashboards are not documented and there is no prompt-effectiveness or output-quality trend analytics.