CoreMedia

Content types are defined as code in the XML content type model with inheritance and a broad set of property types (strings, integers, dates, link lists, markup, blobs and nested Struct properties for JSON-like data). Typed link lists to supertypes give polymorphic references. Not higher because model changes are a developer deploy rather than an editor-facing schema UI, and there is no dedicated location or enum field type out of the box.

Link list properties model one-to-many and many-to-many references, typed to a content type or supertype, and Studio shows referrers so relationships can be traversed in reverse. The Unified API exposes referrers programmatically. Not higher because reverse traversal is not a first-class query in the GraphQL delivery API the way graph-native headless platforms offer it.

The Blueprint page grid composes pages from placements filled with reusable teasers, collections and other content items, and Struct properties allow nested structured data. Headless delivery exposes page grid and navigation. Not higher because rich text is CoreMedia RichText XML rather than a portable block AST with arbitrary nested components.

Studio Server validators cover required fields, lengths, link targets and duplicate checks, and developers can register custom Java validators including cross-property rules, with issues shown to editors before publication. Not higher because validation is primarily a Studio concern; writes through the Unified API are not blocked by the same rule set.

Every check-in creates a version, Studio offers version history with side-by-side comparison and restore of earlier versions, and audit logs record who changed what. The preview time slider shows content state at a point in time. Not higher because there is no content branching, and restore of deleted items is less prominent than in leading headless platforms.

Native subject and location taxonomies (CMTaxonomy, CMLocTaxonomy) are hierarchical, reusable across content types and managed in a Taxonomy Administration UI, with semantic tag suggestions and rights controlling who edits terms. Taxonomies are delivered through the Headless Server. Not higher because synonym management and bulk reclassification tooling are limited.

Studio shows a live preview of drafts beside the form, with device previews and a time-travel preview slider, and the In-Preview Editing extension (July 2025) adds inline plain and rich text editing, image upload and placement editing in the preview. Preview also works for headless frontends through the Headless Server preview mode. Not higher because in-preview editing is an extension that frontends must support, and shareable unauthenticated preview links are not a documented standard feature.

Studio uses CKEditor 5 storing CoreMedia RichText 1.0 XML, with links to content items, embedded images and configurable plugins, and the Headless Server transforms rich text for delivery. Not higher because the stored format is an HTML-like XML dialect rather than a portable AST with custom block types.

Images are content items with metadata, editorial crops per aspect ratio, responsive image variants and server-side transformation, and the cloud image transformation service outputs WebP and AVIF. Referrer views show where an asset is used. Not higher because WebP needs manual setup in self-managed installs and transform customisation on the shared service is limited.

Check-out locking and a concurrent-editing hint prevent conflicting edits, editorial comments with notifications and project To-Dos support async teamwork. Not higher because there is no simultaneous co-editing with presence on the same item.

A dedicated Workflow Server runs workflows defined in XML with custom states, user and group task assignment, approval steps, translation and synchronization workflows, and workflow events emitted to the Event Hub. Approve and publish are distinct rights. Not higher because designing new workflows is developer work rather than a visual builder.

A Scheduled Publication workflow publishes items at a set time, validFrom and validTo dates control visibility, and the preview slider lets editors check future states. Projects group related content with due dates. Not higher because there is no atomic release bundle with a publishing calendar comparable to dedicated release features.

Localization is site-based: a master site is derived into locale sites, content items keep master links and translation status, and synchronization workflows propagate changes. Not higher because this is document-level localization rather than field-level, with fallback handled by site structure rather than configurable locale chains.

Rights rules give groups read, edit, delete, approve and publish permissions per folder and content type, with LDAP or Active Directory integration and SSO through Spring Security. Not higher because there are no field-level permissions and no documented SCIM provisioning.

The Headless Server provides a GraphQL delivery endpoint with multi-site and locale support, plus REST access through mapped persisted queries documented in Swagger UI, separate from the Java Unified API used for management. Not higher because the REST layer is a mapping over GraphQL rather than a full independent API.

The managed cloud runs on AWS in European data centres with a web application firewall, DDoS protection and CDN integration, and the delivery tier caches aggressively with invalidation on publication. Not higher because CDN provider, purge speed and edge capabilities are not publicly documented, and self-managed installs bring their own CDN.

The Event Hub Service delivers content events (create, update, approval, publication, deletion), workflow events and Studio notification events to webhooks in JSON, with filtering, self-service subscription and FIFO retry for up to 7 days. Not higher because it is an optional cloud-only feature sold on request, payload signing and delivery logs are not documented, and delivery can lag up to a minute.

Hybrid headless architecture serves the same content as JSON through GraphQL to any frontend alongside server-rendered sites, with a React and TypeScript example app (Sparc). Not higher because official SDKs are limited to Java and a TypeScript Unified API client, and rich text is web-oriented XML.

The CoreMedia CDP provides unified profiles, identity merging, rule-based and template segments, real-time signals and connectors to external CDPs and CRMs, and segments are usable directly in Studio for targeting. It lives in CoreMedia Engagement Cloud, which needs its own licence alongside Content Cloud. Capped at the add-on ceiling; within it, a strong first-party offering.

Since January 2026 editors create personalized variants of any text block, banner or teaser in Studio and assign segments to variants, with performance shown side by side. The Native Personalization plugin connects Studio to Engagement Cloud and requires that licence. Add-on ceiling applies; in-editor variant management is otherwise near best in class.

A/B tests are created, monitored and resolved in Studio with real-time variant comparison and winner selection, and the vendor also claims multivariate testing. Requires the Engagement Cloud licence. Not higher because statistical significance controls and traffic allocation detail are thinly documented.

Vendor material mentions content and product recommendations and next-best-action suggestions in Engagement Cloud, but documentation of a recommendation engine for on-site content is thin. Scored conservatively until a documented engine is confirmed.

Apache Solr is bundled and powers both editorial search and delivery-side site search through a Blueprint abstraction with full-text search, facets, filtering, spellcheck suggestions and highlighting. Not higher because there is no merchandising, relevance tuning UI or search analytics for business users.

CoreMedia has no cart, checkout, pricing or inventory of its own; it augments external commerce engines and routes shoppable media checkout to them. Score reflects absence of native commerce.

The Commerce Hub provides vendor-built connectors for Salesforce Commerce Cloud (B2C and B2B), SAP Commerce Cloud, commercetools and others, with live catalog browsing in Studio, augmentation of category and product pages, product links in shoppable images and video, and commerce-aware preview. Deep, but scored at the integration ceiling.

Studio shows page performance metrics, drill-downs, data periods and a website KPIs widget per site and per content item, fed by CoreMedia Tag and Engagement Cloud analytics. Requires the Engagement Cloud licence. Not higher because content lifecycle and author productivity reporting are not part of it.

CoreMedia Tag collects behavioural data for the CAE and Headless Server, performance data can be exported to BI tools, and Blueprint has historically offered analytics integrations. Not higher because current, documented first-party connectors to GA4 or Adobe Analytics were not found.

Many sites run in one repository with per-site configuration, shared content and master-to-derived site inheritance, and delivery supports multi-site and multi-language natively. Enterprise programs run dozens of country sites this way. Not higher because restructuring the site hierarchy after launch is developer work.

Translation workflows, side-by-side translation views, XLIFF export and import and translation status tracking are part of the product, with a certified GlobalLink connector and an open-source DeepL extension. Not higher because connectors for Phrase, Smartling and similar TMSs are partner-led and translation memory sits in the TMS.

Site manager groups, per-site rights, shared themes and master-site inheritance let a central team govern many brands and markets from one repository. Not higher because there is no dedicated cross-brand policy or brand analytics console.

The built-in DAM manages images, video and documents as content items with taxonomy tagging, versioning, usage-rights fields and usage tracking, and Bynder and Cloudinary connectors extend it. Not higher because asset approval workflows, rights expiry enforcement and brand portals are not documented as native.

Video items can be uploaded or referenced, made shoppable with product timestamps, and image maps add hotzones; external video from YouTube and other sources comes in through Content Hub. Not higher because there is no native transcoding or adaptive streaming.

Editors assemble pages by dragging teasers and collections into page grid placements with live preview, and In-Preview Editing allows placement editing in the preview for both rendered and headless frontends. Not higher because layouts are predefined page grids and the experience is less free-form than dedicated visual builders.

Rendering: the Content Application Engine renders full sites from FreeMarker themes, and headless frontends are fed by the Headless Server. Hosting: CoreMedia Content Cloud Service operates the platform on AWS with WAF, DDoS protection and sandbox environments, while a self-managed edition exists. Not higher because no site-level SLA is public and decoupled frontend hosting is left to the customer.

Form submissions are used as triggers in Engagement Cloud journeys and surveys (CSAT and NPS) are offered there, but a documented form builder with conditional logic in Content Cloud was not found. Scored low pending evidence.

Engagement Cloud sends personalized email and SMS campaigns using CMS content and commerce data, with triggered sends from on-site behaviour and unified reporting, plus Salesforce integrations. It is a separately licensed part of the suite.

Engagement Cloud offers real-time journey orchestration across email, SMS, voice, web push and on-site channels, lead scoring, workflow nodes and ad audience sync, driven by the shared customer profile. Capped at the add-on ceiling because it needs the Engagement Cloud licence.

Studio manages meta fields, URL segments and indexing rules, Blueprint pregenerates per-site sitemaps with last-modified dates, and JSON-LD for Product, Organization and FAQ is injected automatically. A Redirect Manager extension handles static and conditional redirects with CSV import. Not higher because redirects and on-page recommendations rely on extensions rather than a complete built-in layer.

The vendor positions a GEO-ready CMS with automatic JSON-LD, semantic HTML, page summaries, generated FAQs and a GEO health index, and the managed cloud WAF offers optional bot control. Not higher because llms.txt generation, per-page Markdown endpoints, per-AI-crawler controls and citation analytics are not documented as product features.

The CoreMedia Marketplace lists 100+ tested extensions, plugins and services, including commerce, DAM, translation and Salesforce connectors, distributed as plugins for the Blueprint workspace. Not higher because many entries are partner or open-source extensions with uneven maintenance and installation requires a build.

The Content Application Engine can serve gated content behind Spring Security, commerce connectors carry shopper sessions, and Engagement Cloud profiles key personalization to known contacts. There is no documented visitor login, registration or portal layer with CIAM federation, so authenticated sites are built by the implementation team.

The Headless Server exposes a typed GraphQL schema built on Spring GraphQL with multi-site, image and rich text support, REST endpoints mapped from persisted queries and documented in Swagger UI, and a Java Unified API for management. Not higher because the GraphQL schema is extended in Java rather than generated from the content model, and public API reference pages are thinner than leading headless vendors.

Delivery runs on replicated Master and Replication Live Servers with horizontally scaled CAE and Headless Server nodes and extensive caching, and the managed cloud adds CDN and WAF. Not higher because rate limits, response time targets and large-dataset sync patterns are not publicly documented.

Official client libraries are the Java Unified API and a TypeScript Unified API for Node, plus a React and TypeScript example app for headless delivery. Delivery from other languages relies on generic GraphQL clients. Not higher because there are no official delivery SDKs for Python, .NET, PHP or mobile.

The marketplace lists more than 100 extensions covering commerce (Salesforce, SAP, commercetools), DAM (Bynder, Cloudinary), translation (GlobalLink, DeepL), search and analytics. Not higher because many are partner or open-source contributions with uneven upkeep, and installation is a build step rather than one-click.

A plugin system bundles Studio Client (TypeScript) and Studio Server extensions, custom property editors, toolbar actions, validators, workflow actions, CAE and Headless Server Java extensions, and plugins are referenced through descriptors in the Blueprint workspace. Nearly every layer can be customised. Not higher because extensions are compiled into the deployment rather than hosted apps installed at runtime.

Studio authentication is built on Spring Security and integrates SSO providers through OAuth2 and OIDC style redirects, LDAP and Active Directory are supported out of the box, and MFA is delegated to the identity provider. Not higher because SSO setup is an implementation task rather than a toggle, and API token management is not documented as a self-service feature.

Groups receive read, edit, delete, approve and publish rights per content type within folder paths, giving content-instance scoping by folder and separation of approver and publisher roles. Not higher because there are no field-level permissions.

CoreMedia GmbH holds ISO/IEC 27001:2022 certification for its cloud CMS (valid October 2024 to October 2027), offers a GDPR data processing agreement and EU hosting for data residency. Not higher because no SOC 2 Type 2 report or HIPAA option was found.

No public breaches are known, and release notes regularly patch third-party CVEs and remove risky features such as Workflow JAR upload. Not higher because there is no public bug bounty or vulnerability disclosure programme, and the cloud acceptable use policy forbids unsolicited security testing.

CoreMedia offers a managed cloud service, a self-managed edition for any cloud or on premises, private cloud and hybrid setups, with EU hosting for sovereignty requirements. This is the full range of options. Not higher only because the managed offering is a single-provider deployment.

Service levels are set in an exhibit of the Master Service Agreement and 24/7 emergency support is offered, but no uptime percentage or public status page was found. Scored at the no-public-SLA level.

Publication to a Master Live Server replicated to any number of Replication Live Servers, with horizontally scaled delivery nodes behind caches, is proven for large global brands and high-traffic public institutions. Not higher because documented scale limits are not published.

Content can be exported and imported with server tools, and the managed cloud runs on AWS with backups, but RTO and RPO figures and failover design are not public. Scored as backups and export without documented DR targets.

Developers build the Blueprint workspace and run the full stack locally with Docker, guided by quick-start tutorials, and a 30-day developer trial is available. Not higher because the stack is heavy, with many services and a Maven build.

The workspace builds Docker images through Maven, a GitHub-based workspace option exists, the managed cloud provides sandbox environments, and content type changes ship as code. Not higher because there are no branch-per-PR content environments or a dedicated content migration CLI comparable to headless platforms.

documentation.coremedia.com offers versioned manuals for CMCC 11 to 13, how-to guides, API references, a what's-new feed and release notes. Not higher because much depth sits in long PDF-style manuals, there is no interactive API playground on the site, and some current material is gated to the contributions repository.

The Studio client is developed in TypeScript, a TypeScript Unified API client exists for Node, and the Sparc example is React with TypeScript; the GraphQL schema allows standard codegen. Not higher because there is no official type generation from the content model.

The documentation feed shows a steady drumbeat: CMCC 13 (2512.0.0) shipped in January 2026 with Spring Boot 4, gRPC replacing CORBA, semantic search, native personalization and KIO page assembly, followed by maintenance releases in March, May, July, August and October 2026 across three supported lines. Features now also ship as plugins in the public coremedia-contributions GitHub organisation (kio-plugin and kio-backend pushed in October 2026). Not higher because major functional releases come every 18 months and most of the cadence is maintenance.

Every release carries separate Breaking Changes, Bugfixes and Changes and Improvements notes, published as HTML, PDF and CSV and syndicated through an RSS feed, with a Known Issues page and version-specific upgrade guides. Feature-level What's New posts and twice-yearly webinars sit on top. Not higher because the detailed notes are written for implementers and some release notes reference internal ticket ids rather than plain-language summaries.

CoreMedia publishes its release model openly (18-month majors, roughly 8-week maintenance packs, features as plugins, support end dates years ahead) and runs two update webinars a year, but there is no public feature roadmap or community voting portal. Direction beyond the next maintenance pack is shared through customer success managers and partner events. That places it in the private-roadmap band.

The YYMM.major.minor scheme is disciplined: minor AMPs are documented as drop-in compatible, breaking changes are confined to major AMPs one or two times a year and listed per release, and each major line gets three years of regular support plus a paid fourth year. Upgrades follow a Git merge workflow with written upgrade guides and an Enablement course. Not higher because there is no automated migration or codemod tooling, and a yearly major AMP with breaking changes is required to stay supported.

Public community signals are very small: the most-starred CoreMedia GitHub repository is the Jangaroo build tooling at about 106 stars, the React headless client has 19, and Stack Overflow has no coremedia tag and around 17 questions mentioning it. G2 lists 59 ratings. This is a closed, licence-based platform whose community lives in customer and partner portals.

Engagement happens behind logins: the HelpCenter knowledge base, the Enablement platform and the developer trial's community access with 'techies'. Plugin repositories in coremedia-contributions are actively maintained by CoreMedia staff, but there is little public discussion, issue traffic or outside contribution to observe. Scored low because almost nothing can be verified publicly.

A formal, tiered partner programme (Registered, Silver, Gold, Platinum) with a certification track and a filterable directory spanning DACH, EMEA, UK, North America, APAC and South America; CoreMedia cites more than 700 trained consultants and runs an annual Partner Engage event. Not higher because the network is concentrated in Europe and is small next to the AEM or Sitecore ecosystems.

Learning material is almost entirely first-party: the Enablement platform, documentation how-to guides and vendor webinars. Independent tutorials, courses and conference talks are scarce, and agency blogs are the main outside source. That signals a niche enterprise platform rather than a broad developer ecosystem.

CoreMedia is built on mainstream Java and Spring Boot, and a vendor certification programme exists, but experienced CoreMedia developers are concentrated in German and European agencies and the partner network's roughly 700 trained consultants. Outside DACH, buyers usually hire through a partner rather than the open market.

Product investment is visible (native personalization, KIO, performance metrics, Engagement Cloud lead management), but outside signals of growth are weak: headcount data puts the company at about 186 staff in March 2026, down roughly 19% from 2023, and new customer announcements are rare in the press feed. G2 review volume remains under 60.

CoreMedia has operated since 1996 and has been majority-owned by private equity firm OpenGate Capital since November 2019, which bought out Deutsche Telekom Capital Partners. No new funding since; revenue is estimated around 35 million dollars, and the headcount decline points to a cost-focused rather than growth-funded owner. Stable but not expanding.

Positioning is clear and consistent: a hybrid-headless, Europe-built enterprise DXP strong in commerce-led experiences, multi-site governance and data sovereignty. Analyst recognition is steady (Gartner DXP Magic Quadrant six years running, IDC MarketScape Major Player in two 2025 CMS reports), but as a niche vendor rather than a leader. Not higher because it competes against far larger suites and its recent moves (native personalization, AI layer) are catching up with peers.

Gartner Peer Insights shows an average of 4.5 out of 5 across about 101 DXP reviews, with hands-on support and multi-language strength praised. G2 has only 59 ratings, and a recurring theme there is a steep learning curve for new users. Strong but thin review volume keeps it in the 45 to 60 band, lifted to its top by the Peer Insights average.

CoreMedia publishes no prices or tiers; coremedia.com has no pricing page and every commercial path leads to 'Book a demo'. The only public commercial terms are the support lifecycle dates and the three-year support commitment. Entirely sales-gated pricing sits at the bottom of the band.

Licensing is an enterprise contract negotiated per deal, with Content Cloud and Engagement Cloud sold as separate products and support sold as Professional or Enterprise packages. It is likely predictable once signed, since it is not metered per API call, but buyers cannot model it upfront and capabilities such as native personalization need an additional licence.

Security basics such as SSO, role-based rights and audit logs are part of the core product, which is good. But meaningful capabilities sit behind separate purchases: native personalization requires an Engagement Cloud licence, Event Hub webhooks are an optional feature through sales, 24/7 support is for Enterprise customers, and the fourth support year costs extra.

Regular support is sold with 'an upfront, three-year support commitment', and there is no monthly billing, startup, nonprofit or education programme. Exit and renewal terms sit in a non-public MSA. Multi-year enterprise commitments place it below the annual-only band.

There is no free tier. The only no-cost entry point is a 30-day Developer Trial in GitHub Codespaces for evaluation, which is time-limited and not usable for production.

The Developer Trial runs a full CoreMedia environment in GitHub Codespaces with no installation, with guided exercises that edit content in Studio and run GraphQL queries, so a developer can query content within hours. A real project workspace is a heavier Maven and Docker build of the Blueprint. Faster than most enterprise DXPs, slower than a sign-up SaaS CMS.

CoreMedia projects are enterprise programmes delivered by certified partners: multi-site, multi-language and often commerce-integrated, with custom Blueprint development. No public timelines exist, but the scope, partner-led delivery and the learning curve mentioned in reviews point to several months for a typical first site.

The stack is mainstream at its base (Java, Spring Boot, GraphQL, TypeScript), but productive work needs CoreMedia-specific knowledge: the Blueprint, content types, Studio extension development, the CAE with Freemarker templates and the replication architecture. The talent pool is small and centred on European partners, so expertise carries a clear premium.

CMCC-Service is a vendor-managed cloud with development sandboxes, pre-production and production environments, CDN and WAF, so infrastructure is bundled for buyers on that path. Self-Managed customers run the full multi-server topology (content management server, master and replication live servers, search, databases) themselves. Scored on a mix of the two paths.

Even on CMCC-Service the customer owns the build: they merge each release into their workspace, build and test in the sandbox, push Docker images and deploy through Cloud Manager, with major AMPs requiring support tickets and planned editorial downtime. Self-Managed adds full operation of the server stack. That is a standing DevOps load, though lighter on the managed service.

Content lives in CoreMedia's own repository with a proprietary content type model and rich text format, but it can be exported through server import and export tools, the Unified API and the GraphQL Headless Server. Customisations are Java code against the Blueprint and do not carry over. Moderate migration effort with transformation required.

Developers must learn a sizeable CoreMedia vocabulary: the Blueprint workspace, content types and structs, page grids and placements, view types, the Content Application Engine versus the Headless Server, content management, master live and replication live servers, plus AMP, AEP and LTS release tracks. Each is well documented, but few map to standard web mental models. Typical of an enterprise DXP.

CoreMedia Enablement offers self-paced courses, workshops and a certification programme, including a dedicated upgrade course with video walkthroughs. The free Developer Trial gives a guided walk-through in a ready Codespaces environment, and the documentation site has structured how-to guides with audience and prerequisites per page. Not higher because there is no in-product onboarding and most deep material needs a login.

The backend is standard Java on Spring Boot 4 and headless delivery uses GraphQL with a REST mapping and a React client, all mainstream. But the hybrid side relies on the proprietary CAE with Freemarker templates, and Studio customisation means TypeScript on CoreMedia's own Ext JS based toolchain (Jangaroo). Mixed standard and platform-specific patterns.

The Blueprint workspace is a complete reference implementation with example sites and content, and CoreMedia maintains a React headless client (updated September 2026) and the Sparc example site. There are no official Next.js, Nuxt or Astro starters with deployment config. Solid for the hybrid path, thin for modern headless frameworks.

A working local environment means building the Maven Blueprint workspace and running a set of Docker containers for the content servers, Studio, search and delivery. CMCC-Service adds sandbox, Docker push pipeline and Cloud Manager deployment steps. The trial in Codespaces hides this for evaluation only.

The content type model is flexible (structs, link lists, taxonomies), but schema changes are code: content types are defined in the workspace and require a server deployment, and upgrades can break custom types, as the guide on missing personalization content types when moving to CMCC 13 shows. No schema migration tooling beyond the deployment itself.

With the built-in CAE, Studio preview works out of the box, and In-Preview Editing (July 2025) adds editing in the preview. For headless frontends, preview requires wiring the frontend to the preview Headless Server and Studio's preview client, which is documented but takes frontend work.

Generalist React developers can build a headless frontend, but backend, Studio and Blueprint work needs CoreMedia-specific Java knowledge, and buyers typically rely on certified partners. Certification is not mandatory but is the norm for implementation partners.

A production CoreMedia project usually involves Java backend developers, frontend developers, someone owning build and deployment, and a solution architect, often through a partner. A small team is feasible on CMCC-Service for a single site, but multi-site and commerce scopes, which are the platform's sweet spot, need more roles.

Once templates and page grids are in place, editors self-serve in Studio: drag-and-drop placement, In-Preview Editing, scheduled publication, personalization variants and A/B tests, and the KIO Co-Pilot page assembly tool. New layouts and content types still need developers.

Upgrades are customer projects even on the managed service: teams merge each release into their Blueprint workspace with Git, review the release notes of every intermediate version, test in a sandbox and redeploy. Major AMPs with breaking changes are needed once or twice a year, require CoreMedia support to change infrastructure (requested at least three business days ahead) and mean editorial downtime. Minor AMPs are drop-in, which keeps it off the bottom.

Security fixes ship in minor AMPs roughly every 8 weeks or on demand, documented as drop-in replacements, and are backported to three supported lines at once. Applying them still requires the customer to rebuild, test and redeploy, including on CMCC-Service. The managed cloud's WAF and monitoring cover the infrastructure layer.

Support windows are long (three years regular plus one paid), but CoreMedia requires at least one major AMP per year to stay on supported third-party libraries, and major releases arrive every 18 months with technology shifts such as Spring Boot 4 and CORBA to gRPC in CMCC 13. Customers on v11 lost regular support in December 2024.

The platform is a multi-service Java stack: content management server, master and replication live servers, Studio, Solr search, relational and document databases, delivery tiers and their Spring and third-party libraries, which CoreMedia moves forward in major AMPs. CMCC-Service runs the infrastructure, but the application dependency tree remains the customer's codebase.

On the managed cloud CoreMedia advertises continuous monitoring and 24/7 emergency support, and Cloud Manager exposes deployments, but there is no public status page and application-level monitoring is left to the customer. Self-Managed installs need full monitoring set up in-house.

Studio helps keep content healthy: validators, 'used by' reference views, taxonomy administration, version history, scheduled publication, and KIO for governance and quality checks before publishing, plus native performance metrics since 2506 to spot weak content. Broken links and expiry still rely partly on editorial discipline and marketplace add-ons.

Delivery scales horizontally through replication live servers, and CMCC-Service adds a CDN and rolling deployments for delivery nodes. Caching in the CAE or Headless Server and search tuning still need active care, and Self-Managed customers carry the full performance workload.

Support is sold as Professional or Enterprise packages with a helpdesk, HelpCenter knowledge base and customer success managers; 24/7 contact is for Enterprise customers. Peer Insights reviewers single out hands-on support, which supports a mid-band score, but SLAs are in a non-public MSA.

There is little open community help: Stack Overflow has no coremedia tag and around 17 questions, there is no public forum, Discord or Slack, and GitHub issue traffic is minimal. Peer help is limited to the gated HelpCenter, Enablement and trial community.

Bugfix releases land every one to three months with public per-release bug lists and a Known Issues page, and fixes are backported to three supported lines in parallel (2406, 2506, 2512 in August 2026). Customers still have to deploy each fix themselves.

Studio offers drag-and-drop placement editing on a page grid and, since July 2025, In-Preview Editing so marketers compose pages in the rendered preview. The KIO Co-Pilot Advanced Page Assembly Tool (January 2026) creates new pages from existing page templates. New component types and page grids still need developer work in the Blueprint workspace, which keeps it at the bottom of the 70+ band.

CoreMedia has deprecated its Campaigns integration (CMS-29540, release 2512.0.1) and will remove its modules in a future release, so the dedicated omnichannel campaign service can no longer be counted. Campaign work now rests on Engagement Cloud email, SMS and WhatsApp campaign execution and journey orchestration, plus Studio Projects and scheduled publication for content. Campaign calendaring and cross-channel campaign analytics in the CMS are not documented, so it drops to the mid 50s.

Sitemap generation is built in (with configurable cadence on CMCC-Service since January 2026), SEO properties are part of the Blueprint content model, and JSON-LD injection is supported; KIO generates SEO metadata in bulk. Redirect management comes from a Marketplace extension rather than core, and there is no built-in on-page SEO validation, which keeps it in the mid 60s.

Engagement Cloud brings lead capture, lead scoring and centralized lead management (Lead Management v2 and a POST /external/contact endpoint), and the CoreMedia tag supports conversion goals used by A/B tests. Forms come from Formcentric, a partner form builder built for CoreMedia and listed on the Marketplace, rather than from Content Cloud itself, so it stays below 60.

Native Personalization lets editors build rule-based segments and assign them to content variants directly in Studio (expanded in CMCC 2512, January 2026), backed by Engagement Cloud behavioral data. It requires an Engagement Cloud licence and CMCC 13, and real-time behavioral targeting depth beyond rules is mostly asserted in marketing copy, so it stops just under 70.

A/B tests are created from content variants in Studio, split traffic by a configurable ratio, measure page view or event goals, and pick a winner either manually or automatically when the test duration ends, with the winning variant's properties applied to the baseline. Results show views, conversions and rate only, with no documented statistical significance reporting, so it stops just short of 70.

In-preview editing, reusable modular content, Studio Projects and the page assembly tool shorten brief-to-page time, and KIO runs saved and global prompts and bulk operations on up to 50 selected items with parallel agents. Publication still runs through workflow steps and new layouts need developers, so it does not reach the 70+ band.

Structured content is delivered to web and apps through the GraphQL Headless Server, and the wider Experience Platform pushes content into email, SMS, WhatsApp, chatbot and video channels through Engagement Cloud. Channel-specific renditions beyond web depend on the Engagement Cloud licence, but four or more channels are covered in the product line.

Studio shows page performance metrics and a website KPIs widget from the native personalization stack, and KIO answers plain-language analytics questions inside the CMS. Prebuilt GA4 or Adobe Analytics connectors are not documented and content decay reporting is absent, so it sits just under 65.

Page grids with defined placements, view types and shared templates constrain what marketers can change, and KIO applies centrally stored brand guidelines to generated text. There is no documented locked design-token layer or override enforcement for the delivered site, so it stays below 65.

Engagement Cloud covers social messaging journeys and WhatsApp messages, shoppable content can be pushed into social posts, and Elastic Social adds comments and star-rated reviews with moderation in Studio, which gives on-site social proof. The Social Media Hub for scheduling posts from Studio is a CoreMedia Labs extension last updated for the 2021 release line, and OG card management is not documented, so it stays in the basic band.

CoreMedia has a native DAM with copyright, licensing and usage permissions, cloud image transformation (WebP, AVIF) and Bynder and Cloudinary connectors, and KIO auto-labels and crops images. There is no transcoding or video hosting service, which keeps it under 65.

The master and derived site model lets regional teams adapt global campaigns locally, with XLIFF translation workflows, GlobalLink and DeepL integrations and KIO translation with human approval. Transcreation-specific workflows and market-level compliance content are not distinct features, so it stays just under 65.

Prebuilt Salesforce and SAP integrations, the bundled Engagement Cloud for CRM-style lead data and journeys, and a marketplace of 100+ extensions cover several MarTech categories. Event triggers rely on the Event Hub, which is an optional, separately sold feature, and named MAP and CDP connectors such as Marketo are not documented, so it sits under 65.

Commerce Hub brings catalog products and categories into Studio so editors augment them with rich content, media and tags while the commerce system stays the source of product data. PIM feeds can embed product and price data into assets. Product attribute modeling itself lives in the commerce platform, so it stays below the top of the band.

Editors can augment category pages, drag products into related content categories and tag products by topic to drive related-product content, which goes beyond a plain CMS. There is no search result merchandising or dedicated cross-sell rule tooling, so it stays below 60.

Prebuilt connectors exist for Salesforce Commerce Cloud, SAP Commerce Cloud, commercetools, HCL Commerce, Elastic Path and Spryker, with live catalog browsing, product references in Studio and storefront preview, and content and product federated at API level. A Shopify connector for products, collections and navigation is now on the Marketplace and runs alongside other commerce systems, but it is a CoreMedia Labs extension with community support, and BigCommerce is still absent.

Shoppable content is a first-class authoring pattern: editors add shoppable hotzones to images and product timestamps to video timelines in Studio, with checkout routed to the commerce backend, and products update globally when catalog data changes. This is among the stronger editorial commerce offerings in the dataset.

Commerce connectors let CoreMedia content fragments be placed into storefront pages, and the vendor describes sharing session and cart data across brand and store sites. Managing trust badges or upsell content inside cart and checkout flows is not specifically documented, so it sits in the basic band.

Engagement Cloud journeys and automated follow-ups by email, SMS and WhatsApp can carry post-purchase messaging, and lead and contact data are shared with the platform. Order-event triggered post-purchase pages managed from the CMS are not documented, so it stays in the low 40s.

A Salesforce B2B Commerce connector exists and the vendor positions shoppable spec diagrams and quote actions for manufacturers and dealer portals. Account-based catalog gating and customer-specific pricing display come from the commerce platform rather than native CMS features, so it stays below 50.

Site search runs on Solr with facets and spellcheck, and content can be grouped with products by topic tags. There is no documented blended content and product search or search landing page tooling, and the new Semantic Search is for editors in Studio, so it sits mid-band.

Scheduled publication, the preview time slider and segment-targeted variants let teams time and target promotional banners and shoppable promos across web and messaging channels. Countdown timers and promo code messaging are not native components, so it sits just above the basic band.

Each CoreMedia site can be bound to its own catalog and store, and the master and derived site model shares content across storefronts by region or brand while local editors adapt legal and editorial content. Shared product data stays in the commerce system, so no duplication is needed.

Shoppable video timelines, image hotzones and cloud image transformation cover more than a basic gallery. There is no documented 360 degree view, AR or 3D support and no transcoding service, so it stays at the top of the basic band.

There are no seller profiles or seller-contributed product content features. Elastic Social provides customer reviews with five-star ratings and a Studio moderation view, which covers review aggregation and moderation but nothing marketplace-specific.

Localized sites map to catalog locales so product augmentation and editorial content follow the market, with translation workflows and KIO translation. Currency-aware blocks and regional regulatory labels come from the commerce system rather than CMS features, so it stays below 65.

Page performance metrics and KPI widgets in Studio plus Engagement Cloud tracking give some conversion visibility, and the vendor describes a trackable buying experience. Documented content-to-revenue attribution inside the CMS was not found, so it stays in the basic band.

Editorial rights are granular (rights per content type within folders, LDAP and SAML SSO), but audience-based visibility for delivered intranet content requires custom Spring Security work in the CAE or a headless frontend. That puts it in the RBAC band rather than audience-based visibility.

Strong taxonomy management, version history, approval workflows and Solr search give a solid base for knowledge content, and Semantic Search helps editors find related or duplicate items. There are no review or expiry lifecycle tools for knowledge articles, so it stays in the adequate band.

CoreMedia is positioned for customer-facing sites, commerce and contact centers, with no employee news feed, directory, notification or dashboard features. Building a portal would be a full custom frontend project.

News content and targeted publishing are possible with the standard content model and segments, but read receipts, acknowledgment tracking and mandatory-read workflows do not exist.

No employee directory, org chart or HR system integration exists; a directory would have to be modeled as custom content.

Versioning, approval workflows and audit trails support controlled publication of policy documents. Acknowledgment tracking and automated review reminders are missing, so it sits in the basic band.

No structured onboarding journeys, task checklists or HR-triggered portals exist for employees; Engagement Cloud journeys target customers.

Solr site search with facets and the licensed Semantic Search for editors give reasonable search over CMS content. There is no federated search across SharePoint, Confluence or Drive, so it sits low in the adequate band.

Headless delivery can feed a custom mobile app and sites are responsive, but there is no native employee app, offline mode or push notification feature.

No LMS integration or micro-learning features exist in the product; CoreMedia's own Enablement platform is for training its customers, not a product feature.

Elastic Social, still shipped with CMCC 13, gives site visitors comments, likes and star-rated reviews with moderation and user management in Studio, which could serve an internal site. There are no forums, polls, peer recognition or community spaces, and the module is aimed at customer sites, so it lands in the basic commenting band.

No Microsoft Teams, Slack or Google Workspace integrations are documented. The optional Event Hub could feed a custom notification bot, but nothing ships.

Scheduled publication and withdrawal plus workflow archiving support basic lifecycle control. There are no automated review dates, stale-content flags or ownership assignment for freshness.

Page performance metrics exist for public pages, but there is no department-level analytics, failed-search reporting or adoption dashboard for internal audiences.

Brands run as separate sites in one repository, isolated by site manager groups, folder rights and per-site delivery, and CMCC-Service runs each environment in its own VPC. Brands share one content model and server, so this is silo-style isolation rather than true multi-tenancy.

Shared templates, page grids and a master site let brands reuse structure, and content items can be referenced across sites without duplication. Design tokens are not a CMS-level concept, so it falls just short of 70.

Role-based access at team, organization, brand and market level, centralized LDAP or SAML user management, cross-site approval workflows and audit trails give native cross-brand governance. Global policy enforcement such as mandatory checks per brand is not a distinct feature.

Many brands share one installation, and CMCC-Service is sized by environments and delivery units rather than per site, which suggests economies of scale. Pricing is not public, so the actual curve cannot be verified.

Blueprint themes are assigned per site in the CAE, so brands share components with their own styling, and headless sites carry their own frontend. Theming is a developer artifact rather than editor-managed tokens, so it stays under 65.

Each derived site has its own site manager group and translation workflow, so brand and locale combinations get their own approvers while inheriting from the master. AI translation runs with human approval. Regional legal content governance is handled by convention rather than a dedicated feature.

Page metrics and KPI widgets are available per site, and KIO can answer cross-market questions such as campaign performance by country. No portfolio dashboard comparing brands is documented.

The Workflow Server supports custom workflow definitions and site-specific approver groups, and KIO playbooks can be defined per site. Configuring a separate approval chain per brand is developer work rather than admin configuration, so it stays below 60.

Master content flows to derived sites through synchronization and translation workflows, local sites override where allowed, and updates in the master propagate on the next sync. Since 2512.1.0, updates from the master can also be disabled for translation sites, which tightens override control, though it is still set per site rather than per field.

Hosting can be chosen per deployment (EU region, private cloud or on-premises) and validators can enforce rules, but there are no per-brand compliance rule sets or publishing guardrails for consent or accessibility.

Blueprint themes and bricks give a shared frontend component base that brands extend, versioned through the developer workspace. There is no CMS-level design system with brand extensions and propagation controls.

One user directory (LDAP or SAML SSO with Azure AD, Okta, Entrust) spans all sites, administrators manage everything centrally, and site manager groups give brand teams autonomy with cross-site contributor roles possible. It lands just under 65 because group-based rights setup is developer and admin heavy.

All sites share one content type model, and struct properties allow optional brand-specific fields without forking. Adding brand-specific extensions to a type still needs a server deployment and applies to the whole repository.

No executive reporting across brands for freshness, SLA adherence or cost allocation was found; reporting would be custom or through external BI.

CoreMedia is an EU (Hamburg) vendor, a Data Privacy Addendum is incorporated by reference into the cloud Master Service Agreement for every subscriber, and the managed service can be deployed in an EU region or run on-premises. No public sub-processor list or published SCC terms were found, which keeps it below 80.

No BAA, HIPAA-eligible service statement or healthcare compliance guidance was found; the vendor's regulated-industry material covers insurance, banking and the public sector under EU law. Self-hosting lets a customer build their own controls, but the vendor offers no HIPAA coverage.

The vendor states GDPR and CCPA alignment, publishes UK and US regional contract specifics, and describes controls that support NIS2, DORA and EU AI Act obligations. There is no FedRAMP, C5, IRAP or PCI DSS attestation, so coverage sits just above GDPR plus CCPA.

CoreMedia's security and GDPR pages list ISO/IEC 27001:2022 as the certification and do not mention SOC 2 of any type. No SOC 2 report or trust portal was found.

TÜV SÜD certifies CoreMedia GmbH to ISO/IEC 27001:2022 with a product scope ('creation, provision and support of a cloud-based content management system'), valid 2024-10-17 to 2027-10-16, and Engagement Cloud gained its own ISO 27001 certification in January 2026. No ISO 27018 certificate was found, so it stays below 80.

Beyond ISO 27001, no ISO 42001, CSA STAR, PCI DSS, C5 or Cyber Essentials certification was found. The vendor cites Tier III+ aligned cloud data centers, but that is an infrastructure property of the hosting provider, not a CoreMedia certification.

Subscribers choose the geographic region for CMCC-Service at subscription, the vendor offers EU hosting for residency, and private cloud, hybrid and on-premises deployment give full sovereignty. The supported region list is only provided on request and production delivery uses a CDN whose cache sits outside the region, so it stays below 78.

The contract documents retention: subscriber content stays retrievable for at least 30 days after the term and is then deleted, the service description commits to sanitizing content and backups after termination, and backup retention is up to 15 days. Export uses content import and export tools rather than a self-service portal, and erasure is not self-service.

Audit trails record who changed what, when and who approved it, including which changes came from an AI suggestion, and application logs are kept in a dedicated log storage service on CMCC-Service. No native SIEM push, configurable retention or self-service log export was documented.

Studio release notes show steady accessibility work: keyboard navigation and screen reader improvements in CMCC 2512 and fixes to dialogs, repository tree, library columns and context menus. There is no published WCAG 2.1 AA conformance statement for Studio, so it sits at the bottom of the stated-target band.

No VPAT, ACR, Section 508 statement or ATAG assessment was found; the only accessibility content on coremedia.com is a blog post about the European Accessibility Act aimed at delivered sites.

KIO Co-Pilot has been GA in Studio since CMCC 2506 (July 2025): it drafts, rewrites, summarizes and proofreads content, knows the content model through a repository metadata tool, applies central brand guidelines, and supports saved prompts, toolbar-level global prompts and no-code playbooks. Every change is a new version for editors to review and KIO cannot publish, which earns the 70+ band; bulk generation is capped at 50 items per request.

KIO interprets images, auto-labels, crops and categorizes visuals, finds images by description and turns images into text, which covers alt text and tagging. Image generation is not documented as an editor feature even though the backend configures an image model, so it stays in the partial band.

KIO translates content into a new item on command and playbooks can encode locale paths and brand rules, and a DeepL integration is available on the Marketplace. KIO does not run through the translation workflow and there is no quality scoring, so it sits in the basic MT band.

KIO fills SEO titles, descriptions and keywords for single items or a selected batch, tags content with metadata and describes images. There is no built-in on-page SEO score or schema markup suggestion, so it stays below 70.

Auto-tagging, bulk enrichment through parallel agents, reusable playbooks and toolbar prompts, and duplicate detection through the licensed Semantic Search add up to several AI assists in editorial work. KIO cannot start or advance workflows or Projects, so it is not woven into scheduling or routing.

KIO's backend is a GA multi-agent system: an orchestrator delegates to specialized CMS and Engagement Cloud agents, runs them in parallel, and follows no-code playbooks for multi-step tasks, with per-agent model tiers since backend 2.1.0. Agents cannot publish, delete, move content or drive workflows, and long batch runs are out of scope, so it sits in the lower part of the GA band.

KIO answers plain-language analytics questions over Engagement Cloud data and Studio shows page performance metrics. There are no AI dashboards for content gaps, topic clusters or stale content.

KIO proofreads for grammar, tone and style and applies brand guidelines when generating, and playbooks could script checks. There is no audit tool for quality, brand or accessibility across hundreds of pages, and bulk runs cap at 50 items.

CMS Semantic Search (January 2026) adds natural-language, meaning-based search in Studio and through KIO, and KIO's backend uses embeddings for tool retrieval. It is a separately licensed add-on for editors on CMCC 13, not delivery-side vector search or a RAG endpoint, so it stays in the add-on band.

Marketing pages claim behavior-learning personalization, and KIO suggests audience variants and can create content variants tied to topics. The documented personalization engine is rule-based segments with A/B tests, and no predictive scoring or ML recommendation engine is documented.

CoreMedia does not provide an MCP server that lets external AI agents read or write CoreMedia content. KIO acts as an MCP client that can consume customer-hosted MCP servers, which belongs under extensibility rather than here.

Customers configure their own API keys for OpenAI, Azure OpenAI or Amazon Bedrock (Anthropic Claude and others), map high, medium and low model tiers per agent, and can select a model per environment. The KIO backend is a Docker image customers can run in their own cloud or on-premises, which gives data residency control; models outside the validated list are treated as experimental.

The KIO backend is a customizable Spring AI application: developers add tools through MCP servers, write playbooks as CMS documents and inspect tool calls in debug output, and the GraphQL Headless Server serves structured content. There is no dedicated AI SDK, agent-optimized endpoint or LangChain-style integration guide for external agents.

KIO acts only with the logged-in user's rights, cannot publish, delete or move content, writes each change as a new version with a diff view, and audit trails mark AI-originated changes. Administrators restrict KIO to named groups and playbook editing to a playbook manager role, and customer data is not used to train models. Auto-apply of changes is on by default and no IP indemnification or output confidence scoring is documented, so it stays just under 75.

An optional debug mode shows per-request token usage per agent and tool call, and administrators can tune parallelism to manage consumption. The docs tell administrators to use their LLM provider's usage dashboard, and there are no per-user or per-team usage dashboards or quotas in the platform.