Enonic

XP 8 defines content types, mixins (formerly x-data) and form fragments as YAML schema-as-code, with a broad input-type set (TextLine, HtmlArea, ContentSelector, ImageSelector, GeoPoint, Date/Time, ComboBox, Long/Double, Tag, CustomSelector) plus nested ItemSets and OptionSets for polymorphic blocks. Schemas can only be authored in code today; decoupled schema deployment without a Gradle app is still on the Q4 2026 roadmap.

ContentSelector inputs reference other items by id with allowed-type constraints, the content tree adds native parent/child hierarchy, and the Dependencies panel shows inbound and outbound references. Reverse lookups through Guillotine need query filters on reference fields rather than a declared bidirectional relation.

OptionSets and ItemSets nest to arbitrary depth inside entries, and the page model adds regions, layouts, parts and reusable fragments, with macros embedding structured components in rich text. Rich text itself is stored as HTML, not a portable AST, and the planned Blocks concept that unifies these is not shipped.

Inputs support required and min/max occurrences, regexp, max length and value ranges, and validation runs server-side so it also applies to API writes; XP 8 lists improved validation controls. There is no documented cross-field rule engine or pre-save validation hook for editors beyond custom input types.

Every save creates a version with author attribution, the Content Studio 6 Version history widget compares versions with field-level diffs and restores any version, and deleted items go to an Archive from which they can be restored. The draft and master branches separate drafts from published content; there are no release bundles or content branching beyond that.

Classification relies on the Tag input type, the hierarchical content tree and category content types referenced through ContentSelectors, with mixins adding metadata schemas across types. There is no dedicated taxonomy manager, controlled vocabulary governance or synonym handling.

Content Studio 6 introduced Live View, a pluggable preview with automatic mode selection, and Next.XP 5 implements it so editors preview drafts on the real Next.js frontend and click into page components in the visual editor. Preview runs per layer and therefore per language; field-level inline text editing on arbitrary headless frontends and shareable public preview links are not documented.

The HtmlArea editor (CKEditor based) supports formatting, links, embedded images with image styles, tables and macros for structured embeds, and XP 8.1 adds processHtmlParts() for headless rendering. Output is HTML rather than a portable AST, which limits custom renderers.

Media are content items in the tree; the Image API scales and crops on the fly by URL with editor-set focal point, filters and quality, WebP and AVIF are supported since 7.15, and the Dependencies panel shows where an asset is used. XP 8.1 lets media be served from a separate CDN host.

Collaboration runs through Issues with assignees, comments and content attached, and version history attributes changes to users. There is no real-time co-editing or presence, and autosave was still a roadmap item in 2026.

Items carry In progress and Ready states, and Publish requests route content to a reviewer who can publish or schedule it, with general Issues for tasks. Approval is a single stage with no custom states, conditional routing or per-type workflows; Workflow MK2 improvements are roadmap only.

The publishing wizard sets Online from and Online to times for scheduled publish and unpublish, and publishes a batch of items with their dependencies in one action. Scheduling changes to already published items is not supported yet and there is no publishing calendar view.

Localization uses layers: child projects with their own language, permissions and workflow that inherit content from a parent, so untranslated items fall back to the parent and updates propagate until an item is localized. Localization is document level per layer, not field level within one item.

Projects have Owner, Editor, Author, Contributor and Viewer roles combined with per-item ACLs, XP 8 simplified permissions with explicit ACLs across branches, and ID providers include OIDC and Microsoft Entra ID. Field-level permissions and documented SCIM provisioning are absent.

Guillotine is the GraphQL delivery API with draft and master branches, filtering, sorting, aggregations and highlighting, and Guillotine 9 builds on the XP 8 Universal API used to expose custom REST endpoints. There is no out-of-the-box REST content delivery API, so REST means building one.

Enonic Cloud fronts sites with Fastly (70+ locations, DDoS filtering) and Next.XP triggers event-driven revalidation on publish. Self-hosted installs bring their own CDN, and granular purge controls are not documented for customers.

Outbound webhooks are configured in com.enonic.xp.webhooks.cfg against node and content events, and lib-event lets apps listen to any cluster event and run tasks. Configuration is file based with no UI, delivery logs or documented payload signing.

Content is channel-agnostic structured data served through Guillotine to any client, with official JavaScript and TypeScript tooling (Next.XP, React4XP, enonic-types). Rich text is HTML and there are no official SDKs beyond the JavaScript ecosystem.

Enonic ships no segment builder, visitor profiles or CDP connector; audience logic has to be written in app code, for example in the XP 8.1 site mapping filters that can re-route requests. Nothing in Content Studio lets marketers define audiences.

XP 8.1 request steering lets a filter render different content at the same URL, which Enonic cites for personalized landing pages, but the decision logic is developer code with no editor-facing variant targeting or per-audience preview.

Content Studio's Variants panel creates linked copies of an item for A/B testing, but traffic splitting, statistics and results come from an external testing tool that serves the variant URLs. Variants were a Content Studio+ feature, now bundled under Enonic License 2.0.

No recommendation engine or related-content algorithm ships with XP or Content Studio; related content is curated manually with ContentSelectors or built as custom queries.

XP's built-in query engine supports full-text, fulltext/ngram, aggregations and highlighting for site search, and Enonic Explorer is a first-party search product with collectors, document types, synonyms, a tuning admin and a GraphQL API. Explorer is a separate licensed application, and there is no merchandising or autocomplete UI kit.

Enonic has no product catalog, cart, checkout or pricing engine.

No first-party or marketplace connectors to Shopify, commercetools or other commerce engines were found; product data would be pulled in with custom selectors or the Universal API.

Content Studio has a Publishing Report and dashboard widgets, and analytics apps on Enonic Market surface page statistics in a widget, but there is no native content performance analytics engine.

Enonic maintains Market apps that inject Google Analytics, Google Tag Manager and Siteimprove into XP-rendered sites, and Enonic's architecture blog names Google Analytics among Market apps. Headless Next.js frontends add tags themselves.

One XP instance hosts many projects and many sites per project, each with its own apps and configuration, and layers share content from a parent project into child projects. Governance runs through project roles and ACLs.

Localization runs in-platform: editors localize inherited items in a language layer, layer inheritance shows what is untranslated, and Juke AI Translator offers machine translation on localize. No TMS connectors (Phrase, Smartling, Lokalise) or XLIFF round trip are documented.

Brands can be separate projects or layers with their own permissions, languages and workflow, and shared apps provide common components across sites. There is no cross-brand policy enforcement, brand-level analytics or locked style tokens.

Media live in the content tree with mixin metadata, tags, version history, Archive and usage tracking through the Dependencies panel. Rights and expiry management, asset approvals and brand portals are absent, and no Bynder or Cloudinary connector is documented.

Video and audio files can be uploaded and served as media attachments, but there is no transcoding, adaptive streaming, captions or player.

Content Studio 6's redesigned Page Editor gives drag-and-drop composition of regions, layouts, parts and fragments with page templates, and since XP 8 it works with any frontend framework, including Next.js via Next.XP. Guardrails come from developer-defined allowed components per region rather than locked design tokens.

XP renders full sites itself (site engine, React4XP) or feeds headless frontends, and Enonic Cloud hosts the platform with Fastly CDN, TLS, a custom domain and 99.5% to 99.99% uptime commitments on paid plans. Hosting of a separate Next.js frontend is not documented as part of the plans, so headless frontends usually run on Vercel or similar.

Enonic's Form Builder app lets editors build simple web forms that email submissions or store them with a Form Report widget. There is no conditional logic, multi-step forms, progressive profiling or lead routing.

No native email sending or ESP connectors were found; email integration is custom work through lib-mail or HTTP clients.

Enonic has no behavioral triggers, nurture flows or lead scoring, and no marketing automation connector was found.

Enonic's SEO Meta Fields app (v3.0, June 2026) gives editors title, description and share image control with Open Graph, Twitter Cards and canonical tags, and Enonic apps add sitemap.xml and redirects; vanity paths and shortcut content handle URLs. Structured data authoring and on-page SEO recommendations are absent, and headless sites must render the tags themselves.

No llms.txt generation, Markdown endpoints, AI crawler controls or AI citation reporting were found in XP, Content Studio or Enonic Cloud. XP 8.1's CSP API and Fastly sit in front, but bot rules are left to the customer.

Enonic Market lists apps, libraries and starters installable from the admin tool, but most listings are Enonic's own and third-party connectors for commerce, DAM and marketing are scarce.

XP ID providers (OIDC 4.0, Microsoft Entra ID 3.0, built-in user store) authenticate site visitors as well as editors, and per-item ACLs gate content natively in XP-rendered sites. There is no portal or self-service account toolkit, consent management, or identity-keyed personalization.

Guillotine provides a schema-aware GraphQL API generated from content types, with a query DSL, aggregations, highlighting and draft or published branch selection, and XP 8's Universal API standardizes how custom APIs are written, secured and mounted under /api. Delivery is GraphQL first, with no ready-made REST delivery API.

Customers run dedicated instances with no published rate limits, Enonic Cloud adds Fastly caching, and XP 8.1 adds subtree queries with returned index fields so listings avoid per-hit reads. There are no published latency figures, sync API or documented pagination ceilings.

Official tooling is JavaScript and TypeScript centred (Next.XP, React4XP, @enonic-types, Enonic UI) plus the Java API for app developers. There are no official Python, .NET, PHP, Swift or Android SDKs; other clients use generic GraphQL.

Enonic Market carries apps, libraries and starters (SEO Meta Fields, Form Builder, analytics, ID providers, Explorer), mostly built by Enonic. Commerce, DAM, TMS and martech categories have little or no coverage.

Enonic apps extend everything in TypeScript, JavaScript or Java: custom APIs via the Universal API, HTTP filters, event listeners, scheduled tasks, custom input types and ID providers, and the XP 8 Extensions API embeds web components into Content Studio. Server-side code runs inside the platform rather than in a separate function service.

SSO is included on the Professional plan, with OIDC 4.0 and Microsoft Entra ID 3.0 ID provider apps, service accounts for API access, and XP 8 adds host-specific authentication and PBKDF2 password hashing. MFA is delegated to the identity provider.

Project roles combine with per-item ACLs (read, create, modify, delete, publish, read permissions, write permissions), and XP 8 makes permissions explicit per branch. Field-level permissions are not available.

Enonic is ISO 27001:2022 certified with annual external audits, also ISO 9001, publishes a DPA and sub-processor list, and hosts Enonic Cloud in the EU/EEA. There is no SOC 2 report or HIPAA BAA.

No public breach was found; Enonic publishes a [email protected] contact, runs external OWASP penetration tests and ships security alerts to paying plans, with source open on GitHub. There is no bug bounty program.

XP runs as Enonic Cloud SaaS, self-hosted open source under GPL-3.0, on-premises with a subscription, on Docker or Kubernetes, and Enterprise customers can get dedicated infrastructure.

Professional plans carry a 99.5% uptime guarantee and Enterprise up to 99.99% with 30-minute priority-A response, and status.enonic.com publishes incidents. 99.5% on the mid plan is below the 99.9% norm.

XP clusters on Hazelcast 5 with replicated storage, Enonic Cloud adds Fastly, and NAV runs Norway's largest public site on headless Enonic. Documented scale limits are not published.

Enonic Cloud runs continuous snapshots with encrypted off-site backups held in Azure Sweden, and XP 8 improves exports with ZIP packaging and consistent node versions. RTO and RPO figures are not published.

The Enonic CLI creates local sandboxes that run the full XP runtime and Content Studio, with dev mode hot reload, so the whole platform runs on a laptop.

Apps (code and schemas) deploy through the CLI and Cloud console to separate environments, and Data Toolbox and export/import move content. There is no schema migration framework or branch-per-PR content environment, and decoupled schema deployment is still a roadmap item.

The developer portal was rewritten in 2026 into CMS, Development Kit and XP core docs with versioned pages, tutorials for Next.js and React4XP and a GraphQL playground. G2 reviewers still ask for more examples and tutorials.

XP 8 apps and Next.XP are TypeScript-first with @enonic-types packages, and Guillotine's GraphQL schema supports standard GraphQL code generation for content types. There is no Enonic-documented type generator from YAML schemas.

XP 8.0 shipped in June 2026 with Content Studio 6, XP 8.1 followed in October, and patch releases land every few days (8.1.1 on Oct 21, 8.1.2 on Oct 26) while 7.16.x is still maintained. Next.XP, Guillotine, CLI and Juke apps release on their own cadence.

Each XP feature release has structured release notes plus separate upgrade notes listing breaking changes and deprecations with replacements, and every Market app carries a versioned Releases section.

Enonic keeps a public roadmap on GitHub, posts detailed roadmap updates on Discuss (April and August 2026) naming features and quarters, and runs a public feature-requests repository.

Enonic uses semantic versioning, XP 8 broke compatibility after 16 XP 7 feature releases, and it shipped an App migrator and Data migrator while continuing to patch 7.16. GraalJS will eventually replace Nashorn, a further migration to come.

The enonic/xp repository has about 211 GitHub stars and 39 forks, and Stack Overflow and package download volumes are small.

Enonic staff answer on discuss.enonic.com and post release and roadmap threads there, and the GitHub repos are actively committed to. Participation outside Enonic and its Nordic partners is thin.

A formal partner program with Associate, Solution Partner and Premium Solution Partner levels and developer training exists, with Nordic agencies such as Item Consulting delivering projects. No global SIs are named.

Third-party tutorials, courses and talks are scarce; most learning material is Enonic's own documentation, YouTube channel and blog.

Enonic skills are concentrated in Norwegian agencies and customers, with no certification visible outside the partner program. Next.js frontends lower the bar, but XP app development remains niche.

Recent references include DiBK migrating from Optimizely and KLP choosing Enonic after a tender, alongside long-standing NAV and Gjensidige deployments. New wins are mostly Norwegian public sector and finance.

Enonic AS was founded in 2000, is privately held and has roughly 20 to 26 employees with single-digit million revenue estimates. It is long-lived but small, with no recent funding.

Enonic positions as a hybrid headless CMS with editorial page building and as the largest Norwegian CMS vendor. It appeared as a gold medalist in Info-Tech SoftwareReviews Digital Experience 2025 but not in Gartner or Forrester evaluations.

G2 shows 4.5 out of 5 from 28 reviews, praising structured content, visual editing and ease of administration, with documentation and tutorials the main complaint. The review count is under 100.

enonic.com/pricing publishes plan features, uptime, response times, storage and incident allowances for Free, Professional and Enterprise, but Professional and Enterprise are 'Contact us' with no prices. Third-party sites cite an older $990/month starting point.

Pricing is based on capacity (Medium or Large) and support level, with 'All functions included' and storage from 100 GB, so cost does not swing with API calls or seats. Extra domains are charged on top.

Professional includes all functions, SSO and the AI assistant; Enterprise adds higher uptime, priority support and security functions. Under Enonic License 2.0 the former Content Studio+ features (variants, archive browser, AI) need a subscription, while self-hosted open source keeps the base CMS free.

Paid plans are sold through sales with no published monthly option, startup, nonprofit or education programs. Partners get discounted Enonic Cloud.

A permanent free Enonic Cloud developer plan gives 5 GB and community support for learning and evaluation but not production, and the GPL-3.0 core can be self-hosted free for commercial use. Subscription-only features such as Juke AI are excluded.

The CLI creates a local sandbox and project from a starter in minutes, and the free cloud plan is 'up and running in minutes', so a first GraphQL query takes well under a day. Learning sites, page templates and app deployment adds more time than pure SaaS headless tools.

Published cases are mostly larger public-sector and finance projects (NAV, DiBK, KLP) with multi-month delivery, and no community timeline data for small sites was found.

Frontends use mainstream Next.js and React, but XP app development needs Enonic-specific APIs, Gradle builds and partly Java, and the talent pool is concentrated in Norway.

Enonic Cloud includes hosting, CDN and backups in the subscription, while self-hosting needs JVM cluster nodes and storage. Headless frontends need separate hosting either way.

On Enonic Cloud, Enonic runs the platform and customers deploy apps; self-hosted clusters need Hazelcast clustering, backups and upgrades managed in house.

The core is GPL-3.0 open source so the same runtime can be self-hosted, exports produce ZIP node dumps and Guillotine reads everything out. Content lives in Enonic's node format and page structures map to XP components, so migration needs transformation.

Developers must learn projects, layers, sites, apps, draft and master branches, page templates, regions, parts, layouts, fragments, mixins and ID providers, and XP 8 renamed several XP 7 concepts. The model is coherent but well beyond five core ideas.

The developer portal has getting-started guides, Next.js and React4XP tutorials and a free cloud developer plan, rewritten in 2026. There is no interactive in-product onboarding, and G2 reviewers ask for more tutorials.

Frontends use standard Next.js with GraphQL, but server-side apps run TypeScript compiled to the Nashorn ES5 engine (GraalJS only in preview), build with Gradle and use Enonic libraries.

Enonic maintains starters on Enonic Market, all upgraded to XP 8, including a Next.js starter with sample content model and preview wired up. Deployment configuration for the frontend host is left to the team.

A headless setup needs the XP app, Guillotine, the Next.XP app, a shared preview token, mutual reachability between XP and Next.js and per-site configuration.

The underlying node store is schemaless, so changing YAML schemas rarely breaks stored content, and there are no field-count limits. Schema changes ship only with app deploys and there is no content migration tooling beyond scripts and Data Toolbox.

Next.XP packages draft mode, the preview route and the visual page editor so a Next.js site gets preview by following the documented setup. Other frameworks need a custom Live View preview extension.

Frontend work is generalist React, but app development, page components and permissions need Enonic-specific knowledge that is mostly found at Nordic partners. No certification is required.

A small team of a couple of developers can ship a site on Enonic Cloud using a starter; larger public-sector builds use partner teams.

After launch, editors build pages from components, templates and fragments in the Page Editor, schedule publishing and localize layers without developers. New component types and schema changes still need a deploy.

Feature releases within a major are drop-in (XP 8.1 has no breaking changes for apps), but XP 7 to 8 required migrating apps from XML to YAML and running the Data migrator. Self-hosted customers apply runtime upgrades themselves.

Patch releases ship within days (8.1.1 and 8.1.2 five days apart, 7.16.x patched in parallel), and paying plans receive security alerts. Self-hosted installs still have to roll patches out themselves.

The XP 8 major forced app rewrites to YAML schemas, renamed concepts and removed deprecated APIs, softened by continued 7.16 maintenance. Nashorn's eventual replacement by GraalJS signals another migration.

XP is one Java distribution with embedded storage and search, so there is no external database or search cluster to run; Hazelcast clustering is built in. The JVM and Java 25 runtime are the main dependencies.

XP 8 exposes Prometheus/OpenMetrics out of the box, the Live Trace app profiles applications in real time, and status.enonic.com covers the cloud. Application-level alerting is the customer's job.

Editors get Online to expiry, an Archive, the Dependencies panel and a Publishing Report, but no orphan detection, broken-link alerts or content health dashboards.

Enonic Cloud adds Fastly caching and dedicated instances, but teams still tune queries, caching in Next.js revalidation and cluster sizing.

Professional plans include ticket and phone support with response targets of 1 hour (A), 5 hours (B) and next business day (C) and up to 20 incidents a year; Enterprise cuts priority A to 30 minutes with unlimited incidents.

discuss.enonic.com has staff participation but low volume, and Stack Overflow coverage is sparse.

Bugs are fixed in frequent patch releases with linked GitHub issues, as with the fixes in 8.1.1 and 8.1.2 within ten days of 8.1.0.

Marketers assemble landing pages in the Content Studio 6 Page Editor with drag-and-drop regions, layouts, parts, fragments and page templates, including on Next.js frontends via Next.XP. New component types still need developers.

Campaign support is limited to scheduled publish and unpublish and publish requests; there is no campaign calendar, grouping or campaign analytics.

The SEO Meta Fields app manages titles, descriptions, Open Graph and canonical tags, and Enonic apps provide sitemaps and redirects. There is no SEO validation, structured data authoring or recommendations.

Form Builder offers simple forms stored in Enonic or emailed, and analytics tags come from Market apps. CTA management, lead routing and conversion tracking need external tools.

Targeting means coding request steering filters in XP 8.1; there are no segments, behavioral targeting or geo rules for marketers.

Variants create test copies of content that an external A/B tool serves and measures; Enonic has no traffic allocation or statistics.

Page templates, reusable fragments, duplication and the visual Page Editor speed page creation, and Juke drafts field content. Single-stage approvals and no bulk editing limit throughput.

Structured content is delivered through Guillotine to web, apps and other clients, but there are no email, social or push channel renditions.

Analytics Market apps inject GA and GTM tags and show page statistics in a widget; content performance metrics stay in external tools.

Developers restrict which components editors may place and Gjensidige runs its React design system through Enonic components. There are no locked brand tokens at platform level.

SEO Meta Fields sets Open Graph and Twitter Card values per page; there is no social scheduling or push-to-social.

The media library has focal-point transforms, tags, metadata and usage tracking, but no rights management or video hosting.

Each market can be a layer with its own language, permissions and publishing, inheriting campaign content and translating it with Juke AI with custom tone instructions. There is no transcreation workflow or regional consent tooling.

Beyond analytics tag apps, no CRM, MAP or CDP connectors were found; integrations use webhooks and custom apps.

Product content can be modelled with OptionSets, ItemSets and media references, but there are no product-specific types or attribute modelling.

No merchandising features exist.

No commerce connectors or product pickers exist; a CustomSelector or Universal API integration has to be built.

Editors can compose editorial pages with custom product parts, but shoppable content needs custom components wired to a commerce API.

Cart and checkout content would come from custom components consumed by the commerce frontend; there is no transactional content support.

No post-purchase or order-event content features exist.

Per-item ACLs and visitor ID providers can gate catalogs and documents by account group, but there are no B2B pricing or quote features.

Explorer indexes content and external collections with synonyms and tuning, but there is no product merchandising or blended commerce search.

Banners and promos can be scheduled with Online from and Online to; channel targeting needs custom code.

Layers and multiple sites let regional storefronts inherit shared content and localize their own editorial and legal text.

Product media is limited to images with focal-point cropping; 360 views, video streaming and 3D are absent.

No marketplace or seller content capabilities exist.

Layer localization applies to product content per market, without currency-aware blocks or regulatory content tooling.

No link between content and commerce outcomes exists.

Per-item ACLs, project roles and groups synced from OIDC or Microsoft Entra ID let intranets restrict content to departments or individuals, and XP-rendered sites enforce read permissions for logged-in employees.

Version history, Archive, content tree hierarchy, publish requests and XP or Explorer search support knowledge content, but there are no review dates or knowledge-article lifecycle tools.

No news feeds, social features or personalized dashboards ship; an employee portal would be built as a custom XP site.

News can be published to access-controlled pages, but there are no read receipts, acknowledgments or mandatory-read workflows.

Users and groups come from the ID provider, but there is no directory, org chart or HR integration.

Documents get versioning, attribution and publish requests, but no acknowledgment tracking or review reminders.

Onboarding paths would be modelled as content with ACLs; there is nothing purpose-built.

Enonic Explorer indexes CMS content and external collections through collectors, with document types, synonyms, a tuning admin and GraphQL. There is no AI relevance or prebuilt SharePoint or Confluence collectors.

Intranets are responsive web; Content Studio 6.1 improved mobile view for editors, but there is no native app, offline mode or push.

No LMS integration or learning features exist.

No comments, reactions, forums or polls for site visitors ship with the platform.

Microsoft Entra ID handles employee sign-in, but there are no Teams, Slack or Google Workspace cards or bots.

Online to expiry and the Archive support retirement of content, but there are no review dates, stale flags or owner assignments.

No internal analytics or search analytics dashboards beyond external analytics tags.

Each project has its own repository, permissions, applications, default language and published content, giving strong isolation within one instance, and Enterprise customers can get dedicated infrastructure.

Apps that provide components and schemas can be added to many projects and sites, and layers share content from a parent project to children.

Central administrators manage users, ID providers and project roles across all brands, but there is no cross-brand policy enforcement or approval chain.

Pricing is capacity-based, so many brands can share one instance; each extra domain costs more.

Per-site configuration and shared components allow brand themes, but theming lives in frontend code rather than platform tokens.

Brand and language layers each have their own permissions and publishing, so translation approval can sit with each brand-locale team. Workflows themselves are the same single-stage model everywhere.

No portfolio analytics exist.

Each project or layer has its own reviewers through permissions, but workflow steps cannot be configured per brand.

Layers syndicate content from a corporate parent to child brands or markets; updates propagate automatically until a child localizes an item, and editors can reset a localized item back to inherited.

XP 8.1 adds a CSP API, but there are no per-brand compliance rules or publishing guardrails.

A shared app can carry a design system's components to every brand, as Gjensidige does with feature toggles, but versioning and propagation are handled through app deploys.

One XP instance centralizes users and groups across ID providers, with per-project roles giving brand teams autonomy, and SSO spans all projects.

Mixins let one brand's app extend shared content types with extra fields without forking the base type.

No portfolio reporting exists beyond the per-project Publishing Report.

Enonic publishes a downloadable Data Processing Agreement and its list of sub-processors, has a Data Privacy Officer, and runs Enonic Cloud on Google Cloud in the EU/EEA with encrypted backups in Azure Sweden. Fastly, a US CDN, sits in the delivery path.

No BAA or HIPAA guidance was found; health-sector customers such as the Norwegian Directorate of Health fall under European rules rather than HIPAA.

Enonic states DORA compliance for financial-sector customers and aligns with Norway's Digital Security Act. No CCPA, UK IDTA, FedRAMP, C5 or PCI coverage is documented.

Enonic's security page lists ISO 27001 and ISO 9001 but no SOC 2 report.

Enonic is ISO 27001:2022 certified as a company with annual external audits covering the 93 controls, and a statement of applicability is available on request. No ISO 27018 certificate is listed.

Enonic also holds ISO 9001:2015 and commissions regular external OWASP penetration tests. It holds no CSA STAR, ISO 42001, Cyber Essentials or government authorizations.

Enonic Cloud data stays in EU/EEA data centres with a Norway option, and self-hosting allows any location. There is no US or APAC cloud region, and the cloud runs on US-owned hyperscalers.

Customers can export nodes as ZIP packages and dump repositories with Data Toolbox, and the open-source runtime reads the same data. Post-termination retention periods are covered in the DPA rather than published.

XP writes audit log entries for content, security, application and repository actions by default, searchable through lib-auditlog and the licensed Audit log browser app. There is no native SIEM push; logs are polled or shipped from the runtime.

Content Studio 6 was rebuilt on Enonic UI with WCAG 2.1 AA as the target and documents its accessibility features. Enonic's own October 2026 audit of 6.2.0 found 30 criteria passing, 4 failing and several partial, so it does not yet conform.

An accessibility page in the Content Studio docs and a public audit issue describe status and gaps, but no VPAT or formal ACR is published.

Juke AI Content Operator (v2.1, Oct 2026, GA) is a chat in the Content Editor that knows the content type's fields, fills or revises them, offers multiple alternatives per field and takes custom instructions for tone and purpose. It needs a subscription, and there are no governed brand voice profiles or bulk generation.

The Juke update brought automatic alt text for newly uploaded images, provided by the Content Operator app. There is no AI image generation or AI media processing.

Juke AI Content Translator opens an automated translation dialog when an editor localizes an inherited item in a language layer or changes its language, translating text fields across all schemas with custom instructions such as dictionaries or tone. Output is not quality scored.

Alt text is generated automatically and editors can ask Juke to fill SEO description fields through the chat, but there is no automatic tagging or on-page SEO scoring.

AI assists are limited to alt text on upload and translation on localize; there is no auto-tagging, duplicate detection or AI routing.

Assigning issues to Juke in agent mode and an 'Agentic CMS' are on the roadmap, not shipped.

No AI content gap analysis, scoring or health dashboards exist.

No AI auditing for quality, brand voice or accessibility exists.

XP and Explorer provide keyword search with synonyms and tuning; no vector or semantic search is documented.

There is no personalization engine, rule-based or ML.

Enonic has no official MCP server; an extensible MCP API built on XP's IAM is a Q4 2026 roadmap item, and the only working server found is a demo built by the agency 99x.

Juke runs on Google Gemini models through Vertex AI provisioned by Enonic, and customers may configure their own Google account instead. Only one provider is supported.

Enonic publishes an agent skills repository (enonic/enonic-agent-skills) covering content types, Guillotine queries, Next.XP, migration and webhooks for coding agents, and the schema-aware GraphQL API suits RAG pipelines. There are no AI SDKs or LangChain integrations.

AI output is only a suggestion an editor inserts and the normal workflow still applies, and Enonic states customer data is not stored or used for training, with Google as a listed sub-processor. There are no AI audit trails or brand enforcement.

No AI usage, cost or quality dashboards were found.