Magnolia

Content Types module defines models in YAML (light modules), which works as schema-as-code, with submodels, composite fields, references and an i18n flag per type. No union or polymorphic field type and property types stay constrained by JCR, which keeps it out of the 80+ band.

References are JCR UUID links set through link-field chooser dialogs and content-type-to-content-type references. Relationships are unidirectional and there is no native reverse traversal in the delivery API, so it sits at the low end of adequate.

Page/area/component architecture gives nested component composition with slot-like areas, and Content Apps hold structured entries reusable across pages. Rich text is still stored as HTML rather than a portable structured format, which caps it below 75.

Dialog definitions support required, regex, email and other validators, and custom Java validator classes extend them. Validation lives in the authoring forms rather than the model, with no declarative cross-field rules and limited enforcement on API writes.

JCR versioning creates versions on publish, with a version comparison UI and restore of previous versions; 6.4 adds an external version store (S3/Azure Blob). There is no content branching or release-based forking and deleted-item restore depends on versioned state.

The Categorization module (4.0.0) provides a Categories app with hierarchical categories applied to pages and content, plus a separate Tags app with its own workspace, and catfn templating functions; categories are content exposed through the REST delivery endpoints. No synonyms, term governance or bulk reclassification tooling was documented, so it stays below 75.

The Pages app gives in-context editing on the rendered site, and the Visual SPA Editor brings the same click-to-edit overlays to React, Angular, Vue and Next.js frontends, with device resolution and persona preview in the Preview app. Shareable draft links for headless frontends need an incubator module or custom work, so it misses the 90+ band.

CKEditor 5 (v47 in 6.4.2) with tables, bookmarks, page and asset linking plugins, and since 6.4.6 custom CKEditor bundles in New UI forms. Output is an HTML blob with no portable structured format, so it stays in the standard WYSIWYG band.

The DAM app handles upload, folders, metadata and alt text; Imaging 5.0 generates on-the-fly variations with WebP output and Image Focal 2.0 adds focal points and hotspots; 6.4 adds AI tagging and external binary storage. Responsive variations are definition-based rather than arbitrary URL transforms, and AVIF support was not documented.

Soft locking shows presence and save/move/delete notifications, Content Locking (incubator) adds hard JCR locks, and the Commenting module supports comments with a REST API. There is no simultaneous co-editing or suggestion mode.

The jBPM-based Workflow module ships four-eye approval with task assignment and the Tasks app, Six and Eight Eye workflows add further approval layers, and custom BPMN processes can be mapped per workspace with email notifications. Custom routing requires BPMN/Java and the multi-layer variants are incubator modules.

Scheduled publish and unpublish are set in the publication workflow dialog and run through the Scheduler, and the Campaign Publisher module publishes groups of content together. A calendar view only comes through the Magnolia Orchestrate marketplace app, so it lands in the 60–74 band.

Field-level i18n stores each translation per property (subtitle_en or BCP 47 variants), with per-site locale definitions, default and fallback locales, and a hierarchy-based option for locale trees; delivery endpoints take a lang parameter. Fallback is a single fallback locale rather than configurable chains, which keeps it just below 75.

Custom roles with JCR ACLs by workspace and path, app and web access permissions, and OIDC SSO through the SSO module with custom authorization mapping. No field-level permissions or SCIM provisioning were found, and LDAP and CAS connectors are in maintenance mode.

REST Delivery endpoints with configurable filtering, ordering, paging and locale, plus a GraphQL module (3.1.1) with 2026 fixes for Solr and schema resilience. GraphQL cannot query the Pages or Stories apps and there is no default OpenAPI spec, which keeps it below the 75 REST+GraphQL band.

DX Cloud fronts sites with a Fastly CDN, Surrogate-Control headers and cache management in Cockpit, and the CDN Helper module adds cache headers. Self-hosted installs have no built-in CDN and no sub-second automated purge is documented.

Webhooks 3.0 supports async delivery with up to four retries, path/workspace/node-type filters and custom headers, and 6.4.5 includes the content node in payloads. Only Published and Unpublished events exist, with no HMAC signing or delivery log, so it sits just above the basic band.

REST and GraphQL delivery plus JS frontend helpers make content usable beyond the web, and the content apps are channel-neutral. There are no official mobile or multi-language SDKs and rich text is HTML, so it fits the traditional-CMS-with-API band.

The Personalization module in DX Core provides trait-based segments evaluated in real time, and the CDP Integration Framework connects Segment, mParticle and BSI with YAML tracking config. Profiles stay in the external CDP and audiences arrive via connector, so it lands in the 60–74 band.

Component-level variants targeted at segments and personas are authored in the Pages app and Visual SPA Editor, with persona impersonation in the Preview app. Variant decisioning is rule-based rather than adaptive, which keeps it at the bottom of the best band.

Native A/B/n Testing was deprecated in April 2026 and has been inoperable since 1 August 2026. Testing now runs through the Kameleoon connector (Magnolia Plus), where Kameleoon owns traffic allocation, statistics and reporting, plus an incubator VWO connector.

The Content Recommender incubator module scores content from weighted events with recency and frequency tuning, and the Intent Personalization Platform is a separate incubator service. Both are incubator-grade rather than a supported ML engine, so it stays well below 60.

JCR full-text search and the Solr module provide basic site search, 6.4 replaced the Find Bar with Global Search for editors, and Algolia and Elasticsearch connectors are on the marketplace. No native faceting UI, relevance tuning or search analytics, so basic native search.

Magnolia positions itself as the content layer for commerce and has no native catalog, cart or checkout; commerce comes only through connectors.

First-party connectors for commercetools, SAP Commerce, Salesforce Commerce Cloud, Adobe Commerce and Shopify federate live product data into product pickers and apps, with cart and checkout REST APIs for commercetools. Packaging is integration, which caps it at 60.

Data Intelligence (incubator) adds a Dashboards app with a native content-health source plus GA4, Search Console and BigQuery data. With native A/B result dashboards retired in August 2026, content performance analytics in the product remain thin and incubator-grade.

The Marketing Tags module manages tag snippets natively, and documented connectors cover GA4, Search Console, Piano Analytics, Fullstory and Insightech. Several connectors are incubator modules, which keeps it at the 65 threshold.

The Multisite module runs many sites from one instance with per-site definitions, domain mapping, fallback site and shared content apps and components. Strong native multi-site; no tenant-level analytics, so not higher.

Native XLIFF export and import plus marketplace connectors for Across, ATLS, DeepL, Google and Microsoft translation. TMS and MT connectivity is delivered as integrations, capped at 60.

Live Copy 5.0 provides master-to-copy inheritance with selective change propagation, combined with Multisite and per-site ACLs for brand separation. No cross-brand policy enforcement or brand-level analytics, so it sits at the native threshold.

The native DAM offers metadata, categorization, JCR versioning, external binary storage and AI auto-tagging, and connectors exist for Bynder, Cloudinary and Frontify. No rights or expiry management, asset approvals or brand portals, so it fits the 60–74 band.

The DAM stores small video files without transcoding or streaming, and Magnolia directs customers to YouTube, Vimeo or Cloudinary for video. Video is an embed or connector story.

The Pages app supports drag-and-drop composition of components into areas with template-restricted component palettes, and the Visual SPA Editor extends this to React, Angular, Vue and Next.js frontends. Brand guardrails beyond component availability are limited, which keeps it below 80.

Magnolia renders full sites natively with FreeMarker templates and site definitions. Vendor hosting is DX Cloud, a separately sold PaaS with Fastly CDN, environments, CI pipeline and Cockpit for ingresses and redirects; headless frontends deploy through its pipelines rather than a dedicated frontend host.

The Form module supports multi-step forms with conditions, and the Dynamic Form module adds analytics charts, REST API and external database storage. No progressive profiling or lead routing.

The Mail module sends transactional email (MS Graph support in 6.4.3), and Marketo, Salesforce and HubSpot connectors exist. No subscriber sync with in-CMS email authoring and triggered sends, so basic connector band.

The Marketing Automation Connector Pack links Marketo and Salesforce, and CDP connectors stream behavior to Segment and mParticle. No native automation; integration depth is moderate.

Page properties carry title, description and canonical fields and the SEO module checks pages against best practices. The Google Sitemap module is deprecated in favor of building sitemaps from Solr, redirects come from DX Cloud Cockpit or paid marketplace extensions, and no structured data authoring was found.

No llms.txt generation, Markdown endpoints, AI crawler controls or AI citation reporting were found in Magnolia docs or marketplace. Crawler control would sit with the customer's CDN or frontend.

The Magnolia Marketplace lists 100+ extensions across 16 categories with first-party connectors for SAP, Salesforce, Shopify, Algolia and Cloudinary, plus community modules. Many listings are incubator or partner-built and install is Maven-based, which keeps it below 75.

The Public User Registration module provides visitor registration (mail verification, immediate or admin-supervised), login components and role-based restricted content on the public instance, and the SSO module supports OIDC providers. No portal templates or consent management and CIAM federation for visitors needs configuration, so not 75+.

Magnolia's Delivery Endpoint API (REST 2.1) provides filtering, sorting, paging, multi-language and cross-workspace reference resolution, and the GraphQL module 3.1.1 ships a GraphiQL playground at /.graphiql (introspection off by default). DX Core 6.4.10 (September 2026) made the Nodes and Properties APIs return 400 Bad Request for invalid values instead of silently substituting or dropping them, which improves error handling. GraphQL still cannot read Pages or Stories content, so page delivery remains REST-only, and there is no published OpenAPI spec for the delivery endpoints.

DX Cloud routes delivery through Fastly CDN and load balancers to Kubernetes pods, materially improving API performance for cloud customers, and now carries a 99.9% uptime commitment. Self-hosted performance remains infrastructure-dependent with no vendor SLA, and there are still no published rate limits or performance benchmarks. CDN-backed delivery is a real improvement, but documented performance characteristics remain thin versus cloud-native headless platforms.

Magnolia provides a JS/TS SDK for the Delivery API and a Java SDK (core platform). Framework-specific integrations for React, Angular, Vue, Next.js, Gatsby, and Nuxt are starter kits rather than full SDKs. No official Python, Ruby, Go, or .NET SDKs. The JS SDK provides basic content fetching without automatic type generation from content schema. SDK breadth remains limited at 2 official SDKs.

The docs site carries a module page for each first-party connector: commerce (Adyen, Salesforce B2B, Algolia ecommerce, catalog sync), DAM (Bynder, Amplience, Canto, Celum, Cloudinary, Frontify, MediaValet, Microsoft), experimentation (Kameleoon, VWO), analytics (FullStory, Piano, Siteimprove), deployment (Netlify, Vercel, Bitbucket), plus Veeva, dotdigital, SearchStax, WeChat and Slack, along with the Renivo Core (formerly AI Accelerator) AI modules. That is roughly 25 to 30 maintained integrations covering most categories. It is still a vendor module catalog rather than a self-serve marketplace, and it is far smaller than Contentful's.

Magnolia's extensibility is strong for Java developers. The module system supports custom content apps, custom field types, workflow handlers, REST endpoints, rendering extensions, and UI customizations. Light modules (YAML-based) enable low-code configuration. Custom Java endpoints can be created for tailored APIs. The model is powerful but primarily Java-centric, limiting accessibility for JavaScript-only teams.

Magnolia supports SSO with identity provider federation, SAML, LDAP/AD, CAS, and OIDC. MFA enforced via SSO provider delegation. API key management for Delivery API. DX Cloud includes enterprise SSO capabilities. JAAS-based authentication framework provides flexibility. Solid for enterprise deployments but SSO is Enterprise-tier only, which gates mid-market customers.

Magnolia provides granular permissions and user identity management. ACLs set at content path level, custom roles fully supported, permissions per workspace/content-tree/app. Field-level permissions achievable through custom dialog configuration but not native. Permission inheritance via content tree hierarchy. Mature and JCR-native, but lacks modern ABAC or visual permission debugging.

Magnolia holds ISO 27001:2022 and SOC 2 Type 2 (independently re-audited annually), plus national schemes ENS (Spain) and NIST (US). GDPR compliance tooling with EU data residency via multiple cloud providers (AWS, Azure, GCP, Tencent, Swiss MiroNet), BYOK encryption, and a self-service Trust Center exposing the full certification portfolio. SOC 2 Type 2 + ISO 27001 + GDPR with EU residency puts it at the top of the mid-tier band; absence of a public HIPAA BAA prevents a higher score.

Magnolia has no high-profile breaches. Its responsible-disclosure policy commits to a fix within 30 days, Compass Security performs regular pen testing, and researchers who send strong reports may be invited to a private testing program with possible rewards. NVD lists no new Magnolia CVEs since mid-2025, but the 6.4.10 maintenance release (September 2026) bundles unspecified security fixes. There is still no public bug bounty, which prevents a higher score.

Magnolia offers self-hosted (WAR on Tomcat, Docker) and DX Cloud PaaS with fully managed dedicated infrastructure. DX Cloud supports multi-cloud: AWS, Azure, GCP, Tencent, and Swiss provider MiroNet — excellent flexibility for data residency requirements in regulated industries. Single-tenant hosting provides isolation. The dual model with multi-cloud choice is a genuine strength.

DX Cloud now advertises a 99.9% uptime SLA with automated recovery and multi-region resilience, backed by 24/7 cloud operations, monitoring, and fast-lane support. However, no public status page was reachable and self-hosted deployments carry no vendor SLA. The published 99.9% commitment is a real improvement, but the missing status page and incident-communication transparency cap the score.

DX Cloud uses Kubernetes orchestration with Fastly CDN and load balancer, supporting rolling upgrades with zero-downtime deployments — a meaningful improvement over bare JCR clustering. Author/public instance separation remains. JCR repository scaling limitations persist at very large scale. No published auto-scaling metrics or documented scale limits. Multi-region deployment is supported via cloud provider choice, but enterprise-scale documentation remains lacking.

DX Cloud includes managed infrastructure with multi-cloud options enabling geographic redundancy and automated recovery. JCR XML export and bootstrap mechanism remain for content portability. Automatic security patching reduces risk surface. However, specific RTO/RPO documentation, automated backup frequency/retention details, and multi-region failover specifics are not publicly documented. Adequate but insufficiently documented for enterprises with strict DR requirements.

Magnolia CLI v5 (January 2026) unifies headless and traditional projects, adds a `jumpstart` command for fully configured framework-specific templates, and a `docker start` that removes the local Java prerequisite — a genuine step toward a self-contained local dev experience. Hot reload works for light modules (YAML/FTL) while Java module changes still require a restart. Docker-based startup is a real improvement, but the underlying full Magnolia instance and Maven-based Java workflow remain heavier than headless-CMS competitors.

DX Cloud includes CI/CD pipelines, code and Docker repositories, and Helm values configuration for deployment. Rolling upgrades with zero-downtime. Light modules deployable via CI/CD. Environment management across dev/staging/prod. However, no branch-per-PR content environments or schema migration CLI. Content migration still relies on bootstrap mechanism.

The rebuilt docs site adds llms.txt indexes, per-page Markdown export, an Ask-AI docs assistant and versioned DX Core docs (6.2/6.3/6.4), and GraphiQL gives GraphQL users an interactive playground. Release notes are detailed and include breaking-change guidance with examples. However, the restructuring has left gaps: several DX Cloud paths return 404, and the DX Cloud section of llms.txt is empty, which keeps the score in the adequate band.

Magnolia's TypeScript story remains weak. The JS/TS SDK provides basic types for API interaction but no automatic type generation from content model definitions. Framework starters for React/Next.js/Vue/Angular exist but don't include TypeScript code generation. The platform's Java-centric architecture means TypeScript is supplementary, not primary. Developers must manually define TypeScript interfaces for content types.

DX Core 6.4 kept a monthly cadence through Q3 2026: 6.4.8 (Jul 16), 6.4.9 (Aug 14) and 6.4.10 (Sep 15), following 6.4.2 through 6.4.7 in the first half. Alongside them, AI Accelerator 3.2.0 went GA on 2026-07-27 with Agentic Chat and doc-to-page conversion. LTS streams also kept shipping (6.3.27, 6.2.77). Not higher because the core releases are labeled maintenance releases (GraphQL fixes, search and repository performance, security patches) rather than monthly major feature drops.

Each DX Core release page now opens with a plain-language summary, then has a dedicated 'Breaking changes' section, Improvements and fixes keyed to Jira IDs, links to module changelogs, separate known-issues subpages, and a link to the maintenance-release upgrade guide. 6.4.10 documents its API validation break value by value (for example Boolean '1' now returns 400), which is a strong example of explaining breaking changes. Not higher because the module changelogs are split across dozens of module sites, and code-level migration examples are thinner than Sanity's or Contentful's.

Magnolia runs a public Productboard roadmap portal listing concrete items such as an Orchestrator UI revamp beta, Figma-to-Pages components, PaaS on Google Cloud, multi-region PaaS, an Analytics Agent, modular AI fields and a Helm replacement, alongside a docs roadmap page. That is a structured, customer-facing view of direction. Not higher because there is little visible community voting or discussion, and the horizon stays short.

The lifecycle policy is generous: 6.2 (released March 2020) and 6.3 both get active support until September 2026 and security fixes until September 2027, and 6.4 is promised support for at least two years after the next major. However, 6.4.10 shipped a backward-incompatible change in a maintenance release (the Nodes and Properties APIs now reject values they used to silently coerce), and 6.4.8 quietly lowered a search default from 50 to 20. Both were documented clearly, but breaking behavior in patch releases and the lack of codemods hold this down.

Public developer-community signals are thin. The magnolia-cms GitHub org has 34 public repos with 59 stars in total, and only 2 were pushed to in 2026. The Stack Overflow 'magnolia' tag has 588 questions in total and almost none since 2025. The most-used npm package, @magnolia/react-editor, gets about 28K downloads a month. Not lower because the Community Edition has a real installed base and the vendor runs its own forum and Academy, but there is no Discord or Slack and no visible open-source pull.

Engagement mostly happens in vendor-controlled channels: support tickets, partners and a community site that redirects to an authenticated wiki (401 to anonymous visitors). The public channels a buyer can check are close to silent: Stack Overflow activity has dried up and the GitHub org is barely maintained, with no public issue tracker or Discussions. Not lower because Magnolia staff do run the Academy and partner channels, and Community Edition users get the current major's updates.

Magnolia reports 200+ certified partners in a formal tiered program (Gold, Implementation and Technology tracks) with a Partner Portal and regional offices in APAC, DACH and the Americas. SIs such as Arvato Systems take part. Still European-heavy, so finding certified agencies in North America or APAC is harder than for AEM or Sitecore.

Third-party learning content for Magnolia remains sparse: few external blog posts, YouTube tutorials or non-vendor conference talks, and no notable Udemy or Pluralsight courses or books. Magnolia Academy is the main learning channel, which pushes teams toward partner knowledge transfer.

Magnolia developer talent remains scarce, and Gartner Peer Insights reviewers note difficulty finding developers with deep Magnolia expertise. Job posting volume is low and the Java plus Magnolia-specific skill set narrows the pool; near-zero Stack Overflow activity confirms there is little public knowledge to lean on. Hiring usually means training Java developers, and the certification program has not produced an AEM- or Sitecore-scale pipeline.

Magnolia cites 450+ enterprise customers with marquee logos (American Express, JetBlue, CNN, Sanofi, Sainsbury's, Generali, Ping An) across 100+ countries, and kept shipping AI features buyers can use (AI Accelerator 3.2.0 GA). No new public logo wins or growth announcements surfaced in 2026, and review-volume growth stays slow, so momentum reads as steady rather than accelerating.

GENUI took a majority stake in July 2022, providing PE backing and growth capital, and Magnolia reports about $27.7M revenue with about 252 employees, a healthy ratio for a Swiss vendor founded in 1997. In November 2025 it appointed Luc Haldimann as board chairman with a stated global-growth and AI mandate. No layoffs reported. The main caveat is exit risk that comes with PE ownership.

Magnolia's latest analyst signal is a Visionary placement in the January 2025 Gartner DXP Magic Quadrant, its fifth in a row; CMSWire reported in September 2026 that Gartner has not published a newer DXP MQ. Its composable-DXP-for-regulated-enterprise positioning, between monolithic suites and pure headless CMSes, stays consistent while peers such as Acquia, Optimizely and Contentstack drop the DXP label. Not higher because it has never moved above Visionary and has no visible Forrester Leader standing.

G2 sits around 4.2/5 on a thin base (~36 reviews), and Gartner Peer Insights is similarly low-volume (~3.9/5, ~33 reviews), which puts it in the 45 to 60 band. Reviewers praise composable flexibility, integrations and multi-language and version control. Recurring complaints are costly frequent upgrades, admin-UI limits and implementation complexity. Review sites blocked automated checks this run, so counts were not re-verified.

Magnolia publishes starting prices for both paid editions: DX Cloud from $6,000/mo and DX Core (self-hosted) from $3,500/mo, plus a free open-source Community Edition. The page also names the price drivers (traffic, regions, cloud provider, SLA package, number of sites, extra instances). That is more transparent than fully sales-gated DXPs like AEM or Sitecore XP, but every actual quote goes through sales and there is no calculator or mid tier, so it sits at the low end of the 'public lower tiers, gated enterprise' band.

There are no per-seat fees or API-call metering, and Magnolia states there are no surprise charges for upgrades or limits on content types and locales. But the license scales on several axes: each DX Core instance needs its own license, the number of usable sites is 'defined by the number of sites purchased', some modules need separate special licenses, and DX Cloud price rises with traffic, regions and SLA package. Predictable once quoted, but expanding to more brands or instances means a new negotiation, and the $3,500/mo floor is steep.

The paid bundle is broad: SSO, role-based permissions, customizable workflows, personalization, multisite and SOC 2/ISO 27001 coverage are all listed as included in both DX Core and DX Cloud, so security basics are not held back for a higher enterprise tier. The gating sits elsewhere: Community Edition is capped at one site and one receiver and lacks some DX Core features, pre-built integrations and bot/threat protection carry 'additional costs', some modules need special licenses, and A/B testing now needs the paid Kameleoon-powered Experiments add-on since native A/B testing was retired on 2026-08-01.

Paid editions are quote-based subscriptions with prices expressed per month but no self-serve monthly purchase, and there are no published startup, nonprofit or education programs. A subscription covers all current and future releases, which removes paid-upgrade risk, but exit and renewal terms are not public. The free Community Edition is an entry point, though the jump from $0 to $3,500/mo is a steep cliff.

Community Edition is free, open source under GPLv3, permanent, needs no license key and allows commercial use, with the Delivery REST and GraphQL APIs, light development and the Magnolia CLI. It is limited to one site and one receiver (public instance), has fewer features than DX Core and no support, and the Java stack takes more infrastructure effort than Node-based alternatives. A genuinely useful free tier for a traditional DXP, short of the 65+ band because of the single-site cap.

The Magnolia CLI can jumpstart a project, light modules let developers build templates in YAML and FreeMarker without compiling Java, and there is a 'Jumpstarting a headless Magnolia project' tutorial. Local setup still needs Java, Node.js and a running Magnolia author/public pair, and a meaningful site typically takes days rather than the minutes-to-hours of SaaS headless platforms. Faster than AEM or Sitecore, slower than API-first headless CMS.

Reviewers report basic implementations in 2–3 months and enterprise multi-site projects at 4–8 months, and migrations from a prior CMS are repeatedly described as complex and resource-intensive. Magnolia counters with a Migration Accelerator and solutions architects who stay on after the sale. Shorter than AEM (6–12+ months), comparable to mid-tier DXPs like Liferay or Kentico, and recurring upgrade work (e.g. the CKEditor 4 to 5 migration in 6.4) adds to effective timelines.

Vetted Magnolia developers run about $65–75/hr, and reviewers say developers who truly understand Magnolia are hard to find and expert agencies are pricey. Light development and the React/Angular/Vue front-end SDKs let frontend developers contribute without deep Java, but backend customization still needs Java, JCR and Magnolia expertise from a narrow talent pool. A premium below AEM, above mainstream headless CMS.

Self-hosted DX Core runs as a Java web app on Tomcat with separate author and public instances, each needing its own license, so infrastructure cost comes on top of the $3,500/mo floor. DX Cloud ($6,000/mo) bundles dedicated managed infrastructure on AWS, Azure, GCP or Mironet with unlimited dev/test environments, CI/CD and CDN integration, making costs predictable but high. Lighter than AEM, heavier than SaaS headless CMS where hosting comes bundled at lower prices.

DX Cloud is fully managed with monitoring, automated recovery and up to 99.9% uptime, reducing ops to application configuration. Self-hosted DX Core still needs JVM tuning, JCR repository maintenance, author/public clustering and security patching, which means a part- to full-time DevOps resource, and reviewers flag frequent upgrades as an ongoing cost. Burden is falling as customers move to DX Cloud but remains above pure SaaS.

Content can be exported via the Delivery REST API (JSON), GraphQL for content apps, and JCR XML export, and the GPLv3 Community Edition source lowers vendor risk. GraphQL cannot read Pages or Stories content, so page extraction goes through REST, and templates, Java modules and light-module YAML would all need rewriting on a new platform. Content extraction is feasible; the customization investment is Magnolia-specific.

Magnolia still requires learning the JCR content repository model, workspaces and node types, FreeMarker templating, the page/area/component hierarchy, dialog definitions, light modules vs Maven modules, the author/public publication model and the apps framework. CLI v5 (GA Oct 2024, now 5.3) unifies headless and FreeMarker workflows behind one jumpstart command, which reduces the 'which world am I in' load, but the underlying mental model is unchanged. Lighter than AEM's OSGi/Sling stack but well beyond mainstream web dev patterns, so mid-pack among Traditional DXPs.

The getting-started guide walks through a single `npx @magnolia/cli@latest jumpstart` flow that downloads a Magnolia bundle, demo content and optionally a frontend app, with separate headless and FreeMarker tracks, a Hello Magnolia tutorial, how-to guides and Magnolia Academy certification paths. The guide still opens with JDK installation and JAVA_HOME setup per OS, and there are no interactive in-console onboarding tours like the top headless platforms offer.

The core stack (Java, FreeMarker, JCR, YAML light modules) remains non-mainstream for modern web development, and backend customization is Java-only. Frontend SDK v2 (Feb 2025) is now TypeScript and supports Next.js, Nuxt and Angular SSR, so frontend developers work in familiar frameworks, but anything beyond stock backend behaviour needs Java skills and page delivery runs through Magnolia-specific REST endpoints and component mapping.

Official SDK v2 starters now cover angular, react, vue, angular-ssr, nextjs, nextjs-ssr and nuxt plus a freemarker starter, each with demo content and working examples of component autogeneration, inheritance, i18n and personalization in the visual editor, and all are wired up by the CLI jumpstart command. Teams can publish their own ProjectTemplates for jumpstart. Not higher because the starters live on Magnolia's own GitLab rather than GitHub, there is no Astro or SvelteKit starter, and deployment config is limited to the separate Next.js-to-Vercel project.

The CLI docker-start plugin (Oct 2025) generates a docker-compose.yml and starts Magnolia with file watching, and jumpstart writes mgnl.config.js for you, so local setup is much shorter than it used to be. But docker-start is an add-on rather than the default path, the official getting-started guide still requires a specific JDK and JAVA_HOME, and production configuration spans light module YAML, JCR config, Java module config and property files with non-obvious precedence.

Additive schema changes are easy: content types are YAML in light modules, the CLI create-content-type plugin scaffolds them, and there are no field count limits. The Content Types docs explicitly warn against editing definitions in production because renaming a workspace or changing a node type orphans existing data that then has to be migrated by hand, and there is no automated content migration tooling for breaking schema changes.

The Visual SPA Editor gives in-context editing for React, Angular, Vue, Next.js and Nuxt apps, and Frontend SDK v2 fixed the old inEditor() SSR limitation so server-rendered apps now render (including personalized content) on the author instance without workarounds; externally hosted SPAs are supported. The starters ship with the editor already wired. Setup still needs component mapping and EditablePage/area wiring in the frontend, so not plug-and-play, while FreeMarker sites get in-context editing with no extra work.

Production Magnolia work still needs Java-skilled developers for anything past templates and content types; generalist TypeScript/React developers can build the frontend but not the backend. Light modules and CLI generators (pages, components, content types, apps, REST endpoints) reduce how often Java is needed, and certification is recommended rather than required, but the skill set is proprietary enough that Magnolia developers are a niche hiring pool. More specialized than headless CMS platforms, less than AEM.

A typical Magnolia implementation needs 3 to 5 people: a Java/Magnolia backend developer, a frontend developer and project/content support, with enterprise multi-site or commerce work needing more. Jumpstart and docker-start make solo local development realistic, but self-hosted DX Core production still needs Java and ops expertise. Smaller teams than AEM or Sitecore XP, larger than headless CMS projects.

After go-live the Pages app gives authors strong autonomy: they create pages, pick templates, add and arrange components, and set personalization variants without developers, including on headless SPA sites through the Visual SPA Editor. New content types, templates and components still need developers, but day-to-day content operations are self-serve, a real strength compared with form-based headless authoring.

Major upgrades remain substantial: 6.3/6.2 to 6.4 requires Jakarta EE 10, Frontend SDK v2 (magnoliaContext must be passed or the SPA editor silently fails), browser subapp rewrites, unified role naming and YAML site definitions, with checkpoints after every section. The docs now offer a single unified 6.2 to 6.4 guide (no stop at 6.3 required), an OpenRewrite recipe that automates the javax to jakarta package migration in custom code, and automatic update tasks for data moves such as user profiles; monthly maintenance updates within 6.4 are usually non-breaking. Not higher because the remaining steps are manual and some migration failures are silent (e.g. profile migration resets locales with no error).

Magnolia commits to a fix within 30 days of a confirmed vulnerability, ships it in the next maintenance release (6.4.6 through 6.4.10 each list security fixes, on a roughly monthly cadence) and backports to supported lines; DX Cloud applies patches for customers. Advisories are deliberately terse: release notes carry only a short statement with no details and the Jira issues stay private for 90 days, so self-hosted teams must patch on trust, and Magnolia's patched Apache Tika 2.4.1 fork is flagged by scanners as unpatched, requiring manual suppressions. Not higher because self-hosted patching is a manual WAR/dependency upgrade owned by the customer.

Major-line support windows are long (6.4 end-of-life November 2028), but 2026 brought several vendor-timed changes: native A/B/n testing was deprecated on April 9 and stopped working on August 1, under four months, with the replacement being the paid Kameleoon-powered Experiments module; OpenAI Automations had to move to the AI Accelerator; and maintenance release 6.4.10 broke backward compatibility by making the Nodes and Properties APIs reject values (e.g. Boolean '1', unpadded dates) they previously accepted. Not lower because the core platform's LTS runway is multi-year and the AI module change ships a relocation artifact that preserves existing automations.

Self-hosted Magnolia carries a Maven-managed Java stack (JCR/Jackrabbit, Jakarta EE 10, Log4j 2, GraalVM for JavaScript models, Solr optionally) with periodic upstream-driven churn: Magnolia maintains its own fork of Apache Tika 2.x because upstream dropped the line, and the GraalVM 25 upgrade broke multi-threaded JavaScript model rendering until 6.4.8. DX Cloud abstracts most of this. Not higher because the transitive tree is substantial and occasionally lags upstream security support.

Self-hosted Magnolia provides Log4j 2 logging with a runtime Log Tools app, audit logging, JMX metrics for export to APM tools, and a /.rest/health endpoint aggregating registered health checks for orchestration readiness probes; DX Cloud adds database, cache and CDN dashboards and 24/7 cloud operations. Not higher because there is no native APM or alerting, self-hosted monitoring must be assembled from JMX and logs, and the DX Cloud monitoring docs could not be re-verified this round.

Core content-dependency tooling shows broken-link warnings when pages or assets are marked for deletion, plus a Links dialog and optional Dependencies tab; a Tasks cleaner module purges resolved workflow tasks, and 6.4.10 improved data store garbage collection and the Repository Tools app. The incubator Data Intelligence module adds content-health dashboards. Not higher because dependency checks cover only Pages and Assets by default, there is no proactive site-wide broken-link or orphan scan, and the content-health module is incubator-tier.

Swift Publication in 6.4 speeds publishing, DX Cloud fronts delivery with a managed CDN, and recent releases add cookie-aware cache keys and tunable global-search scan limits. Releases 6.4.9 and 6.4.10 had to fix grid freezes on large asset repositories and add JCR read caching for large workspaces, which shows scale performance still needs attention, and self-hosted sites own JVM, JCR and cache tuning. Not higher because performance at scale remains an active customer concern outside Cloud.

Gartner Peer Insights reviews from 2025-2026 describe support as responsive with a partner-style approach, and DX Cloud adds fast-lane tickets and a dedicated account manager. Good support is gated behind DX Core or DX Cloud licensing (from about $3,500 per month), and a Europe-based team can leave timezone gaps for the Americas and APAC. Not higher because responsive support requires enterprise contracts.

The developer community is small: DevDays draws about 150 developers, Stack Overflow coverage is thin for complex issues, and there is no active public Discord or Slack. Not lower because Magnolia staff participate in community channels and an announcements mailing list keeps users informed of releases and security fixes.

Magnolia 6.4 has shipped a maintenance release almost every month of 2026 (Jan 26, Feb 25, Mar 27, Apr 16, May 13, Jun 16, Jul 16, Aug 14, Sep 15), each with a public Jira changelog filter and a known-issues page with workarounds, and critical security issues carry a 30-day fix commitment. Non-critical fixes still wait for the monthly train, and some releases shipped regressions (6.4.6 and 6.4.7 known issues; an improvement announced in 6.4.4 shipped only in 6.4.6). Not higher because turnaround is release-gated and the small vendor team limits throughput.

Magnolia's WYSIWYG Page Editor provides drag-and-drop component composition, multi-device preview, and template-governed page creation — marketers can build and launch landing pages without developer involvement once components are set up. Campaign Manager lets marketers publish campaigns with a single click and re-run at any time. As of the AI Accelerator 3.x / Magnolia 6.4 (Nov 2025) release, the Text-to-Component feature transforms raw text into structured Magnolia components and can generate entire pages/stories with brand-aware prompts, reducing the initial component-assembly overhead. The component library still depends on initial developer investment (no OOTB marketing component library), which prevents a higher score.

Magnolia's Campaign Manager module supports creating, managing, and scheduling campaigns with visual editing, multi-channel coordination (web, email, social), targeted content delivery by audience segment, and analytics tracking via campaign IDs. Marketo and Salesforce Marketing Cloud connectors allow end-to-end campaign orchestration. Not higher because analytics depends on external providers and the module is a paid add-on.

Magnolia provides meta title/description fields as standard page properties, configurable friendly URLs, URL translation, and 301 redirects through virtual URI mapping and the URI Mapping app. The old Google Sitemap module was deprecated in 6.0 and the SEO audit module is now marked deprecated (incubator, last built for 6.2), so there is no current first-party sitemap or on-page SEO validator in the 6.4 line. The newer AI Analytics extension (Renivo Agentic Chat) combines page SEO metadata with GA4/Search Console traffic, flags missing metadata and CTR gaps, and applies bulk metadata fixes, but it is 1.0.0-beta, not for production, and needs a special license. AI Accelerator also generates SEO-friendly asset metadata. Solid basics, but the dedicated SEO tooling is either deprecated or beta.

Lead capture and conversion tracking are better covered than previously credited. The Dynamic Form module (incubator 3.0.1, 6.4-compatible) lets editors create and publish forms and polls and view answers and analytics, and the core Marketing Tags module (DX Core, 4.0.0) gives marketers an AdminCentral app to inject tracking tags scoped to page trees and linked to cookie consent. Magnolia Conversions powered by Insightech (Magnolia Plus, paid) adds conversion tracking, session replay and behavior insights, and Marketo/Dotdigital integrations push form submissions to marketing automation. Still no native CTA management or UTM-aware content logic, and the conversion layer is a paid partner product.

The core Personalization module (DX Core, 4.0.3) provides trait-based audience segmentation and rule-based variants for pages and components, and Campaign Manager adds per-segment campaign variants. On top of that Magnolia now documents an Intent Personalization Platform (incubator 1.0.1, 6.4) that accumulates per-visitor intent scores from tracked behavior and selects the best-matching experience, plus a Content Recommender with weighted interest-score models and a CDP integration framework (Segment, mParticle, BSI). This gives a real path to behavioral targeting inside Magnolia, but the intent engine is incubator-grade, runs as a separate service with its own database, and resolves client-side, so it is not yet a mature native real-time engine.

Magnolia's native A/B/n Testing module was deprecated in April 2026 and stopped working on 1 August 2026. Its replacement is Magnolia Experiments powered by Kameleoon, a paid Magnolia Plus extension: editors set up experiments in an Experiments app inside Magnolia, variants are filtered at the edge or in the browser, it works with Live Copy, and a winning variant can be promoted back to content. Allocation and statistics are done by Kameleoon, not Magnolia. A VWO module is also listed. This is tight third-party integration rather than native experimentation, and it now costs extra.

Once templates are built, marketers create pages and campaigns without developer involvement using the WYSIWYG Page Editor with drag-and-drop, inline editing, and reusable content blocks. Campaign Manager enables one-click publish and re-run. The AI Accelerator (3.x, GA with Magnolia 6.4 in Nov 2025) generates entire articles, stories, and components from brand-aware prompts and converts raw text into structured components, materially compressing brief-to-publish time, while the new Swift Publication engine publishes large content volumes 70%+ faster. Approval shortcuts and multi-step workflow are available. Initial template creation is a one-time overhead and there are still no native bulk content-editing operations, keeping it just short of the top band.

Magnolia is positioned as a composable/headless DXP that can deliver content to multiple channels via API. The Campaign Manager coordinates across web, email, and social channels. Email delivery is orchestrated through MarTech connectors (Marketo, Salesforce Marketing Cloud) rather than native. API-based delivery to mobile, in-app, and other channels is possible but requires frontend implementation. Web-first with API-based delivery to other channels describes the pattern well.

Magnolia now has in-CMS content performance dashboards. The Data Intelligence module (incubator 1.0.1, 6.4.8+) adds a Dashboards app inside AdminCentral showing published volume, outdated pages and other content-health signals with no setup, plus GA4, Search Console, BigQuery, Insightech and ai12z GEO connectors for traffic, ranking, conversion and AI-citation figures; dashboards can be built by describing them in Renivo Agentic Chat and respect the user's permissions. The AI Analytics beta adds traffic-aware SEO prioritization. Older GA, Adobe Analytics and Piano connectors remain. Held at the threshold because Data Intelligence is incubator and AI Analytics is beta.

Template inheritance, locked template areas and restricted component palettes give component-based consistency, and Live Copy enforces master templates across sites with field-level protection. New in 2026, the Content Compliance module (incubator 1.0.0, 6.4.3+) adds brand profiles capturing voice, terminology and compliance rules that AI tasks use to write, rewrite and validate text on brand, with optional Vale validation. This adds verbal brand governance, but visual design tokens are still enforced only through developer-built templates and the compliance module is incubator-grade.

Magnolia supports OG/Twitter card meta tag management through templates, enabling social sharing previews. No evidence of native social scheduling, push-to-social workflows, or social publishing integration found. UGC embed support is possible but not a first-class feature. Basic OG meta tag management is standard for any CMS of this type, but no social-specific tooling beyond that.

Magnolia's built-in DAM handles organization, imaging variations (including WebP output), focal-point cropping via the supported Image Focal extension, and AI metadata generation from the AI Accelerator (description, caption, title, subject, alt text, bulk tagging). It also ships connectors to external DAMs including Bynder, Canto, Celum, Frontify, Amplience, Microsoft and Cloudinary. Rights management and usage tracking are not native and depend on the connected DAM, which caps the score.

Strong multi-language support, Live Copy for locale sites sharing 80-90% of their content, and locale-specific campaign scheduling. The Content Translation Extended module (5.2.1) automates translation through DeepL, ChatGPT, AI Accelerator or translation-agency connectors with batch management apps, and Content Compliance translation profiles add per-language glossaries that AI translation enforces and verifies. The Privacy module covers consent. There is still no purpose-built transcreation workflow with locale review chains, keeping it below the top band.

Magnolia ships pre-built connectors across many MarTech categories: CRM (Salesforce Sales Cloud), marketing automation (Marketo, Salesforce Marketing Cloud, Dotdigital via a marketing automation framework), CDP (Segment, mParticle, BSI via the CDP integration framework), analytics (GA, Adobe Analytics, Piano, Fullstory, Insightech), experimentation (Kameleoon, VWO), and accessibility/quality (Siteimprove). Webhooks fire on publish/unpublish with retries and filters. Several connectors are incubator or paid, and webhooks cover only publication events.

Magnolia can model product content through its generic content type system, but nothing is purpose-built for PIM. Variant/SKU modeling requires custom content types. Product relationships, attribute management, and faceted product data need custom development. The Commerce Connector Pack pulls product catalogs from commerce platforms but doesn't provide native product content authoring — it is a passthrough, not a PIM.

Magnolia has no general merchandising suite, but the E-commerce Category Sync incubator module (6.4-compatible) imports commerce categories into an E-Commerce Categories app and provides a Visual Merchandise field to reorder a category's products by drag and drop, then plays that order back to the storefront. That is a real, if narrow, merchandising tool. Promotion rules, cross-sell/upsell logic and search merchandising still come from the commerce platform.

Magnolia's Commerce integration framework (included with DX Core) pulls product catalogs and categories into Magnolia, gives editors a product chooser, exposes template functions, and passes cart and order information over REST. Out-of-the-box connectors (paid extensions) cover Adobe Commerce, commercetools, Salesforce Commerce Cloud (certified) and SAP Commerce Cloud (certified), plus a Salesforce B2B connector. The Algolia-backed connector is a 6.2-era proof of concept. This is product picker plus API-level integration with local caching, short of real-time federation.

Magnolia's Commerce Connector enables editors to combine CMS content and product data from the connected commerce platform to create editorial content around products — buying guides, product spotlights, story-driven pages with inline product references. The content-commerce blending use case is explicitly marketed and supported. However, shoppable content with purchase CTAs embedded inline requires developer template work; it is not a first-class no-code authoring pattern for marketers.

The Commerce Connector provides REST APIs for cart and checkout integration, which in principle allows CMS-managed content to be injected into transactional flows. However, this requires developer implementation to inject CMS content into the commerce platform's cart/checkout templates. There is no CMS UI for managing cart/checkout content directly, and no documented pattern for trust badges, upsell banners, or post-add modals without template changes.

No evidence of CMS-managed post-purchase content tied to order events. Magnolia has no order event hooks, no transactional email templates (beyond MarTech connector handoffs), and no documented pattern for onboarding sequences triggered by purchase. Post-purchase content is entirely managed in the commerce platform or email marketing platform.

Magnolia has a Salesforce B2B Commerce connector providing integration with B2B commerce scenarios. The RBAC system can gate content per role or group, applicable to B2B scenarios. However, there are no native features for account-specific pricing display, quote-request flows, or catalog segmentation by account — these rely entirely on the connected B2B commerce platform.

Magnolia offers built-in content search plus Solr and Elasticsearch providers, a Search Index Feeder, and SearchStax integration for enhanced relevance. The Algolia e-commerce connector is an incubator proof of concept built for 6.2, so blended content-product search depends on custom work with the external search provider. No native synonym management or search landing page tooling.

Magnolia's Campaign Manager supports time-based scheduling and activation of promotional content. Campaigns can be published and archived with scheduling, enabling sale banners and timed promotions. Audience segment targeting for channel-specific promotional content is available. However, countdown timers, promo code messaging integration, and tiered pricing displays are not documented as native CMS features.

Magnolia's Multisite module enables a single CMS instance to serve multiple storefronts by region or brand. Shared product content from the commerce connector can be combined with storefront-specific editorial and legal content per site. The Live Copy feature enables centrally authored content pushed to brand-specific storefronts with local override points. Some content duplication is required for storefront-specific customizations.

Magnolia's built-in DAM handles images, video hosting, and audio, with AI-driven asset tagging and metadata generation (expanded in 6.4) helping editors find and describe media. Basic image galleries and video embeds are supported. However, 360-degree product views, AR/3D model references, and image hotspot interactivity are not native Magnolia features — these require custom frontend development or third-party visual commerce tools.

Magnolia has no marketplace-specific content management capabilities. Multi-author content is possible through the RBAC/workflow system, but there is nothing designed for seller profiles, seller-contributed product descriptions, review aggregation, or content moderation at marketplace scale. This use case requires extensive custom development.

Magnolia's multi-language support extends to product content managed through the CMS. Locale-specific product descriptions, regional campaign schedules, and regional legal content are supported through the standard localization framework. Currency-aware content blocks and regulatory content (EU labels, etc.) require developer template work to implement. The localization is generic CMS localization applied to product content, not purpose-built commerce localization.

Magnolia Conversions powered by Insightech (paid Magnolia Plus) adds conversion tracking and session replay, and the Data Intelligence dashboards can surface Insightech conversion figures next to content health inside AdminCentral. Campaign IDs carry through to GA and Adobe Analytics. There is still no native revenue attribution to content pages or product-content performance tied to commerce order data.

Magnolia's RBAC and ACL system provides granular path-based permissions for department-level content segregation. SSO integration enables enterprise employee authentication confirmed across multiple intranet deployments (Generali, Prosegur via Microsoft Active Directory, ISDIN). The Generali deployment personalizes content based on user profile and country for 75,000 employees — confirming audience-based content visibility works at enterprise scale. The permission system operates at both author-facing and audience-facing levels.

Magnolia provides category/tag taxonomy, content tree organization for structured hierarchy, versioning, and approval workflows for knowledge updates. Internal search works for finding content. Real intranet deployments (Generali, Prosegur, ISDIN) confirm viability at enterprise scale. However, there are no purpose-built knowledge base templates, no automatic archival/expiry workflows, and no knowledge lifecycle management features.

Magnolia powers real intranet portals at scale — Prosegur connects 160,000 employees across 26 countries, Generali's portal is the opening page for every employee with content personalized by profile and country, and ISDIN replaced its old intranet specifically to add interactivity and community features. However, these are all custom-built portals on Magnolia's platform. There are no OOTB employee experience features: no built-in notifications, social features, employee directory, personalized dashboards, or employee news feeds.

Magnolia can publish company news and department announcements, and the Personalization module enables audience-segment-targeted delivery of internal content. The Generali and Prosegur deployments confirm targeted internal communication at scale. However, read receipts, acknowledgment tracking, mandatory-read workflows, and internal comms-specific features are not documented — all of these confirmed deployments are custom-built on the platform.

Magnolia has no native employee directory, org chart visualization, or team pages. A basic directory could be built using custom content types and templates, but there are no pre-built templates, no HR system connectors (Workday, BambooHR), and no org chart visualization. Building this requires developer effort.

Magnolia provides versioning, approval workflows, and basic content lifecycle management that can serve policy document management. Version history, content approval chains, and content hierarchy organization are available. However, mandatory acknowledgment tracking, automated review date reminders, and policy-specific expiry workflows are not native features. Basic document publishing with version control describes the capability well.

No purpose-built onboarding journey features in Magnolia. Onboarding content could be structured using content types, audience segments (via Personalization module), and role-based access to progressively reveal content. However, task checklists, HR-triggered new-hire portals, 30/60/90-day progressive disclosure, and onboarding-specific workflows are not native capabilities.

Magnolia provides internal content search via built-in search functionality. External search providers (Algolia, Solr, Elasticsearch) can be integrated for enhanced relevance and faceting. AI-driven search is available for DAM assets. However, there is no native federated search across connected systems (SharePoint, Confluence, Drive), and search analytics are not a documented native feature. Adequate for internal content volumes with external search augmentation.

Magnolia delivers responsive web experiences accessible on mobile browsers. The Prosegur intranet (160K employees including frontline security workers) was built on Magnolia, confirming mobile web access works in practice. However, there is no native Magnolia mobile app, no offline support, no push notification system, and no specific low-bandwidth or kiosk mode — frontline access is via responsive web only.

No native LMS capabilities in Magnolia. No documented connectors for Cornerstone, Workday Learning, or other LMS platforms in the Magnolia marketplace. Learning content can be hosted as structured CMS content, but completion tracking, course assignment, certification, and LMS-side reporting require entirely external platforms with no CMS integration.

Magnolia core has no social layer, but two incubator modules supply basic pieces: the Commenting module (3.0.0, 6.4-compatible) adds comments with likes and dislikes, moderation, author favorites, a REST API and a content app, and the Dynamic Form module creates polls with results analytics. Both need an external database and are incubator-grade. No forums, peer recognition, idea submission or community spaces, so intranets such as ISDIN's still custom-build their community features.

An incubator Slack Integration module (1.2, compatible with 6.2) posts publication notifications for pages and DAM assets to Slack channels through incoming webhooks, and the general webhooks module can call other tools on publish. There is no Microsoft Teams or Google Workspace integration, no embedded content cards and no bot experience.

Magnolia supports scheduled publish and unpublish, version history with a Version Cleaner, approval workflows, and broken-link warnings on deletion. The Data Intelligence dashboards now surface outdated pages as a content-health signal without setup. There are still no automated review dates, content ownership assignment or structured archival workflows.

The Data Intelligence dashboards (incubator) show content volume, outdated pages and GA4 traffic inside AdminCentral, scoped to the viewer's permissions, and Dynamic Form polls report answers. That is basic page-level analytics in the CMS. There is no department-level engagement view, failed-search reporting or intranet adoption dashboard.

Magnolia's Multisite module provides native multi-tenancy with independent content trees, per-tenant configuration, and per-tenant access controls, positioned as consolidating siloed deployments into a single multi-tenant installation. Sites can operate independently or share content and assets. The permission model acts as a UX filter, hiding irrelevant sites/tools per user. True data isolation (separate databases) still requires separate instances — shared infrastructure means some configuration overlap. The isolation model is silo-based (separate content trees within shared infrastructure), adequate for multi-brand within a single organization.

Magnolia's template inheritance and component system supports shared components across brands/sites with per-brand overrides. A global component library can be defined centrally and extended per site. Templates inherit from base templates with brand-specific variations. Shared media libraries are possible within a single instance. The sharing model works well for organizations on a single Magnolia instance but is not as sophisticated as native cross-tenant content federation.

Magnolia provides centralized administration across sites with role-based site-level autonomy — a 'single pane of glass' centralizing global governance while giving local teams creative autonomy. HQ maintains global brand consistency through master version inheritance while local teams use field-level protection to adapt content. Adequate for mid-complexity multi-brand scenarios but less sophisticated than purpose-built multi-tenant governance in larger DXPs.

Multiple brands can share one Magnolia instance, and Magnolia's guidance says consolidating siloed deployments can cut operating costs. But DX Core is licensed per instance and per purchased site, and several modules need separate special licenses, so each added brand site adds licence cost. The economies come from shared infrastructure and operations rather than volume pricing.

Magnolia supports per-site/per-brand CSS theming, template inheritance with brand-specific visual overrides, and per-site style configuration. Each site in the Multisite module can have its own design identity while sharing underlying component structures. Design tokens can be managed at the template/CSS level per brand. This is solid CSS/config-level theming but not a platform-level design token system with enforced style propagation.

Magnolia has strong multi-language support with per-site locale configuration. Translation workflows exist within the platform. Per-brand/per-locale governance with separate translation approval chains is possible through the workflow system. The Generali deployment (50+ countries) and other multi-region deployments demonstrate this works at scale. However, shared vs. isolated translation workflow configuration and brand-aware translation approval are not documented as purpose-built features.

No portfolio-level analytics dashboard spanning multiple brands/sites exists in Magnolia. The analytics integration (GA, Adobe Analytics) shows per-page and per-site metrics. Aggregating engagement, content velocity, and publishing cadence across all brands requires manual aggregation from the analytics provider — no native cross-brand reporting layer.

Magnolia's workflow system can be configured independently per site/brand. Role-based workflows, approval chains, and review stages can be set up differently for each brand. Central audit of workflow activity is available through the admin interface. However, fully independent approval chain configuration per brand with a centralized audit dashboard is not a documented out-of-the-box feature — it requires workflow configuration work per brand.

Magnolia's Live Copy feature is specifically designed for this use case: centrally authored content is pushed to child brands or regional sites via master version inheritance with controlled local override points and field-level protection. Press releases, legal disclaimers, and product announcements can be authored at corporate level and syndicated to all brand sites, with local teams able to override specific fields while the core content is locked from the parent. This is a first-class Magnolia capability actively marketed for global multisite management.

Per-site configuration covers GDPR consent through the Privacy module and Marketing Tags linked to cookie consent, and the 6.4 UI is WCAG 2.1 AA compliant. The incubator Content Compliance module lets brands define compliance rules in brand profiles that AI tasks validate text against. There are still no hard publishing guardrails that stop non-compliant content from going live in a given region.

Magnolia's template inheritance provides a form of federated design system: a core component library is maintained centrally and brand instances extend it with brand-specific variations. Template versioning through the CMS provides update history. However, Magnolia does not have a dedicated design system management tool (no Storybook-like component documentation, no automated propagation of updates to brand extensions, no component versioning system). It relies on CMS-level template inheritance rather than a purpose-built design system layer.

Magnolia has a centralized admin console from which all sites/brands can be managed, with the permission model acting as a UX filter so users only see the slice of the system they manage. SSO is supported across tenants. Central administrators can manage users across all brand sites, while brand-level admins have scoped autonomy within their site boundaries. Cross-brand contributor roles are possible through role inheritance. This covers the key requirements of central admin, autonomous brand teams, and SSO across brands.

Magnolia supports content type inheritance where brands can extend global content types with brand-specific fields and configurations. A global product page model can be extended per brand without fully forking the base model, using template inheritance. Shared content models with per-brand extensions are achievable. The mechanism is the template/content type inheritance system rather than a purpose-built multi-brand content modeling tool.

No executive portfolio reporting dashboard exists in Magnolia for tracking content freshness by brand, publishing SLA adherence, cost allocation per tenant, or capacity planning across the brand portfolio. Per-brand analytics data is accessible via external analytics integrations, but aggregation across the portfolio is entirely manual. This is a significant gap for large brand portfolio management.

Magnolia's Conveyor-hosted Trust Center now publishes a sub-processor list (17 entries with purpose and data location, e.g. hosting DCs 'specified by customer in the contract', LLM providers in Europe), states it will enter into a DPA, and offers a downloadable Technical and Organizational Measures document for DX Cloud. Swiss HQ under nFADP, a named DPO, and customer-chosen EU/Swiss hosting regions complete a strong EU posture. The DPA itself is still not published and SCCs could not be verified publicly, which keeps this just below the 80+ band.

No BAA is offered and HIPAA is absent from Magnolia's Trust Center certification list (SOC 2 Type 2, ISO 27001:2022, GDPR, SOC 3, ENS High). The pharma and biotech industry page covers Veeva Vault PromoMats integration for MLR review, not PHI handling, and the Trust Center FAQ states Magnolia does not collect sensitive client data. Without a vendor BAA this is unsuitable for PHI workloads.

ENS at High category (RD 311/2022) covers Spanish public-sector requirements and Swiss nFADP gives GDPR-equivalent coverage, while the security page markets jurisdiction choice across DACH, UK, North America and AWS Sovereign Cloud. There is still no FedRAMP, PCI DSS, HITRUST, IRAP or C5, and no documented CCPA, LGPD or PIPEDA conformance. Score reflects GDPR plus ENS without broader formal regional or industry coverage.

Magnolia's 2026 SOC 2 Type 2 report (A-LIGN, all five Trust Service Criteria) was released on the Trust Center in April 2026, and a 2026 Type 2 SOC 3 report is now published alongside it for general distribution. The FAQ confirms annual external audits covering the entire ISMS including cloud deployments. Full TSC scope, annual cadence and report access put this at the top of the band.

Magnolia completed its ISO 27001:2022 recertification audit in September 2026 with no non-conformities, at ISMS scope covering cloud deployments, and the certificate is downloadable from the Trust Center. No ISO 27018 or ISO 27701 for cloud PII processing is listed, which keeps this in the 60-75 band.

ENS High category is a meaningful government-grade certification, supplemented by a public SOC 3 report and at least annual third-party penetration testing. There is still no CSA STAR, PCI DSS, FedRAMP, IRAP, Cyber Essentials Plus, C5 or TISAX, so the portfolio is one solid additional certificate rather than a broad stack.

DX Cloud is single-tenant and deployable on AWS, Azure, Google Cloud, Aliyun in China, or dedicated Swiss and European clouds (MiroNet), with the hosting region specified in the customer contract; the security page adds AWS Sovereign Cloud as an option. Self-hosted DX Core gives full sovereignty including air-gapped setups. Fastly CDN/WAF is listed as a global sub-processor, so cached content can leave the chosen region.

The Trust Center affirms customer data deletion and holds a Data Retention Policy and DX Cloud TOMs, and JCR content is exportable via API and export tooling. However, the retention policy, post-termination deletion window and erasure answers are gated behind access requests, and there is no self-service erasure portal.

The JCR audit trail records repository modifications, and the Trust Center states security and admin events plus all CRUD on confidential customer data are pushed to an immutable write-only repository (Grafana Loki) with one-year default retention, configurable by contract. DX Cloud natively forwards core, ingress, Fastly CDN, WAF and Kubernetes logs to customer SIEMs via FluentBit, and Cockpit exposes Keycloak audit events with configurable retention.

Magnolia targets WCAG 2.2 AA and shipped accessible Forms, Global Search and app navigation in Magnolia 6.4 (November 2025), with an Accessible Pages Editor, Content Apps and a completed new authoring UI on the 2026 roadmap. The statement, last modified November 2025, still says 'the Magnolia user interface is not yet fully accessible' and no 2026 deliveries are recorded, so this remains a stated target with partial implementation.

Magnolia publishes an accessibility statement with a release history and roadmap, and its bundled CKEditor 5 carries its own WCAG 2.2 A/AA and Section 508 ACR. No VPAT or ACR for the Magnolia authoring interface is published, either on the website or among the Trust Center documents, and no ATAG 2.0 assessment exists.

Renivo Core (the AI Accelerator, renamed September 2026, v3.2.1 GA) ships AI and Assisted Text Fields (summarize, expand, rewrite, tone change), component, page, story and text-to-component generation, Doc-to-Page conversion, and Hyper Prompt templates for brand tone and keywords. The new Content Compliance module (incubator 1.0.0) adds brand profiles (Always/Never tone rules, preferred and forbidden terms) that AI writing tasks follow and a validation task that reports violations with severity and suggested replacements. Held below 70 because the brand-guardrail layer is an incubator module rather than a supported part of the core AI offering.

Image generation from the Assets app via DALL-E, FLUX (Fal.ai), Gemini and, since 3.2.0, AWS Bedrock models with a selectable image size parameter; the AI Image Editor handles background removal, layer composition and text/shape overlays. Asset metadata generation produces multilingual titles, captions, descriptions and subjects, and Image Recognition auto-tags images with multimodal models. Focal-point cropping exists through the Image Focal extension but is manual rather than AI-detected, and there is no AI video processing, so it stays at 70.

Content Translation Support Extended integrates DeepL, Google Translate, Microsoft Translator and LLM translation inside the editorial workflow, and Renivo Agentic Chat (3.2.0) can translate content and generate localized SEO metadata across all configured locales in one run. Content Compliance translation profiles add per-language glossaries (required translations, do-not-translate and case-sensitive flags) that AI translation enforces and verifies, which is brand-term preservation across locales. No translation quality score is produced, and the glossary layer is incubator, so it sits at the bottom of the 70+ band.

Renivo Core generates SEO titles, meta descriptions and Open Graph tags plus GEO data (structured data, voice summaries, entity mentions), now also as optimize_seo/optimize_geo agent tools that cover every locale in one run; image tags, alt text and multilingual asset metadata are automated. The AI Analytics module adds per-page SEO health analysis combined with GA4/Search Console data and bulk metadata fixes, but it is 1.0.0-beta, specially licensed and flagged not for production. The legacy SEO module is deprecated, so there is no production on-page SEO scoring yet.

AI assists now span image auto-tagging, bulk multilingual asset metadata, segment variant generation, Doc-to-Page ingestion with structured DAM sub-folder organization, and the Renivo Authoring module (incubator 1.0.0), which lets the chat agent search, edit, restructure, version and publish pages and manage DAM assets with review before each change and undo for destructive ones. The pgvector-backed context index supports queries such as finding outdated content or pages missing meta descriptions. Smart scheduling, duplicate detection and automated lifecycle triggers are still absent, and the broadest ops capability is incubator, so it stays below 60.

Renivo Agentic Chat shipped GA in Renivo Core 3.2.0 (27 July 2026): a named agent inside AdminCentral that executes tools from a unified registry, carries context of the current app and selection, and runs multi-step tasks such as all-locale SEO/GEO optimization, translation and dashboard building. Destructive or confirmation-required tools are excluded by default and need explicit human approval (3.2.1), and the Renivo Authoring and Intent Personalization add-ons let the agent draft and change content behind confirmations. Scheduled or event-triggered autonomous pipelines and an agent marketplace are absent, and the richest content-writing tools are incubator, so it sits in the lower GA band.

The Data Intelligence module (incubator 1.0.1, built for Renivo Core 3.2.0) adds a Dashboards app in AdminCentral with native content-health signals (published counts, outdated pages) plus GA4, Search Console, BigQuery and ai12z GEO citation connectors, and dashboards can be built from a plain-language chat request. AI Analytics (beta) adds a site-wide content-priority work queue scored by effort versus impact. Both are incubator or beta and the content-health logic is rule-based rather than AI gap analysis or topic clustering, so it stays below 60.

Content Compliance (incubator 1.0.0, requires DX Core 6.4.3+ and Renivo Core) provides AI validation of text against brand profiles, reporting rule breaks with severity and suggested replacements, and translation verification against glossaries, with optional Vale for deterministic style checks. AI Analytics (beta) detects missing metadata and engagement problems site-wide. This covers the brand-voice dimension reasonably but not accessibility or duplicate/thin-content detection, and both modules are pre-production, so it sits at the bottom of the 45-60 band.

The vector database integration shipped in the GA Renivo Core 3.2.0 release: pages, assets and structured content are indexed as embeddings in PostgreSQL pgvector inside Magnolia, with permission-aware, multi-site and multi-language semantic search feeding RAG for the agent; 3.2.0 also hardened indexing and limited it to activated content. Magnolia Answers (ai12z) adds visitor-facing conversational search. Only OpenAI is supported as an embedding provider and the index serves authoring and agent context rather than a documented delivery search API, so it stays just below 65.

Native personalization remains segment-rule based, and the new Intent Personalization Platform (incubator 1.0.1) scores visitor intent with a documented deterministic weighted-sum model that its own docs say is not machine learning. AI helps on the authoring side: Renivo generates segment variants, and the platform's chat assistant drafts inactive journey experiences and applies intent tags behind confirmation. With no ML scoring or predictive assignment, it stays in the rule-based band, a little above pure rules because of the AI-drafted experiences.

Two official MCP offerings exist: the Dev MCP server (listed in the GA Renivo Core 3.2.0 release) gives Claude, Cursor and Copilot JCR SQL2 queries plus node create/update/delete and template tooling, and the runtime Magnolia MCP module exposes registry content tools (component, variant and image generation, app navigation) to external clients with pattern-based exposure rules and also consumes external MCP servers. The runtime module is 1.0.0-beta2, specially licensed and marked not for production, and the Dev server targets developers rather than editorial publish flows, so it stays below the 75+ band.

Renivo Core is built around bring-your-own-model: OpenAI, Azure OpenAI, AWS Bedrock (including native Converse agents since 3.2.1), Google Gemini (native agent type), Fal.ai and any OpenAI-compatible Chat Completions endpoint, configured through YAML provider and model registries, with per-agent model selection via modelId. Self-hosted DX Core can point at privately hosted models, and data residency follows the customer's own cloud accounts. Embeddings for the vector index are OpenAI-only, which keeps it from going higher.

Developers get a YAML AI agent framework (four agent types, custom tools, renderers and system prompts), a unified tool registry with layered security consumed by both agents and the MCP server, AI task types, parameter mappers, editor plugins, the Dev MCP server with custom plugin support, and an MCP client for federating external tools into agents. This is agent-oriented tooling with official guides, but there are no LangChain/LlamaIndex integration guides or a standalone AI SDK, and the bidirectional MCP module is beta, so it stays below 70.

Renivo Core 3.2.1 (September 2026) added an AI audit log recording every generation (user, origin, model, outcome), every AI content write, provenance failures, tool executions and human approvals, joined by trace id to mgnl:ai* provenance marks on each AI-written node, positioned for EU AI Act Article 50 disclosure. Destructive tools require human confirmation, external MCP calls are default-deny with per-call approval and an optional redaction filter, agents run under the user's roles, and brand profiles enforce voice. There is no IP indemnification or toxicity scanning, and brand enforcement is incubator, so it sits at the top of the 50-70 band rather than 75+.

The new AI audit log gives administrators a per-execution record of who triggered AI, which model answered, the outcome and tool durations, which can be aggregated from the log-audit logger. There is still no AI usage dashboard, token or cost tracking, quotas or quality trends in Magnolia, so admins depend on provider consoles for consumption and spend. This is minimal observability, up from fully opaque.