Squiz DXP

Component content models are defined in JSON Schema with custom input types (FormattedText, SquizImage, SquizLink) and deployed as code through the dxp-component-library CLI, while Matrix metadata schemas add typed fields grouped into sections with defaults, editability and required settings. A genuine two-tier model rather than rigid templates, but there are no union or polymorphic field types and schema-as-code covers components, not the asset types themselves.

The Matrix Linking screen exposes where an asset is linked from, NOTICE links record dependencies so deletions surface their impact, and %asset_linking_info% returns linking data including parent lineage; page-builder usage reporting adds where-used for templates, layouts and components. That meets the one-to-many-with-reverse-lookup band, but the model is a hierarchical asset tree with no polymorphic references, native many-to-many fields or graph-style querying through the delivery API.

The Component Service provides reusable, nestable components from a central design-system library, and templates and layouts became first-class reusable building blocks in 2026, so composition spans component, layout and template tiers. Component content is structured JSON, but rich text inside it is HTML rather than a portable structured format and nesting depth is undocumented, which keeps it below 75.

JSON Schema underpins component models, giving the standard vocabulary (required, type, min/max, enum, pattern), and Matrix metadata fields enforce required values and defaults. No cross-field rule engine or pre-save validation hook is documented, and it is unclear whether schema rules are enforced on writes through the management API, so this stays in the standard built-in band.

Matrix keeps automatic version history per asset and the Page Builder gained a dedicated version history UI in 2026 that selects, compares and restores versions; Safe Edit holds a draft alongside the live version for comparison before approval, and the trash allows deleted assets to be recovered. No content branching or release-based versioning and no documented programmatic version API keep it below 75.

Matrix metadata schemas can be applied across any asset type (pages, files, DAM assets) with typed select and hierarchical fields, and the Thesaurus asset provides a controlled vocabulary with term relations and synonyms that Funnelback search also uses; asset-level permissions govern who can edit schemas and vocabularies, and metadata is returned through the Content API. Held below 75 because there is no dedicated taxonomy manager with term-level governance or bulk reclassification UI, and the newer component and page-builder layer has a thinner classification story than core Matrix.

Because Squiz renders the production site itself, the Visual Page Builder and Matrix inline edit mode let editors change draft content in place on the real page, with Matrix 6.6 extending inline editing to component properties, personas and display conditions, Safe Edit previewing unpublished changes, and 2026 language variants allowing per-language preview. The ceiling is that in-context editing applies only to Squiz-rendered pages: there is no draft preview or click-to-edit overlay SDK for a separate headless frontend.

The FormattedText input provides a WYSIWYM editor with a standard toolbar (formatting, alignment, lists, images, links, tables, raw HTML) that emits clean HTML aligned to the design system, configurable per component through JSON Schema, and Matrix's WYSIWYG offers asset embedding by link. Output is an HTML blob rather than a portable AST with custom renderers, which caps it at the standard WYSIWYG band.

The built-in asset library handles images, video and documents with metadata, centrally managed alt text and captions, and versioning; uploads are automatically converted to WebP (v6.18) and AVIF, image varieties are generated automatically or by trigger for responsive use, an in-built editor crops and resizes, and linking data shows where an asset is used. No URL-parameter transform API or focal-point control is documented, which keeps it below 75.

Matrix prevents last-write-wins: asset locking blocks concurrent edits and names the lock holder, separate attributes can be edited concurrently, Safe Edit isolates in-progress changes, and comment assets plus workflow comments and change requests provide async annotation with author-attributed history. There is no real-time co-editing, presence indicator or @mention notification documented, so it sits in the locking-with-async-comments band.

Workflow schemas are configured in the admin interface without code: multi-step approval chains with conditions, steps bound to roles and user groups, email notifications, approve and reject with comments, and an attributed audit trail, applied per asset or subtree so different content can follow different paths, and since September 2026 admins can stop users opting out of inherited workflow when moving assets. Parallel approval paths and due dates or SLAs on review tasks are not documented, which keeps it from the top of the band.

Future Status schedules any asset to publish, archive (unpublish) or go up for review at a set date and time, covering embargo and expiry, and the Scheduled Jobs Manager lists every pending job system-wide. There is no calendar view of upcoming content and no release bundles that publish many assets atomically, so it sits in the scheduled-publish-without-bundles band.

Matrix Contexts store alternate field values per language on the same asset, falling back to the default context when no translation exists, component fields can be marked translatable, and 2026 Page Builder language variants manage all of a page's languages in one interface. Fallback is to a single default rather than configurable chains, and locale-aware validation and per-locale publishing are thinly documented, so it stays below the 75+ field-level-with-fallback-chains band.

DXP primary roles govern service access organisation-wide while Matrix applies granular read, write and admin permissions at asset and subtree level, with roles usable as workflow steps, custom roles scoped to services, sites or DAM folders, and SAML 2.0 SSO; a September 2026 feature restriction stops users opting out of inherited workflow, role and permission schemas when moving assets. SCIM provisioning and field-level permissions are not documented, and console SSO is arranged through Squiz rather than self-service, which keeps it in the good-role-model-with-SSO band.

The read-only Content API (in Matrix core since 6.16) uses bearer tokens minted in Content API Manager and scoped to an asset subtree, with a data parameter to select properties plus filtering and pagination, and a separate REST API covers management. GraphQL exists only as a Beta Connect component for calling external services, not as a native delivery API, which keeps this in the REST-only band.

Squiz DXP SaaS fronts delivery with Cloudflare CDN, WAF and Squiz Edge Workers, and Edge Side Includes let dynamic fragments assemble at the edge, giving a managed CDN with real edge compute. Cache purge latency on publish is not documented, which keeps it out of the 80+ sub-second band.

Trigger Manager events (status change, web path update, publish and more) fire outbound into Squiz Connect flows, which provide filterable execution logs, operator-initiated error retry, custom error handlers and credential-secured webhook triggers. Retry is manual reprocessing rather than automatic backoff, HMAC payload signing is undocumented and there is no event-streaming alternative, so it sits in the solid-webhooks band.

A traditional CMS with a headless API layer added: the Content API supports hybrid delivery and component content is JSON, but the architecture is page-first, rich text is emitted as HTML, and no official SDK fleet across several languages is published. That places it in the traditional-CMS-with-API band.

Squiz's own CDP builds rule-based and event-driven segments from first-party behaviour, evaluated server-side each session, with Single Customer View profiles, per-site segment sets and segment templates added in 2026, automatic portal-user sync, and a Tealium integration that queries external profiles at request time. It is licensed as part of the separately sold Personalization capability rather than the base CMS, so the add-on ceiling applies, and the attribute palette is narrower than dedicated enterprise CDPs.

Authors create per-segment variants of content blocks directly in the Visual Page Builder and preview what each segment sees before publishing, with CDP-driven server-side delivery. Strong native variant handling, held below the add-on ceiling because priority and fallback across overlapping segments are thinly documented and the capability sits in the separately licensed Personalization module.

The Optimization service provides adjustable traffic distribution, conversion goals by element selector or destination URL, a duration and significance calculator, variants edited in the Visual Page Builder and in-platform reporting, with segment-scoped tests added in 2026. It is strictly two-variant A/B testing with no multivariate or bandit mode, and it is licensed alongside Personalization rather than in the base CMS.

Funnelback ships a recommender that suggests related items from query and click logs (CO_CLICKS, RELATED_CLICKS, RELATED_RESULTS), a real algorithmic signal rather than manual curation. It is search-package-centric, not an editorial recommendation engine wired into page authoring or CDP profiles, and requires the separately licensed Search product.

Squiz Search (Funnelback) is a first-party enterprise search product with full-text and faceted search, relevance tuning across 70+ ranking factors, autocomplete, synonyms, multi-source indexing of external systems and search analytics, under active 16.x development in 2026. It is the platform's strongest DXP capability, scored at the add-on ceiling because Search is sold as its own product in the suite.

Squiz DXP has no product catalog, cart, checkout, pricing or inventory; its capability set is content, search, CDP, personalization, forms, DAM and integrations. Commerce is reached only through connectors, scored in 2.3.2.

Squiz Connect has first-party connectors for BigCommerce (SKU to product ID mapping), Shopify with Buy Button embedding, Magento 2, PayPal and Stripe. These are API-level flows rather than an in-editor product picker or live catalog federation, and commercetools, SFCC and SAP Commerce are not covered.

The Behavioural Analytics capability adds visual journey mapping with drop-off identification and A/B results with real-time significance, Funnelback adds search analytics and a Content Auditor for readability, missing metadata, duplicate titles and outdated pages, and Content Intelligence (GA May 2026) adds a site-wide Content Health dashboard; the CMS adds usage reporting for templates, layouts and components. Journey and conversion analytics sit in separately licensed capabilities, and author productivity or editorial throughput reporting is not documented.

Google Analytics is a prebuilt entry in the integration library and Connect adds Tealium, Mixpanel and Power BI connectors, with Matrix pages accepting any tag manager snippet. No Segment, Amplitude or Adobe Analytics connector is documented and there are no event helpers for the page builder.

A single Matrix system routinely runs hundreds of sites, with shared assets linkable across sites in one tree, component libraries shared across sites with per-site or per-channel availability, and per-site configuration; one customer story covers 400+ publishers on one DXP. Below 85 because cross-site reuse is component- and tree-led rather than a governed shared-content repository with site-level overrides.

Squiz Connect provides first-party connectors for RWS (SDL) and Lionbridge plus a Google Translate machine-translation connector, and the page builder manages language variants in one interface. These are Connect flows rather than an in-platform translation job UI with translation memory, and Phrase, Smartling, Lokalise and Crowdin are not covered.

The Component Service is a design-system governance layer: a central library of brand-approved components, control over which components and versions each site or channel may use, and brand rules compiled into components; a documented two-brand deployment themes one design system per brand from one codebase. Cross-brand approval routing and brand-level analytics are not documented as distinct features.

The built-in DAM, included without an extra licence, provides metadata schemas, tagging, versioning and permissions with centrally managed alt text and captions, guided to libraries of roughly 10,000 assets, and Squiz maintains two-way Bynder and Asset Bank integrations for larger estates. There is no rights or expiry management, asset approval workflow or brand portal, which keeps it at the bottom of the library-with-taxonomy-and-versioning band.

Video uploads into the asset library with playback in the preview screen and centrally managed captions, transcripts and descriptions, and a MediaValet connector serves external media workflows. There is no transcoding, adaptive streaming or Squiz video player, so production video is normally embedded from YouTube or Vimeo.

The Visual Page Builder offers drag-and-drop assembly from a governed component library, inline editing with live preview, reusable templates and layouts (2026), per-site component availability as brand guardrails, and usage reporting before changing a building block. It composes Squiz-rendered pages only, with no visual composition for an external headless frontend, and template locking is less granular than the leading builders.

Squiz DXP is a SaaS platform that both renders and hosts the full site: Matrix produces the pages, delivery runs on Squiz-operated infrastructure behind Cloudflare CDN and WAF with custom domains, TLS and Edge Workers, and the Component Service runs component code on Squiz infrastructure. Hybrid headless delivery is supported through the Content API, but Squiz does not host a customer's separate JavaScript frontend, which keeps it below the 90+ band.

Advanced Forms delivers drag-and-drop design, chained conditional logic including hidden fields, multi-page forms, payments, save-and-resume, submission token validation (January 2026) and progressive profiling that writes answers into CDP profiles and pre-fills from them; Matrix's base Custom Form asset covers simpler needs natively. Scored as add-on because Advanced Forms is its own licensed capability, and native spam protection and field-level drop-off analytics are not documented.

Official connectors cover Mailchimp, Marketo and HubSpot, and the CDP tracks email campaign link clicks into profiles. There is no native send, no in-CMS email composition or preview and no documented triggered sends from content events.

Squiz feeds automation tools rather than running automation: CDP events and form submissions flow into Marketo, HubSpot and Salesforce through Connect, and journey mapping visualises journeys without orchestrating them. No native drip, nurture, lead scoring or lifecycle stages are documented.

Matrix manages meta titles and descriptions through metadata schemas, generates XML sitemaps, handles redirects through the Remap Manager with bulk import and PCRE pattern rules plus automatic redirects when URLs change, and outputs canonical and hreflang tags through designs. The Funnelback SEO Auditor, built into Squiz DXP, benchmarks a page against the top results for a target keyword and gives prioritised on-page advice. Structured data is still hand-built in templates rather than authored with validation, which keeps it below 75.

The AI Readiness Auditor in Squiz Content Intelligence (GA May 2026, bundled into Squiz DXP) groups the site into topics, generates realistic buyer questions, tests whether AI systems can answer them from the content and ranks page-level fixes so ChatGPT, Claude and Google AI Mode can cite the site. That is genuine first-party AEO guidance, but there is no native llms.txt generation, Markdown endpoints, managed per-bot crawler rules or AI-referral reporting, which must be assembled through hand-edited robots.txt, text assets and the Cloudflare layer.

marketplace.squiz.net and the integration library advertise 100+ integrations, backed by around 61 Squiz-built Connect connectors across CRM, DAM, commerce, translation and analytics plus generic REST, SOAP, GraphQL and webhook components, with Google Calendar, ServiceNow, SharePoint, Microsoft Fabric and MediaValet added in 2026. Nearly all connectors are Squiz-built, with little partner-contributed ecosystem, which keeps it below 75.

Matrix supports front-end visitor accounts natively: Account Manager registration and profile pages, SAML, OAuth 2.0 and LDAP authentication for site users, permission-based gated content and personalised portal pages, with 2026 automatic portal-user sync into the CDP so personalization keys off authenticated identity. Consent and preference management and social login are assembled from these building blocks rather than shipped as a portal product, which keeps it just below 75.

docs.squiz.net/dxp-api is now a genuine API portal indexing 14 interfaces with public/private markers — Matrix SOAP/JavaScript/Content Delivery/Asset Management, Integrations REST, Logging Service, Job Runner, File Store, and six Funnelback APIs — a real improvement over the two-page stub of the prior pass. The content delivery surface is still read-only REST with bearer tokens, the GraphQL component remains explicitly Beta and is an outbound connector to third-party GraphQL APIs (with documented parsing, attachment and OAuth2 limitations) rather than a native GraphQL delivery API, and there is no interactive playground. Fragmentation across eight product modules keeps it below the well-designed-single-REST-API band.

Delivery is CDN-backed via Squiz Edge on AWS with Elastic Load Balancing across multiple availability zones, and the Datastore provides server-side pagination (limit(), page object for multi-collection requests). However, no rate limits, throttling policy, pagination ceiling, or include-depth limit is published for the core Content, Asset Management, or Integrations APIs — the only documented rate limit found belongs to the third-party Bynder connector. Absence of published limits is the binding constraint on this item.

The official SDK surface remains JavaScript/TypeScript-only and is actively maintained — @squiz/dx-json-schema-lib 1.90.2 (2026-10-01), @squiz/local-component-dev-ui 0.8.2 (2026-09-29), @squiz/dxp-cli-next 5.36.0 (2026-10-15), @squiz/db-lib at 510 published versions. No official SDK exists for Python, Java, .NET, PHP, Swift, or Android, and the @squiz npm scope returns zero results in npm's public search index, indicating no discoverable community layer either. Strong release cadence cannot lift a single-language ecosystem out of the community-only band.

The integration library at dxp.squiz.net/integrations now enumerates exactly 100 distinct named integrations across 20 categories — CRM (Salesforce, Dynamics, Pipedrive, Zoho, Sugar, Creatio), DAM (Bynder, MediaValet, Frontify, Asset Bank), commerce (Shopify, Adobe Commerce, BigCommerce, WooCommerce), payments (Stripe, PayPal, Braintree, Westpac PayWay), AI (ChatGPT, Claude, Gemini, Grok, Manus), translation (DeepL, Wordbee, Lionbridge), analytics and LMS — substantiating the vendor's 100+ claim that the prior pass could only verify at 61. A separate marketplace.squiz.net adds extensions, templates, blueprints and recipes. Held below 75+ because every listing is Squiz-built and Squiz-maintained: the Marketplace carries only five extensions and there is no third-party publishing model or revenue share.

Component Service supports custom web components with typed JSON Schema input definitions, inline editing integration, enforced SemVer with documented rollback to earlier versions, per-site component libraries, and Components-at-Edge server-side execution with fetch access; the Job Runner API adds programmatic scheduled server-side jobs, and Marketplace Extensions (HTML CodeSniffer, JSON Web Token, Matrix Keyword Helper) extend the Matrix authoring UI. This is materially more than webhook-plus-UI extension. It stays short of 75+ because there is no app framework for building custom DXP console panels or sidebar widgets, and no platform-level content lifecycle hook API.

DXP console SSO is SAML 2.0 only and is not self-service — the docs state setup "can be arranged by contacting your Customer Success Manager," and there is no SCIM or directory sync ("Users in your directory are not automatically created within your DXP service, you must manually invite users"). OIDC is documented only for front-end Portal authentication, not console login, and MFA is explicitly delegated to the IdP ("the password (or 2FA) associated with your single sign-on") with no native enforcement. SSO being bundled rather than tier-gated holds it in the mid-60s; the vendor-mediated setup and missing SCIM, which the prior pass did not capture, prevent more.

The DXP console ships fixed primary roles (Owner, Admin, other primary roles) plus four service-scoped secondary roles — Customer data agent, Forms admin, Logs auditor, Chatbot reviewer — with SAML attribute mapping; custom role creation is documented only within Search. Matrix supplies granular asset-level and tree-scoped permissions, and Content API tokens can restrict access to specific branches of the asset tree with most-restrictive-wins precedence. The modern DXP layer still documents no field-level or content-instance-level permissions and no general custom role builder, which caps this at the predefined-roles-plus-granular-legacy-layer midpoint.

Squiz holds ISO/IEC 27001:2022, CSA STAR Level 1, TX-RAMP Level 2 (certification TX1591016, expiry 2028-08-25, via the lightweight Acknowledgement and Inventory Form path), and GDPR commitments — but its SOC 2 is Type 1, not Type 2. Critically, the prior score of 76 rested on an EU data residency claim that is false: squiz.net/security/squiz-saas-platform lists Squiz-managed AWS hosting as United Kingdom, North America and Australia only, and post-Brexit the UK is not an EU region. No HIPAA BAA is offered. Correcting the residency error and the Type 1/Type 2 distinction drops this well out of the 80+ band.

No CVEs or breaches specific to the Squiz DXP SaaS platform surfaced for 2025–2026; the platform runs an ISO 27001-certified ISMS with bi-annual third-party penetration tests, TLS 1.2+ with BYOK, and monthly releases that bundle dependency security upgrades plus specific hardening fixes (September 2026 corrected form-submission assets becoming publicly readable when disconnected from their parent form). Disclosure is a published [email protected] contact and an NDA-gated trust center at trust.squiz.net rather than a public advisory feed. No bug bounty program exists, which holds this at the top of the clean-history-with-basic-disclosure band.

The modern DXP is SaaS on Squiz-managed AWS with a customer choice of United Kingdom, North America or Australia, single-region deployment across multiple AZs, logical tenant separation at the database level, and BYOK for TLS certificates. Squiz Matrix 5 remains self-hostable for on-premises or private cloud, giving more flexibility than pure SaaS. The score is capped because Matrix 5 is now filed under "Legacy Products" in the docs navigation and the current DXP capability set — Component Service, CDP, Content Intelligence, Connect — is cloud-only, and there is no EU-resident option.

Squiz publishes a 99.9% Monthly Uptime Percentage SLA measured at the CDN, a live public status page at status.squiz.cloud with incident history, and — unusually for this tier — a contractual support agreement with both response and resolution targets (P1 immediate and no greater than 30 minutes response, 6 hours resolution; P2 2 working hours; P3 2 working days) on 24/7 coverage, bundled into the subscription rather than sold as a premium tier. The published resolution commitments lift this above a bare 99.9%-plus-status-page posture. It stays under 80 because the SLA itself is 99.9% rather than 99.95%+, and no resolution target is published for non-outage functional defects.

Squiz documents Elastic Load Balancing distributing workloads across multiple AWS availability zones within a region, scaling "both automatically and on demand" in response to traffic spikes, Squiz Edge CDN delivery, and Components-at-Edge rendering, with substantial public-sector and higher-education reference deployments. What is missing for the 75+ band is any published quantitative ceiling — no documented limits on assets, entries, concurrent authors, or API calls per second — so buyers cannot size against the platform without a vendor conversation.

Substantially better documented than the prior pass found: Squiz operates a primary/secondary data centre model with Squiz Edge failing traffic over to a read-only secondary during a primary outage, states it performs DR "against measured Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)," and the subscription agreement commits to backups every 24 hours retained 30 days plus a 30-day post-termination data export window. Export tooling exists — Matrix Export assets to XML and Export files tools, plus asset version control retaining the previous 100 changes. It cannot reach 75+ because the actual RTO/RPO figures sit behind an access-request form at trust.squiz.net rather than being published, backups are explicitly "not for archival purposes," and the export window is request-based with a proprietary XML schema.

@squiz/local-component-dev-ui (0.8.2, published 2026-09-29) and @squiz/dxp-cli-next provide a genuine local development server for the component layer with auto-reload, local environment variables, and local layout testing, so developers can build and preview components without a live DXP connection. This is real local tooling rather than remote-only workflow. It falls short of a higher score because the emulator covers only components — there is no local Matrix/CMS instance, Content API, Datastore, or Connect emulator, so anything touching content or integrations requires a live environment.

Component Service enforces Semantic Versioning — every code change requires a version increment and redeploying a changed component under an existing version is impossible — and Squiz documents reverting DXP environments to an earlier component version, which is real deployment rollback rather than just version labelling; bring-your-own CI/CD runs through the CLI with deployment enablement controls and lint/format gates, and Connect documents staging/production workspace separation. It remains mid-band because there is no schema migration tooling for content model changes and no branch-per-PR or ephemeral content environment pattern, so content-model changes are still promoted manually.

The help centre has grown materially: roughly 17 capability sections now including new Content Intelligence, Advanced Forms and Optimization trees, a dedicated DXP Releases site, a centralized DXP APIs portal indexing 14 interfaces with public/private markers (previously a two-page stub), a 100-entry integration library with category and sector filters, a Marketplace of recipes and blueprints, and an Academy. Release notes are current through September 2026 and specific. It stays below 80 because content is still fragmented across separate product doc trees with inconsistent depth, there is no interactive API playground, and there are no framework-specific quickstarts for Next.js, Nuxt or similar.

The component toolchain is TypeScript-first and actively maintained — @squiz/dx-json-schema-lib at 1.90.2 (published 2026-10-01, 517 versions), render-runtime-lib, and the TS/React dxp-component-library — with component inputs defined through JSON Schema typed input types, and manifests now supporting previewPlaceholder hints. However there is still no automated type generation from the component manifest or the content model, and the read-only Content API ships no typed client at all, so anything consuming content is untyped. Typed build tooling without codegen and without a typed delivery SDK lands below the typed-SDK band midpoint.

Squiz DXP's monthly release cadence holds through autumn 2026: the Help Center release index carries per-month pages from January through September 2026 (the September 8 release added restrictions on cascading metadata and workflow schemas), and the developer tooling ships continuously, with the DXP CLI on 47 npm releases in 2026 and the component CLI updated as recently as 29 October. 2026 also shipped a genuinely new product (Content Intelligence, GA May 2026) plus page builder templates, language variants and improved version history. Still short of 75+ because the monthly payloads are mostly incremental service updates rather than platform-level feature drops.

Squiz maintains a dedicated, searchable releases site with per-month pages distinguishing new features, bug fixes and improvements, cumulative yearly rollups, changelog errata, and separate per-product release notes for Component Service, Datastore, Connect and Funnelback. What still caps it below 75 is that individual monthly entries do not consistently flag breaking changes inline or link to per-release migration guides — that material lives in a separate deprecations register rather than in the release stream itself.

Squiz publishes a public roadmap alongside a companion Product Releases page, and the 2026 roadmap has proven predictive rather than aspirational — Content Intelligence, page builder templates and layouts, language variants and improved version history all moved from 'coming' to shipped within the year, which is a credibility signal a private roadmap cannot offer. It stays below 70 because there is still no community feedback or voting portal (no Canny, Ideas board or GitHub Discussions), so prioritization remains entirely vendor-controlled.

Prior scoring recorded no public deprecation policy; that was wrong. Squiz Content Management/Matrix documents a four-part MAJOR.MINOR.MICRO.PATCH versioning scheme, a three-year full-support window per release branch followed by security-only support, and a dedicated 'Deprecated assets and features' register recording the version each item was Deprecated In and Removed In — with automatic upgrade scripts that remove or convert deprecated assets so existing implementations do not break. It does not reach 75 because the newer SaaS-side services (Component Service, Datastore, Connect) publish no equivalent deprecation register or notice window, so the guarantee is uneven across the DXP.

Squiz DXP is a proprietary SaaS platform with no public GitHub repository or npm package to measure, and G2 still shows only 27 reviews across the whole seller profile — very thin for a vendor claiming 500+ enterprise customers. The following remains niche and concentrated in government, higher education and utilities across ANZ and the UK.

Squiz runs an official Discourse community at forums.squiz.net with separate Matrix, Developers, Support, Documentation and Community Website categories for bugs, feature requests and implementation tips — a real touchpoint beyond documentation. Engagement remains low relative to peers: no Discord or Slack, discussion is Matrix-centric and modest in volume, and the developer base stays concentrated among a handful of specialist agency partners.

Squiz operates a formal tiered partner program — entry at a 'Community' tier with no prior Squiz knowledge required, progression by expertise and delivery record, regional enablement teams, free Squiz Academy onboarding and joint marketing — covering agency, SI, ISV and consultant categories, with a public directory listing partners such as Deepend, FrontStage Digital, Carnegie and XCentium plus the Slalom relationship for public-sector delivery. It stays mid-band because there is still no Accenture, Deloitte or Valtech presence, so enterprise buyers outside ANZ/UK have a shallow pool of delivery choices.

Independent learning material for Squiz DXP/Matrix remains sparse — September 2026 searches surfaced no Udemy or Pluralsight courses and no notable community blog output for the year, with results dominated by Squiz's own documentation, tutorials and Academy. The only substantive video resource is a 'Learning Squiz Matrix 6' YouTube playlist, and conference and tech-blog coverage stays minimal versus traditional-CMS peers.

Squiz Matrix/DXP remains a niche skillset concentrated in Australia and the UK, hired mainly through specialist agencies or Squiz itself (~28–30 open roles worldwide, mixing PHP/Matrix with TypeScript/Node/React/AWS engineering). The mitigating factor previously missed is Squiz Academy: free registration, free courses and structured developer learning plans for Component Service, which materially lowers ramp cost for a team new to the platform. It stays below 50 because there is still no market-recognized certification exam and Stack Overflow coverage is negligible, so buyers carry real delivery-talent risk outside core geographies.

Squiz keeps a steady case-study pipeline in its core verticals — UniSC's 15,000-student portal, James Cook University's multi-site consolidation, University of Newcastle's 400-publisher upgrade, Greenwich's conversational search and a Queensland Health network overhaul — and Content Intelligence's CMS-agnostic standalone packaging opens a land-and-expand motion outside the existing CMS base. Momentum reads as steady rather than accelerating: G2 reviews are flat at 27 and no flagship North American enterprise logo was announced in 2026 despite the Slalom channel.

Squiz is an established private company (founded 1998, CEO Gavin Dumsday) with Mercury Capital holding a ~30% stake since 2019, headcount essentially flat at ~386–393 across offices in Australia, NZ, UK, US and Poland, and no funding rounds, acquisitions or layoff reports through September 2026. Third-party revenue estimates diverge sharply — getLatka reports $43.2M for 2025 while Owler lists $70.1M for 2026 — so the growth trajectory cannot be verified, and PE ownership implies disciplined rather than aggressive product investment.

Squiz remains a Gartner Magic Quadrant Niche Player with clear vertical focus on government, higher education and service-led organizations, offering SaaS or on-premises deployment with vertical accelerators. The prior score assumed its AI answer was unshipped roadmap; that is now stale — Content Intelligence went GA globally in May 2026 as a CMS-agnostic crawler-based product (AI Readiness Auditor plus a WCAG 2.2 AA/AAA Accessibility Auditor), a differentiated wedge sellable into non-Squiz CMS estates. It stays below 65 because the wider auditor set (SEO, broken links, brand compliance) and the 'fix it for me' remediation are still roadmap, and Gartner's innovation-pace caution on personalization and journey management is unresolved.

G2 holds at 4.2/5 from 27 reviews, which under the scoring formula lands in the 45–60 band on review volume alone. Reviewers consistently praise support responsiveness, search, integration options and ease of use (8.7 vs AEM's 7.7), but the negative pattern is recurring rather than isolated — rocky onboarding with an implementation team that turned over four times on one account, documentation described as poor or missing, an editor and developer experience that is hard to navigate and extend, and support quality varying with staff turnover. Those themes offset the high ratings and hold this at the band midpoint.

Squiz DXP pricing is entirely sales-gated: the squiz.net/pricing route serves a 404 proxy page with only a 'Get started' contact link, and aggregators (SaaSworthy, Capterra, GetApp, Software Advice) report quote-only custom pricing with no free plan. The only channel that ever carried real figures was UK G-Cloud 13 (May 2022: Matrix CMS from £12,100/yr, +Funnelback Search from £17,000/yr), but that framework expired and Squiz is a supplier on neither G-Cloud 14 nor 15. Held at 35 rather than lower because the Subscription Agreement and Fair Use Policy publish the billing structure, just none of the rates or tier limits.

The current Subscription Agreement has dropped automatic overage invoicing: usage beyond the Order's 'Consumption Parameters' now falls under a Fair Use Policy in which Squiz 'may approach the customer to review usage' and may offer efficiency fixes before charging. That is softer than metered overage, but the fee decision is discretionary, weighed against seven open factors including 'use of the products by other Squiz customers' and 'input costs'. The other ratchets remain: unused Usage Metric allocation is forfeited, you can move up a tier mid-term but never down, Squiz may reprice at renewal, and Conversational Search and Content Intelligence simply stop working when their Conversation or Page Audit quota runs out. Raised from 33 because the published billing step is gone; not above 40 because tier limits are unpublished and the overage outcome is negotiated, not predictable.

Squiz says 'pricing is based on the capabilities you actually use' across a capability menu that keeps growing: it now includes Accessibility Auditor and AI Readiness Auditor (both marked NEW), Squiz Spark, Conversational Search (sold in tiers), Content Intelligence, CDP, DAM, Personalization, Optimization, Behavioural Analytics, Integrations and more. The Subscription Agreement lets Squiz decide 'in its sole discretion' whether new features need an additional fee, and one customer review notes 'not a lot of custom capability without paying more money.' Lowered from 40 because more of the platform is now sold as add-ons whose price Squiz sets at its discretion. It stays above the worst band because core CMS publishing is bundled, and buying capability by capability means nobody is forced into an Enterprise upgrade to unlock one feature.

Fees are invoiced annually in advance and due before the Subscription Period starts, payment obligations are 'non-cancellable' and fees 'non-refundable', and terms auto-renew for one-year periods unless either party gives 60 days' written notice. Squiz can suspend service on 7 days' notice for late payment, and no monthly billing, startup program or published nonprofit or education pricing exists. Not lower than 30 because the 60-day non-renewal right is documented and works both ways, which beats an evergreen term with no exit clause.

No free tier, trial or self-serve sandbox exists: every squiz.net entry point leads to 'Get started' or 'Talk to the team' contact forms or demo videos, and aggregators record no free plan. The closest offers are a sales-run migration proof of concept on the prospect's content and the free-migration campaign, which applies only to customers who sign a paid subscription. Not zero because those incentives slightly lower the barrier to evaluating it.

There is no self-serve sandbox or instant trial. First access requires talking to sales and waiting for Squiz to provision the multi-service stack, and G2 rates Squiz DXP's ease of setup at 6.9 against WordPress.org's 8.2. Once provisioned, the Component Service offers a modern local loop (components in any JavaScript framework, Matrix in a local Docker container), but only on an existing tenant running Matrix 6.29 or later. First value takes days to weeks, not hours.

Squiz now promises lift-and-shift content migration in 'a few weeks' and says its AI-powered migration tools let customers switch 'in weeks, not months', but the same FAQ admits those tools are still being 'actively developed'. Real-world delivery is inconsistent: one higher-ed customer reported the implementation team turning over four times and onboarding being 'rocky at best', while others were delivered on time and on budget. Government and higher-ed procurement plus multi-capability scope keep typical timelines in the months range, so vendor marketing alone does not justify a higher score.

Matrix remains a niche skill. Job listings cluster in Australia, specialist brokers exist because the talent pool is thin (frontstage.digital sells pre-vetted Squiz DXP and Matrix developer profiles), and UK partner day rates on G-Cloud 14 run £938–£1,465. The Component Service has moved some front-end work onto mainstream JavaScript frameworks, which keeps the premium from being higher. Outside Australia and the UK, the asset-tree, parse-file and Matrix admin knowledge the platform needs is still scarce.

Squiz DXP is fully managed cloud SaaS. Infrastructure, CDN (Cloudflare with Squiz Edge Workers), automatic scaling and platform operations are bundled into the subscription, so buyers provision no servers, databases or CDN of their own. Storage and Data Transfer are still capped Usage Metrics, and the Fair Use Policy allows additional fees or a forced upgrade when usage passes the cap. The automatic overage billing is gone, but hosting is still only included up to an unpublished limit, so the score holds at 75 rather than going higher.

Because Squiz runs the platform as fully managed SaaS with automatic updates and a monthly release cadence, customers never patch, scale or monitor infrastructure. Their ongoing work is platform configuration and content administration. Not higher because a multi-capability suite (CMS, CDP, DAM, Funnelback Search, Component Service, Integrations) still takes real platform administration, and teams have to watch consumption against unpublished Order limits: crossing them triggers a fair-use review, and the AI Conversation and Content Intelligence quotas cut off without warning.

Matrix has documented bulk export tooling: the Export assets to XML tool exports an asset tree with attributes, links, designs, permissions and metadata, alongside an Export files tool, an Asset syncing tool and a CRUD Asset Management API. The contract also commits Squiz to make Customer Data and Customer Applications available for export if you ask within 30 days of termination. Lock-in is moderate rather than severe. Still, the XML is a Matrix-only format built to rebuild 'an identical asset structure in a target Matrix system', the termination export only happens on request and lasts 30 days, and no export path is documented for CDP profiles or Funnelback configuration. The data transformation work and the pull of proprietary CDP data keep this in the middle band.

Squiz Matrix keeps its 'everything is an asset' model where sites, pages, images, workflows, and users all live in one hierarchical Asset Tree — a fundamental departure from standard web dev mental models. Developers must internalize a multi-state asset lifecycle (Under Construction, Live, Safe Edit, Archived), overlapping presentation layers (Designs, Paint Layouts, Content Templates), HIPO Jobs, Contexts, Workflow Schemas, and editing locks. Matrix 6 improved navigation (new screen header, revamped Linking screen, unified component picker) but these are UX fixes on top of the same proprietary model, so the concept load is unchanged.

Squiz Academy now runs a free, structured Component Service learning plan sequencing six courses from ecosystem overview through create/preview/deploy/delete, component sets, complex input fields, local preview, and environment variables — an actual guided path rather than docs alone, backed by a YouTube training playlist and in-person, live-online, and webinar training confirmed in 2026 review profiles. It stays out of the 65+ band because onboarding is split across three hubs (docs.squiz.net, matrix.squiz.net, academy.squiz.net), there is no in-console onboarding tour and no framework-specific (Next.js/Nuxt) guide, and 2026 reviewers still say the learning curve 'can be hard for new starters.'

Component Service is documented and marketed as framework-agnostic — components can be built with JavaScript, React, and other modern tooling, and the product page pitches 'familiar frameworks like React and JavaScript.' But the official squizlabs/dxp-component-library is still vanilla JS + Handlebars, the manifest.json component contract is proprietary, the Content API is a bespoke REST surface with no GraphQL, and no first-class Next.js integration path is documented — React is permitted, not paved, which keeps this in the proprietary-patterns band.

Squiz does publish a first-party starter: the Matrix 6 Bootstrap 5 Website Starter Template on Squiz Marketplace, built by the Squiz Matrix team, shipping Bootstrap 5 SCSS, Font Awesome, default content and form styling, and robots.txt, with a live demo — plus a Marketplace component/template catalog and `cmp init` component scaffolds. The prior 'no official starters' read was too harsh. It does not reach the 50+ band because there is still zero official boilerplate for Next.js, Nuxt, Astro, or SvelteKit, no TypeScript or CI/CD config, and no content-model-plus-example-content starter; the starter targets Matrix's own design layer, not a modern decoupled frontend.

The scaffolding step is better than previously credited: `npx @squiz/dxp-cli-next cmp init <path>` generates a component from a basic or advanced/bundled template, and `cmp dev` / `cmp dev-ui` give a local runner and UI with no DXP access required for local building. The remaining surface is still heavy — CLI install via NPM, manifest.json configuration (mainFunction, inputs, previews, environment variables), Developer-level console access that must be provisioned through Customer Success, separate Content API and Asset Management API token setup, then component-set creation and wiring to Content Management — which is well past a 3-env-var integration.

The write path keeps widening: the REST Asset Management API does full CRUD with a PATCH contextid parameter for context-specific attributes and metadata, Data Record assets and (September 2026) PDF files can be created, read, updated and deleted through it, and since June 2026 Component Service schema validation errors pass through to API responses instead of a bare 'Validation failed', which makes programmatic content work debuggable. The asset syncing tool gives an environment-promotion path. It stays below 50 because Hierarchy and Thesaurus metadata fields are still unsupported by the Asset Management API, templated pages need matching nodeIds for unlocked zones, editing locks persist, and there is no declarative schema migration tooling.

Preview is manifest-driven: the 'previews' field takes named preview identifiers, wrapper HTML and sample data, `cmp dev-ui` gives a local component UI with HMR, and since June 2026 manifests support `previewPlaceholder` on string and FormattedText fields so empty fields stay visible and inline-editable without developers writing default render logic; July 2026 added preset placeholder images for SquizImage fields. On the authoring side Page Builder does inline editing on the page preview, drag-and-drop composition and multi-viewport modes. Still code-and-manifest setup rather than plug-and-play, so it stays in the documented-but-code-required band.

No certification is required and Academy training is free, and the Component Service layer is genuinely reachable by generalist JavaScript developers — local building needs no DXP access and React is supported. The score stays at 40 because that is only the component tier: full Matrix work still means PHP-level asset types, Designs and Paint Layouts, Contexts, and workflow schemas, and the market for it runs through agencies and contractors with 15+ years of Matrix-specific experience rather than transferable skills.

Squiz sells to enterprise and public-sector buyers on a co-build model with professional services attached; there is no free tier and no instant self-service signup, deploying components requires Developer-level console access provisioned by Customer Success, and Matrix upgrades run through Squiz's Streamline Upgrade and Maintenance Service on Squiz Cloud rather than customer-controlled deploys. Component development, Matrix administration, API/token setup, and frontend delivery are effectively three or four distinct skill areas, so a solo developer without prior platform exposure faces real friction.

Post-go-live editor self-service is the platform's strongest build-simplicity dimension: Page Builder offers a unified component picker, drag-and-drop composition, inline editing on the live preview, multi-viewport checks, A/B, personalization variants (consentless personalization added September 2026) and workflow-controlled publishing, and 2026 releases made templated pages safer for editors (zone-type icons on content templates, components in locked zones can no longer drift out of sync with the template, admins can force schema cascading on moves). Marketplace supplies pre-built components and templates. The ceiling is scope: any new component type, integration, metadata schema or segment still needs a developer.

Squiz DXP (Squiz Content Management, formerly Matrix 6) is SaaS with vendor-managed releases on a roughly fortnightly cadence, reaching 6.98.0 on 2026-10-07 and 6.99.0 on 2026-10-21, with no customer-run upgrade. The one-time Matrix 5 to 6 move was a customer project of about two weeks including UAT and a readiness program, and reviewers still cite the cost and duration of major upgrades. Held below the SaaS 80–90 band because major version moves have historically been customer projects rather than transparent vendor operations.

Vendor-managed SaaS: security updates are bundled into the subscription and applied centrally with no customer action, and Squiz proactively removed the Export Files Tool in March 2026 because it bypassed permission checks. NVD lists only seven Squiz CVEs ever, the newest an IDOR in Matrix 6.20 from 2022, and none in 2025 or 2026. Docked from the SaaS maximum because Squiz publishes no security-advisory feed, CVE disclosure policy or patch SLA.

The Matrix 5 to 6 SaaS migration wave has largely completed, and the maintained deprecations page lists each asset or feature with the version it was deprecated and removed in, even reinstating removed design areas in 6.20 to ease customer upgrades. Against that, windows can be short (the Export Files Tool went from deprecated in 6.39.2 to removed in 6.41, a few weeks of releases), Personas and Variations were deprecated in 6.70 with removal TBA, and no minimum notice window is published. Kept mid-band for the recent forced-migration history and undocumented notice periods.

AWS-hosted SaaS where runtime (including the PHP 8 move), database, search, cache and CDN layers are vendor-managed, so customers carry only client-side SDK and integration dependencies. Near-zero operational dependency burden for typical deployments. Slightly below the SaaS maximum because composable pieces (Connect flows, Component Service components) add a customer-maintained code surface.

Squiz ships more native monitoring than most SaaS peers: Experience Monitoring is a documented DXP capability (page load time, caching, broken links, malfunctioning forms, absent content) and Content Intelligence adds a Content Health dashboard, alongside a public Statuspage at status.squiz.cloud with postmortems. Top of the 65–75 SaaS band, not higher because there is no native APM, API-usage metering or integration-health dashboard.

Content Intelligence (GA May 2026) is bundled into Squiz DXP rather than separately gated: a CMS-agnostic crawler audits the whole published estate, an Accessibility Auditor flags WCAG 2.2 issues with AI-generated fixes, an AI Readiness Auditor tests answerability, and results land in a Content Health dashboard, on top of Experience Monitoring's broken-link and absent-content detection and the Funnelback Content Auditor. Raised because the earlier assumption that it was a separate add-on was wrong. Held in the mid 60s because core Matrix still has no orphan detection or content-expiry workflow and Content Intelligence's own broken-link checker is still roadmap.

SaaS on AWS with auto-scaling and the built-in Squiz Edge CDN means little day-to-day performance tuning. The incident stream has eased in 2026: the status page shows a major network disruption in January and a critical service degradation in February, but only two minor Funnelback incidents (10 September) in the last 90 days, against a 2025 with roughly a dozen major or critical events. Raised for that improvement, still below 75 because customers absorbed two serious outages this year that they could not mitigate.

Squiz publishes a contractual Support Agreement (P1 response within 30 minutes and resolution within 6 hours, P2 within 2 working hours, P3 within 2 working days, 24/7 for P1/P2 via My Squiz) with support bundled into the single subscription rather than a premium tier. Reviews praise responsive support and dedicated CSMs. Kept below 70 because reviewers also report support is hit and miss due to staff turnover and varies by region, on a thin review base of about 27 G2 reviews.

forums.squiz.net is the only real peer channel and thread volume is sparse; the community is niche (ANZ/UK government and education), with essentially no Stack Overflow or Reddit presence. A public Canny feedback board (squizpm.canny.io) and Squiz Academy exist but are vendor channels, not peer help, and reviewers say documentation is often thin, pushing users to paid services. Held in the sparse-community band.

Fixes ship on a roughly fortnightly cadence with detailed public bug-fix notes (October 2026 alone fixed PHP 8 trigger failures, AMAPI cleanup errors and REST Resource HTTP status handling across 6.98.0 and 6.99.0), reach customers without upgrade action, and serious incidents get published postmortems. A contractual P1 resolution target of 6 hours backs this. Still mid-band because no resolution SLA covers non-outage functional bugs and the January and February 2026 incidents ran longer than a day in one case.

Squiz's Visual Page Builder is a genuine drag-and-drop, no-code tool marketed to non-technical editors — Squiz claims a landing page in under an hour with no developer. Inline editing works directly on the page preview, templates and layouts ship as reusable building blocks, and 2026 added language variants and an improved version history retaining the last 100 versions with compare-and-restore. Marketers compose new pages freely, but the component palette is still developer-built via Component Service, so truly novel component types remain a developer task.

Squiz supports scheduled publish, archive and scheduled-review actions plus multi-stage approval workflows, and the CDP can build campaign segments from utm_campaign parameters — but that is personalization plumbing, not campaign management. Targeted searches found no content calendar view, no multi-channel campaign coordination, no campaign-as-a-unit construct, and no campaign analytics rollup. This remains the scheduling-only band.

Stronger than previously credited. Remap Manager provides full 301 redirect management with PCRE pattern rules, CSV import for bulk remaps and a system-wide 404 asset; metadata schemas render meta/OG tags with keyword replacements; and Squiz ships three separate shipped auditors — the Funnelback SEO Auditor (on-page and technical signals, benchmarked against the top 10 results for a target keyword, with prioritized optimization advice), the Content Auditor (duplicate titles, missing metadata, readability, slow pages, outdated content) and Experience Monitoring (broken links, absent content). The prior score treated SEO auditing as thin; it is a first-class, documented product surface. Schema.org structured data is achievable through metadata design areas but is not guided, and sitemap/canonical handling is not prominently documented — that keeps this out of the 75+ band.

Advanced Forms is a real drag-and-drop builder with conditional logic, multi-page forms, auto-calculation, booking, and payment fields across Pin Payments, PayPal and Westpac PayWay including dynamically priced amounts driven by form selections. The CDP Advanced Forms destination auto-populates fields from the Single Customer View for progressive profiling, and Optimization A/B tests carry explicit conversion goals (target page view, click events on elements like Buy Now / Sign Up). UTM awareness is now confirmed rather than absent — the CDP captures utm_campaign and other campaign parameters and can trigger personalized page versions from them, correcting the prior 'no native UTM tracking' finding. A dedicated lead-management workflow still does not exist; leads hand off to CRM via Squiz Connect.

This is a genuine platform strength and now clears the native-real-time-targeting threshold. The CDP is built into Squiz DXP rather than bolted on, and segments combine real-time behavioral signals (pages viewed, downloads, interest tags), geo/location, referral source, UTM campaign parameters, lifecycle stage and CRM attributes. Marketers build segment-targeted variants directly in Visual Page Builder with per-audience preview, no code. 2026 added per-site segment sets (Jan), segment templates with ready-made tracking events for common cases like location and engagement, automatic portal-user sync from the IdP into the Single Customer View on login, and a real-time Tealium integration that queries visitor profiles at page-request time. Targeting remains rule-based — no predictive or lookalike modeling — which caps it below 75.

Optimization provides native A/B testing for whole pages or individual components with a structured test-plan workflow and conversion goals measurable in-platform. Documentation still covers only test mechanics — no statistical significance calculation, confidence intervals, auto-winner selection or multivariate testing is documented. The one notable improvement, targeting A/B tests to specific CDP segments, is explicitly a roadmap item on squiz.net/roadmap rather than a shipped capability, so it earns no credit here.

Bulk operations are no longer a gap. Matrix ships asset cloning plus a Mass Clone Tool that produces a specified number of copies into a chosen destination, alongside 2026 content templates and reusable layouts with reference links, reusable components that update once and propagate everywhere, inline editing in Page Builder, and 100-version history with one-click restore to recover from a bad edit. Squiz markets sub-hour brief-to-publish for landing pages. The component palette is still developer-defined and there is no bulk field/metadata edit across many assets, keeping it below 75.

Content can be delivered headlessly — the Content API exposes Matrix content over REST with scoped API tokens restricting which sections of the asset tree are reachable — and Squiz positions DXP as hybrid-headless. But the Content API is a Marketplace extension rather than core, GraphQL access remains beta, and there are no channel-specific renditions. Email, SMS, social and push all require handing off to external platforms through Squiz Connect rather than authoring once into native channel outputs. This is web-first with API delivery, squarely in the 40–60 band.

Standard tag integration is solid — GA4 is documented with a UA migration path, FullStory provides session replay and behavioral heatmaps, Behavioral Analytics ships as a core module, and Funnelback's Insights dashboard gives search-side reporting (query volume, clicks, zero-result, location, trends) with drill-down and export. What still does not exist is a content performance dashboard inside the authoring UI: there is no most-viewed / lowest-engagement / conversion-by-page-type view for web content without leaving for GA4. The new Content Intelligence health dashboard scores content quality and AI readiness, not traffic or conversion performance.

Guardrails are enforced at the platform level. Component Service holds a central library of brand-approved components, component sets act as design systems, libraries can be exposed only to selected sites or channels, and governance controls which component versions editors can reach. Page Builder templates now carry locked zones: editors cannot change a locked region, and the October 2026 release blocks component version upgrades inside a locked zone from the page so the page cannot drift from its template. Styling runs through global CSS custom properties acting as theme tokens. It stays below 75 because the token layer is a developer CSS convention rather than a governed token UI with approval.

Open Graph and Twitter card fields are produced through metadata schemas using keyword replacements (%asset_name%, %asset_url%, %asset_metadata_Description%), giving proper social preview control. That is where it ends: repeated searches found no social scheduling, no push-to-social workflow, no UGC embed components and no social-proof widgets. Publishing to social requires an external tool wired through Squiz Connect. Basic OG card management only — the 30–50 band.

The DAM is better than a plain media library. Images are automatically resized for device and converted to modern formats (WebP, AVIF) with compression and served over CDN through Squiz Edge Workers; image varieties give explicit control over renditions; a built-in image editor handles crop and resize; asset permissions scope which assets a given content team can even see; and watermarking plus automatic replacement of an outdated asset across every property that references it are documented. It stops short of the 65+ full-DAM band: no focal-point editor, no licensing/rights-expiry management, no usage tracking across external channels, and video hosting is listed but not detailed.

Materially better than the prior score allowed. Page Builder language variants let editors manage multilingual pages in one place, and the same variant workflow used for personalization and A/B testing extends to languages — so a locale-specific campaign variant can itself be personalized and tested. Translation is workflow-driven, not manual: the Wordbee integration pushes page name, summary, content and configurable metadata fields to a TMS with no manual file export, automatically tracks which source content is new or changed, and flags translated content edited in Matrix as needing re-approval by the translation provider; a Google Translate connector covers machine translation. That is a real translation governance loop, short of full transcreation. Still missing: cookie consent and legal-disclaimer management (third-party), and market-level regulatory tooling.

Squiz Connect is a purpose-built low-code iPaaS with 100+ pre-built connectors spanning well over three MarTech categories — CRM (Salesforce, HubSpot, Zoho, Pipedrive, Close, SugarCRM), marketing automation and email (Marketo, Klaviyo, Mailchimp, Swift Digital), SMS (ClickSend), CDP (Tealium, with real-time profile lookup added in 2026), analytics (Tableau Cloud), translation (Wordbee, Google Translate) and payments — over REST, SOAP and GraphQL with OAuth2, plus a generic component for any unlisted API. Flows are triggerable from CDP event feeds and form submissions. It misses 70+ because no ad-platform connectors (Google Ads, Meta, LinkedIn) are documented and per-connector depth varies between full event orchestration and simple API actions.

Squiz is not a commerce content platform and nothing in 2026 changed that — no purpose-built product content types, no variant or SKU-level attribute modeling, no product taxonomy tooling, no editorial-commerce co-authoring. Matrix metadata schemas do give formally structured content models and Squiz's own documentation cites 'custom fields for a product page' as a use case, so generic types can be deliberately repurposed. That is the generic-types-repurposed band and no higher.

Still essentially absent, but one of the rubric's five merchandising capabilities does exist: search result merchandising. Funnelback Curator lets an administrator define trigger/action rules against queries, and Best Bets pin chosen results (with HTML and thumbnails) for key queries, both editable in the Insights dashboard with a draft-then-publish step. Applied to a product index that is genuine result merchandising. Everything else is missing — no category management, no commerce promotional scheduling, no cross-sell/upsell content management, no product spotlights — and the curation tooling is built for content, not catalogs. Top of the no-merchandising band rather than the middle of it.

Broader connector coverage than previously credited, but the same shallow depth. Squiz Connect ships a Shopify connector with documented actions plus BigCommerce, Magento 2, PayPal and Stripe components under a Digital commerce category, and Matrix has an official tutorial for selling through a Shopify Buy Button embedded via the Code component. These are API-level flows and payment rails. There is no in-editor product picker, no product reference field type, no catalog federation and no real-time bidirectional sync, and no commercetools or Salesforce Commerce Cloud connector exists. That keeps it at the top of the webhook/custom-integration band, not the product-picker band.

There is no shoppable-content authoring pattern. Product references exist only as Shopify Buy Button widgets dropped into a generic Code component — not inline product references with purchase CTAs woven through editorial. Editors cannot co-author rich content against structured product data, so buying guides or shop-the-look formats would be hand-built each time.

No documented ability to inject CMS-managed content into cart or checkout flows. Transactional pages belong entirely to the embedded commerce widget or the external commerce platform, with no CMS overlay, slot or template hook.

Order confirmation, delivery tracking, product onboarding and loyalty content are all handled inside the embedded widget or the external commerce platform. Nothing ties CMS content to order events, and no order-triggered content delivery mechanism is documented.

The building blocks for basic B2B gating are real: authenticated portals with SSO, per-asset Read permissions granted to user groups or roles (so a spec-sheet library or catalog section can be gated to named accounts), and Advanced Forms with conditional logic and auto-calculation that could carry a quote-request flow. None of it is B2B-specific or packaged as such — no customer-specific pricing display, no account-based catalog segmentation, no quote workflow, no documented B2B deployment pattern. Access control applicable to B2B, which is the 30–50 band.

The content-side search machinery is strong and better-documented than the prior score reflected: faceted navigation for result refinement, user-defined synonyms for query expansion, Curator trigger/action rules and Best Bets for editorial result control, configurable results pages that function as search landing pages, automated relevance tuning that derives ranking attributes, and staged draft/publish of tuning changes from the Insights dashboard. What is missing is precisely the commerce half — no product-content result blending, no price/attribute facet hierarchies, no search landing pages mapped to product categories, and no product catalog connector. Strong general search applied to commerce, not commerce search.

Scheduled publishing gives time-activated banners, and Page Builder blocks can be varied by CDP segment, which delivers audience-targeted promotional content — more than plain scheduled banners. But none of the commerce-specific promotional primitives exist: no countdown timers, no promo code messaging blocks, no tiered pricing tables, and no channel-specific promotional targeting beyond web segments.

Multi-site on a single instance with per-site content trees and shared components could in principle back several storefronts, and Squiz genuinely runs hundreds of sites per customer. But there is no documented multi-storefront commerce pattern, no shared product catalog with storefront-specific editorial layering, and no commerce reference architecture. The rubric explicitly penalizes 'could be used for this'.

The DAM handles basic product imagery competently — image varieties for controlled renditions, a built-in crop/resize editor, and automatic WebP/AVIF conversion with CDN delivery, which matters for PDP performance. None of the commerce-grade media capabilities are present: no 360-degree spin, no AR/3D model references, no image hotspots for shop-the-look, no deep zoom, and no documented video-in-PDP pattern. Basic galleries and embeds, the 30–50 band.

No marketplace content capability at all — no seller profiles, no seller-contributed authoring, no review aggregation, no moderation at marketplace scale. Squiz's documented verticals are government, higher education and corporate web, and no marketplace customer or reference pattern exists.

The generic localization stack — Page Builder language variants plus the Wordbee TMS workflow and Google Translate connector — applies cleanly to product pages, which is a real (if unspecialized) capability. What does not exist is anything commerce-aware: no currency-aware content blocks, no regulatory product content handling (EU labels, CA Prop 65), and no market-specific promotional calendar.

Behavioral Analytics and Optimization conversion goals track page-view and click conversions, and GA4 integration carries data out to external tools. There is no content-to-revenue attribution, no content-assisted conversion tracking tied to purchases, no ecommerce/revenue event model, and no product content performance reporting inside the CMS.

Higher than previously scored — the prior note that content-instance permissions were undocumented was wrong. Matrix grants Read, Write or Admin on any individual asset to the public, a named user, a user group or a role, with optional automatic cascade to child assets and inheritance on creation, so visibility can be scoped to a department, team or individual at the content-instance level rather than only by content type. Roles are dynamic per-asset assignments, so the same role resolves to different people on different branches of the tree. Authentication is SSO-backed via SAML 2.0 and OpenID providers. Field-level sensitivity is still absent, which keeps it out of the 75+ range.

The lifecycle half is genuinely complete: assets can be scheduled to flip to an 'Up For Review' status on a recurring interval, Metadata Triggers fire scheduled actions against expiry dates held in metadata fields, version history retains the last 100 versions with compare and restore, and multi-step workflow schemas route approvals through user groups and roles with email notification per step. Internal findability is excellent via DXP Search with RAG-backed conversational Q&A. The gap is structure, not lifecycle — no dedicated knowledge base article type, no pre-built knowledge taxonomy (metadata schemas can express one, but nothing ships), and no article-level analytics for knowledge gaps beyond search zero-result reporting.

Lowered because Squiz has retired Workplace from its product line. The feature set still exists for installed customers (staff directory, org chart, social feed, communities, classifieds, community events, four-level homepage alerts, comments with likes and bookmarks), but the Help Center now files Workplace under Legacy Products, its product page is gone from squiz.net, its documentation stops at v3.8 and it has no entries in the 2026 release notes. A buyer evaluating Squiz today for an employee portal is offered the generic DXP portal pattern (authenticated, role-based dashboards and content, search, forms) rather than a purpose-built employee hub. That is a capable base for a custom portal, not packaged employee experience, and there is still no mobile app, PWA or push channel.

Workplace's news articles, events, announcements, emergency-level homepage alerts and per-user email digests still exist for installed customers, but Workplace is now a legacy product, so they are no longer something a new buyer can rely on. On the current DXP, internal news is ordinary Matrix publishing with per-asset permissions and CDP segments for audience targeting, which is basic news publishing with real targeting. Read receipts, acknowledgment tracking and mandatory-read workflows have never existed in either.

Lowered further. The staff directory, profile pages and clickable org chart are Workplace features, and Workplace is now listed as a legacy product with no 2026 development. Even where installed, the directory and org chart are fed from CSV files with no Workday, BambooHR or Entra sync, and no skills or expertise fields are documented. Outside Workplace, a directory on the current DXP would be built from user assets and metadata schemas, which is the buildable-directory band.

Better than previously credited on the version-control axis. Documents get 100-version history with compare and restore, recurring scheduled review that moves an asset to 'Up For Review', Metadata Trigger jobs that fire actions on metadata-held expiry dates, and multi-step approval workflows whose email trail gives a de facto change record. That is solid versioned document publishing — the top of the 30–50 band. It cannot go higher because the compliance-specific layer is entirely missing: no mandatory acknowledgment tracking, no dedicated policy template or register, and no purpose-built tamper-evident audit trail report.

Workplace can host onboarding pages and a new-starter community, and per-asset permissions could gate content by group — but searches found no role-specific content paths, no 30/60/90 progressive disclosure, no task checklists and no HR-triggered new-hire portal provisioning. Basic onboarding pages are buildable from generic structures; nothing is onboarding-specific.

Squiz's standout capability, and stronger than the prior score. Funnelback / DXP Search is a 25-year-old dedicated enterprise search product that indexes far beyond the CMS — SharePoint 365 and non-365, Google Drive, Alfresco and CMIS repositories, Jira, LiveLink, Documentum and FileNet via ManifoldCF connectors, plus authenticated crawling, LDAP, database and SFTP feeds. Critically for intranet use it applies early-binding security, resolving document permissions at index time so results never leak content a user cannot open. On top sit faceted filtering, synonyms, Curator rules and best bets, automated relevance tuning, five analytics reports including zero-result and trend spikes, and Conversational Search using RAG restricted to approved indexed content with a second guardian agent verifying the generative agent's answers. It stops short of 80 because retrieval is unified-index rather than true real-time federation, and Confluence is not a confirmed connector.

Squiz delivers everything as responsive web on Squiz Cloud. There is no native mobile app, offline support, PWA packaging, kiosk mode or push notification, and the only proactive channel in the now-legacy Workplace was email. Deskless workers get browser access and email, the lower half of the responsive-web band.

No LMS story. Searches for Cornerstone, Workday Learning and Moodle integrations with Squiz returned nothing, and no course assignment, completion tracking, certification or micro-learning features exist in Workplace or DXP. Training material can be published as ordinary pages with no tracking attached.

Workplace carried a real social layer (public and private communities with categories, threaded discussions with moderation, comments with likes, bookmarks, sharing and flagging, classifieds, community events), but it is now a legacy product with no 2026 development and no product page. On the current DXP, social interaction is limited to what forms and custom components provide. Polls, surveys and peer recognition were never available. Credit is held at the top of the basic commenting band for installed customers rather than the community-platform band.

Connectivity is flow-level, not experience-level. Squiz Connect carries SharePoint 365 and non-365 connectors (including a Matrix SharePoint Connector asset for sending, receiving and managing SharePoint records), Google Drive, Google Calendar, ServiceNow, Microsoft Fabric and MediaValet components across 2025–2026, and Moveworks offers a third-party Squiz Intranet integration. Funnelback separately indexes SharePoint and Google Drive with permission-aware results, which is the most useful workplace-tool behavior Squiz actually delivers. What is still missing is the deep experience integration the 65+ band requires: no Microsoft Teams app, no bot-driven notifications, no embedded content cards, no single-pane experience. Dedicated searches this round could not independently re-confirm a first-party Slack connector, so confidence stays MEDIUM.

This clears the automated-review-and-stale-flagging bar. Assets can be scheduled to move to an 'Up For Review' status at a set date or recurring interval (for example every six months), the Metadata Triggers scheduled job fires actions against expiry dates stored in metadata fields, workflow schemas route the resulting review through named groups and roles, and 100-version history backs any rollback. Stale-content detection is now active rather than manual: the Content Auditor surfaces outdated content, duplicate titles and missing metadata across the site, and Experience Monitoring proactively detects broken links and absent content across all of an organization's domains. Explicit per-asset ownership assignment for accountability is still not a distinct field, and there is no single archival workflow product surface.

Workplace's engagement dashboard (total users, per-item views, comments, favourites and time spent, top publishers) is now part of a legacy product. What remains current is solid but generic: Funnelback's zero-result and trend reports explicitly surface content gaps from failed searches, Behavioral Analytics and GA4 report page views, and the CDP can segment authenticated users. There is no department-level breakdown, no heatmaps and no current adoption dashboard for an intranet built on the DXP.

Squiz runs multi-brand as many sites inside one instance — customers manage hundreds of sites with separate content trees, per-site permissions and per-site component libraries from a single installation. Isolation is therefore silo-based within a shared instance: brands do not get independent content models, independent environments or independent API endpoints, and a platform-level administrator sees everything. Squiz's SaaS security documentation describes logical tenant separation with individually credentialed databases, but that boundary is between Squiz customers, not between brands inside one customer's deployment, so it does not lift this item.

Cross-site sharing is native and well-documented, not a workaround. Component Service maintains one central library of reusable components consumed by every site, components can be grouped into libraries exposed only to selected sites or channels, a single component update propagates to all consuming sites at once, and global CSS custom properties act as shared theme tokens. Component Service also supports reusing rich asset-based data between instances through a standardized exchange format, so an editor can reference assets from either instance under a shared API identifier. It stays below the 70+ native-cross-tenant band because sharing is cross-site within an instance; cross-instance support covers data exchange rather than full component federation.

Governance is an explicit Squiz DXP pillar and the mechanisms are real: site-level permission delegation lets a central team hand day-to-day management to department or agency teams without losing central oversight, roles resolve per-asset so the same approval role maps to different people per branch, workflow schemas enforce content standards per site, Component Service governs which component versions any site can use, and 2026 per-site segment sets scope personalization assets so editors only see segments relevant to their site. Squiz's government positioning is built on exactly this centralized-control-with-local-autonomy pattern. What is not documented is a global policy configuration surface or an approval workflow that spans sites, which keeps it out of the 75+ range.

Pricing remains contact-only with no public tiers, no volume licensing and no multi-site bundle, and Squiz is off the UK G-Cloud framework where figures were once visible. The October 2026 subscription agreement softened the usage terms: automatic overage invoicing was replaced by a Fair Use Policy under which Squiz reviews usage and may propose efficiencies, an upgrade or extra fees. Unused allowance is still forfeited, tiers can move up mid-term but never down, and Squiz can reprice at renewal, so each added brand adds licensed sites and consumption without documented economies of scale. Linear scaling with discretionary cost risk; confidence stays LOW for lack of public numbers.

Each component set functions as a design system, an organization can run several sets with different themes, and sites are assigned only the component libraries they should have — then customize how those shared components look without maintaining forked copies. Theming runs on global CSS custom properties, so a brand's colors and typography change through token values rather than component rewrites. That is per-brand visual identity over shared component structures. It lands just below the 65 line because the token layer is a documented developer styling convention (src/styles/common, src/styles/themes) rather than a governed per-brand token store with its own approval and versioning.

The brand x locale intersection is workable but not governed as such. Multi-site gives separate content trees per brand or locale, Page Builder language variants manage multilingual pages in place, and the Wordbee integration adds a per-site translation workflow that tracks changed source content and flags Matrix-side edits to translations as needing translator re-approval — a genuine translation approval loop, and it works across any number of sites in an instance. What does not exist is brand-aware governance over that loop: no per-brand translation approval configuration, no shared-versus-isolated translation workflow model, and no regional legal content governance scoped per brand.

Aggregation across sites now exists, though it measures content health rather than content performance. Experience Monitoring registers multiple domains and presents statistics for every enrolled domain in one dashboard reached from the organization dashboard, and Content Intelligence crawls an organization's full content estate CMS-agnostically — including microsites and non-Squiz properties — grouping pages by topic and rolling AI-readiness and accessibility into a single health dashboard for leaders. Per-site engagement and search analytics remain in Funnelback Insights and GA4. What is still absent is a portfolio dashboard comparing engagement, content velocity or publishing cadence between brands, so cross-brand performance benchmarking is manual.

Workflow schemas are applied per asset branch, so each brand or site can carry independently defined review stages and approval chains, with steps assigned to user groups (so cover is maintained when an approver is away) or to roles that resolve to different people per asset. Scheduling and review intervals are likewise configured per site. Central auditability is partial rather than designed: workflow step emails and 100-version history provide a per-asset trail, but there is no cross-site audit dashboard or portfolio-level workflow compliance report.

Shared components and reusable content created centrally can be consumed by any site in the instance, and a single update propagates to all consumers — which covers the corporate-to-brand push for componentized content like disclaimers or announcements. Component Service's cross-instance asset data exchange extends this a step further. But targeted searches found no syndication feature as such: no parent-to-child content push with defined override points, no local adaptation model with change notification, and no documented press-release or corporate-content distribution pattern. Content reuse, not governed syndication.

Compliance is handled at platform level, not per brand. Customers choose a UK, North America or Australia hosting region and data stays there including offsite backup replication — but there is no EU region, so EU-data-residency brands fall back to the UK, and residency cannot be varied per brand inside one deployment. Accessibility is genuinely well served: the Accessibility Auditor scans any publicly accessible URL or domain against WCAG 2.2 AA/AAA plus ADA and EAA, whether or not the site is hosted on Squiz, and prioritizes issues with AI-generated fixes — useful across a brand portfolio. The CDP supports GDPR obligations. What is absent is guardrails: nothing prevents a non-compliant page from publishing, and there are no per-brand cookie or regional publishing restrictions.

The largest correction in this re-score — the prior note that versioning and rollback were undocumented was wrong. Component Service enforces Semantic Versioning: every code change to a component, feature or bugfix alike, requires a version increment, and redeploying a changed component under its existing version is impossible. Squiz documents the explicit purpose as allowing DXP environments to revert to an earlier version when needed, giving real rollback. Governance follows from it — you control which component versions are available to which sites, so brand extensions come from assigning different component sets and libraries per site while the core library stays central, and May 2026 added renaming and removal of component sets. This clears the 60+ band comfortably. It is held below 75 because brand extension is set assignment rather than a formal inheritance/extension model, and update propagation across tenants has no staged rollout or deprecation workflow.

One user base spans every site in the instance, authenticated through SAML 2.0 or OpenID SSO, organized into user groups with membership conditions, and granted access per asset branch — which is exactly the central-admin-with-autonomous-brand-teams pattern the rubric asks about, and Squiz's government positioning describes delegating day-to-day management to teams while retaining central oversight. Roles give a clean cross-brand contributor model since the same role resolves to different people per site. It stays below 65 because SSO federation across genuinely independent tenants is not documented (the model assumes one identity provider for the whole deployment) and there is no per-brand identity-provider configuration.

Metadata schemas are the extension mechanism and they do support the pattern in a limited way: a schema defines fields (date, hierarchy, asset picker, select, text) and is applied to a section of the asset tree, so one brand's branch can carry extra fields on the same underlying asset type that another brand's branch does not — extension without forking the base type. That is better than fully separate models. But it is field-level metadata layering rather than genuine content-type inheritance: there is no documented base-model/derived-model relationship, no way to version a global model and propagate changes to brand extensions, and no enforcement that brand extensions stay compatible with the core.

Raised because estate-wide reporting genuinely arrived in 2026, though it is content health rather than executive portfolio management. Content Intelligence crawls an organization's entire content estate CMS-agnostically, groups pages into topics and produces a single colour-scored content health dashboard spanning AI readiness and accessibility across all properties — explicitly pitched at giving leaders one view of where content stands and what to fix first. Experience Monitoring separately reports page load, caching, broken links and absent content per enrolled domain from one dashboard. Two caveats hold it at the top of the manual-aggregation band rather than above it: reporting is organized by domain and topic rather than by brand, and Content Intelligence is a separately purchased product priced by estate size. Publishing SLA adherence, content freshness by brand and per-tenant cost allocation are all still absent.

Squiz publishes a DPA available to all customers that incorporates the 2021 EU Standard Contractual Clauses with the UK IDTA, recognises the EU-US Data Privacy Framework for US transfers, and commits to delete-or-return of personal data at the customer's discretion on termination. Two gaps hold it inside the 60-78 band: the sub-processor list and change notices now live on the Vanta Trust Center, which sits behind a request-access form rather than being published, and there is no EU-resident hosting option, since Squiz-managed regions are only the United Kingdom, North America and Australia and the UK is not in the EU.

The current Squiz subscription agreement states verbatim that Squiz is not HIPAA accredited and disclaims all liability for protected health information, which it defines as Sensitive Personal Information. No BAA is offered and no healthcare compliance documentation exists anywhere in the public estate; this disclaimer was re-verified as still live in September 2026.

Squiz DXP is independently verifiable on the Texas DIR TX-RAMP certified products list at Level 2 status (ID TX1591016, expiring 25 Aug 2028) — a correction to the prior pass, which could not find it — and contract and security documentation covers GDPR, UK GDPR, CCPA/US privacy law, the Australian Privacy Act 1988 and the New Zealand Privacy Act. It stays well below the 75+ band because the IRAP and FedRAMP claims are inherited from AWS rather than held by Squiz, PCI DSS is expressly disclaimed, there is no C5 or HITRUST, and the UK G-Cloud channel has lapsed (Squiz appears on neither the G-Cloud 14 nor 15 supplier list).

Squiz's public wording is consistently unqualified — /security says only 'Squiz holds SOC 2 accreditation' and the Shared Responsibility Model commits to 'adherence to the SOC 2 framework' and 'relevant SOC 2 reports' on request, never naming Type 2 or a Trust Service Criteria scope. The only dated public artifact is the DNX Solutions case study documenting a Type 1 engagement, and no Type 2 attestation announcement exists in 2025-2026 sources; the Vanta-hosted trust center gates its document list behind a request form, so the type cannot be confirmed externally. That places this at the top of the rubric's Type 1 / no-Type-2 band rather than above it.

Squiz maintains its own ISO/IEC 27001:2022 certified ISMS covering platform scope — not inherited AWS certification — with DevSecOps integrated across processes, third-party audits against the framework, and a Statement of Applicability released to customers on request alongside the certificate. ISO 27018 for cloud PII processing is absent from every Squiz source checked, which is the single requirement keeping this out of the 80+ band.

The verifiable portfolio beyond ISO 27001 is a CSA STAR Level 1 CAIQ self-assessment that Squiz links to directly from /security (registry entry live, listed since 2016), TX-RAMP Level 2 certification confirmed on the Texas DIR list, Cyber Essentials certificates released on request, and annual independent penetration tests with executive summaries available to customers. It stops short of the 65-80 band because every one of these is either a self-assessment or a single-jurisdiction authorization: there is no CSA STAR Level 2 third-party audit, no PCI DSS (disclaimed), no FedRAMP or StateRAMP, no platform-level IRAP, no Cyber Essentials Plus, C5 or ENS, and the former UK G-Cloud listing has lapsed.

Customers pick one of three Squiz-managed AWS regions — United Kingdom, North America or Australia — deployed in a single region across multiple availability zones, with a documented commitment that storage and processing of PII stays inside the deployed region; the regional split is corroborated independently by the Logs Service API's au/us/uk routing. Two things cap it below the 78+ band: there is no EU-resident option at all (UK is not EU), and Squiz Edge/Cloudflare distribute cached content from nodes worldwide, so delivery-tier caching leaves the chosen residency region.

The post-termination window the prior pass could not find is published in the subscription agreement: a 30-day period in which Squiz makes Customer Data and Customer Applications available for export or download, after which Squiz may delete or render them inaccessible, paired with DPA delete-or-return at the customer's discretion and documented Matrix bulk export tooling (Export assets to XML, Export files, Asset Management API). It does not reach 75+ because the post-termination export is request-based rather than self-service, the XML schema is Matrix-proprietary rather than a standard interchange format, DAM, CDP and Search configuration have no documented bulk-export path, and Squiz explicitly disclaims archival backup — backups run nightly with 30-day retention for disaster recovery only.

The DXP Logs service has a dedicated Audit log type for 'security and compliance events, including access to sensitive information and system configuration changes', masks PII by default and writes a further audit entry recording who revealed it, gates access behind an Owner-assigned Logs Auditor secondary role, retains audit logs for 12 months in hot storage, exports to CSV, exposes a regional Logs Service API, and natively streams to external platforms (Datadog, Dynatrace) in near real time with compliance retention given as the documented rationale. It falls short of the top band because the streaming destinations are observability tools rather than mainstream SIEMs, retention is a fixed platform policy rather than customer-configurable, and audit trails are fragmented — CMS, Integrations and Search logs are explicitly excluded from the DXP Logs service and live in three separate tools.

Every accessibility artifact Squiz publishes is about delivered content rather than the editing interface: the Accessibility Auditor tests customer sites against WCAG 2.0/2.1/2.2 A/AA/AAA plus ADA and EAA, and squiz.net/accessibility is a statement about squiz.net's own marketing website measured against the superseded WCAG 2.0. No stated WCAG 2.1 AA target, ATAG 2.0 assessment, or keyboard/screen-reader conformance claim for the DXP authoring UI exists in any Squiz source, and the one VPAT that did cover the editing product is no longer retrievable. That is a general corporate commitment without a product-level target, which sits at the bottom of the stated-target band.

There is now no publicly obtainable VPAT or ACR for any Squiz product — the Matrix v5.4.1.3 report previously hosted by Middlesex University returns HTTP 404, and repeated searches across vendor, .edu, .ac.uk and .gov.au sources surfaced no replacement, current or otherwise. What remains is an accessibility statement page written about squiz.net itself against WCAG 2.0, with no Section 508 conformance statement and no ATAG 2.0 assessment, which is the accessibility-page-without-a-VPAT band and a material procurement gap for the higher-education and government buyers Squiz targets.

The Visual Page Builder still ships GA "GenAI content tools" — headline variations, tone adjustment and clarity rewrites driven by AI prompts that admins pre-configure and test, with brand guardrails built into the prompts themselves. Nothing new shipped Jun–Oct 2026 (the October 6.98/6.99 release notes are Page Builder bug fixes and template-lock changes with no gen-AI entries), and the Spark Assistant's brief-to-page generation is still early-access only. Stays below the 70+ mature-native band: no bulk generation, no content-type awareness, no documented review workflow.

Still no native AI image generation, smart crop, or automated alt-text workflow in the DAM as of September 2026. The File Store "What's new" page lists no AI capability, and no Firefly/DALL-E/Stable Diffusion integration appears in any 2026 release note or on the roadmap. Alt-text remediation is only reachable indirectly as an Accessibility Auditor smart-fix suggestion, not as a DAM feature.

Squiz shipped language variants in the Visual Page Builder during H1 2026, but that is multilingual content management, not machine translation — the Page Builder translation docs describe building pages with translated content supplied externally. No MT engine, AI-assisted TMS hookup, or bulk AI translation appears anywhere in 2026 release notes or the roadmap. Confidence raised from LOW to MEDIUM because the full Jan–Sep 2026 release record was reviewed directly.

Content Intelligence's AI Readiness Auditor remains the main asset here: an LLM is fed raw page content, page type and topic mapping to extrapolate the questions a page should answer, then scores and prioritises gaps, and the Accessibility Auditor's "Generate smart fix" button returns ready-to-use code or content remedies. But auto-generation of SEO titles, meta descriptions, OG tags, schema markup and taxonomy tags inside the editing workflow still does not exist — enhanced SEO and content-quality auditing remain on the Future section of the roadmap. Partial-automation band.

Alongside the in-editor AI prompt library and Content Intelligence's prioritised smart fixes, Squiz now states its AI-powered migration tooling is in production — automatically moving existing sites into Squiz DXP while applying AI-driven best practices — which is real bulk AI content work, though it is delivered as a Squiz-led migration engagement rather than a self-serve editorial feature. Fixes are still surfaced rather than applied ('fix it for me' and Spark's Optimization agents are not GA), and there is no auto-tagging, smart scheduling, content routing, duplicate detection or AI publishing trigger. Two or three lightweight assists, so it stays well below the 60+ band.

Squiz has published a named agentic product — Squiz Spark — with four named agent classes (Build, Audit, Optimization, Migration agents) and a Spark Assistant that confirms and explains key actions before execution, grounded in approved components, templates and design systems. As of late October 2026 it is still pre-GA: the page invites customers to get early access and take part in beta testing and describes what 'the first Spark release sets out to' do, and Spark appears in no product documentation and in no 2026 release note including October's. Early/beta agentic band, not GA.

Content Intelligence remains GA and is bedding in: a CMS-agnostic crawler clusters pages into AI-generated topics, an LLM generates and tests the questions each topic should answer, and a Content Health dashboard tracks optimization scores and prioritised recommendations over time, with monthly rescans that only re-audit changed pages. Jun–Sep 2026 brought documentation and FAQ expansion rather than new capability, and the product still has no performance scoring, ROI attribution or stale-content detection, and topics cannot be filtered to a granular taxonomy. Comfortably built-in AI content intelligence, but that narrow scope holds it just under the leaders.

The Accessibility Auditor runs continuous estate-wide WCAG 2.2 AA/AAA scans ranked by severity weight and frequency, with AI-generated code and content remedies behind a "Generate smart fix" action, and the AI Readiness Auditor scores answerability per topic. Brand-voice and content-policy monitoring, spell check, broken-link detection and Flesch-Kincaid readability are all still Future roadmap items, and the FAQ confirms the accessibility rules are predominantly technical conformance checks. Covers accessibility and answerability well, so it clears 45–60 but not the 70+ quality + brand + accessibility band.

Conversational Search is GA and documented as an LLM experience over Squiz Search using vector search and RAG, with a second LLM verifying every generated answer and answers drawn solely from approved indexed sources; H1 2026 delivered a ~3× retrieval speed-up and answer caching, and the October 2026 release fixed index updates so pages excluded after initial indexing are never cited as chatbot or Q&A sources. It stays below the headless leaders because the docs state plainly that it "is not a development platform" and that core prompt structures are fixed, so there is no developer-facing embedding or vector API to build on.

Segment assignment in the Squiz CDP is still rule-based with no ML scoring, predictive assignment, next-best-content model or cold-start handling. The one genuinely AI-touched element is Conversational Search: Squiz's demo documentation states the LLM tailors each generated answer using the query, the content, and user behaviour signals including location, on-site interactions and defined audience segments — an AI-generated response layered on human-authored segments. That is enough to lift it off the floor of the rule-based band but nowhere near the AI-assisted 40–60 band.

No MCP server for Squiz DXP exists as of October 2026. MCP is not mentioned on the roadmap, the Spark or capability pages, or in the Jan–Oct 2026 release notes, and no official or community Squiz MCP package appears on npm or in MCP registries. Scored at the floor of the no-server band.

The Conversational Search documentation states directly that it "is not a development platform" and that while you can supply instructions shaping tone, focus and topics, "our core prompt structures are fixed to maintain safety and governance standards" — the LLM is Squiz-selected and Squiz-managed. No AI feature anywhere in the DXP accepts a customer OpenAI, Anthropic, Azure or Gemini key, and no BYOK/BYOM capability is announced or on the roadmap.

Squiz still offers the well-documented Funnelback REST API, DXP APIs with API-key management, an event service for webhook subscriptions, and a ChatGPT Integration Component in the Marketplace — all usable for AI integration work. Against that, the conversational AI layer is explicitly closed to developers (fixed prompts, "not a development platform"), and there is no AI SDK, no agent-optimised or RAG-ready delivery endpoint, no LangChain/LlamaIndex guidance and no MCP. Firmly in the standard-API-usable-for-AI band.

Governance is materially stronger than previously credited: Conversational Search exposes AI behaviour controls (declared purpose, off-limits topics, tone of voice, answer detail, configurable fallback response), grounds answers only in approved indexed sources, runs a second LLM to verify every answer and can suppress or modify answers that fail accuracy thresholds, and the platform ships a dedicated Chatbot Reviewer secondary role — assignable only by an Owner — that gates access to conversation transcripts containing PII with explicit GDPR/CCPA and least-privilege framing. Editor-side AI prompts carry admin-configured brand guardrails and Content Intelligence inherits DXP RBAC. Held to the bottom of the 50–70 band because there is no AI-specific audit trail of who invoked AI in the editor or what it generated, no IP indemnification, and Spark's human-in-the-loop approval gates are not GA.

More AI visibility exists than previously scored: Conversational Search retains complete conversation history and surfaces monitoring-and-insights reporting on what visitors actually asked and where content fell short, the Chatbot Reviewer role exists specifically so nominated staff can review transcripts for quality assurance and chatbot performance monitoring, and Content Intelligence meters consumption against a contracted page-audit allocation with audit-usage views in the console. It stays in the minimal-observability band because those usage views are explicitly restricted in the initial release, there is no per-user or per-team AI consumption metric for editor prompts, no cost/credit tracking, and no model-performance or prompt-effectiveness dashboard.