CMS & Website Platforms
234 martech vendors in CMS & Website Platforms, part of Web & Digital Experience. Each record carries the date we last verified it, so you can see how current it is before you rely on it.
Last verified:
Procurement-readiness profiles — SOC 2, ISO 27001, GDPR and DPA posture, data residency, AI-training policies — are available when you sign in.
Content management system (CMS) and website platform software builds, hosts, and publishes a company's website without hand-coding every page, from blogs and landing pages to full marketing sites. Marketing and web teams use it daily; security reviewers need it audited because it sits on the public internet and often collects visitor and lead data directly.
Who it is for
- Web and marketing teams evaluating a platform migration, redesign, or new site launch.
- IT security reviewers assessing how a public-facing platform handles hosting, patching, and visitor data.
- Legal and compliance teams confirming cookie-consent handling and a published privacy policy before launch.
What your No-Committee will ask
- IT security
- Is the platform's public endpoint enforcing modern TLS, and is admin access protected by MFA? Our audits capture TLS configuration and MFA support as evidenced claims, each marked verified, self-attested, or not found.
- Data governance
- What visitor or lead data does the platform capture by default, and is a Data Processing Agreement available? Data residency and DPA availability are pulled straight from the vendor's own legal pages, not inferred from a sales page.
- AI governance
- If the platform generates page copy or images with AI, is that disclosed to the end visitor? Our audits log AI-output disclosure as its own evidenced claim wherever the feature is visible on the live site.
- Legal / compliance
- Does the vendor publish a sub-processor list, and does the platform support consent-based cookie management out of the box? Sub-processor disclosure and consent-tooling claims are recorded with a source link.
- Risk / finance
- Is there a published uptime SLA and a status page for outage history? SLA terms and status-page links are captured wherever the vendor publishes them, not inferred from a sales page.
How we verify
Every claim comes from the vendor's own public pages — trust center, privacy policy, security page, or DNS-visible configuration — never from a review aggregator. The full breakdown of what verified, self-attested, and not-found each cover lives on our methodology page.
Frequently asked questions
How is a CMS different from a landing page builder?
A full CMS manages an entire website's structure, navigation, and content types, usually with developer-level extensibility. A landing page builder is scoped to single, standalone pages for a campaign, with less structural flexibility but a faster setup. Many marketing teams use both together rather than picking one.
Do CMS vendors typically publish SOC 2 or ISO 27001 certification?
Enterprise and headless CMS vendors serving regulated industries more often publish a SOC 2 report, sometimes behind a trust center. Smaller, template-driven website builders more often rely on a general trust page without third-party certification, which our audits record as self-attested.
Is hosting included, or does it require a separate provider?
It depends on the platform type. All-in-one website builders bundle hosting into the subscription; headless and open-source CMS platforms often separate content management from hosting, leaving the buyer to choose and secure the hosting layer independently. We note which model a vendor publishes.
What should I check beyond templates and design flexibility before shortlisting a platform?
Confirm how the platform handles cookie consent, whether a Data Processing Agreement is available, and what its published uptime commitment looks like. A public-facing website is the first thing a security reviewer will scan, so these checks belong early, not after launch.