DatoCMS

VERIFIED

Headless CMS · Italy

Founded 2015 · datocms.com ↗

Italian developer-friendly headless CMS (Milan); 25K+ businesses; bootstrapped feel, no US PE.

In short

DatoCMS, in the Headless CMS category, is a European service with Ireland as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

DatoCMS (Dato srl, Milan IT) is a smaller bootstrapped-feel Italian headless CMS serving 25,000+ businesses; no US-PE involvement identified; ownership_signal: eu_owned; ISO 27001 / SOC 2 attestation not surfaced publicly and sub-processor list not disclosed; for procurement-grade buyers verify trust / security pages directly with the vendor before promoting.

CLOUD ACT
OWNERSHIP
SUB-PROCS: 0 none disclosed

Verified signals

Jurisdiction

EU / adequacy hosting
EU / adequacy operator
No US CLOUD Act exposure

Transparency

Public DPA
Sub-processors disclosed
Open-source clients
Third-party certification

Visit site ↗

Verified

Last audit: 2026-05-12
Next audit: 2026-08-12
Methodology: v2026.05 ↗

JUMP TO

OVERVIEW

About DatoCMS

DatoCMS (operated by Dato srl, Milan, Italy) is a developer-friendly headless CMS positioned as "the most complete, user-friendly and performant Headless CMS": 25,000+ businesses, scaling from small teams to enterprises with 250+ editors managing global content operations. Paid plans from €39/mo (Agency Partner tier; regular tier from similar entry point); free tier available for hobby projects. Mostly self-funded / bootstrapped feel, no identified US-PE majority involvement, placing DatoCMS in ownership_signal: eu_owned. The procurement-grade caveat is verification depth: no public ISO 27001 / SOC 2 attestation surfaced on marketing site at time of research, review trust/security pages directly with the vendor before promoting.

SUB-PROCESSORS

Sub-processor map · none disclosed

Source ↗

Vendor discloses zero sub-processors. All data processing happens in-house.

CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-12).

FEATURES

Capability matrix

Self-hostable

Version history

GraphQL API

REST API

Visual editor

Localization (i18n)

Media library

API / webhooks

INTEGRATION & ACCESS

REST API

SSO (SAML / OIDC)

COMPLIANCE & GOVERNANCE

Audit log

Self-host / on-prem option

PRICING

Pricing & tiers

FREEMIUM

from €39/mo

View pricing page ↗

PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).

Data Processing Addendum (DPA)

— missing

missing
Sub-processors list

www.datocms.com/legal…

Open ↗

ALTERNATIVES

Alternatives in this category

Enonic

Norway · Founded 2000

EU-HOSTED

Norwegian headless/hybrid CMS (Oslo, est. 2000); founder-owned, ISO 27001 + 9001 certified; but managed Enonic Cloud runs on Google Cloud + Azure + Fastly.