Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Hygraph

VERIFIED
Headless CMS · Germany
Founded 2017 · hygraph.com ↗

Berlin GraphQL-native headless CMS (formerly GraphCMS, founded 2017); enterprise clients incl. Samsung, LEGO; mostly EU-funded.

In short

Hygraph, in the Headless CMS category, is a European service with Germany as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

Hygraph (formerly GraphCMS, Berlin DE, founded 2017) is ISO 27001 + SOC 2 referenced, GraphQL-native federated content platform, enterprise customer base (Samsung, Dr. Oetker, LEGO, Paramount, TED); $30M Series B 2023 led by One Peak (UK PE) with OpenOcean (FI) and SquareOne (DE); mostly European cap table, no US-PE majority, so ownership_signal: eu_owned. Gap: Hygraph does not publish a publicly accessible DPA; data-processing terms and sub-processors are not surfaced in public documentation and access appears to require enterprise contact; verification of DPA and sub-processor disclosure is pending despite the largely EU-aligned ownership and certification posture.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Hygraph

Hygraph (Berlin, Germany, founded 2017; previously GraphCMS until 2021 rebrand) is a GraphQL-native, API-first headless CMS positioned for enterprise teams managing complex multi-brand, multi-region, multi-platform content. Enterprise customers include Samsung, Dr. Oetker, LEGO, Paramount, TED. Compliance: ISO + SOC referenced in marketing (no explicit certificate URL on public homepage at time of research). $30M Series B 2023 led by One Peak (UK private equity) with participation from OpenOcean (Finland) and SquareOne (Germany). Its mostly-European cap table makes Hygraph one of the cleanest non-US-funded headless CMS picks in the catalogue. From €39/mo for paid tier; free tier available.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
SOC 2
ACTIVE
Informational · US framework
FEATURES

Capability matrix

Self-hostable No
Version history Yes
GraphQL API Yes
REST API No
Visual editor Yes
Localization (i18n) Yes
Media library Yes
API / webhooks Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

FREEMIUM
from €39/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
ALTERNATIVES

Alternatives in this category

DatoCMS
Italy · Founded 2015
EU-BASED

Italian developer-friendly headless CMS (Milan); 25K+ businesses; bootstrapped feel, no US PE.

Public DPA Sub-processors Open source
FROM
€39/mo
CLOUD ACT
MINOR
Enonic
Norway · Founded 2000
EU-HOSTED

Norwegian headless/hybrid CMS (Oslo, est. 2000); founder-owned, ISO 27001 + 9001 certified; but managed Enonic Cloud runs on Google Cloud + Azure + Fastly.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Prismic
France · Founded 2013
EU-BASED

Paris headless CMS / page-builder (founded 2013); Slice Machine + Next.js / Nuxt / SvelteKit focus; from €7/mo.

Public DPA Sub-processors Open source
FROM
€7/mo
CLOUD ACT
MINOR