Directus

Directus models any SQL table as a collection with a broad field-type set (string, text, integer, decimal, JSON, geometry with subtypes, UUID, hash, CSV, datetime, alias fields) and polymorphic Many-to-Any relations. Schema can be managed as code through schema snapshots and diff endpoints, and v12.3.0 added the @directus/cli sync pull/diff/push workflow over committed JSON files. Held at 80 because the Core tier caps collections at 25, which limits model breadth for free self-hosted users.

Native M2O, O2M (the reverse side of an M2O, queryable from both ends), M2M via junction collections, and M2A polymorphic relations, all backed by real foreign keys in the database and traversable with nested field and deep filter queries in REST and GraphQL. v12.2.0 added search in the relationship collection picker. Not higher because M2A requests require explicit collection names in v12 and there is no graph-style reference query beyond relational joins.

Block-based composition is achieved with M2A 'builder' fields that nest any collection as a block, plus the repeater (JSON) interface, which gained inline editing in v12.0.1. The official starters use this pattern for page builders. Not higher because rich text is stored as HTML rather than a portable structured format, and portable block-in-rich-text editing relies on community extensions such as flexible-editor.

Fields support required, unique, and filter-rule validation (regex, comparisons, ranges) enforced on API writes, plus conditional rules that make fields required, hidden or read-only based on other field values. Flows with a blocking Filter event hook can validate or reject any create/update transaction, giving a custom cross-field rule engine. Just under 75 because Flow-based validation is limited on Core (5 Flows) and versioned drafts defer required-field checks to publish time.

Every change is tracked in directus_revisions with attribution, a comparison view and restore; content versioning adds a global draft plus any number of named versions that act as branches, and publishing opens a comparison modal with per-field accept/reject. Not higher because revision history is retained only 30 days on Core and 90 days on Team, and there is no native trash for restoring hard-deleted items (soft delete relies on an archive field).

Directus offers a Tags interface (free-form or preset tags, with an option to block new tags) and hierarchical classification by modelling a self-referencing collection with the tree-view interface. Because taxonomies are built by hand as collections and relations, they are reusable and queryable through the API, and term governance comes from permissions on that collection. Scored in the 40–59 band because there is no dedicated taxonomy feature, synonym handling or bulk reclassification tool.

Live Preview renders the customer's real frontend beside the item form with device toggles, pop-out and a {{$version}} variable for draft preview; the Visual Editor module adds click-to-edit overlays on the live site via the framework-agnostic Frontend Library and data-directus attributes, with Published/Draft switching. v12.5.0 added a Preview Base URL setting so one preview config works across environments. Not higher because both require developer setup (CSP headers, library integration), there are no official per-framework SDK components, and per-locale preview is left to the frontend.

The core WYSIWYG interface outputs HTML and keeps improving: v12.3.0 added image captions (figure/figcaption) and block-level custom formats, and v12.5.0 added image linking and paste cleanup that strips unsupported markup with an undo option. A Markdown interface is also available. Not higher because output is an HTML blob, embedding related items inside rich text needs the community flexible-editor extension, and there is no portable AST with custom marks.

The file library supports folders, metadata, titles and descriptions, an image editor with focal point, and URL-based Sharp transforms (resize, crop, fit, quality, WebP/AVIF) with stored presets; v12.2.0 added a cap on transform output dimensions. Files are pluggable across S3, GCS, Azure and local storage. Not higher because there is no built-in usage tracking showing where an asset is referenced, and video has no processing.

Native collaborative editing (since 11.15) shows who is viewing an item and applies smart field-level locking across collections, files and relations, with changes broadcast live; item comments support @mentions that create in-app notifications. Not 80+ because it is field locking rather than simultaneous character-level co-editing, and there is no suggestion or change-request mode.

Draft-first publishing is native for versioned collections (published view is read-only, edits go through a draft, publish shows a diff), and a configurable status field (interface settings added in v12.1.0) combined with per-state permission rules and Flows gives multi-step review with notifications. Scored mid-band because approval routing, assignment, due dates and an approval audit trail are a permissions-and-Flows recipe rather than a workflow designer, and custom access policies are not on Core.

There is no native scheduled publish, unpublish or release bundle; the documented approach is a CRON-triggered Flow that polls a publish-date field and updates status. A calendar layout can display items by date. Scored in the workaround band because scheduling and embargo need a self-built Flow (counting against the Flow cap) and nothing publishes many items atomically.

Translations are field-level: a wizard generates a languages collection and a translations junction holding only the chosen translatable fields, edited side by side in the translations interface, with RTL support and API filtering per language through deep queries. Not higher because there is no native fallback locale chain (frontends must implement fallback), no locale-aware required-field validation and no per-locale preview setting.

Policy-based access control grants per-collection CRUD with field-level allow lists, row-level item rules using filters and dynamic variables, IP allow lists and enforced 2FA (v12.5.0 fixed TFA enforcement under IP-restricted policies), with SSO through SAML, OpenID, OAuth 2.0 and LDAP. Not 70+ because SCIM provisioning is not documented in current docs, and SSO and custom access policies are unavailable on Core ('cannot be added as an add-on').

Every collection is exposed through auto-generated REST and GraphQL APIs plus WebSocket subscriptions, with rich filtering (including JSON path filters), sorting, aggregation, deep relational queries and an OpenAPI spec; the official TypeScript SDK wraps all three. Not higher because delivery and management share one API rather than a separate cached delivery API, and locale selection is via relational filtering rather than a locale parameter.

Directus Cloud (a $99/month add-on for Core and Team) serves assets through a CDN, and its limits table separately meters non-CDN API requests; self-hosted deployments rely on the customer's own CDN in front of the API with Redis caching. Scored low because there is no documented sub-second purge-on-publish, edge compute or edge personalization, and the majority of open-source deployments have no CDN by default.

Flows provide event hooks on create, update, delete, login and other system events, scoped by collection, in blocking (filter) or non-blocking (action) mode, plus incoming webhook, schedule, manual and chained triggers, with a Webhook/Request URL operation supporting custom headers; Flow run logs aid debugging. Not higher because outbound requests have no built-in HMAC signing or retry policy, there is no event streaming connector, and Core is capped at 5 Flows.

Directus is fully headless and database-first, so content is channel-agnostic and reachable over REST, GraphQL and WebSockets from any language. Not higher because the only official SDK is JavaScript/TypeScript (other languages are community-maintained) and rich text is stored as HTML, which is web-oriented rather than a portable format.

Directus has no segment builder, visitor profile or CDP connector; teams can store segment definitions as collections and evaluate them in their frontend or edge middleware. None of the official integrations or Directus Labs packages is a CDP. Scored at the bottom of the custom band because segmentation needs an external engine end to end.

Variant content can be modelled as related items tagged with an audience, but Directus has no targeting rules, audience preview or decision engine, so the frontend chooses which variant to show. Content versions are editorial drafts, not audience variants. Custom packaging, scored low within it.

No experimentation feature exists in the product, its release notes or the Directus Labs extensions; testing requires a fully external tool wired up in the frontend.

There is no recommendation engine; related content is curated manually through relational fields. Algorithmic recommendations require an external service.

Native search is only the API's unoptimized string-field search, but Directus Labs publishes Algolia, Elasticsearch, Meilisearch and OpenSearch Flow operations to sync collections into a search engine, plus documented indexing hooks. Scored mid-band because these are experimental Labs operations that each consume a Flow, with no search UI components, faceting or analytics from Directus.

Directus has no catalog, cart, checkout, pricing or inventory features; commerce is presented as a build-it-yourself tutorial with Stripe and Flows.

No pre-built connector or product picker exists for Shopify, commercetools, BigCommerce or SAP among the official integrations or Labs packages; Stripe and similar integrations are tutorials built on hooks and Flows. Custom packaging, scored below mid-band because nothing ships.

Insights dashboards let teams chart any data stored in Directus, and the activity log records editor actions, but there is no content or page performance analytics. Activity retention is 30 days on Core and 90 on Team. Scored as operational metrics only.

Directus Labs offers a Plausible Analytics bundle to show site stats in the Studio, and the official Airbyte connector moves Directus data into warehouses; Zapier and n8n triggers can push events elsewhere. There is no first-party GA4, Adobe Analytics or Segment integration, and tag management lives in the frontend.

There is no multi-site module; multiple sites are modelled with a sites collection and row-level permissions in one instance, or as separate instances synced with the CLI. Vendor guidance documents the row-scoped pattern, but per-site configuration and governance are self-built, and custom access policies are not on Core.

The translations interface gives side-by-side editing, AI Translations (Enterprise plan) machine-translate all languages at once, and a Labs AI Translator Operation exists for Flows. TMS coverage is a Crowdin workflow tutorial and a third-party Localazy connector, with no Phrase, Smartling or Lokalise integration and no translation memory. Mid-band integration score.

Governance across brands relies on policy-based access control and syncing roles and policies between instances via the CLI; there are no shared component libraries with brand overrides, cross-brand policy enforcement or brand-level analytics.

The file library has folders, editable metadata fields and permissions, but no rights or expiry management, asset approval, asset versioning, usage tracking or brand portal, and there is no first-party DAM connector to Bynder, Aprimo or Cloudinary. Scored as a basic library without enterprise features.

Video and audio files can be uploaded and served from the file library, and a Labs Video Player Interface plays Directus-hosted, YouTube or Vimeo video in the Studio. There is no transcoding, adaptive streaming, thumbnail generation or caption management, and transforms are image-only.

Pages are assembled from M2A block builder fields whose blocks can be added and reordered in the item form, and the Visual Editor lets editors click into those blocks on the live frontend. There is no drag-and-drop composition on the rendered page, no template locking or design-token guardrails. Structured block editor with preview, scored low in the 45–65 band.

Directus does not render websites, and Directus Cloud hosts only the Directus instance; frontends are hosted on Vercel or Netlify, for which Directus documents official integrations and starters. Headless with partner-hosted frontends, the 25–44 band.

There is no form builder; forms are coded in the frontend and post submissions into Directus collections, where permissions and Flows can process them. Vendor tutorials document dynamic form patterns, but conditional logic, spam protection and lead routing are all self-built.

Flows can send transactional email (v12.4.0 added a From Name option and a native Mailtrap transport), and Labs provides Resend and HubSpot operations. There is no subscriber sync, campaign content push or email preview for ESPs such as Mailchimp, Marketo or Salesforce Marketing Cloud.

Flows are general-purpose automation (conditions, scripts, requests, email, schedules) that could drive simple drips, but there is no lead scoring, nurture orchestration or lifecycle model, and the HubSpot operation covers CRM objects only.

The Directus Labs SEO Plugin adds a structured SEO field for meta title and description with previews and sitemap and indexing settings, which the frontend reads through the API. Sitemaps, redirects, canonicals, hreflang and structured data are still built by the frontend team, so this sits low in the 40–59 band.

Directus serves no public pages, so llms.txt, Markdown endpoints, crawler controls and AI citation analytics all belong to the customer's frontend and CDN, and no Directus documentation or Labs package addresses answer-engine visibility. Its MCP server is an AI feature scored elsewhere.

The in-app Marketplace installs extensions from an npm-backed registry of roughly 700 entries with compatibility warnings, and Directus Labs maintains dozens of first-party packages (search, email, analytics, SEO, media). Not higher because Labs packages are labelled experimental, official third-party integrations number about eight, and the extension SDK is aimed at developers rather than turnkey apps.

Directus's auth layer can serve frontend users: public registration with email verification, login, password reset, OAuth/OpenID providers and policy-based row rules can gate content per user, all through the API. The portal itself, consent and account pages are built by the frontend team, and visitor accounts share the user system with Studio seats, so it sits in the generic-API band.

Directus exposes both REST and GraphQL with documented behavior parity and a comprehensive directus.io/docs/api reference carrying REST, GraphQL, and SDK examples in every endpoint section, and the v12.0.x line fixed aliased relational fields across GraphQL queries, fragments, and REST. v12.1.0 (July 2026) continued GraphQL hardening — single-use enforcement for GRAPHQL_SINGLE_USE_MUTATIONS and tightened GraphQL WebSocket restrictions. No built-in interactive playground ships with the product (third-party GraphQL explorers required), keeping it below 85.

Directus Cloud runs on AWS with Redis-based distributed caching, CDN asset delivery, and multi-AZ auto-scaling, and recent releases added REDIS_NAMESPACE configuration plus configurable import timeout/concurrency tunables. However, public documentation on specific rate limits, API call-per-second ceilings, or documented entry-count scale limits remains sparse, and self-hosted deployments inherit whatever infrastructure the operator configures. Adequate for most workloads but lacks the explicit performance guarantees that tier-1 SaaS CMSes publish.

The official @directus/sdk on npm is TypeScript-first, modular, and dependency-free with strong type safety. Beyond JavaScript/TypeScript, all other language SDKs (Python, PHP, Go) are community-maintained, not official. This holds the score in the 50–55 range — one excellent official SDK but no multi-language official coverage matching what tier-1 headless CMSes publish.

Directus has dedicated integration guides covering native Vercel and Netlify deployment modules (with real-time build status), Zapier (beta) opening thousands of app connections, an n8n community node for workflow automation, Clay for data enrichment, and Framer for bidirectional CMS sync, with deployment integrations surfacing provider dashboard links. The ecosystem is broadening beyond UI/workflow extensions but still lacks pre-built integrations for commerce, DAM, and analytics categories.

Directus has a comprehensive extension system covering custom API endpoints, server-side hooks (database events, schedules, lifecycle), App Extensions (interfaces, displays, panels, modules, layouts, themes), Operations for Flows, and a CLI that scaffolds every extension type, with Themes formalized as an extension type and a Marketplace for publishing. Under the v12 MSCL license, connecting custom/self-hosted LLMs is now a licensed feature — a minor gating — but the core extension framework remains unrestricted and runs in the same environment as the main application with direct service access.

Directus supports SSO via OAuth 2.0, OIDC, LDAP, and SAML 2.0, plus MFA and API token management, and v11.17 added OpenID/OAuth2 cookie security attribute configuration. With the v12 MSCL license (June 2026), SSO is no longer in the free Core tier — it now requires a Team or Enterprise license (or the Open Innovation Grant for orgs under $5M revenue / 50 employees) even on self-hosted, where it was previously freely configurable via environment variables; unlicensed instances lose SSO login after the 30-day grace period. SSO is functional and available on the mid-tier Team plan, but the new license enforcement on self-hosted adds friction, lowering the score.

Directus v11 introduced a Policy-based additive permissions system on top of RBAC, with permissions scoped to collection + item + field level, custom filter rules for read and write access, content-instance-level access control, and default value injection — one of the most granular permission models in the open-source CMS space. The granularity is unchanged in v12, but under the new MSCL license custom permission rules are now a licensed feature gated behind Team/Enterprise (or the Open Innovation Grant) for orgs over the free thresholds, so the most powerful permissioning is no longer freely available, trimming the score from its prior peak.

Directus Cloud achieved SOC 2 Type II certification in July 2025; GDPR is documented and AWS underlies the cloud (which itself holds ISO 27001 and SOC 2 Type II). EU data residency is not explicitly advertised, no HIPAA BAA is offered, and Directus does not hold its own ISO 27001. This places Directus in the SOC 2 Type II + GDPR tier without ISO 27001 or HIPAA, capping the score in the high 60s.

The 2026 advisory stream remained heavy, with disclosures including CVE-2026-35412 (TUS upload authorization bypass allowing arbitrary file overwrite), CVE-2026-39942 (path traversal / broken access control in the File Management API), CVE-2026-35441 (GraphQL DOS via alias resolver duplication), CVE-2026-35408 (COOP-header SSO interception, CVSS 8.7), CVE-2026-39943 (plaintext token disclosure in revisions), CVE-2026-26185 (password-reset timing user enumeration), on top of the 2025 CVSS 9.3 critical (CVE-2025-55746). v12.1.0 (July 2026) shipped proactive hardening (single-use GraphQL mutations, upload path validation blocking writes to extension/temp dirs), and disclosure/patching is active and responsible (security@directus.io, researcher credits), but there is still no traditional paid bug bounty — only a Key Contributors recognition program — and the recurring high-severity pattern holds the score at 50.

Directus remains source-available with official Docker images on Docker Hub and GHCR for full self-hosted deployments on any infrastructure, alongside Directus Cloud (managed SaaS on AWS), and v12's MSCL license converts each version to GPLv3 after four years. However, v12 replaced the permissive BSL honor system with active license-key enforcement: the free self-hosted Core tier is now capped at 3 user seats / 25 collections / 5 flows, and larger organizations need a paid commercial license (or the Open Innovation Grant). Deployment flexibility is still maximal, but self-hosting is no longer freely unlimited, pulling the score down from the top of the band.

Enterprise Cloud offers a minimum 99.9% uptime SLA (99.99% available under custom enterprise agreements with dedicated single-tenant servers and region selection), and status.directus.cloud provides public transparency — reporting 100% uptime across April–June 2026. Self-service cloud customers receive no uptime guarantee, and the Starter tier retirement (Nov 2025) narrowed cloud options, so the absence of any SLA for non-enterprise cloud caps the overall score in the low 60s.

Directus Cloud uses AWS with multiple availability zones, Redis distributed caching (with namespace control), auto-scaling, and a global CDN, while Enterprise Cloud runs on dedicated single-tenant servers with no hard limits on users, collections, or data volume and configurable import timeouts/concurrency. Documented benchmarks, API call-per-second ceilings, and named hyperscale enterprise references remain unavailable, holding it in the upper-60s.

Directus Cloud offers automated backups, and self-hosted deployments can use S3-compatible automated backups; schema snapshot/apply commands enable schema version control and the migration module supports instance-to-instance migration. However, no public RTO/RPO documentation exists for Cloud, and multi-region failover details are not advertised outside Enterprise discussions, holding the score in the upper-50s.

Directus runs fully locally via Docker Compose with official images — developers get a complete instance including Data Studio and API on localhost — and the extension CLI scaffolds every extension type, with v11.17 having improved local build performance via tsdown's oxc-transform. The workflow remains Docker-based without a lightweight emulator mode, capping the score in the low 70s.

Directus supports schema snapshot/apply for CI/CD schema promotion, and the migration module enables instance-to-instance migration with compatibility checks, while native deployment modules integrate with Vercel and Netlify (with provider dashboard links and real-time build status) and run migrations automatically during deployment. Branch-per-PR content environments and automated migration rollback tooling remain unsupported natively, capping the score below 70.

docs.directus.io is comprehensive and well-structured with REST, GraphQL, and SDK examples across every endpoint, plus a dedicated integrations section providing step-by-step guides for n8n, Zapier, Vercel, Netlify, Clay, and Framer, and thorough getting-started and extension-development content. No interactive API playground ships with Directus (third-party tools required), holding the score below 80.

The official @directus/sdk is TypeScript-first with comprehensive type definitions covering the full API surface and IDE IntelliSense, and v11.17 migrated collab types into @directus/types. Schema typing still requires manually defining types or community tools (directus-extension-ts-typegen, directus-typescript-gen) — no first-party code-generation CLI auto-generates types from the content model, capping this below 80.

Directus sustained a strong cadence through the v12 major cycle and beyond: v12.0.0 GA on 2026-06-15 (rc.1 May 29, rc.2 Jun 5) was followed within two weeks by the v12.1.0 minor (2026-07-02) and v12.1.1 patch, on top of the v11.17.x line that shipped weekly through April. A coordinated major plus a fast follow-on minor demonstrate both steady and milestone velocity. Not higher because most of the cadence is incremental minors/patches rather than repeated major feature waves.

Directus maintains a structured docs changelog at directus.com/docs/releases/changelog organized by version, distinguishing improvements from breaking changes, and the v12 release was accompanied by a dedicated migration guide and license FAQ. Monthly community changelog recaps with video continue. Not higher because automated migration codemods for extension authors are still not provided.

Directus operates a public roadmap at roadmap.directus.io using Productlane with community feedback capability, and the v12 direction (editorial workflows, MCP/OAuth 2.1, AI translations) was communicated ahead of GA. Not higher because it lacks granular milestone dates or weighted community voting.

Directus correctly reserved its breaking changes for a major bump (v11→v12): VResizeable deprecation, status→archived, and main→published rename (with backward compatibility maintained), all documented in the breaking-changes section, plus a 30-day grace period for newly license-gated features. Still no automated codemods for extension authors and no formal 12+ month deprecation windows. Appropriate semver hygiene offset by the absence of migration tooling.

Directus has ~36.4k GitHub stars, 4.7k+ forks, ~13k Discord members, and claims 10M+ total installations. The 20K+ star tier warrants 75+, but Discord size remains moderate relative to Strapi (~70k stars) and npm monthly download volume for @directus/sdk is modest. Steady but not accelerating growth.

Engagement remains active via monthly changelog discussions, Discord, the Discourse forum, and Productlane feedback, with core-team participation (including a formal license-revision feedback thread). However, the v12 MSCL relicensing with active license enforcement continues to generate friction — Reddit/self-hosted and community-forum threads express frustration over feature-gating and enforcement, with some users forking older versions or moving clients off Directus. Held down to reflect souring sentiment despite high baseline activity.

Directus maintains 55+ global partners with a tiered certification system, a public agency directory, revenue sharing, and exclusive training. Third-party agency roundup articles validate the ecosystem. However, no major global SIs (Accenture, Deloitte, Valtech) are listed, and the partner count remains modest compared to enterprise platforms.

Directus has Udemy courses, a dedicated learning site (learndirectus.com), official Directus TV tutorials, and expanded integration documentation, plus multiple 2026 comparison articles featuring it prominently. The v12 release and MSCL relicensing generated fresh third-party coverage and licensing explainers. Still does not reach Strapi's content density but improving.

Directus is recognizable in the developer community via its GitHub presence (~36k stars) and npm ecosystem, with a handful of Directus-specific LinkedIn job postings and agencies offering dedicated Directus developer hiring. The partner certification program adds a formal credential pathway. Not higher because it does not appear in the Stack Overflow Developer Survey or major analyst reports.

The v12 release expands the platform story (editorial workflows, MCP/OAuth 2.1 for AI agents, redesigned Studio) and the MSCL model is an explicit monetization push, but the relicensing keeps introducing churn risk: some self-hosters are evaluating Pocketbase and Payload rather than upgrading. Enterprise logos (Adobe, AT&T, Bose, Tripadvisor, U.S. Navy) and 10M+ claimed installs remain, with ~55 employees. Held down to reflect migration friction partly offsetting feature and commercial momentum.

Directus raised ~$19.5M total ($7M Series A in Nov 2022 led by True Ventures) with no new rounds in 2025–2026, and the v12 MSCL relicensing is explicitly framed around 'long-term sustainability' — a revenue-driven monetization move rather than a growth round. ~55 employees maintained and monthly shipping continues. Stable but modest: the relicensing signals a push for commercial revenue without fresh capital.

Database-first architecture and the growing integration/AI story (MCP, n8n, Vercel, Netlify) remain clear differentiators, but the v12 move from BSL to the more restrictive MSCL weakens the open-source positioning precisely as rival Payload went MIT-licensed, pushing some buyers toward Payload and Pocketbase. Still no analyst recognition (no Gartner MQ or Forrester Wave). Held down because the relicensing erodes the open-source advantage relative to direct competitors.

Directus holds a G2 rating of 4.9/5 (~50 reviews) and Capterra 4.5/5 (60 reviews, Value for Money 4.9/5), with users praising flexibility, the SQL-native approach, and open-source extensibility. However, the rubric penalizes strong negative community sentiment: the MSCL relicensing continues to draw vocal frustration over feature-gating and license enforcement on Reddit/HN/community forums, not yet reflected in the slower-moving review sites. Held down to capture this ongoing backlash on top of the low-review-count ceiling.

Directus publishes a clear tier ladder: free Core (self-hosted) / Core Cloud at $99/mo, a public Team tier at $499/mo annual ($599/mo monthly), and a sales-gated Enterprise tier (third-party sources cite a ~$15,000/yr floor). Publishing the Team price is a genuine improvement over the old Professional-then-custom gap, but Enterprise (SCIM, offline mode, dedicated infra) remains contact-sales only. Fits the industry norm of public lower tiers with a gated Enterprise, so mid-60s rather than higher.

The v12 tiering creates a steep free-to-paid cliff: the $99/mo Core Cloud tier is hard-capped at just 3 seats and 50 collections, and the next real tier (Team, with SSO and custom permissions) jumps to $499/mo — a ~5x step. Limits are hard caps rather than metered overages, which is predictable but inflexible (services pause at the cap rather than billing overages), and the $5M revenue + 50-employee self-hosted threshold still creates uncertainty for growing startups.

v12 introduced active license enforcement (MSCL-1.0), reversing the earlier 'full feature parity' posture. SSO now requires the Team tier ($499/mo) and is not available on Core or as an add-on, custom permission rules on access policies are ignored without a license, and SCIM, offline mode, and custom/self-hosted LLM features are gated to Enterprise. Gating SSO and custom roles behind expensive tiers is exactly the pattern the rubric penalizes — though core data modeling, APIs, and basic RBAC remain free.

A monthly billing option exists — Team is $599/mo on a rolling monthly basis vs. $499/mo on annual commitment — and the Innovation Grant gives qualifying orgs (<$5M revenue, <50 employees) free use. Existing customers were protected during the v12 transition (monthly plans grandfathered six months, annual honored to renewal). However, monthly flexibility only begins at $499+/mo, and there is no published dedicated startup-discount program beyond the grant.

Self-hosted Core remains genuinely free with commercial use permitted, and the Innovation Grant extends full free use to orgs under $5M revenue and 50 employees. But the v12 free Core tier is explicitly capped (3 seats, 50 collections) and subject to active license enforcement via registration keys, with SSO unavailable and custom permission rules ignored unless licensed. Still a permissive, commercially usable free path, but more feature-restricted than the pre-v12 model.

Directus Cloud provisions in roughly 90 seconds and one-click deploy templates (e.g. Railway) provide a fast self-hosted path, with the dependency-free @directus/sdk and framework tutorials (Next, Nuxt, Astro, SvelteKit) keeping first-API-call under 30 minutes. The v12 redesigned Studio and native draft/publish workflow further smooth onboarding for non-technical users. A registration-key step adds only trivial friction.

Community signals continue to indicate standard headless CMS timelines — days to weeks for typical projects — with auto-generated REST/GraphQL APIs reducing custom backend work. The v12 native draft/publish experience and redesigned editorial Studio streamline common content-workflow setup. A sustained release cadence through v12.1.1 (July 2026) reflects a healthy, actively maintained platform.

Directus is built entirely on mainstream technologies — Node.js, TypeScript, Vue.js, standard SQL (PostgreSQL/MySQL/SQLite), REST, and GraphQL — with no proprietary DSL, query language, or certification program. Native MCP support further aligns it with standard tooling. Any competent full-stack TypeScript developer can be productive after brief familiarization, keeping the premium over a generalist Node developer minimal.

Core Cloud at $99/mo bundles all infrastructure, while self-hosted needs only a container host and PostgreSQL (Redis is optional, required only for horizontal scaling), with Railway one-click deploy enabling ~$5–20/mo small setups. Typical production self-hosted on AWS/GCP without Redis runs ~$20–100/mo. Score reflects the additional infrastructure spend versus a pure-SaaS model for the most likely self-hosted deployment path.

Directus Cloud is fully managed with near-zero ops overhead, and single-container self-hosted is moderate — Docker plus PostgreSQL, with Redis only for scaling. v12's active license enforcement and registration-key model add a small operational concern: keys must be maintained and the 30-day grace window or an expired/misconfigured license can disable SSO and custom permissions. Reflects that added license-management surface on top of standard container ops.

Lock-in remains low by design: Directus wraps your existing SQL database, so data lives in standard PostgreSQL/MySQL tables you define, schema is portable via /schema/snapshot and /schema/apply, and files sit in any S3-compatible store — removing Directus leaves data intact. The one soft dependency is that above-threshold self-hosted users must maintain a paid license or lose SSO and custom permissions, even though raw data export stays trivial. MSCL versions also become GPLv3 after 4 years.

Directus maps closely to standard web development concepts: collections = database tables, fields = columns, items = rows, roles = access control, with REST/GraphQL exposed automatically and no proprietary query language. v12's explicit draft/published item states map to familiar CMS mental models rather than adding new abstractions, and v12.1's changes were fixes/security hardening that introduced no new core concepts. Slight complexity remains from system vs. user collections and the abstraction layer above the raw schema, keeping it just below the 75 threshold.

Structured quickstart, dedicated tutorials, and framework-specific guides for React/Next.js, Nuxt, and Astro, plus directus-template-cli scaffolding and AI Assistant in-context help. The v12 launch added upgrade/licensing migration docs and a redesigned Studio, but introduced no formal certification program or in-app guided tours, keeping onboarding depth below Contentful or Sanity. The MSCL upgrade path remains one additional thing existing users must learn, offsetting the expanded docs surface.

Standard REST and GraphQL APIs with no proprietary query language; official JS/TS SDK handles auth, collection access, and type generation, and works with Next.js, Nuxt, Astro, and SvelteKit via official starters. v12 makes JSON dot-notation path filtering native at the database level and adds OAuth 2.1 for MCP, further aligning with conventional data-access and integration patterns. Node.js backend is universally familiar; no proprietary templating or rendering engine.

The official directus-labs/starters repo provides starters for Next.js, Nuxt, Astro, and SvelteKit, including a full-featured CMS starter with pages, blog posts, dynamic forms, live preview, and visual editing, plus an i18n variant with locale routing; directus-template-cli init scaffolds a Docker-based backend and frontend with content model and example content. Quality is good but still not as polished or actively maintained as Sanity's or Contentful's starter ecosystems, with community starters filling some gaps. No v12.1-specific change to the starter lineup.

Self-hosted Directus still needs a .env with DATABASE_CLIENT + connection vars, SECRET, ADMIN_EMAIL, and ADMIN_PASSWORD (6–10 vars for production), and v12 requires PUBLIC_URL to be a valid absolute URL (the default `/` is rejected during activation). v12's MSCL relicense adds configuration friction: paid features (SSO, custom permission rules, custom/self-hosted LLM connections) now require a license key with active enforcement after a 30-day grace period; v12.1 added the optional PROJECT_OWNER_ENABLED env var, a minor net-neutral addition. The free Core tier still needs no registration and runs air-gapped, but the licensing surface and previously-free features now gated keep this below the earlier 64.

Directus wraps your own database, so schema changes operate at the DB level with no proprietary field-count limits; schema migration endpoints enable environment promotion with diff and dry-run previews. v12's AI-assisted translations build on the v11.17 translations generator to further automate i18n collection/field creation. Renaming or changing field types still carries standard database-level risk, though tooling helps inspect changes, keeping it in the low-risk-with-tooling band.

Directus offers a Visual Editor (@directus/visual-editing) where editors hover and click to edit content directly on the frontend preview, with field-level permission and version checks, and the official CMS starters ship live preview and visual editing wired up. v12 makes draft/published a first-class native workflow — new items open in draft by default and publishing is an explicit action, with version selectors and publish actions surfaced as core Studio UI — reducing the custom wiring previously needed for draft-mode preview. Still requires installing the library and adding data-directus attributes for visual editing, so it is well-documented but not fully plug-and-play.

Generalist TypeScript/JavaScript developers can be fully productive with standard REST/GraphQL skills — no certification exists or is needed. Some Directus-specific knowledge helps for Flows, custom extensions, and Hooks/Operations, but these are optional and follow conventional JS patterns. v12 adds licensing/key management as a mild ops consideration rather than a specialized skill; the Visual Editor uses standard data attributes, not a proprietary framework.

A solo developer can realistically build and deploy a production Directus project: Directus Cloud removes infrastructure concerns, self-hosted Docker Compose is a one-file setup, and one-click Vercel/Netlify deployments reduce the ops surface. Auto-generated APIs and the permission system let one person own content modeling, API, auth, and frontend. The v12 license-key step is a minor addition that does not change the minimum viable team.

v12 delivers a native editorial workflow that materially reduces post-go-live developer involvement: explicit draft/published states with drafts opening by default, intentional publishing, and a redesigned Studio surfacing draft indicators, version selectors, and publish actions for non-technical users. Combined with collaborative editing, live presence, the Visual Editor, and v11.17 deployment-module RBAC (content teams trigger Vercel/Netlify builds without full admin), editors self-serve far more of the publish workflow. Structural/schema changes still require developer access, and advanced approval workflows rely on custom permission rules that v12 now gates behind a paid license, capping the gain.

The v11→v12 major migration (licensing evaluation, SSO-to-password conversion, IP_TRUST_PROXY flip, /server/health probe repointing, theme/extension code changes) remains the dominant upgrade-difficulty factor and is already priced in. The subsequent v12.1.0/12.1.1 minors are Docker-image-swap upgrades, but v12.1.0 removed the /utils/hash/generate and /utils/hash/verify endpoints in a minor release — a small non-semver API break reinforcing the historical pattern. Held steady: the API upgrade mechanics are unchanged and no new schema migrations were introduced.

Patch velocity and proactive hardening improved through July: v12.1.0 removed the risky /utils/hash endpoints, made sensitive GraphQL mutations single-use, and hardened upload-path validation against writes to extension/temp storage, while v12.1.1 resolved dependency advisories (esbuild→0.28.1 for GHSA-gv7w-rqvm-qjhr) and closed an IPv4/IPv6 blocklist-bypass gap. This is a genuine security-posture gain layered on the v12 defaults hardening. Still below peers because the historical advisory volume (15+ in ~6 months, including the April High-severity batch) continues to weigh on the baseline.

The v12.0.0 relicense to source-available MSCL-1.0-GPL with active enforcement (SSO disabled, custom permission rules ignored, self-hosted LLMs/AI disabled on the free Core tier after a 30-day grace period) remains a textbook vendor-forced cutover and stays near the dataset floor. New community evidence confirms the severity rather than easing it: some teams are forking older versions or migrating off entirely, and Directus→Strapi migration specialists are now advertising. Held: enforcement is immediate, the grace window is short, and the change is commercially coercive.

Dependency hygiene stayed active — v12.1.1 bumped bundled esbuild to 0.28.1 to clear GHSA-gv7w-rqvm-qjhr, continuing the prompt transitive-CVE tending seen across the 11.17.x/12.x line. The Docker-first runtime shape (Node, database, optional Redis/search/CDN) is unchanged and no new external service requirements were added. No movement: the dependency surface and tending quality are stable.

The v12 health-surface rework (cached/shared /server/health, auth-restricted with /server/ping for liveness, HEALTHCHECK_ENABLED/HEALTHCHECK_SERVICES toggles) remains the baseline and is already priced in. No new native APM, webhook-delivery dashboards, or built-in observability arrived in v12.1.x, so external monitoring stays mandatory. No change.

v12's content-governance guardrails (locked published items in versioned collections, edited via draft) and editing conveniences (JSON repeater inline editing, keyboard date entry) carry forward, and v12.1.0 restored the pre-v12 back-button navigation that eases editorial workflows. Automated content hygiene — orphan detection, broken-reference alerts, content expiry — is still absent. Net neutral.

No performance-management step change in v12.1.x beyond the carried-forward multi-instance health-check caching and the 11.17.x tunable surface (ASSETS_CACHE_REVALIDATE ETag headers, GraphQL resolver dedup, Redis namespace control, useItems count reduction). Self-hosted operators still own Redis, CDN, and database tuning. Score holds steady.

Support structure is unchanged: open-source self-hosted users rely on community channels with no formal SLA, while Premium support ($300/month add-on) and Enterprise Cloud provide 24/7 critical-issue support and a dedicated CSM. The v12 licensing tiers formalize paid plans but do not alter support responsiveness or accessibility. Meaningful support remains locked behind paid plans, keeping Directus mid-range.

Discord, GitHub Discussions, and issue triage remain active with team participation, and the release cadence stayed brisk (v12.1.0 and v12.1.1 shipped in early July). The further modest reduction reflects realized relicensing fallout: the community is now described as 'noticeably split,' with some teams forking older versions or migrating off entirely — eroding the open-source community value proposition. Still clearly above open-source headless peers like Strapi (~48.7) on participation and responsiveness.

Velocity remains a strength: v12.1.1 shipped real bug fixes (MCP files-tool batch update, GraphQL WebSocket accountability overrides, public WebSocket accountability) plus dependency-advisory patches shortly after v12.1.0. The non-semver model still bundles fixes into version bumps rather than isolated hotfix branches, adding upgrade friction for conservative self-hosted operators. Held steady: responsive cadence offsets the absence of a dedicated hotfix-branch model.

Directus v12 (June 2026) shipped a comprehensively redesigned Studio — reworked navigation, headers, sidebars, and action patterns explicitly aimed at non-technical users — plus version indicators inside the visual editor so editors always know which draft/published version they are editing. Visual Editing (GA April 2025) enables in-place editing across Nuxt, Next.js, and Astro frontends, and the M2A Dynamic Page Builder lets editors assemble pages from predefined block types with drag-and-drop reordering. The v12.1.x point releases (July 2026) only restored pre-v12 back-button navigation and added security/bug fixes — no layout-authoring additions. Developers must still create block schemas and component definitions, so marketers edit and compose from existing blocks but cannot author new layouts from scratch. Remains at the low end of the edit-but-not-create tier, nudged up by the redesigned Studio.

Directus v12 introduced a native draft & publishing workflow — explicit draft/published states when content versioning is enabled, with publishing as an intentional action — and replaced the collection status field with a native archived boolean, bringing the platform closer to a real publish/archive lifecycle. The Releases feature still batches cross-collection content for simultaneous publish, and Flows can automate scheduled email sends. However there is still no native content calendar, multi-channel campaign coordination, campaign analytics, or audience segmentation, and v12.1.x added nothing here. Scores at the low end of the headless CMS range, lifted slightly by the v12 publish lifecycle.

The first-party @directus-labs/seo-plugin provides metadata management, focus keyphrase analysis, OG image settings, sitemap configuration (change frequency, priority), canonical URL support, custom meta tags, and JSON-LD/Schema.org output. Redirect management remains manual or server-level. v11.17 adds a utility endpoint and UI for generating translations collections, lowering setup friction for multilingual SEO; v12.0.0 and the v12.1.x point releases did not extend SEO tooling. The plugin covers the main SEO bases but requires manual setup per collection and falls short of automated SEO audit suites.

No native form builder, CTA management, lead capture, or UTM/conversion tracking in Directus core through v12.1.1. All performance marketing tooling must come from the frontend or external integrations. The official Zapier (Beta) and n8n integrations could bridge lead data to external form/CRM tools, but Directus itself provides no performance marketing features. Scores at the floor for this item.

No native personalization engine, audience segmentation, or behavioral targeting in Directus core. A 2025 blog post ('Is Your CMS Ready for AI & Personalization?') positions Directus as the content backend that plugs into third-party personalization layers (Optimizely, LaunchDarkly, Segment) via API but does not deliver them natively. The MCP server and AI Assistant enable content creation and schema operations but cannot route personalized content to end users. Scores near the floor for headless CMS.

No native A/B testing, content variant management, or experimentation framework in Directus through v12.1.1. The platform provides no experiment scheduling, statistical reporting, or winner-selection tooling. Teams must wire in external experimentation platforms (Optimizely, LaunchDarkly, VWO) via the API. Scores at the absolute floor.

Content velocity improves materially in v12: a native draft & publishing editorial workflow (explicit draft/published states, version selectors, and publish actions as core Studio UI) plus a comprehensively redesigned Studio aimed at non-technical users, layered on v11.15 real-time collaborative editing (field-level locking, live presence), the Deployments module (Vercel + Netlify build triggers for non-admin roles), Releases for batching cross-collection content, AI-assisted translations, and the v11.17 translation quick-setup utility. The v12.1.x releases restored pre-v12 back-button navigation, a minor editing-flow UX improvement. Once block templates are defined, editors clone and compose pages quickly with a clearer draft-to-publish path. The ceiling remains developer dependency for new layout types.

Directus's headless API-first architecture makes multi-channel delivery a core strength. Structured content models serve web, mobile, email, digital signage, and in-app via REST and GraphQL APIs. The Releases feature batches cross-collection content for simultaneous or scheduled multi-channel publishing. The Framer bidirectional content sync adds another structured channel delivery path. Flows enable webhook-based event delivery to downstream channels. Fortuna Entertainment Group case study shows 70% faster cross-channel content deployment across web and mobile for 3 gaming brands. The limitation is that channel-specific renditions must be implemented in each consuming application.

No native analytics dashboards or content performance metrics within the Directus Data Studio. Analytics integration is entirely frontend-handled — GA4, Adobe Analytics, or similar tags are added to the consuming application. Directus Flows can emit events to analytics platforms on content publish/update, and the official n8n and Zapier integrations provide structured paths to sync content events to analytics tools, but Directus itself collects no content performance data. No pre-built analytics connectors as of v12.1.1.

Brand consistency is enforced structurally through the M2A Dynamic Page Builder — block types define what components exist, limiting arbitrary layout deviations. Directus Data Studio supports full white-labeling (custom logo, colors, module navigation) for per-brand admin experiences. However, there are no platform-level brand guardrail features — no locked design tokens, no restricted override palettes, no built-in validation that content conforms to brand guidelines. Component-based consistency without enforcement.

The @directus-labs/seo-plugin includes Open Graph and Twitter/X card management with preview and OG image settings. There is no native social scheduling, push-to-social workflow, UGC embed support, or social proof widget in Directus core or the official extension marketplace. The official Zapier (Beta) integration could bridge content publish events to social scheduling tools (Buffer, Hootsuite), but this is generic automation, not a first-class social feature. Social metadata is covered; social workflow is not.

Directus has a built-in file management system with folder organization, metadata tagging, image transformations (Sharp on self-hosted; CDN transforms on Directus Cloud), and multi-file associations per content item. v11.17 added bulk folder deletion from the files grid, improving large-scale asset cleanup, and introduced background data imports enabling large asset batches without blocking the interface. v12.0.0 and v12.1.x shipped no material file/DAM changes. Not a full DAM — no rights management, expiry workflows, brand portals, or usage tracking across content. Scores in the mid-range of basic media library with transforms.

Strong native localization via Translations field on any collection, creating language-variant records. Directus v12 added AI-assisted translations (auto-translate content across languages from within the Studio) on top of the v11.17 utility endpoint and UI to generate translations collections and fields. The official Crowdin connector automates translation sync with auto-PR merges and WYSIWYG preview for translators, and Data Studio UI is localized in 64+ languages; timezone support aids scheduling across markets. The gap remains no locale-specific campaign variant scheduling, no regional compliance tooling (cookie consent per locale), and no market-level publish windows. Note v12's MSCL relicense gates AI Translations behind a paid license.

Directus has official integration guides for Zapier (Beta — connecting to thousands of apps including CRM, MAP, CDP, and ad platforms), n8n (dedicated Directus node with CRUD operations and trigger node for event-based automation to 400+ service nodes), and Clay (data enrichment and automated workflows). These move beyond the previous Flows-only webhook pattern to officially supported automation bridges. However, there are still no first-party native connectors to Salesforce, HubSpot, Marketo, or ad platforms in the Directus Marketplace through v12.1.1 — all MarTech connectivity is mediated through automation platforms rather than purpose-built integrations.

Directus explicitly markets a PIM solution (directus.io/solutions/product-information-management). Multiple production PIM deployments exist: fashion e-commerce (Fashioncloud/Salsify/ERP consolidation distributing to Shopify, Amazon, Zalando, Otto), Shopify PIM for industrial goods, T2 MarCom engineering data validation, and MightyHQ managing product and marketing data for multiple e-commerce brands. This is a generic modeling approach repurposed for products — no attribute inheritance, completeness scoring, or publish-readiness workflows — but validated by real-world deployments.

No native merchandising features — no category management UI, no promotional content scheduling tied to commerce, no cross-sell/upsell tooling, no search result merchandising. Directus is a data platform, not a commerce tool. Any merchandising logic lives entirely in the frontend or commerce platform.

Directus integrates with Shopify as a headless PIM via REST/webhook-based synchronization — documented case study for an industrial goods retailer syncing categories, tags, images, and translations. An official tutorial covers building an e-commerce platform with Next.js, Stripe, and Directus Automate. The official n8n integration provides a structured automation path to Shopify (n8n has dedicated Shopify nodes for CRUD on products, orders, etc.), improving the integration story from pure custom webhooks to automation-platform-mediated sync. No deep API federation or real-time bidirectional sync; integration remains mediated rather than native.

Editorial commerce is achievable in Directus through M2A page builder blocks blending article content with product references, and the fashion e-commerce PIM case study demonstrates editorial product presentation. MightyHQ manages product and marketing data together from one instance. However, there are no native shoppable content features — no inline product purchase CTAs, no lookbook component, no shop-the-look templates. Product embeds are possible but require custom frontend implementation; not a first-class authoring pattern.

No CMS-managed content in transactional flows. Directus has no native mechanism for injecting trust badges, shipping callouts, upsell banners, or post-add modals into commerce checkout flows. The Stripe integration tutorial covers order creation logic but not CMS-managed checkout content. All transactional content management lives in the commerce platform or requires custom frontend implementation.

Directus Flows can receive webhooks from commerce platforms (Shopify order events, Stripe payment_intent.succeeded) and trigger content-related actions — email sequences, status updates. The n8n integration provides a more structured path for post-purchase automation (n8n Shopify trigger to Directus CRUD operations), but this is still entirely custom. No native post-purchase templates, delivery tracking page management, or loyalty content features.

Directus's RBAC with field-level and row-level permissions enables account-specific content visibility (gated catalogs, segment-specific pricing display). The T2 MarCom case study shows B2B industrial data management with data validation frameworks for technical specifications. However, there are no purpose-built B2B features — no quote-request flows, no customer-specific pricing display components, no account-based catalog segmentation UI. B2B patterns are achievable but require custom schema and frontend design. Note v12's MSCL relicense ignores custom permission rules on the free Core tier, so row-level gating now requires a paid plan.

No native faceted search, content-product blending, or search landing page management in Directus. Teams integrate Algolia, Meilisearch, or Typesense via Flows (sync on item create/update) and build search UIs in their frontend frameworks. The n8n integration provides a more structured automation path for syncing content to external search engines. There is no out-of-the-box search analytics or synonym management.

Directus v12's native draft & publishing workflow (explicit draft/published states) improves pre-staging of promotional content for scheduled go-live, on top of content versioning and the Releases feature that batches promotional updates across collections for simultaneous publish. v11.17 timezone support for datetime fields improves scheduling accuracy for international promotions. However, there are still no native countdown timers, promo code messaging components, time-activated banners, or channel-specific targeting features. Scheduled publishing with a real draft/publish lifecycle is available; purpose-built promotional tooling is not.

Directus handles multi-storefront content via row-level tenancy (tenant_id + RBAC filter rules) on a single instance, allowing shared product content with storefront-specific editorial. The Fortuna Entertainment Group case study demonstrates 3 gaming brands across 5 markets served from one Directus instance. The fashion PIM case study shows content distributed to Shopify, Amazon, and Zalando from a single source. Multi-storefront is achievable but requires custom schema design; no native multi-storefront abstraction exists.

Directus supports image transformations (Sharp on self-hosted, CDN-backed transforms on Cloud), multi-file associations per product record, folder-based asset organization, and basic video file hosting. v11.17 added bulk folder deletion for large asset libraries. There is no native 3D model viewer, AR integration, image hotspot editor, 360-degree product views, or zoom functionality. Basic image galleries and video embeds achievable via custom frontend components.

Directus RBAC supports multi-author content at scale — different editors can own different content namespaces via role-based isolation. A custom marketplace schema (seller profiles as content types, product descriptions with seller ownership via row-level permissions) is achievable. However, there are no marketplace-specific features: no seller onboarding workflows, no content quality moderation queues, no review aggregation, no seller portal UI. Multi-author content is possible but not marketplace-specific.

Directus's Translations field on any collection supports locale-variant product descriptions, multi-language product attributes, and region-specific editorial. v12 added AI-assisted translations to auto-translate product content across languages, on top of the v11.17 utility endpoint + UI for generating translations collections and timezone support for locale-aware scheduling. The Crowdin connector automates translation sync for product content, and the fashion PIM case study distributes product content to Shopify, Amazon, Zalando, and Otto. No currency-aware content blocks or regional regulatory content tooling natively.

No native connection between Directus content and commerce conversion metrics. The Data Studio collects no revenue attribution data, content-assisted conversion tracking, or product content performance analytics. All commerce analytics live in the frontend analytics stack or commerce platform. Directus Flows can emit events on content publish but cannot correlate them with downstream conversion outcomes.

Directus retains deep RBAC for a headless CMS: field-level permissions, filter-rule-based row-level access, IP allow-lists, the v11 policy-based additive permissions model (composable permission sets decoupled from roles), and SSO via OAuth2, OpenID Connect, SAML 2.0, and LDAP. However, the v12 MSCL relicense (June 2026) moves the two controls most relevant to intranet scenarios behind a paid license: SSO no longer works on the free Core tier (users must convert to email/password), and custom permission rules on access policies are ignored on free Core. The depth remains best-in-class for a headless CMS on paid tiers, but the advanced access controls are now paywalled, narrowing the gap to SSO-gating peers.

Directus v12 added a native draft & published editorial workflow (explicit states, version selectors, publish actions in the Studio) giving knowledge articles a real review-and-publish cycle, on top of content revision history with side-by-side comparison (v11.15), native collaborative editing with live presence, Flows-based approval workflows, global draft versions (v11.16), and comparison modal filtering (v11.17). The 'Mission: Internal Knowledgebase' Directus TV episode demonstrates a verification flow. However, there are still no purpose-built knowledge lifecycle features — no content expiry/review scheduling, no automated archival workflows, no stale content flagging.

Directus does not appear in any intranet comparison and has no native employee portal features — no news feed, employee directory integration, notifications for employees, social features, or personalized dashboards. The 'Built With Directus — Internal App' use cases show it used as a backend for custom-built internal tools, not as an off-the-shelf employee experience platform. The v12 Studio redesign improves the admin editing experience for non-technical staff but is not an employee-facing portal. Building a full employee portal requires extensive custom frontend development. Scores at the floor.

No native internal communications features — no company news feed management, no department announcement targeting, no read receipts, no acknowledgment tracking, no mandatory-read workflows. Directus can host news content in a custom 'posts' collection with Flows-triggered email notifications, but this is entirely custom infrastructure with no internal comms-specific UI in the Data Studio.

No native people directory or org chart features. Directus's flexible content modeling can represent employee profiles as content types with relational fields (skills, manager/team M2M), but there is no pre-built directory UI, no org chart visualization, no HR system integration (Workday, BambooHR), and no search-by-expertise feature. Building a basic employee directory via content modeling is feasible but entirely custom.

Directus v12's native draft & publishing workflow plus the new archived boolean improve staging and retiring of policy documents, on top of content revision history with side-by-side comparison, Flows-based approval workflows, and an activity log that tracks every create/update/delete with user, timestamp, and IP for audit trails. However, there are still no native policy management features: no mandatory acknowledgment tracking, no automated review/expiry reminders, no policy archival workflows with owner notifications, and no content ownership assignment for freshness enforcement.

No native onboarding content delivery features in Directus. Role-based content access via RBAC could theoretically restrict onboarding content to new-hire roles, and Flows could trigger onboarding sequences on employee record creation, but there are no structured onboarding journey templates, progressive disclosure mechanisms, task checklists, or HR-triggered new-hire portal patterns in the product or extension marketplace.

No native full-text or enterprise search in Directus Data Studio — built-in filter/search is limited to basic field-value matching. Teams integrate external search platforms (Algolia, Meilisearch, Typesense) via Flows sync on content publish. The n8n integration provides a more structured path for syncing content to external search engines, but there is no federated search across connected systems, no AI-powered relevance ranking, and no search analytics dashboard.

Directus Data Studio is a web application with responsive design, accessible on mobile browsers, but optimized for desktop admin use. There is no native mobile app for content editors or frontline workers, no offline support, no push notifications, and no kiosk/shared-device mode. Headless API delivery enables custom mobile apps for consumers but requires full custom frontend development. Scores at the low end of responsive-web-without-native-app tier.

No native LMS integration, micro-learning features, course assignment, completion tracking, or certification capabilities in Directus through v12.1.1. Learning content can be hosted as structured content types, but tracking, sequencing, and certification require an external LMS connected via API. No documented integration patterns with Cornerstone, Workday Learning, or similar LMS platforms.

Directus v11.15 added native real-time collaborative editing (WebSocket, field-level locking, live presence indicators) — but this is for content authors in the Data Studio, not for employee social interaction. There are no employee-facing social features: no comments or reactions on published content, no discussion forums, no peer recognition, no polls/surveys, no idea submission, no community spaces. The collaborative editing is an authoring tool, not a social layer for employees.

Directus has official integration guides for n8n (which has dedicated nodes for Slack, Microsoft Teams, Google Workspace) and Zapier (Beta — connecting to thousands of workplace tools). These provide structured automation paths for content-to-workplace-tool delivery beyond raw Flows webhooks. The MCP server (now using OAuth 2.1 in v12) allows AI assistants (Claude Desktop, Cursor) to interact with Directus content. However, there are still no native embedded content cards, no bot-driven experiences, and no single-pane integrations with workplace tools through v12.1.1 — all integration remains automation-platform-mediated.

Directus v12 introduces explicit draft/published states and replaces the collection status field with a native archived boolean, giving a clearer first-class archive concept, on top of content versioning, revision history with comparison view (v11.15), global draft versions (v11.16), and comparison modal filtering (v11.17). The activity log provides an audit trail of all content changes. However, there are still no automated review dates, no stale content flagging, no archival workflows with owner notifications, and no content expiry scheduling. Content lifecycle management remains largely manual — owners must proactively review and archive.

No internal content analytics in Directus. The activity log records admin actions (create, update, delete, login) but not content consumption or employee engagement metrics. There are no page view analytics, no department-level engagement dashboards, no failed search term reporting, no adoption dashboards for intranet ROI measurement. Content analytics must be implemented entirely in the consuming frontend application.

Directus supports multi-tenancy via row-level tenant_id filtering + RBAC policy scoping on a shared instance, and separate-instance-per-tenant for strict data isolation. Row-level isolation is functional and production-validated (multiple SaaS case studies: Saley, Comeata). Directus Cloud Professional projects run in isolated containers. v11.17 added Redis namespace control which improves multi-tenant cache isolation on shared infrastructure. However, there is no native multi-tenant architecture — no built-in tenant provisioning, no schema-per-tenant management, and no centralized tenant orchestration. The proposed Directus Hub remains unreleased as of v12.1.1 (July 2026).

No native cross-tenant or cross-brand content sharing mechanism. In multi-brand setups, shared global content must be federated via API from a central Directus instance — a workable but entirely custom pattern. M2A Dynamic Page Builder blocks serve as a shared component library within a single instance. Schema Sync extensions exist for propagating schema changes across instances. The proposed Directus Hub would add modular schema/extension deployment but remains unreleased.

No native cross-brand governance, centralized approval workflows, or global policy enforcement across multiple Directus instances. The v12 draft/publish editorial workflow strengthens per-instance governance but is not a cross-brand layer. The Directus Hub discussion proposes audit trails, schema drift detection, and centralized access management but remains unreleased through v12.1.1. Per-instance governance is solid (RBAC, activity logs, approval Flows), but there is no multi-instance governance layer. Organizations managing multiple brand instances must coordinate governance manually.

Directus v12's MSCL relicense (June 2026, replacing BSL 1.1) materially reshapes scale economics. The free Core tier is now capped at 3 Studio seats and ~25–50 collections with no SSO and custom permission rules ignored. Organizations under $5M revenue AND fewer than 50 employees can still get full free access via the Open Innovation Grant (registration required), preserving a free path for small agencies. Beyond those thresholds, the paid Team plan is $499/mo annual ($5,988/yr) / $599/mo monthly with 10 SSO seats and $50/seat/mo beyond. Self-hosting remains source-available with near-zero marginal infrastructure cost per brand, and API-only delivery carries no seat cost — but Studio-editor seat licensing now scales with team size and the seat/collection caps constrain larger multi-brand agency use. Still better than SaaS-only per-brand licensing, but the previous best-in-class footing (blanket free under $5M including production, no seat limits) is gone.

Directus Data Studio supports full white-labeling: custom logo, primary color, favicon, and module navigation per project instance. AgencyOS demonstrates per-client branded CMS admin experiences. Brand-level theming of the admin experience is solid. However, there are no platform-level mechanisms for enforcing per-brand design tokens in the content delivery layer — theming of published frontend sites is handled entirely by consuming application code, not by Directus.

Directus supports per-brand localization via Translations fields on any collection, with the Crowdin connector and v12 AI-assisted translations for translation workflow automation, and the v11.17 translation quick-setup utility reducing configuration friction. However, there is no brand-aware localization governance — no per-brand translation approval workflows, no regional legal content governance per brand, and no brand x locale intersection management. Translations are managed per-instance or per-collection, not at a cross-brand level.

No cross-brand or portfolio-level analytics in Directus. The activity log provides per-instance admin action tracking, not content performance metrics. There is no dashboard aggregating engagement, publishing cadence, or content velocity across multiple brand instances. Multi-instance organizations must build custom data pipelines to aggregate metrics. Scores at the floor.

Directus Flows allow different automation logic per collection, trigger, and role — enabling distinct approval chains per brand within a single instance via separate Flow configurations, and the v12 draft/publish workflow adds per-collection editorial states. With separate instances per brand, completely independent workflows are possible. However, there is no central audit across brand workflows, no cross-brand workflow visibility, and no UI for configuring per-brand workflows from a central control point.

Corporate-level content can be syndicated to brand sites via API from a central Directus instance — press releases, legal disclaimers, and product announcements can be fetched by brand frontends from a shared content source. The n8n integration provides a structured automation path for syncing content between Directus instances (CRUD + trigger nodes). However, there is no native syndication mechanism with controlled override points, no push-update system for propagating corporate content to child brands, and no brand-level adaptation layer.

Directus Cloud offers SOC 2 Type II, ISO 27001, and GDPR-compliant infrastructure with 15+ global deployment regions enabling data residency choices. Per-brand RBAC policies can restrict what editors publish in which regions. However, there are no per-brand/region compliance publishing guardrails — no automated GDPR consent content checks, no accessibility standard enforcement, no cookie policy management, and no guardrails preventing non-compliant content publication. Compliance is infrastructure-level, not content-governance-level.

No centrally maintained design system with federated brand extensions in Directus. Dynamic Page Builder block types serve as a rudimentary component library within a single instance, but there is no versioning, update propagation across instances, or brand-level extension mechanism. AgencyOS provides a starting template for per-client deployments but does not implement a federated design system. White-label branding is limited to the admin UI.

Within a single Directus instance, the v11 policy-based permissions model supports composable roles enabling central admin oversight of all brands alongside brand-specific editor roles, and access policies can be duplicated to reduce setup repetition. However, v12's MSCL relicense moves SSO (SAML/OIDC/LDAP) behind the paid Team plan ($499/mo, 10 SSO seats) — it no longer works on the free Core tier — so unified cross-brand authentication now requires a paid license. In multi-instance setups, user provisioning must still be replicated per instance; there is no native cross-instance user management hub.

Directus's flexible schema-based content modeling allows shared base content types reused across brand contexts within a single instance, with brand-specific fields added per collection. Schema Sync extensions enable propagating schema changes across instances. However, there is no formal model inheritance mechanism — Brand A cannot extend a global product page model without diverging schemas that must be manually synchronized. Shared types with limited customization are achievable but not architected for multi-brand extension without forking.

No portfolio-level reporting in Directus. Per-instance activity logs track admin actions with timestamps, users, and affected items, but there is no cross-instance aggregation, no content freshness reporting by brand, no publishing SLA tracking, no cost allocation per tenant, and no capacity planning dashboard. Organizations managing a brand portfolio must build custom data pipelines to aggregate metrics from multiple Directus instances. Scores at the floor.

Directus publishes a Privacy Policy with GDPR rights (erasure, portability, access, rectification) and CCPA rights, plus a public Trust Center sub-processor list (AWS, Cloudflare, SendGrid, Google, and Northflank — engaged Feb 1, 2026 for cloud infrastructure/hosting). Multiple EU regions are available (incl. EU Frankfurt on Professional), but a GDPR-compliant DPA is offered only on the Enterprise Cloud tier with no self-service DPA for Professional, which caps the score below the 80+ tier.

Directus Cloud does not offer a HIPAA BAA, and no healthcare-specific guidance appears in the security or trust documentation. Self-hosted deployments can be placed on HIPAA-eligible infrastructure, but compliance is entirely the customer's responsibility — no vendor-side coverage exists.

Coverage is limited to GDPR (EU) and CCPA (California), explicitly addressed in the Privacy Policy. The security page references NIST SP 800-53 access-control principles and AWS Well-Architected reviews, but these are framework adoptions rather than certifications. No FedRAMP, IRAP, C5, PCI-DSS, HITRUST, UK GDPR IDTA, LGPD, or PIPEDA documentation found.

Directus Cloud holds a SOC 2 Type II attestation audited by A-LIGN (announced July 2025) covering all five Trust Service Criteria — Security, Availability, Processing Integrity, Confidentiality, and Privacy — with the report accessible via the SafeBase-hosted Trust Center under NDA. The full TSC scope places this at the top of the SOC 2 tier; annual surveillance cadence is not explicitly published, which prevents pushing higher.

Directus does not hold ISO 27001 at the platform/ISMS scope. The security page only states that cloud hosting providers (AWS) must be ISO 27001 compliant, which per the scoring rules cannot be inherited by the SaaS platform. No ISO 27018 certification is published.

Beyond SOC 2 Type II, the Trust Center publishes a CAIQ self-assessment (equivalent to CSA STAR Level 1) and penetration test reports. NIST SP 800-53 alignment and AWS Well-Architected reviews are framework adoption, not certification. No PCI-DSS, Cyber Essentials, FedRAMP, IRAP, ENS, or C5.

Directus Cloud advertises 19 regions on Enterprise (US, EU, APAC, South America, Africa) and 3 on Professional (US East, EU Frankfurt, APAC Singapore), with documentation framing region selection for GDPR. However, contractual residency guarantees are not publicly documented in standard terms, and CDN-cache impact on residency is not addressed.

Trust Center documents data erasure procedures and backup policy with daily encrypted (envelope-encrypted) backups and 24–48h RTO/RPO. The privacy policy supports right-to-erasure and data portability. Specific post-termination retention windows are not published, and there is no self-service bulk export portal beyond the standard REST/GraphQL APIs.

The Activity Log captures user actions, system events, timestamps, and IP addresses with REST/GraphQL export. Documented n8n integration provides event-based trigger nodes that can forward Directus events to external systems, supplying a documented path to SIEM beyond pure API polling. Still no native SIEM push connector, log retention period is undocumented, and direct database writes outside the API are not captured.

Directus publishes a dedicated accessibility page for Data Studio documenting keyboard navigation (Tab, arrow keys, Enter/Space), skip menu, and shortcuts (Meta+S save, Meta+Enter apply, Escape cancel). Known limitations are transparently listed (manual sorting, DateTime interface, CodeMirror Tab-trap, Markdown editor). The v12 Studio redesign (GA 2026-06-15) reworked navigation, headers, sidebars, and editorial workflows for non-technical users but introduced no formal WCAG 2.1 AA conformance claim or ATAG 2.0 statement, which keeps this below the 45+ stated-target tier.

A dedicated accessibility documentation page covers keyboard navigation and known limitations, providing practical guidance. However, no VPAT/ACR is published, no Section 508 conformance statement exists, and no ATAG 2.0 assessment is available — the page is operator guidance rather than procurement-grade conformance documentation.

Directus ships a native AI Assistant (GA since v11.15, carried into v12.1.x July 2026) embedded in the Data Studio sidebar with reusable Mustache-templated prompts and built-in presets for spelling/grammar, social posts, SEO descriptions, expand/condense, and rewrite. In v12 the Assistant creates content, runs translations, and triggers Flows directly from the Studio. The Marketplace AI Writer Flow operation extends generation to pipelines (OpenAI, Anthropic, Mistral, LLaMA). Brand voice guardrails are still absent for freeform generation and bulk generation requires custom Flows configuration rather than native editorial tooling, capping the score.

Directus Marketplace ships AI image generation via DALL-E, AI Alt Text Writer via Clarifai, AI Focal Point Detection using OpenAI, and AI Image Moderation via Clarifai. The multimodal AI Assistant (GA since v11.16, retained in v12) supports image and PDF upload from the local machine or the Directus File Library with a provider adapter pattern for OpenAI, Anthropic, and Gemini — enabling inline analysis and alt-text generation via drag-and-drop. All image generation features remain Marketplace extensions rather than natively integrated DAM features, holding the score below 70.

Directus v12 makes AI-assisted translation a mature native feature: a 'Translate with AI' button in the translations interface translates fields across all configured locales at once using the provider set in Settings → AI (OpenAI/Anthropic/Gemini), and v12 adds a customizable model, a translation glossary, and a translation style guide specifically to keep brand voice consistent across languages — closing the prior brand-voice gap. Editors can also ask the AI Assistant to translate a post into multiple languages and have it write directly into the correct locale fields. Held below the high-70s because AI translations require a valid license (not on the free Core tier) and there is still no AI-TMS quality scoring.

The built-in AI Assistant includes a 'create SEO descriptions' prompt out of the box, and developers can chain AI Writer + AI Text Intelligence operations in Flows to auto-populate SEO metadata fields on content save. The official @directus-labs/seo-plugin provides structured SEO metadata management (title, description, OG tags, focus keyphrase) but is manual-only with no AI generation. No native automated metadata pipeline ships without Flows configuration, and no on-page SEO scoring engine is included.

Directus Flows supports multiple AI-driven content operation patterns: auto-tagging image uploads via Clarifai + Flows, scheduled publishing via date-field triggers, content moderation via AI Image Moderation, and multi-step AI pipelines combining image transformation, translation, sentiment analysis, and SEO metadata population. v12's native draft/publish workflow adds submission triggers, review notifications, and conditional approval/publish actions to these flows. Inngest is the official pattern for durable long-running AI ops and the documented n8n integration adds another automation pathway. Features still require Flows or external tool configuration rather than one-click editorial AI.

Directus has no named AI agent product, but its agentic infrastructure strengthened materially in v12: the official MCP server supports OAuth 2.1 with CIMD and Dynamic Client Registration, so AI agents act on behalf of real users under their own policies after an explicit consent flow, and each agent receives a Directus role with field- and collection-level permissions. Combined with Flows this enables genuine agentic patterns (CSV product imports, WordPress migrations with taxonomy, multi-entity creation in one conversation). It remains developer/operator-facing capability without a packaged agent product or named editorial agent, keeping it in the early-to-mid band.

The @directus-labs/ai-text-intelligence-operation (Deepgram) provides Flows-based content analysis returning summaries, topics, intents, and per-segment sentiment scores, and the @directus-labs/ai-transcription-operation (Deepgram) generates transcripts from audio that can be piped into text intelligence. These are Marketplace extensions requiring Flows configuration — no native content analytics dashboard, content performance layer, or stale-content detection ships out of the box.

AI Image Moderation (@directus-labs/ai-image-moderation-operation via Clarifai) provides image-level content safety auditing in GA. The MCP + Flows combination is documented as a pattern for running content audit flows across a date range of blog posts, but this requires custom-built automation rather than a built-in auditor. No dedicated readability scoring, brand-voice compliance checking, or content-quality dashboard exists, and accessibility scanning and duplicate/thin-content detection are absent.

Directus still has no native semantic or vector search as of v12.1.x (July 2026). GitHub discussions #17822 and #22213 requesting pgvector/embedding support remain backlog feature requests with no committed timeline. Standard Directus search is a keyword/LIKE filter via REST and GraphQL. The open API and item hooks make Directus usable as a RAG data source with externally built embedding pipelines (e.g., the Upstash Vector and pgvector tutorials), but this requires fully custom external integration rather than any native AI search capability.

Directus explicitly positions itself as a content/data platform layer and not a personalization engine. No native rule-based or ML-driven personalization system is available, and no first-party personalization integrations exist in the Marketplace; personalization requires a fully external implementation (edge function, CDN logic, or third-party tool). Directus provides the flexible API to feed external personalization engines but has no native AI personalization capabilities.

Directus ships an official production MCP server (@directus/content-mcp) covering read/create/update/delete items, collections/fields/relations, file management, user/role/permission management, triggering Flows, markdown conversion, file imports, and dynamic Mustache-templated prompt storage. v12 added OAuth 2.1 support with Client ID Metadata Document (CIMD) and Dynamic Client Registration for remote MCP, alongside static-token mode, putting it at the front of the MCP field. It is schema-aware, enforces role-based permissions, includes global delete protection, logs all actions in the activity log, and supports Claude Desktop/Code, ChatGPT, Cursor, VS Code Copilot, and Raycast.

BYOK remains a first-class design principle — Directus provides no hosted AI inference; administrators supply their own keys in Settings → AI for OpenAI, Anthropic, and Google Gemini on every tier, keys are encrypted at rest and masked, an Allowed Models dropdown restricts models per provider, and a Provider Options field passes provider-specific parameters. However, v12's MSCL license change now gates custom and self-hosted OpenAI-compatible endpoints (Azure OpenAI, Ollama, DeepSeek, self-hosted models) to the Enterprise tier — Core-tier instances are limited to the three default providers — narrowing the previously open BYOM breadth and data-residency story.

Directus offers strong composable AI extensibility: the OpenAI-compatible custom endpoint field enables any model without code changes (Enterprise tier); the full REST and GraphQL API makes Directus a viable document store in RAG pipelines; custom Flows operations can call any external AI service; and the @directus/ai npm package provides shared AI types. Inngest is the official pattern for durable long-running AI workflows and the documented n8n integration adds a visual pathway to external AI services. However, no official LangChain or LlamaIndex connector exists, and there is no dedicated AI SDK or agent-optimized content delivery endpoint.

Directus governs AI through its existing policy model, strengthened in v12: MCP OAuth 2.1 adds explicit user consent flows and user-scoped permissions, AI agents receive a Directus role with field- and collection-level permissions, and every AI create/update/delete is logged in the native activity log with full attribution — identical to human actions. v12's native draft/publish workflow provides a human-in-the-loop gate (AI writes drafts; publishing is an intentional human action), with submission triggers, review notifications, and conditional approvals in Flows. Keys are encrypted/masked and instance-level kill switches (AI_ENABLED, MCP_ENABLED) exist. Gaps: no IP indemnification, no hallucination detection, and provider data privacy depends on the operator.

AI telemetry provider configuration for Braintrust and Langfuse (AI_TELEMETRY_ENABLED, AI_TELEMETRY_PROVIDER), added in v11.17.0 and retained in v12, exports traces for observability, usage monitoring, and token cost analysis, with AI_TELEMETRY_RECORD_IO optionally capturing full prompts and responses and AI SDK Devtools middleware for development debugging. These external platforms provide cost breakdowns, latency tracking, trace replay, and prompt experiment tracking. No native Directus dashboard for token usage, per-user consumption metrics, or AI credit quotas exists — observability is fully delegated to external tools.