Jahia

Content types are defined as code in CND files with a broad property set (string, long, double, decimal, date, boolean, weakreference, binary, choicelists, mixins, nested child node types), and 8.2.x added per-field config overrides and new content selectors. There is no supported UI schema editor (the legacy content types module is deprecated) and no true union field, which keeps it below 70.

Weakreference properties support one-to-many and many-to-many references with content-type constraints, and the JCR hierarchy provides parent/child relationships; reverse lookups are available through JCR-SQL2 queries and the GraphQL references field. Relationships are not graph-native and reverse traversal needs explicit queries, so it sits in the adequate band.

Jahia's node model nests content lists, areas and components to arbitrary depth, and pages are composed from areas holding structured components; JavaScript Modules render the same structures as React views with island hydration. Rich text remains an HTML string rather than a portable block AST, so it stops short of 75.

CND supports mandatory properties, regex and value constraints, ranged numeric validation (added 8.2.1) and choicelist enumerations, and mandatory-property checks are enforced on GraphQL writes as well as in the editor. Cross-field or custom rules require a Java module (validator or rule), with no UI rule builder.

Jahia keeps versions on publication with a redesigned version comparison in jContent (March 2026) and restore of earlier versions, plus content history attributing operations to users; files are versioned on publication since jContent 3.7.1. There is no branching beyond the edit/live workspaces and deleted items are not restorable from a trash once the deletion is published.

Jahia ships a hierarchical Category Manager whose editing is permission-controlled, plus a site Tag Manager with usage counts and renaming; both apply to any content type via the categorized/tagged mixins, are queryable through GraphQL and are weighted in Augmented Search, and images can be autotagged with Amazon Rekognition. Synonyms and bulk reclassification are not core (bulk tag/category edit is a community module), which keeps it just under 75.

Page Builder gives in-context editing on Jahia-rendered pages (both JSP and JavaScript Modules), with per-language preview, a compare preview vs live view (8.2.1) and personalization variant preview. Headless frontends get preview through the Next.js SDK only, and shareable authenticated preview links for external reviewers are not documented, so it stays below 75.

The CKEditor 5 module (1.0, June 2026) provides a modern editor with per-field toolbar configuration via CND, internal link and media pickers, paste-from-Word and an accessibility checker. Output is an HTML string, not a portable AST with custom renderers, which limits it to the standard-WYSIWYG band.

jContent media management offers folders, metadata, asset usage tracking in views and pickers (8.2.3), thumbnails and Rekognition autotagging. On-the-fly transforms, WebP conversion and srcset resizing come through the Jahia-managed Scaleflex Cloudimage service on Jahia Cloud rather than a native URL transform API, and there is no native focal point.

Jahia offers item locking to prevent conflicting edits, and the Content Review accelerator adds threaded comments, assignments and notifications on content. There is no presence indicator or simultaneous co-editing, and the commenting module is an accelerator rather than core, so it sits low in the adequate band.

Jahia's jBPM-based workflow engine supports multi-step BPMN2 workflows with custom states, role-based task assignment, workflow assignment per content type or subtree, notifications and a publication dashboard now reachable from Page Builder. Custom workflows require developer work, the OSGi workflow extender is deprecated and the announced re-foundation has not shipped, which keeps it just under 70.

Visibility conditions provide native start/end date display control, and scheduled publication comes through the Scheduled Publication Workflow module, which its own docs describe as not supported by Jahia and which uses server timezone only. Release bundles exist only as the Content Releases accelerator and there is no publishing calendar, so scheduling effectively needs plugins.

Localization is field-level: each property is flagged i18n or shared across languages, with mandatory languages that gate publication, per-language publication workflows, and a mix-language fallback to the default language. Fallback is single-level to the default language rather than configurable chains, so it stops just below 75.

Jahia has custom server and site roles built from fine-grained permissions, ACLs assignable on any node with inheritance, language-specific editing rights and per-content-type editor permissions, plus SSO via the SAML2 Authentication Valve (4.0.0 for 8.2.3), OAuth/OIDC and LDAP modules. Field-level permissions are not a standard role feature and no SCIM provisioning is documented.

The GraphQL API (graphql-core) covers read and write with Relay pagination, filtering, sorting, per-language queries and extension points, alongside the JCR REST API and Augmented Search GraphQL. Delivery and management share one endpoint distinguished by workspace rather than a separate delivery API, which keeps it below 75.

Jahia Cloud offers CloudFront CDN and WAF with dashboards and cache-tag invalidation, but the Cloud FAQ lists CloudFront as an add-on and full-page HTML caching was still listed as upcoming in March 2026. Self-hosted installs have no vendor CDN and there is no edge-side personalization.

Events are available to developers through JCR observation listeners, the Drools rules engine and GraphQL subscriptions, and StackConnect (Workato) can react to some events. There is no first-class outbound webhook service with UI, filtering, signing, retries or delivery logs, so any webhook must be coded in a Java module.

Jahia is a hybrid CMS: content is exposed through GraphQL for any channel and there is an official Next.js SDK alongside JavaScript Modules for server rendering. SDK coverage is limited to JavaScript, rich text is HTML, and there are no native mobile SDKs, which places it in the traditional-CMS-with-API band.

jExperience, built on jCustomer (Apache Unomi, which Jahia created), provides first-party unified visitor profiles, rule-based and behavioral segments, scoring plans and static lists usable directly in personalization rules, included in the DXP Enterprise plan. Identity resolution and third-party CDP sync rely on connectors rather than named deep integrations, keeping it just under 75.

Editors create per-segment content variants directly in Page Builder, with the default variant visible and colour-coded and preview per audience (March 2026 update). Rules are segment and profile-property driven without AI decisioning, which is scored elsewhere.

jExperience supports native A/B tests with traffic split, goals and results dashboards with filtering (March 2026). Statistical significance, auto-winner selection and multivariate testing are not documented, so it stays below 70.

Jahia has no recommendation engine; the nearest capability is scoring plans and interest-based personalization rules that teams can wire into content lists. Algorithmic or collaborative-filtering recommendations would have to be built on the profile APIs.

Augmented Search (4.x on Elasticsearch 9) is Jahia's own search product, with faceting, autocomplete, weighting of tags and categories, a GraphQL search API and Search UI components, provided in the Enterprise distribution. Merchandising and search analytics are thin compared with dedicated search products.

Jahia has no catalog, checkout, pricing or inventory; the only commerce artifact is a demo shopping-cart module illustrating the concept.

No Shopify, commercetools, BigCommerce or SAP Commerce connector is listed in the Jahia Store or integrations catalogue; connections would go through StackConnect (Workato recipes) or custom GraphQL federation. That is a generic iPaaS path without product picker or live federation.

jExperience provides dashboards for A/B tests, personalizations, goals and audience behavior, and the content reports module covers content status, authorship and workflow lifecycle. Page-level engagement analytics are partial and most sites still pair Jahia with an external analytics tool.

Store modules connect Google Analytics to jExperience, Siteimprove has a Jahia CMS plugin, and Power BI and others are listed integrations; tag managers are added through templates. These are connectors rather than in-product analytics, so the integration ceiling applies.

Jahia runs many sites per instance with per-site languages, templates, roles and settings, and content can be shared and referenced across sites; Local Site Manager synchronizes a global site to local sites. Cross-site sharing is strong, though master/local sync depends on a separate module.

Official connectors exist for GlobalLink (Translations.com) and DeepL machine translation (updated January 2026), with XLIFF export/import for other TMSs. Phrase, Smartling or Lokalise connectors are not listed, and the connectors are integrations, capping the score at 60.

Shared template sets and modules, per-site local administrators and Local Site Manager synchronization give central teams consistent components across brands. Cross-brand policy enforcement and brand-level analytics are not offered as dedicated tooling.

Jahia's own media library has usage tracking, tags and versioning but no rights, expiry or asset approvals; enterprise DAM comes through the Jahia Store connectors for Cloudinary and Keepeek. A Bynder connector exists only from third party Gladtek and is not in the Jahia Store.

Jahia has no video transcoding, streaming or captions; the legacy video streaming module is listed as elderly and video otherwise comes through Cloudinary or Keepeek pickers or YouTube/Vimeo embeds.

Page Builder reached parity with Page Composer in 8.2.3 and is production-ready, with drag-and-drop, insert-anywhere, templates with locked areas and restricted component lists, and 2026 performance and drag improvements. Brand guardrails such as locked design tokens and composition for fully headless frontends are limited.

Jahia renders the full site (JSP or JavaScript Modules SSR) and Jahia Cloud hosts it on dedicated infrastructure with 99.9% production availability, blue-green upgrades, environments and EU/US/APAC regions, included with the Enterprise plans. CloudFront CDN is listed as an add-on and headless frontends are hosted elsewhere, which keeps it below 90.

Jahia Forms provides a builder with multi-step, multi-language and conditional forms, validation, CAPTCHA, submission storage and actions, and progressive profiling via the jExperience bridge that prefills or hides known fields. Form analytics and lead routing are lighter than dedicated marketing platforms.

A Marketo connector pushes segmentation and scoring to Marketo, but its documentation predates Jahia 8, and other ESPs are reached through StackConnect recipes. There is no native send, email preview or triggered sends from CMS events.

jExperience provides goals, scoring and campaign tracking, and profile data can be pushed to Marketo or orchestrated through StackConnect. Drip flows, nurture and lifecycle orchestration are not native, so this is tight-ish integration at best.

Site settings include a full UI for vanity and canonical URLs with a dashboard, page metadata and Open Graph fields, a sitemap module generating per-language sitemaps, and hreflang via language handling; Siteimprove adds recommendations. Redirect management on rename comes from the community Permalink Generator and there is no native structured-data authoring.

A community llms.txt manager module (source in github.com/Jahia/llms, updated July 2026) adds an editor-managed /llms.txt under jContent's SEO menu. It is community-status rather than supported, and there are no per-page Markdown endpoints, AI crawler controls or citation reporting; crawler blocking would be done at the CDN/WAF.

The Jahia Store lists many modules with Supported, Community and Legacy statuses, covering authentication, translation, DAM, search, SEO and analytics, and StackConnect opens Workato's large connector catalogue. Many listings are community or dated, and first-party connectors for commerce and ESPs are thin.

Jahia supports visitor accounts, login forms and ACL-based gated content natively, social login through the Jahia OAuth module (Google, Facebook, LinkedIn, GitHub, FranceConnect), SAML2 and OIDC federation, and jExperience maps authenticated profiles into personalization with privacy manager consent. Self-service portal pages and the OIDC/Keycloak modules are community-level, keeping it below 75.

Jahia 8.2 positions GraphQL (graphql-core, endpoint /modules/graphql) as the primary recommended API and deprecates the JCR REST API for content manipulation, with an interactive GraphQL Playground in Developer Tools, custom SDL schemas, and a separate Provisioning REST API at /modules/api/provisioning for platform operations. The jahia-mcp-community-server (first release April 2026) re-exposes that GraphQL surface as an MCP server for AI assistants. The API is GraphQL-first but still projects a JCR node tree rather than a purpose-built content-delivery API, which keeps query shapes node-centric and caps the score below modern headless platforms.

The prior score penalized Jahia for undocumented limits; graphql-core now ships and documents explicit query-cost guards — graphql.query.maxComplexity (default 2000), graphql.query.maxDepth (default 30), graphql.request.operationLimit (default 20), and graphql.fields.node.limit (default 5000 nodes per page) — with complexity and depth measured per operation in batch requests and post-fragment-expansion field bounds added in PRs #670/#676 (Aug–Sept 2026); over-budget queries are rejected before execution. Delivery sits behind AWS/OVH CDN with 300+ edge locations, and Augmented Search offloads search to Elasticsearch with published capacity-planning guidance. Held below 75 because these are self-tunable safeguards rather than a published throughput or latency contract, and there is no sync/delta API for large-dataset incremental pulls.

The only official content-consumption SDK Jahia ever shipped, @jahia/nextjs-sdk, is stalled at v0.0.7, was last published roughly three years ago, and the npm listing states it is no longer supported — the Next.js initiative was an exploration, not a maintained product. What remains is javascript-modules-library (.d.ts typings for backend methods exposed by the Java OSGi bundle), which is a module-authoring library rather than a client SDK, and Apollo Client, a community library Jahia merely recommends. There are no official Python, Ruby, .NET, PHP, Swift, or Android SDKs, so this stays in the community-only band.

Jahia's breadth comes from StackConnect, an OEM of Workato, but it is documented under jExperience and gated to a StackConnect/jExperience subscription rather than being a native Jahia marketplace, and Jahia's own pages quote inconsistent counts (250+, 400+, and 1,000+ connectors across jahia.com/integrations, the technical-overview page, and the Academy). The first-party Jahia Store is modest by comparison: DAM is Cloudinary and Keepeek only, plus analytics (Google, Adobe) and Commerce Factory. Lowered from 62 because the headline connector numbers belong to a third-party iPaaS and do not reconcile against each other, while the directly-owned catalog has real category gaps.

Jahia offers two first-class extension paths: OSGi Java modules with hot deployment, 30+ documented UI extension hooks, custom SDL GraphQL schema, and custom JAX-RS endpoints; and JavaScript Modules (engine v1.2, shipped stable in 8.2.3, OpenJDK-compatible) that let teams extend the platform in React/TSX with full Java/OSGi interoperability. Against that, the Workflow Extender module and custom JBPM workflows are now deprecated with a replacement only promised by end of 2026, meaning a documented extension path is being withdrawn ahead of its successor. Net unchanged: the dual Java + JavaScript surface is among the broader profiles in traditional DXP, but the workflow gap prevents a move higher.

SAML 2.0 (saml-authentication-valve) and OAuth/OIDC social-login modules are free, open-source, and installable on any Jahia edition rather than being gated behind an Enterprise tier, which is a genuine advantage over peers that paywall SSO; 8.2.3 added an OSGi authentication service, and the user-password-authentication module supplies secure login forms with a GraphQL auth API, email-based MFA with customizable templates, and pluggable custom MFA factors, alongside jahia-mfa-core on the Store with OTP/SMS/Email/Phone providers. Raised modestly from 70 on the confirmed ungated SSO and the productized MFA modules. Held under 78 because the Academy still frames MFA as a sample implementation customers adapt themselves (mfa-community-parent), there is no tenant-wide MFA enforcement policy, and API tokens depend on JWT having been split into the separate security-filter-tools module in 8.1.9.

Jahia uses a node-level ACL permission system where permissions attach to JCR nodes, supporting content-instance-level access control and custom roles; the permissions deep-dive documents granular actions (read, write, delete, publish) and Content Editor supports per-field permissions. 8.1.9 added a security-filter permission configuration allowing extension of jnt:user child node types and system-only protection on user deletion. The model is genuinely granular, but its JCR heritage makes reasoning about effective permissions harder than in purpose-built RBAC systems, which keeps it out of the 80+ band.

Jahia holds ISO 27001:2022 via AFNOR with a broad company-wide scope that explicitly includes Product Development alongside Cloud, IT, Support, Professional Services, Legal and HR; it is GDPR compliant with native right-of-access/erasure/anonymization tooling, was assessed against the HIPAA Security Rule by Coalfire, maintains PCI DSS SAQ A 3.2.1 annually, and offers EU and sovereign residency via AWS Ireland, AWS Switzerland, and OVH France with single-tenant infrastructure. The absence of any SOC 2 Type 1 or Type 2 report — plus no public HIPAA BAA, FedRAMP, CSA STAR, or HITRUST — is the gap that keeps this below the 80+ band for North American enterprise procurement.

Security communication has visibly matured: Jahia now publishes a dated security-patch page with linked advisories and ships dedicated security patch releases (8.1.9.3, 8.2.3.2), with concrete hardening shipped in 2026 — remember-me cookies rejected before authentication when malformed, Authorization: Basic gated by default (SEC-285), a security.profile=off switch for deployments supplying their own authorization, system-only protection on user deletion, and npm packages published with provenance attestations against supply-chain attacks. It runs an ISO 27001:2022 ISMS with regular cloud pen tests and proactive third-party CVE remediation (snakeyaml 1.33→2.4 for CVE-2025-52999 in 8.1.9). Raised from 60 on that advisory discipline, but capped below 70 by a real historical CVE record (XSS in older xCM releases) and the lack of any formal HackerOne/Bugcrowd bug bounty — only security@jahia.com and Open Bug Bounty reports.

Jahia supports both Jahia Cloud (managed, on AWS and OVH, with dedicated single-tenant stacks per customer) and full self-hosted/on-premise deployment via published Docker images, with private cloud explicitly supported for regulated industries and sovereign region choices including AWS Switzerland and OVH France. Docker images plus documented image-extension guidance make infrastructure-as-code patterns practical in both modes. The dual model earns the top of the flexibility band without exceeding it, since self-hosting still means operating a clustered Java/JCR stack.

Jahia's Cloud terms commit to the platform being operational at least 99.9% of each calendar month on fully redundant dedicated stacks, with up to 99.99% available for enterprise tiers and availability measured by synthetic probes running every minute against Jahia, Augmented Search, and jCustomer. status.jahia.com is a genuine public status page with incident history and posted scheduled maintenance (e.g. Cloud release v3.50.0 on 2026-04-28), and 2026 shows no sustained incident pattern. Held at 70 because 99.9% is a tier below the 99.95%+ threshold, the 99.99% tier terms and incident-response commitments are not public, and self-hosted deployments carry no vendor SLA at all.

Jahia Cloud runs auto-scaling Docker clusters that expand in under five minutes when average CPU exceeds 80% for five minutes, behind 300+ CDN edge locations on AWS and OVH, with clustered HA configurations (load balancers, multiple browsing nodes) and geo-data redundancy, plus blue-green deployments via the Provisioning API for zero-downtime releases. Augmented Search moves search load off the JCR repository onto Elasticsearch and ships published capacity-planning documentation — a rare concrete sizing artifact. The score stays below 75 because the documented limits are infrastructure-side rather than content-side (no published entry counts, API requests-per-second ceilings, or concurrent-user figures) and named enterprise-scale references are thin.

Jahia Cloud automates backups, restores, environment copies and cross-region migrations, with multi-datacenter replication on AWS and OVH and zero-downtime blue-green deployments driven by the Provisioning API. No public RTO or RPO targets appear in the Academy docs or the trust center, and self-hosted deployments rely entirely on customer-implemented DR. Automation is solid and export paths exist, which places this squarely in the automated-backups-without-documented-RTO/RPO band rather than higher.

The @jahia/create-module CLI scaffolds a JavaScript module with a pre-configured docker-compose.yml, so a developer gets a full local Jahia runtime without a manual Java/OSGi install, then iterates with yarn dev hot-deploy against Vite. Java module developers have a parallel path via the org.jahia.archetypes Maven archetype with -Djahia.deploy.targetContainerName to deploy into a local Docker container, and provisioning scripts can be injected at container start via EXECUTE_PROVISIONING_SCRIPT. It remains a container-based local stack rather than a lightweight emulator, and the two development paths mean teams maintain two toolchains, which caps it near the bottom of the 70+ band.

The Provisioning API (REST at /modules/api/provisioning, or filesystem, or the Docker EXECUTE_PROVISIONING_SCRIPT variable) drives module deployment and configuration without filesystem access to production, Jahia Cloud exposes create/delete environment operations for dev/staging/prod separation and blue-green upgrades, and SAM (Server Availability Manager) provides an explicit readiness gate so pipelines can wait for the platform before issuing module operations. The @jahia/create-module CLI ships GitHub Actions workflows out of the box. Raised from 68 because API-driven environment operations plus a documented readiness gate are exactly what the higher band asks for; held under 75 by the absence of content-schema migration tooling and branch-per-PR content environments.

Jahia Academy segments documentation by persona (developer, sysadmin, end user), publishes per-version release notes plus What's New and Customer Center sections, ships an in-product GraphQL Playground, and added full JavaScript/React tracks for 8.2 (introduction to JS modules, island architecture, under-the-hood) alongside the Java developer path. Working against it: the site serves the same pages under inconsistent version slugs (jahia-8.2 and jahia-8-2 both resolve), some feature docs live under jExperience rather than the core CMS tree where readers look for them (StackConnect), and MFA guidance sits in a knowledge-base article describing a sample to adapt rather than product documentation. Adequate with real gaps, not comprehensive.

JavaScript Modules are stable and natively support React TSX with a TypeScript + Vite build pipeline rendered server-side on React 19.x via GraalJS, and javascript-modules-library publishes .d.ts typings for the backend methods exposed by the Java OSGi bundle, with packages released to npm on every commit under provenance attestation. What is still missing is any code generation from the JCR content model to TypeScript types — the equivalent of GraphQL codegen on headless platforms — so content reads stay untyped unless teams wire up Apollo codegen themselves. TypeScript coverage is real at the component layer but absent at the content layer, which is exactly the typed-SDK-without-codegen band.

Core platform cadence has visibly slowed: as of Sept 2026 the newest Jahia core release is still 8.2.3, with 8.1.9 (Mar 2026) a security-only maintenance drop — no 8.2.4 or 8.3 exists, leaving roughly 14 months since the last core feature release (8.2.0, Jul 2025). Module-level shipping remains genuinely active, with Augmented Search 4.0 (Nov 2025, Elasticsearch 9) and 4.1 (Apr 2026), faster bulk indexing (Jun 2026), and a CKEditor 5 update adding macros, a styles dropdown and ChatGPT-assisted authoring (Jul 2026). Scored down from 65 because the core product, not just the module estate, is what buyers upgrade — modules carrying the cadence alone caps this below the 65+ band.

Jahia publishes structured, publicly indexable per-version release notes at academy.jahia.com plus a 'What's New' recent-releases hub, and separates feature work from security fixes (8.1.9 and 8.2.3 both call out security patches explicitly). Augmented Search 4.0 flagged its Elasticsearch 9 breaking change with upgrade notes. Held at 63: no per-release migration guides, codemods, or linked upgrade tooling, and parts of the Customer Center sit behind a customer login.

Re-verified in Sept 2026: Jahia operates no public roadmap page, ideas portal, or community voting mechanism (no Canny, Productboard, or GitHub Discussions equivalent), and forward direction is communicated mainly through retrospective monthly product-update marketing posts. The one genuine forward commitment found is the Workflow Extender deprecation carrying a stated replacement target of end-2026. Stays at 50 — squarely the 'private roadmap shared in enterprise briefings' band, neither opaque nor open.

Jahia demonstrates a working deprecation process with advance notice: portlets deprecated in 8.0 were removed only in 8.2.0/8.1.9, JDK 8 was dropped alongside JDK 17 being added, Hibernate was un-exposed, and the Workflow Extender deprecation ships with a stated end-2026 replacement window rather than an abrupt cut. Parallel 8.1.x and 8.2.x maintenance branches let customers defer major upgrades. Nudged up from 55 for the announced-replacement-before-removal pattern, but still no published semver or deprecation policy and no automated migration tooling.

Hard numbers are now confirmed and they are very small: the Jahia core repo carries 51 stars, 36 forks and 21 watchers, and the Jahia DXP G2 listing holds roughly 59 reviews rather than the 603 previously credited (that figure is the vendor-wide seller profile). Stack Overflow volume is sparse and there is no Discord or Slack; the 508-repo GitHub org is breadth without gravity. Well inside the sub-45 'very sparse' band, and lowered from 38 because the corrected G2 count removes the one signal that made the footprint look larger.

Jahia Academy remains the single hub — documentation, training and a login-gated customer center — with no Discord, Slack, or active public forum, and the 508-repo org shows minimal external starring or forking. The separate JahiaCommunity org is explicitly framed as a home for modules Jahia no longer officially supports, which is maintenance offload rather than co-development. Trimmed from 42: the customer-support model sustains existing licensees but generates little visible two-way developer participation.

Jahia runs a formal three-tier program (Silver/Gold/Diamond) with a public directory segmented across EMEA, Americas and Asia Pacific, and named integrators include genuinely global firms — Atos, Dept, Talan and ASI — not only French-market shops. A paid certification track with exams backs partner competence. Raised slightly from 60 as the directory is broader in geography and SI calibre than previously credited; capped there because independent trackers list only ~47 named partners and delivery depth outside Europe remains thin.

A targeted Sept 2026 search for Jahia tutorials, Udemy/Pluralsight courses, YouTube series and conference talks returned no Jahia-specific third-party material at all — the results were generic platform noise. Essentially all learning content originates from Jahia itself (Academy, company blog, official training), concentrated in the French-speaking EU market. Held at 40: functional first-party documentation keeps this out of the 30s, but independent content validation is close to absent.

Jahia-specific job postings remain rare globally — isolated listings (e.g. a CyberCoders 'Jahia Developer' role) against a talent pool still concentrated in EU/French-speaking markets. A real certification path exists (free online developer basics, a 3-day instructor-led course with a certification exam, quarterly jServices sessions), and the 8.2 JavaScript Modules path widens the addressable pool by letting React/TypeScript generalists build views without OSGi. Held at 42: the retraining route is credible but the hire-ready pool is still small and the JS shift is too recent to have produced one.

The reference base is deeper than previously credited — FeaturedCustomers now lists 66 customer reviews and references, and named logos span Marriott Vacations Worldwide, Algolia, Ben & Jerry's, the European Parliament and UNIL's consolidation of 300+ sites onto Jahia multisite. Market presence is active in 2026 via the Digital Sovereignty Summit in Paris (booth C13 with Efficy) and La French Tech membership. Raised from 53 for the larger reference base and visible 2026 activity, but still capped by the absence of headline new-logo announcements and a small ~346-company detected install base.

Jahia's only institutional round remains $22.6M raised in February 2015 — over eleven years without follow-on capital — against estimated revenue of $7.6–9.5M and no acquisitions made or received. No layoffs are reported and the company continues shipping, but executive churn continues after the CEO transition: Joe Henriques, President North America, has departed for quantilope, weakening the NA expansion story. Held at 42: genuinely stable and self-sustaining, with no growth signal to lift it.

Jahia is absent from the current Gartner Magic Quadrant for DXP — the 2026 edition, in which Optimizely swept both axes and ended Adobe's five-year lead, names peers such as Adobe, Optimizely, Sitefinity and Magnolia but not Jahia, and Jahia's own 'included in Gartner MQ' press release dates to the 2018-era report. Offsetting that, its positioning has genuinely sharpened around European digital sovereignty — sovereign hosting, GDPR-native tooling, Digital Sovereignty Summit presence and French Tech membership — which is a defensible niche with real 2026 tailwinds. Raised from 43 for that clearer differentiation, but no current analyst placement keeps it well below the 65+ band.

Correcting a prior conflation: the 603 figure is G2's vendor-wide seller profile spanning all Jahia products ('Jahia Products | Read 603 Reviews'), while the Jahia DXP product listing itself holds roughly 59 reviews — consistent with Capterra's 59 and TrustRadius's 44. Ratings are genuinely good where volume exists (G2 4.4, Capterra 4.6) with praise for multisite/multilingual flexibility and API integration, and the only recurring complaint is a steep learning curve — no pricing or reliability scandal. Lowered from 63: the formula puts a sub-100-review platform in the 45–60 band, and the strong ratings justify the top of it rather than above it.

Jahia now publishes a real pricing page with a ~60-row CMS Enterprise vs. DXP Enterprise comparison matrix and an FAQ naming the three pricing drivers (edition, hosting model, users + traffic volume), plus full Terms & Conditions for all three legal entities and a Maintenance and Support Policy with a published SLA table — far better scope transparency than a bare contact form. But both plans carry only a 'Get a quote' button with zero published figures, and Cloud T&C 25.1 §9.5 states 'All pricing terms are confidential, and Customer agrees not to disclose them to any third party,' which also makes the aggregator ranges unreliable secondhand. Top of the entirely-sales-gated band, not into the public-lower-tier band.

The prior assessment that Jahia avoids per-API-call and bandwidth metering is contradicted by its own contract: Cloud T&C §9.2 tracks 'API Calls, Pages View, Profiles stored, Log Entries, Backups, Network Bandwidth, Storage and other consumption metrics' against the Order, bills additional fees on exceedance, and places the monitoring burden on the customer ('it will be the Customer's obligation to check the cloud portal'). §1.37 further meters named Users, with additional Users 'billed based on the per-user price' — so the pricing page's 'no surprise overages' claim does not survive the contract text. §9.7 also lets Jahia raise renewal prices by OECD CPI with no carryover of prior discounts. Tier-level predictability is real, but seven metered dimensions plus per-seat overage is a worse model than a flat included-limits subscription.

The newly published plan matrix shows unusually generous base-tier gating for a Traditional DXP: Enterprise SSO integrations, granular permissions, clustering, multisite management, import/export tools, content versioning, DAM, workflows, advanced forms, headless API and all four AI features (writing assistant, automated asset tagging, AI alt text, AI translation) are all included in the entry CMS Enterprise tier. What is gated to DXP Enterprise is genuinely DXP scope — personalization, A/B testing, customer data collection, analytics dashboards, segmentation, scoring, API-based personalization. Held below 70 because Augmented Search (advanced/faceted/federated search and the relevance API) is a separate paid add-on at both tiers, 24/7 support requires the Premium Support tier, and 'Number of users' is a contracted quantity with per-user overage rather than unlimited.

First-party contract text overturns the aggregator claim of monthly billing: §11.2 states subscriptions 'shall automatically renew for successive periods of a minimum of one year each' and require 90 days' written notice before expiry to stop, while §11.5 provides that 'in no event shall there be termination for convenience during the Initial Term or a Renewal Term… or a refund or cancellation of any… Subscription Fees.' Layered on top are a CPI-OECD renewal escalator with no discount carryover (§7.6) and audit rights on ten business days' notice where >5% excess use triggers back-fees, interest and the cost of the audit (§7.7). No startup, nonprofit or education program and no self-service checkout were found; the only real credit is that these terms are publicly published rather than hidden.

The free edition has been repackaged and is materially easier to run: Jahia Community (now 'Jahia Open-Core') ships exclusively as a Docker image from 8.2.3.0 — 'docker pull jahia/jahia-opencore:<tag>' then 'docker run -p 8080:8080' to a working instance — replacing the old Tomcat + JDBC install whose download page now 404s. It is permanent and commercially usable, and Jahia is moving its open-source codebase off GPLv3 dual-licensing toward Apache 2.0 (MIT for front-end components), which removes the copyleft friction that capped the prior score. Held below 65 because it is explicitly best-effort — less tested than the Enterprise release, no SLA or support, and it cannot install Enterprise modules — needs 4–8 GB RAM, and is self-hosted rather than a managed free tier.

Verified end-to-end: 'npm init @jahia/module@latest <name>' scaffolds a project with TypeScript, Vite, ESLint, Prettier, GitHub Actions CI and a docker-compose.yml, and the documented loop is 'yarn install' → 'docker compose up --wait' (Jahia 8.2 + PostgreSQL 16) → 'yarn dev' with no local Java or OSGi setup; @jahia/create-module 1.2.0 published January 2026 confirms the toolchain is live, not aspirational. Separately, Open-Core reaches a running CMS in a single docker run. It stays out of the sub-hour 75+ bracket because multi-GB Jahia and PostgreSQL images must pull first, Node 22.14+ and Yarn 4.9 via Corepack are hard prerequisites, and a first real render still means learning definitions.cnd (JCR Compact Node Definition) and import.xml. Note the vendor's 'Jahia CLI' framing is stale — the jahia-cli npm package last published December 2021; the live entry point is npm init @jahia/module.

Jahia now markets a free AI-agent CMS migration that crawls a site's sitemap.xml and rebuilds components, content, assets and SEO metadata in Jahia with Jahia experts running the project, and commits contractually to a timeline and to go-live rather than a demo — a genuine implementation-cost lever for the common replatforming case. Its scope is narrower than the headline: only public, sitemap-discoverable content is automated, while authenticated areas, custom business logic, CRM/PIM/DAM integrations, security rules and final SEO validation remain expert work. Community signal has not moved — G2 and Capterra reviewers still report a steep learning curve and that advanced configuration demands high technical expertise — so the item rises but stays below mid-band; the low upgrade churn of the published release policy (Major every 5–10 years, Feature every 18+ months) also limits recurring re-implementation cost.

The JavaScript Modules path genuinely broadens the hiring pool — the verified starter is standard TypeScript/React/Vite/Yarn/ESLint work a generalist frontend developer can do without JVM knowledge, and Academy tutorials are open and free. But Jahia's own training catalogue still gates the advanced surface behind certification: jContent Developer training is a 3-day course with 'Jahia Online training mandatory' as a prerequisite, jExperience Integration training requires a 'Certified Jahia developer,' and the Maintenance and Support Policy conditions unlimited Jahia 8 upgrade assistance on personnel 'trained and certified by Jahia.' Backend extensions, custom workflows and deep JCR work still need Java/OSGi specialists from a small talent pool, so the premium narrows rather than disappears.

Jahia Cloud bundles a real managed stack — managed WAF, AWS/OVH DDoS protection, CDN, automated backups, auto-scaling, zero-downtime upgrades, bundled Datadog and a 99.9% SLA — but it is not a flat infrastructure bundle: Cloud T&C §9.2 meters Network Bandwidth, Storage, Backups, Log Entries, Page Views and Profiles against the Order and bills overages, so infrastructure consumption remains a variable line item. The self-hosted path carries the full JVM plus JDBC database, CDN and backup provisioning, and Open-Core alone asks for 4–8 GB RAM per container before any content. Both deployment paths add meaningful spend beyond the license.

Jahia's published support policy explicitly excludes, at every tier including Cloud, 'system or server administration activities', 'performance tuning', 'database optimization or health-checks', 'architecture planning', 'configuration or debugging of the customer's network and systems' and any issue involving community modules — so even Managed Cloud customers must staff platform tuning and administration themselves. Self-hosted adds JVM, Tomcat and PostgreSQL operations on top. Cloud's automated updates, backups, zero-downtime upgrades and bundled Datadog monitoring keep this from falling further, but this is not a near-zero-ops platform.

Exit rights are now contractually explicit rather than inferred: Cloud T&C §13.6 states 'Customer has the ability to migrate or download all its Customer Data from the Services at any time' and grants a 60-day post-termination window to download or migrate, and Appendix B §5 gives delete-or-return of personal data at the customer's choice. The published plan matrix lists Import/Export Tools in both tiers, content sits in standard JCR (JSR-283), and the core is self-hostable as an Open-Core Docker image with the codebase moving to Apache 2.0/MIT. Held out of the easy band because the proprietary module and view system, jExperience/jCustomer personalization and segmentation structures still require rebuilding elsewhere, and 60 days is a short retrieval window with no retention obligation afterwards.

The JavaScript Modules path makes React TSX a native server-side templating language with Island Architecture, and 8.2.3 removed the GraalVM runtime requirement (OpenJDK-compatible), so the view layer maps to mainstream component mental models. But the surrounding concept surface is unchanged: every component still ships a CND node-type definition, and the developer doc tree still requires JCR, OSGi bundles/module lifecycle, JCR-SQL2, Content Editor form JSON overrides, and Jahia Studio. Independent reviewers still report the internal architecture and module lifecycle take time to internalize, so this stays in the 40-55 'significant re-learning' band rather than rising.

The Academy front-end developer track is a seven-step project-building tutorial (Introduction, Setting Up Your Dev Environment, Making a Hero Section, About Us Page, Making a Blog, View Content in Full Page, Building a Navigation Bar), last updated 2026-03-12, with parallel Editors-Marketers and Java Developers tracks plus free online developer training with a self-assessment and optional certification. Jahia also ships a first-party agentic harness (npx @jahia/agentic, v0.6.0 Aug 2026) covering Claude/Codex/Copilot/Cursor/Gemini/Windsurf with a public benchmark. Held below 65 because there is no in-app or in-console onboarding tour, the online developer training still centres on legacy Jahia Studio, and reviewers describe docs as extensive but scattered for advanced cases.

The generated module is an ordinary modern Node project — React 19, TypeScript 5.8, Vite 7, Yarn 4.10, ESLint 9, Prettier, CSS Modules, react-i18next — and the toolchain packages reached 1.0.0 in Oct 2025 and 1.2.0 in Jan 2026, so the prior 'pre-1.0 immaturity' discount no longer applies. Platform-specific patterns remain: .server.tsx/.client.tsx file conventions, the @jahia/javascript-modules-library APIs, CND content modelling, JCR-SQL2/GraphQL data access, and server code executing on GraalJS inside a Java OSGi bundle. Capped below 70 because there is no Next.js/Nuxt/Astro path at all — you build inside Jahia's rendering engine rather than alongside it.

Unpacking @jahia/create-module 1.2.0 shows a genuinely polished starter: three templates, and the recommended hello-world ships working .server.tsx/.client.tsx components, example content via settings/import.xml, CND definitions, content-type icons, en/fr locales and CSS Modules, while the module scaffold adds docker-compose + provisioning, a GitHub Actions build workflow, TypeScript, Vite, ESLint, Prettier and VS Code/JetBrains config. Luxe (github.com/Jahia/luxe-jahia-demo) supplements this as a production-grade monorepo reference with a Storybook design system, island architecture and GraphQL/JCR queries. Short of the 75+ band because coverage is limited to Jahia's own in-platform React runtime — there is no Next.js, Nuxt, Astro or SvelteKit starter — and the included CI builds an artifact rather than deploying it.

Zero-to-running is four commands with no config values to edit: npm init @jahia/module@latest <name>, yarn install, docker compose up --wait, yarn dev — with the generated .env consisting entirely of commented defaults, vite.config.mjs shipping every option commented out, and docker-compose pre-wiring Jahia + Postgres and auto-provisioning the JS modules engine; 8.2.3 also dropped GraalVM in favour of stock OpenJDK. Offsetting this, the dev image is jahia/jahia-ee under a 30-day trial licence requiring a licence request thereafter, package.json carries a Jahia-specific block (module-type, server entry, static-resources, module-dependencies), and production self-hosting still means JVM + Tomcat + database, OSGi .cfg files and HAProxy clustering. Lands mid-band rather than at the 70-80 minimal-config tier because the near-zero-config experience covers only the local dev loop.

Jahia's own 'Modifying existing content definitions' documentation states that any operation other than adding a property with a default value carries risk, that namespaces, nodetypes and properties cannot be renamed, and that removing a definition leaves existing content unreadable, uneditable and unremovable. Migration is hand-written Groovy scripting — 8.2.3 explicitly deprecates GraphQL migration scripts in favour of Groovy — with no first-party schema diff or automated migration tooling, and the JS Modules path does not change this since starters and Luxe both model content in CND files. Build-time 'Module definition checks' that flag tightening of restrictions are a real mitigation, which keeps this at 40 rather than lower.

On the JavaScript Modules path preview is effectively free: React SSR is wired directly into Jahia's templating and view system, so the same code renders in the editor and at runtime and on-page editing, preview, publishing and caching work without custom integration, with Page Builder reaching feature parity with legacy Page Composer and production-ready status in 8.2.3. The offsetting gap is that consumers outside the platform get nothing — no preview middleware SDK, draft-mode helper or framework starter exists for an external Next.js/Nuxt frontend hitting the GraphQL API, so that path is entirely custom. Rated above the mid-band on the strength of the in-platform experience but well short of plug-and-play because only one of the two consumption models is served.

The Academy front-end track states only that it assumes familiarity with JavaScript and React, the generated project requires no local Java or Maven, and 8.2.3 declares the JS Modules engine production-ready with several projects shipping on it — so a generalist TypeScript/React developer can build views without Java or OSGi, and the free agentic harness further lowers the platform-knowledge tax. Java and OSGi remain necessary for backend extensions and the 'Interoperability with Java' documentation is still marked Upcoming, while CND and JCR-SQL2 are genuinely proprietary skills and TrustRadius reviewers still advise keeping strong J2EE developers on hand. That mix places it in the 55-70 'moderate platform-specific knowledge, no certification required' band rather than at its floor.

The containerised dev environment and JS Modules path let a 2-3 person front-end team build and iterate without a dedicated Java specialist for view work, and Jahia Cloud removes infrastructure ownership. A production enterprise build still typically draws in a solution architect for JCR/CND schema design, a Java developer for backend extensions and integrations, and DevOps for self-hosted JVM/Tomcat/database and clustering, with reviewers describing multi-month implementations backed by professional services. Sits at the upper end of the 35-55 'multiple dedicated roles' band rather than the 65-75 small-team band.

Page Builder reached feature parity with legacy Page Composer in 8.2.3 and is documented as production-ready for daily use, so editors can compose pages, pick templates, manage content and publish routine changes in jContent without a developer, and Academy maintains a dedicated Editors-Marketers track covering new pages and personalization. Ongoing developer dependency persists for anything structural: new content types still require a CND edit and a module rebuild/deploy, new templates require JS Module code, and jExperience personalization rules need developer setup. That puts it just below the 65+ self-serve threshold rather than at it.

Jahia Cloud environment upgrades are fully automated and customer-triggered, using blue-green deployment so traffic can be switched between Green and Blue environments; an in-place upgrade costs roughly 10 minutes of downtime, or zero if the customer clones production and uses Swap Domain. Self-hosted 8.2 upgrades remain genuinely hard (JDK 8 dropped for JDK 17, Hibernate removed from the public API, two JSON override files consolidated to one, content types moved to legacy-default-components, a provisioning-API permission with no migration script), and the July 2026 8.2.3.2 patch changes behavior on upgrade — Editor/Editor-in-Chief lose Modify access control by default, UGC authors no longer get the owner role, and all remember-me sessions are invalidated forcing re-login. Higher than the prior score because the Cloud path is more automated and self-service than previously credited; still well below SaaS because the self-hosted path carries breaking changes plus permission-model re-testing on a security patch.

Jahia Academy hosts a dedicated security section documenting its internal vulnerability detection and analysis process, a CVE analysis page for every CVE found in Jahia or its dependencies, and published SBOM and VEX JSON files for ingestion into scanning tools — unusually mature transparency for a mid-tier vendor. Patches are backported across parallel maintenance lines (8.1.9.x, 8.2.2.x, 8.2.3.x), so customers on an older minor get security fixes without a feature upgrade, and Cloud customers receive them automatically with no downtime. Raised from the prior score on the CVE page, SBOM/VEX artifacts and parallel backporting, but held below 70 because fixes arrive as batched periodic roll-ups (dated security patch pages for September 2025 and July 2026) rather than rapid per-CVE releases, and self-hosted customers apply them manually.

The forced-change cadence is elevated and the March 2026 updates added a new one: the Workflow Extender module and custom JBPM workflows are both deprecated with the replacement only promised 'by end of 2026' — deprecating before the alternative ships leaves customers with custom workflows in limbo. This stacks on Augmented Search 4.0 (Nov 2025) forcing an Elasticsearch 7 to 9 migration ahead of Elastic Cloud's v7 EOL, JDK 8 dropped in 8.2, Spring in modules officially deprecated, Content Editor folded into jContent, and a further 'major release' in preparation that upgrades several libraries and frameworks. Lower than the prior score because of the JBPM/Workflow Extender deprecation-without-replacement; not lower still because Jahia publishes a formal Release & Maintenance Calendar with end-of-maintenance and end-of-support dates and keeps several minor lines alive in parallel.

Self-hosted Jahia carries a heavy stack — JDK 17+, Elasticsearch 9, a relational database, Jackrabbit JCR storage, Tomcat, and optional jCustomer/jExperience — with clustered deployments adding MariaDB, GlusterFS and HAProxy, and recent releases have forced major-version bumps in core dependencies. Module-level dependency friction is real too: the 8.2.3.2 JWT service now requires the separate security-filter-tools module to be started. Nudged up only because the published SBOM and VEX files give customers genuine visibility into transitive dependency exposure; the underlying tree is still large and Cloud is the only way to escape it.

Jahia Cloud bundles Datadog monitoring with custom Jahia dashboards, live log access, and built-in DDoS protection across all plans, plus a synthetic /ping.jsp check every minute and alerting; 8.1.8 added dedicated instance health probes. Self-hosted deployments get none of this and must stand up their own stack, and Jahia's own best-practice docs state permanent monitoring of a DXP is necessary, so application-layer effort remains even on Cloud. Slightly higher than the prior score because live log access and DDoS protection are confirmed as bundled rather than add-ons; capped well below SaaS norms by the self-hosted half of the install base.

The prior score of 45 was an absence-of-evidence error: Jahia ships three distinct content hygiene tools. The Link Checker crawls an entire site for dead external links including rich-text content and produces a fixable report; the Content Reports module generates dashboards for content created/modified by author and date, all content references on a site, and content stuck in work-in-progress or a workflow state, exportable to CSV; and the content-integrity module runs an extensible jcr:integrity-check scan with checks including PublicationSanityDefault/Live, LockSanity, MarkForDeletion and UndeployedModulesReferences, with documented procedures for cleaning orphan and unused versions. Scored at 60 rather than higher because all of this is on-demand and admin-facing — there is no proactive broken-reference alerting, no content expiry workflow, and no editor-facing health dashboard — and reviewers still report that changing data structures after content exists is painful.

Jahia Cloud fronts sites with a CDN spanning over 300 edge locations across five continents on AWS and OVH, provisions Docker containers instantly with the cluster expanding in under five minutes under load, and exposes Datadog performance dashboards — close to hands-off for Cloud customers. Self-hosted still demands active tuning of caching, Elasticsearch indexing, Jackrabbit clustering and JVM memory, and Gartner reviewers flag a concrete application-level performance gap: back-office page search is described as completely unoptimized, costing editors real time. Marginally above the prior score on the confirmed CDN footprint and sub-five-minute autoscaling, held down by the self-hosted tuning burden and the authoring-side search complaint.

The subscription includes technical support with guaranteed SLAs, unlimited releases/hotfixes/service packs and a dedicated Customer Success Manager, and G2/Capterra reviewers repeatedly describe the team as knowledgeable, responsive, and willing to go beyond the initial ticket. Two things pull this down from the prior 65: the Maintenance and Support Policy gates 24/7/365 coverage for Level 1 and 2 production issues behind a separate Premium Support purchase — without it, customers get the Online Support Portal during Regular Business Hours — and Gartner Peer Insights reviewers describe the support process as frustrating and hit or miss, taking weeks of back-and-forth to get to the bottom of an issue. Scored in the band for good support that effectively requires the premium tier, with positive review sentiment keeping it at the top of that band; the prior run's citation of a 487+ review G2 base conflated Jahia's vendor-wide seller profile with the far smaller Jahia DXP product listing and is not relied on here.

Two rounds of research have failed to surface any active public Jahia community channel — no Discord or Slack, negligible Stack Overflow presence, and the only forum found is a legacy jahia.com/home/community path rather than a live destination. What community-adjacent support exists is the Jahia Forge GitHub organization, where module source and issue trackers are public and release issues are visible, plus the Academy documentation and knowledge base. Lowered from the prior score and confidence raised to MEDIUM because the absence of a peer community is now well-established rather than merely unverified, and reviewers consistently cite scattered documentation and insufficient developer code examples; not lower because the open GitHub trackers and Academy KB are real, usable self-service channels.

Jahia actively maintains several release lines in parallel (8.1.9.x, 8.2.2.x, 8.2.3.x) and backports security fixes into all of them, and ships functional fixes at a steady clip — 8.2.3 brought Page Builder to production parity with the legacy Page Composer and shipped JavaScript modules engine v1.2, with 8.2.3.2 following as a security-focused patch. Against that, Gartner reviewers report issues taking weeks of back-and-forth, the Workflow Extender and JBPM replacements slipped to a year-out commitment, and security fixes arrive in batched periodic roll-ups rather than as-discovered. Unchanged from the prior score because the new evidence cuts both ways: issues do get fixed and shipped, but not quickly and not with exceptional communication.

Page Builder reached full feature parity with the legacy Page Composer and is Jahia's recommended in-context editor for production daily use as of the 8.2.3 maintenance release. Drag-and-drop, pre-built customizable components, template inheritance, and inline editing let marketers build and publish landing pages without developer involvement. A 2026 refinement lets authors insert content anywhere within a list rather than appending and reordering afterward. Gartner Peer Insights reviewers independently confirm fast page creation from ready-to-use components.

jExperience (the current product name; Marketing Factory is the legacy branding, and marketing-factory-core is now flagged Legacy in the Jahia Store) provides native campaign management: campaign goals, conversion tracking, segmentation and scoring, and publish/validate lifecycle, all operable without IT involvement. jExperience 3.x remains actively released. Still no visual content calendar and no multi-channel campaign orchestration beyond web.

Baseline SEO is native and plugin-free: clean and vanity URLs, 301 redirect management, per-language sitemap.xml generation, robots.txt configuration, canonical URLs, and full metadata including Open Graph. The 2026 Jahia AI release adds the piece this framework explicitly asks for and that prior scoring did not credit — automatic generation of Schema.org structured data (FAQPage, Article, BreadcrumbList), named entities and definition blocks at content create/update time, automated meta description generation, and SEO audits across the full page catalog, plus GEO optimization for generative answer engines. Scored MEDIUM rather than HIGH because the AI SEO layer is evidenced from Jahia's own product page and is new enough that independent verification is thin.

Jahia Forms is a confirmed enterprise add-on form builder, not a workaround: multi-step, multi-language, multi-condition forms with validation rules, built-in field types, and a Forms dashboard for monitoring and analyzing submissions. Submissions land in the JCR or directly in Unomi profiles, so lead capture feeds personalization and triggers automated workflows; jExperience goals close the conversion-tracking loop. This clears the framework's 60+ bar for a built-in form builder plus conversion tracking. Deep lead routing to CRM/MAP still runs through StackConnect rather than a native connector, and UTM handling is not documented as first-class.

jExperience, built on Apache Unomi (which Jahia itself created and donated to Apache), provides native behavioral segmentation, scoring, geo-targeting, session- and profile-based personalization and real-time targeting without a separate CDP. Personalization is now first-class inside Page Builder: content personalization, A/B tests and personalized lists render there directly, the default variant is visible without opening the personalization window, and jExperience elements carry a dedicated purple color code. Dedicated personalization dashboards with filtering shipped in 2026.

jExperience provides genuine integrated A/B testing on content and personalized lists, authored inline in Page Builder with variants color-coded, and goal-linked conversion measurement. Dedicated A/B testing dashboards with filtering were added in 2026. Held below 70 because automatic statistical-significance calling and auto-winner promotion are not documented — winner selection is a manual read of the dashboard.

Several 2026 additions compress brief-to-publish. The Copy To Other Languages module copies values from one or more fields into multiple languages at once. jContent gained direct access to advanced options, configurable displayed columns, easily duplicable content examples and improved preview; workflow and notification screens were modernized; the publication dashboard is reachable from Page Builder with compare preview vs live. Jahia AI adds writing assistance, automated classification and bulk updates, and the native MCP server lets an agent create pages or trigger workflows in plain language while still passing through approvals and access controls. Complex multi-stage approvals remain a manual cost.

Jahia delivers headlessly through a full GraphQL API (plus REST) with documented React, Next.js and Vue.js consumption and PWA support, so web plus API-driven app and custom channels are well covered. jExperience personalization extends into headless delivery. But there is still no native email, SMS, push or social channel management — those require external tools wired through StackConnect. Web-first with API delivery, which is exactly the framework's 40–60 band.

jExperience ships in-CMS dashboards for campaign performance, A/B test results, personalization engagement and login events, all redesigned in 2026 with new filtering. Google Analytics is built in and Matomo and AT Internet (Xiti) are supported, and Jahia provides content status, language and metadata reports. What is still missing is page-level content performance and content decay surfaced inside the CMS — that analysis stays in the external analytics tool.

The Site Factory model plus standardized page models and restricted component palettes give real template-level brand governance, and Gartner reviewers independently report using Jahia to implement a design system correctly with ready-to-use components. Jahia AI actions are routed through the same approval and brand controls as human edits. Enforcement is still governance- and convention-driven rather than locked style tokens with blocked overrides, so a determined author can deviate.

The SEO module handles Open Graph and Twitter card metadata natively so social preview cards are correct out of the box. There is still no native social scheduling or push-to-social workflow and no social proof or UGC widget set — those require StackConnect recipes or custom components. Solid OG management only, at the top of the framework's 30–50 band.

jContent's media library gained meaningful 2026 improvements: image size, format and usage are surfaced in both thumbnail and list views, and file naming is standardized automatically on upload. CloudImage integration cuts delivery weight substantially, and the Jahia Store offers Cloudinary and Keepeek DAM connectors. A Bynder integration exists but was built externally by Gladtek and is not a Jahia Store module. This is a competent media library with transforms and integration paths, not a native enterprise DAM — no rights management or licensing workflow.

Multilingual marketing is one of Jahia's strongest areas and got materially better in 2026. The new Copy To Other Languages module pushes field values into multiple languages in one action, complementing the side-by-side translation interface reachable from Page Builder. Jahia AI adds automatic translation inside the editorial workflow. Per-language sitemaps, locale-specific campaign variants via jExperience, and per-site Unomi cookie consent cover regional compliance. Formal transcreation workflow with translator roles and TMS round-trip is still configuration rather than a shipped feature.

StackConnect is powered by Workato, which reframes this item: it is a real iPaaS with a 1,000+ connector library, drag-and-drop recipe building and scheduled or event-triggered automation, not a thin webhook layer. Bi-directional Salesforce sync with lead creation and update is documented, and CRM, MAP, ad and data-warehouse categories are all covered by the underlying library. jExperience adds event-triggered personalization on the content side. Held in the mid-60s because connector depth is Workato's rather than Jahia-curated, so per-tool data mapping is project work.

Downgraded after re-checking Commerce Factory's actual status. Commerce Factory embedded the third-party Mogobiz engine, was announced in 2014, and its artifacts still sit under com/mogobiz in the Jahia Nexus; Commerce IO documentation stops at version 1.0 under the Jahia/DX 7.3 developer docs, and neither appears anywhere in the Jahia 8.x documentation set or in any 2025–2026 product update. Prior scoring credited a 2014 feature list as current. What Jahia actually offers today is flexible JCR content modeling repurposed for product content, helped by AI taxonomy classification — squarely the framework's 'generic content types repurposed' band.

The prior score of 35 rested entirely on Commerce Factory's automated category pages, category faceting, cross-sell/upsell and advanced couponing — all from the 2014 Mogobiz-based product that has no Jahia 8.x documentation and no recent release. With that removed, Jahia has no merchandising-specific tooling. Augmented Search relevance configuration is the only merchandising-adjacent capability, and it is search tuning rather than product merchandising. This lands in the framework's 10–25 'no merchandising-specific tooling' band that most CMS platforms occupy.

Jahia's current commerce story is integration, not a commerce engine: the commerce-io page now sells drag-and-drop editing plus the 1,000+ connector library rather than a catalog product. Because StackConnect runs on Workato, connectors to Shopify, SAP and Salesforce Commerce Cloud genuinely exist and can sync data on a schedule or on events. What is missing is the thing this item weights most — a UI-level product picker inside the content editor and real-time federation of product data into content. Without it this is integration-platform plumbing, so it sits at the top of the webhook/API band rather than in the product-picker band.

Page Builder plus JavaScript/React modules make it entirely practical to build buying-guide and lookbook style pages with embedded product components, and the editorial toolset behind them is strong. But with Commerce Factory out of the picture there is no first-class shoppable-content pattern, no inline product reference type and no purchase CTA component shipped with the platform — every product embed is a custom component fed from an external commerce API. That is the framework's 'possible but not a first-class authoring pattern' band.

The prior 35 credited Commerce Factory cart-adjacent banner management and promotional scheduling, which does not survive the Commerce Factory re-check. There is no documented pattern for injecting Jahia-managed content into an external commerce platform's cart or checkout flow without editing that platform's templates, and Jahia no longer has a native checkout of its own to manage. jExperience can personalize any page Jahia renders, but transactional pages are typically not Jahia-rendered in current deployments.

No post-purchase content management exists. Order confirmation, delivery tracking, review solicitation and loyalty content all live in the commerce platform. StackConnect/Workato could in principle listen to order events and trigger a Jahia update, but no documented pattern or reference implementation exists, and the framework is explicit that 'could be built' is not fit.

This is the one commerce item that does not depend on Commerce Factory and therefore holds its score. Jahia's node-level RBAC with inheritance, combined with Portal Factory's documented B2B customer and partner portal use cases, genuinely supports account-based content delivery, role-gated catalog visibility and gated product documentation — real access control applicable to B2B, which is the framework's 30–50 band. Customer-specific pricing display and quote-request flows remain custom integration work.

Augmented Search is a genuine Elasticsearch-backed search layer exposed through Jahia's GraphQL API, with configurable synonyms via standard Elasticsearch configuration, faceted filtering, and federated indexing that can pull external data sources into the same result set — so blending product data with content is architecturally supported. Version 4.0 moved to Elasticsearch 9 and a June 2026 release improved bulk indexing speed, network traffic and indexing progress visibility. Lowered from 52 because the automatic category faceting that justified part of the prior score was a Commerce Factory feature, so product-side facets now require custom indexing work.

Stripping the Commerce Factory couponing claims leaves a real but generic capability: the Scheduled Publication Workflows module lets contributors set publication date and time and separates validation from publication, and jExperience targets promotional content by segment, geo or behavior. That is time-activated promotional content with audience targeting, which is solid for the 30–50 band. Countdown timers, promo-code messaging and tiered pricing tables are not shipped components.

Jahia's multisite architecture is genuinely strong and applies directly here: one instance runs many sites, each with its own domain, URLs, templates, language configuration and user access, and Local Site Manager synchronizes source pages and content from a global site to local or regional sites. That covers storefront-specific editorial and legal content cleanly. Trimmed slightly because 'shared product content' — the other half of this item — now depends on an external commerce platform rather than a Jahia catalog, so the shared-product-data half is integration work.

CloudImage gives responsive, heavily optimized image delivery and the Cloudinary connector adds transform and optimization depth; jContent surfaces image size, format and usage per asset. Video embeds are straightforward. But 360-degree spin sets, AR/3D model references and image hotspots are absent, and the multi-image-per-SKU capability cited previously was a Commerce Factory feature rather than a current platform one. Basic galleries and video embeds is the honest read.

No marketplace or multi-vendor capability. There are no seller profiles, no seller-contributed content workflow and no moderation queue designed for marketplace scale. Jahia's workflow engine could gate third-party submissions, but that is generic approval workflow, not marketplace content management, and Commerce Factory was single-vendor even when it was current.

Jahia's core multilingual machinery is excellent and applies to product content as it does to any content type: per-language variants, side-by-side translation, Copy To Other Languages, AI translation, and per-locale regulatory and consent content. What has been removed is the multi-currency and multi-country tax handling credited previously — that was Commerce Factory's, not the platform's. So this is strong generic localization applied to product content, the framework's 35–55 band, rather than currency-aware commerce localization.

jExperience goals connect content engagement to defined conversion events and the redesigned 2026 dashboards report on them, and GA4/Matomo carry ecommerce data in the external tool. But there is no revenue attribution to CMS content pages and no content-assisted conversion funnel inside Jahia. The ML product recommendation and drill-down analytics claims cited previously came from the Commerce Factory era. Basic analytics with conversion data living externally.

Node-level RBAC where roles assigned to a content node inherit down the tree with configurable inheritance breaks is exactly what intranet audience-scoped visibility needs. Custom role creation, fine-grained permissions, SSO and 2FA are all supported, and per-site local administrators let each team run its own space within a shared framework. jExperience segmentation adds audience-based visibility on top of the permission model.

Raised on evidence the prior run did not have. Alongside approval workflows, version history and taxonomy, Jahia now has a documented archive module that archives and restores JCR content from the jContent Content Actions menu into a date-organized folder structure with metadata preserving the original location for restoration — real lifecycle tooling rather than workflow improvisation. Jahia AI adds automated taxonomy classification of content, and Augmented Search improves discoverability. Automated review-date reminders for knowledge articles are still absent.

Jahia does have a dedicated employee intranet solution and Portal Factory with role- and department-personalized content delivery, pre-filled forms and HR dashboards, and reference customers using it for intranets. But the framework reserves 60+ for platforms purpose-built or heavily adapted for employee experience, and three defining EX features are missing from the core: a social layer, an employee directory, and a native mobile app. Portal Factory also shows no 2025–2026 release activity in the product updates, so the EX product line looks static while the CMS core advances.

Company news, departmental announcements and audience-segmented delivery via jExperience are all workable, and personalization by role or department is genuinely native. The gap that keeps this mid-band is the compliance half of internal comms: no read receipts, no acknowledgment tracking and no mandatory-read workflow anywhere in the documentation.

A directory is buildable through content modeling and can be fed from an HR system, and because StackConnect runs on Workato the Workday and BambooHR connectors needed to sync employee records genuinely exist. But there is no shipped people-directory module, no org chart visualization and no skills or expertise profile type. This is the framework's 'basic directory buildable via content modeling' band, nudged down slightly since every element is custom.

Raised modestly on the archive module plus scheduled publication. Policy documents get version control, approval workflows, audit trails via Tracked Operations, scheduled publication and unpublication, and a controlled archive-and-restore path. That is solid versioned document publishing. The policy-specific half — mandatory acknowledgment tracking and automated review or expiry reminders — remains entirely absent, which caps this below 50.

Role-specific content paths through Portal Factory and time- or profile-based progressive disclosure through jExperience rules make a new-hire portal achievable, and StackConnect could trigger enrollment from an HRIS. But there is no structured onboarding journey, no task checklist component and no 30/60/90-day progressive program — it is all assembled from generic parts, which is the framework's 25–45 band.

Augmented Search 4.0 on Elasticsearch 9 delivers faceted filtering, synonym configuration, relevance tuning and federated indexing that brings external data sources into Jahia results — the core of what intranet search needs. A June 2026 release improved large-volume indexing speed, cut network traffic and added clearer indexing progress across multiple sites. Held at 62 rather than higher because pre-built SharePoint, Confluence and Drive connectors are not shipped (federation is index-your-own-source), and there is no AI-powered semantic relevance layer documented.

Intranet portals are responsive and the GraphQL API plus documented PWA support means a custom mobile or offline-capable experience is a real option rather than a theoretical one. But there is no native Jahia employee mobile app, no push notification channel and no kiosk or shared-device mode — anything beyond responsive web is a custom build. Responsive web without a native app is the framework's 30–50 band.

Raised slightly now that StackConnect is confirmed to run on Workato, whose connector library covers major LMS and HCM learning systems — so LMS connectivity is a configuration exercise rather than a custom build. Learning content itself hosts fine in the CMS. But there is no Jahia-native learning module, no course assignment, no completion tracking and no certification handling, and no documented LMS integration pattern on jahia.com or the Academy.

No native social layer. Comments, reactions, discussion forums, polls, idea submission and peer recognition are absent from Portal Factory and the module store, and none appear in 2026 product updates. Jahia is a content governance and delivery platform; the collaboration layer is expected to come from the workplace suite it integrates with rather than from Jahia itself.

Materially re-scored on the Workato finding. StackConnect being powered by Workato means Microsoft Teams, Slack, SharePoint and Google Workspace connectors are part of the shipped library, and Workato recipes support bot-driven notifications and bi-directional sync — so basic-to-good workplace integration is configuration, not custom development. Still well short of 65+ because the integration is outbound automation rather than a single-pane experience: there are no embedded Jahia content cards inside Teams or Slack and no Jahia bot app in those marketplaces.

Raised on the archive module, which the prior run missed. Jahia 8.2+ has a documented archive and restore capability from the jContent Content Actions menu that moves unpublished content into a date-organized archive folder while preserving original-location metadata for restoration. Combined with scheduled publication and unpublication, workflow states, version history and the redesigned publication dashboard, the manual lifecycle story is good. Automated review dates, stale-content flagging and content ownership assignment are still absent, which is what keeps this below the 60+ band.

Nudged up for the new login event dashboards shipped in 2026, which are the closest thing Jahia has to an intranet adoption metric. Alongside them, jExperience reports engagement by audience segment, Augmented Search provides search analytics including failed queries, and GA/Matomo cover page views. Department-level breakdown is achievable through jExperience segments rather than as a purpose-built intranet report, and there is no adoption dashboard as such.

Genuine multi-tenant architecture rather than instance-per-brand. A single Jahia instance runs many virtual sites, each with its own domain, URLs, templates, language configuration, user access settings and local administrator, and Jahia Cloud provisions dedicated single-tenant infrastructure per customer. Content models are shared by default and extensible per site rather than independently defined per tenant, which is what keeps this at 72 rather than higher.

Raised after examining Local Site Manager more closely. Cross-site content reuse is native — a global site holds source pages and content that are synchronized to local sites, and content objects in one virtual site can be referenced from another. Site Factory propagates a predefined feature set and shared templates to each new site at creation, and JavaScript modules give a shared React component library consumable across sites. This is native cross-tenant sharing, the framework's 70+ definition, held marginally below it because component version propagation to existing sites is a deployment activity.

Federated governance is Jahia's explicit positioning and it is backed by mechanism, not just messaging: central control with local autonomy, a local administrator per site, granular roles and permissions designed to avoid bottlenecks, JBPM workflows configurable per site, multilingual workflow management and a central audit trail. Jahia AI extends the same governance envelope to agent operations — every AI action passes the same approvals, access controls and activity logging as a human editor, which matters as agent-driven publishing scales across brands.

The architecture genuinely produces economies of scale — one platform, shared infrastructure, and a Site Factory model whose stated purpose is to cut deployment cost and development time per new site, which Jahia markets as cheaper than one CMS per project. What blocks a higher score is the complete absence of pricing evidence: no public rate card, no documented volume tiers, no per-site or per-tenant pricing commitment anywhere public. Architectural efficiency without contractual proof only supports a modest score.

Each site carries its own templates and can hold its own theme, typography, palette and logo treatment while sharing the underlying component structures distributed by Site Factory. Under the 8.2 JavaScript Modules model, per-brand styling uses CSS modules and React component theming, which is a cleaner isolation mechanism than the legacy JSP approach. It stops short of a formal platform-level design token API with enforced inheritance, so brand theming is a convention backed by good tooling rather than a governed token system.

The brand x locale intersection is handled directly by Local Site Manager, which synchronizes and localizes global content into regional sites and tracks that relationship in its own dashboard — so translation governance is brand-aware rather than a flat site-by-site concern. Per-site JBPM translation workflows, the new Copy To Other Languages module, AI translation and per-site Unomi consent policies complete the picture. Held in the low 60s because the approval routing itself is configured per site rather than orchestrated centrally across the portfolio.

Per-brand analytics are solid — each site gets jExperience campaign, A/B testing and personalization dashboards, all redesigned with filtering in 2026. What does not exist is the aggregate half of this item: no portfolio dashboard comparing engagement, content velocity or publishing cadence across brands, so cross-brand comparison means exporting from each site and combining externally.

JBPM-based workflows are configurable independently per site, so each brand can define its own review stages, approval chains and scheduling policy, while the audit trail and Tracked Operations remain centrally visible. The 2026 modernization of the workflow system and notification management with redesigned screens makes per-brand workflow administration more practical. This is genuine per-brand workflow independence with central auditability.

Substantially raised — Local Site Manager is precisely the corporate-to-brand syndication engine this item describes, and the prior score treated it as generic cross-site reuse. A designated global site holds source pages and content that are explicitly selected for synchronization to local or regional sites, where local teams then localize them, with an LSM dashboard tracking the sync relationship. That is push-based syndication with controlled local override, exactly the 65+ definition. Held at 68 rather than higher because granular field-level override locking is not documented.

Per-brand and per-region compliance settings are real: Unomi-based consent management and privacy policies configure per site, GDPR data-subject-rights tooling is native, and Jahia Cloud offers EU and sovereign hosting regions (AWS Ireland, AWS Switzerland, OVH France) plus self-hosting for data residency. What is missing is the guardrail half — nothing prevents a non-compliant publish. Compliance is configuration and process, not enforced policy, and there is no accessibility conformance artifact to back the accessibility-standards element of this item.

Site Factory maintains a central component library and template set propagated to new brand sites, and the open-source Luxe reference project demonstrates a production-grade React/TSX design system with content modeling and island architecture under the 8.2 JavaScript Modules model. Gartner reviewers report successfully implementing their design system on Jahia. Brand-level extension works. The gap is versioning: there is no automated mechanism to version a core component and propagate the update across existing tenants — that requires coordinated deployment.

A single dashboard administers all sites with granular RBAC, and the per-site local administrator model gives brand teams genuine autonomy inside a centrally governed framework — the exact split this item rewards. Cross-site roles and permissions are configurable, and SSO and 2FA apply centrally. Note that Jahia Cloud console SSO itself is arranged rather than self-service, but that is a platform-administration concern rather than a content-user-management one.

JCR node types support inheritance and mixin-based extension, so a base content model can be defined centrally and extended per brand without forking it — the underlying capability this item asks for genuinely exists, and Site Factory deploys base models to new sites. What keeps it mid-band is that this is a developer activity in module definitions rather than a brand-manager-facing feature: there is no UI for a brand team to extend a shared model, and no documented governance for what happens to child extensions when the base model changes.

Nudged up slightly: Jahia provides a single dashboard for managing all sites and produces content status, language and metadata reports, which is a partial freshness and completeness signal across the portfolio. But this is site administration and content inventory, not executive reporting — there is no publishing SLA adherence tracking, no per-tenant cost allocation and no capacity planning view, so portfolio-level insight still means manually aggregating per-site reports.

Contrary to prior scoring, Jahia does publish a complete Article 28 Data Processing Agreement — it is Appendix B of the standard Cloud Subscription T&C, downloadable from jahia.com/legal in all three entity variants (Jahia France/JSF, Jahia Switzerland/JSG, Jahia US), and applies to every Cloud customer rather than being Enterprise-gated. It covers documented-instruction limits, confidentiality, security measures, return-or-delete at the customer's choice, Data Subject Rights and DPIA assistance under Arts. 35/36, 24-hour breach notification (well inside the typical 72-hour commitment), audit rights once per 12 months, a named sub-processor list by URL with 30-day advance change notice and an objection right, and third-country transfers restricted to adequacy decisions or European Commission Standard Contractual Clauses. With EU/Swiss residency and a dated public sub-processor table carrying per-vendor customer-data flags, Jahia meets all four of the rubric's 80+ conditions. Held below 90 because the SCCs are incorporated by reference rather than annexed as pre-signed modules, the sub-processor list has not been updated since 2025-03-27, and the self-service DSR tooling sits in the jExperience add-on rather than core CMS.

Jahia's own binding Cloud contract prohibits the data HIPAA governs: the Appropriate Use clause in both the EU and US Cloud Subscription T&Cs forbids customers from inputting 'HIPAA-protected data' into the Services, and the string 'Business Associate' appears zero times in either document. That directly contradicts the trust center's 'HIPAA compliant' marketing and the published Coalfire Security Rule certificate — the assessment is genuine and the full report is available on request, but no covered entity can lawfully place PHI in Jahia Cloud under these terms. Score stays above the 20–35 'no HIPAA coverage' floor only because Jahia is also deployable self-hosted or private-cloud, which falls outside the Cloud T&C and could be built to HIPAA on the Coalfire-assessed control set. Down sharply from 55, which credited the Coalfire certificate without checking the contract against it.

GDPR coverage is genuinely strong and now contractually backed by the published DPA and SCC transfer terms, but the rest of the regional portfolio is thinner than previously scored. The CCPA claim's only source page (jahia.com/solutions/security-and-compliance) is now 404 and could not be re-verified; PCI DSS SAQ A is the narrowest PCI scope and Jahia's own ISMS sheet describes it as 'self-certified'; and HIPAA is contractually barred on Cloud per 9.1.2. GLBA, FERPA, COPPA, CAN-SPAM and HITECH appear only in a mutual 'comply with applicable laws' clause, which is not coverage. No FedRAMP, IRAP, C5, ENS, HITRUST, or LGPD; OVH Canada hosting and the SCC clause give partial comfort to PIPEDA and UK-transfer buyers without being framework certifications.

Re-verified on the live trust center 2026-09-22: Jahia lists GDPR, HIPAA (Coalfire), ISO 27001:2022, PCI DSS SAQ A and AWS FTR, with no SOC 2 Type 1 or Type 2 mentioned anywhere on jahia.com, in the ISMS information sheet, or in the Cloud Subscription T&Cs. Jahia's assurance stack is deliberately ISO 27001-centric in the European pattern, and there is no published signal that a SOC 2 engagement is underway. The gap remains material for North American enterprise procurement, where SOC 2 Type 2 is the default ask.

The ISO/IEC 27001:2022 certificate remains live on the trust center (AFNOR, award document dated 6.09.2025), with a company-wide scope covering Cloud, IT, Support, Professional Services, Legal, HR, Product Development and General Administration — broader than the infrastructure-only certifications many peers present, and notable for explicitly including the software development lifecycle. No ISO 27018 (cloud PII processing) or ISO 27701 certification exists. Held at 72 rather than raised because the ISMS information sheet Jahia currently links from the trust center is badly stale — it still describes the company as ISO/IEC 27001:2013 certified in September 2019 by IT Governance and Coalfire, and claims hosting on 'AWS and Microsoft Azure facilities' when every other source says AWS and OVH.

The additions beyond ISO 27001 are real but lighter than the prior 56 credited. PCI DSS SAQ A 3.2.1 is the narrowest merchant tier and Jahia's own ISMS sheet calls it a self-certification; the Coalfire HIPAA assessment is independently conducted and published but is undercut by the Cloud T&C's PHI prohibition (9.1.2); and the AWS Foundational Technical Review is a partner-program well-architected review, not a security certification. Regular external penetration testing and BitSight security ratings are good operational practice but are not third-party attestations. Still verified absent 2026-09: CSA STAR Level 1 or 2, FedRAMP, IRAP, ENS, C5, Cyber Essentials Plus, HITRUST, ISO 27018/27701.

Jahia now advertises an APAC region, which was the specific gap holding the prior score down: jahia.com/cloud-and-security states customers choose hosting in France (OVH), Ireland or North Virginia (AWS), or Singapore, giving genuine EU/US/APAC choice alongside a sovereign non-hyperscaler EU option in OVH France. Every Cloud customer gets 100% single-tenant isolation with encryption at rest and in transit, the DPA constrains third-country transfers to adequacy decisions or SCCs, the sub-processor table publishes per-vendor hosting countries and customer-data flags, and full self-hosted or private-cloud deployment remains available for buyers needing complete data-plane control. Held below 80 because the Academy Cloud FAQs still list only AWS North Virginia, Ireland and OVH France — a live documentation conflict on Singapore — AWS Switzerland appears in the sub-processor list but is not offered as a selectable region on the current product page, and no standalone contractual residency-guarantee clause is published.

The missing piece from prior scoring — a documented post-termination retention period — is in fact published in the Cloud Subscription T&C: §13.6 states customers can migrate or download all Customer Data at any time and get sixty (60) days after termination to do so, after which Jahia may delete it. DPA §5 adds a Return-or-Disposal obligation exercisable at the customer's choice at end of provision, and the DPA publishes explicit personal-data retention criteria ending in deletion or anonymization. Combined with documented export tooling (XML/ZIP from page and content folders, an Export-to-CSV module, an HTTP POST export servlet for automation, Groovy-scheduled exports) and API-based profile erasure/anonymization/portability via jExperience's Privacy Manager and Apache Unomi, Jahia meets all three of the rubric's 75+ conditions. Held below 80 because the self-service erasure tooling requires the jExperience add-on rather than shipping in core CMS, and the marketing page that asserted no-code native erasure is now 404.

Infrastructure-layer audit controls are documented more strongly than previously credited: Jahia's ISMS information sheet states all executed actions are logged with success/failure outcome, that these logs are read-only so they cannot be altered, and that all authentication activity, all permission attribution and privilege changes, and all access to sensitive data are logged and reviewed on a scheduled basis. Each Cloud customer receives their own Datadog sub-organization, so log retrieval and onward forwarding to a SIEM run through a tenant the customer controls rather than a shared Jahia view. At the application layer, jContent content history records who/what/when including deletions, the jahia_contenthistory table supports configurable purging, Jahia 8.2 added an OSGi listener for login/logout/download events, and JCR 2.0 versioning gives rollback and comparison. Held below 70 because no native SIEM push connector (Splunk, Sentinel, QRadar) is documented, per-tenant configurable log retention is not published, and the ISMS sheet carrying these claims is itself stale (ISO 27001:2013, Azure references).

A correction lowers this: the built-in WCAG rich-text checker cited in prior scoring shipped only up to Jahia 7.3, and Content Editor in Jahia 8 no longer integrates it — Jahia now directs customers to third-party tools such as Siteimprove. So even the ATAG Part B output-assistance story is weaker than credited, and Part A authoring-UI conformance remains entirely undocumented: no WCAG 2.1 AA or ATAG 2.0 conformance report for jContent or Content Editor, no keyboard-navigation or screen-reader statement, and jahia.com/accessibility still 404s. Jahia's own accessibility blog concedes it offers functionality that is 'beginning to approach' CMS accessibility standards rather than conforming to them.

Re-verified 2026-09-22: jahia.com/accessibility still returns 404, and neither the trust center nor the legal index (which lists Terms of Use, Cloud and Software License T&Cs, sub-contractors list, Privacy Policy, Cookies Policy and Maintenance and Support Policy) contains a VPAT, ACR, Section 508 conformance statement, ATAG 2.0 assessment, or any accessibility statement. The gap is sharpened by timing: the European Accessibility Act has applied since June 2025 and French DGCCRF enforcement inspections began January 2026, yet this France- and Switzerland-domiciled vendor publishes accessibility thought-leadership blog posts while publishing no conformance artifact for its own product. The absence blocks US federal and many EU public-sector procurements outright.

In-editor generation ships through the CKEditor 5 AI Assistant — write, rewrite, translate, summarize — covered by Jahia's embedded CKEditor 5 license at no extra cost, but requiring explicit configuration and the customer's own OpenAI API key rather than a turnkey vendor service. Jahia AI adds bulk copy/metadata generation 'within your editorial rules,' and every AI output is routed through the content type's configured validation workflow, giving implicit governance. Held below 70 by the absence of brand-voice controls and prompt-template libraries, and because the editor AI is CKEditor's feature configured with a BYO key.

Two native media-AI paths were confirmed that the prior run missed: the Autotagging module applies AWS Rekognition machine learning to automatically tag uploaded images (documented in both the 8.2 end-user and developer docs), and Page Quality Audit 1.6.0 generates AI alt-text suggestions for every image lacking one — thumbnail, ≤125-character suggestion, a one-line reason, and decorative-image detection — with vision-capable Anthropic/OpenAI models receiving a downscaled copy of each picture. Migration additionally rebuilds alt text at scale. Capped in the mid-40s because there is no AI image generation, no smart focal point or crop, no AI video processing, and alt-text suggestions are copy-to-clipboard at audit time rather than generated on upload.

Three converging MT pathways remain in place: the DeepL module (right-click any content in jContent and translate from the current language into all enabled site languages) plus the jahia-translate-workflow module for review gating; the CKEditor 5 AI Assistant's in-editor translation; and Jahia AI producing first multilingual drafts across large content sets for local teams to review. Bulk cross-locale operation plus workflow integration justify the top of the mid-band. Below 70 because no brand-voice preservation across locales and no MT quality scoring or confidence metrics were found.

Page Quality Audit 1.6.0 closes the on-page-scoring gap that previously capped this item: a Page audit drawer in jContent and Page Builder scores each page across eight tabs with severity-rated issue counts, and with an LLM provider configured the SEO tab emits ready-to-paste <title> alternatives, meta descriptions with live character counts, og:title/og:description, a focus keyword plus supporting terms, heading rewrites with reasons, and specific replacements for generic CTAs. Combined with AI alt text, Rekognition taxonomy tagging, Jahia AI's catalog-wide SEO audits and GEO optimization, and Schema.org rebuilding at migration, all four rubric elements — titles, descriptions, alt text, tags — plus editor-time scoring are present. Short of 80 because suggestions are display-and-copy only and never written back to the repository, and the audit module is community-maintained rather than an enterprise-supported product.

Auto-tagging is now confirmed as a shipping native capability rather than a marketing claim — the Autotagging module runs AWS Rekognition ML over uploaded images to tag them automatically and reduce duplicate uploads — and it sits alongside Jahia AI's bulk updates, taxonomy tagging and metadata generation, page-level AI enrichment via Page Quality Audit, and DeepL bulk translation. Every AI action activates from inside the editorial surface, triggers the already-configured workflow steps, respects existing user permissions and lands in the activity journal. Held at 65 because smart scheduling, content routing and duplicate/thin-content detection are still absent as first-party features.

Cut after checking what the 18-agent claim actually covers: the concretely documented fleet is a migration offering — an Assessment agent crawling sitemap.xml, a Reconstruction agent rebuilding components, and a Content Migration agent recreating content — delivered as a vendor-run service against a public site with a free assessment and no access to the customer's admin, database or source code. No Academy documentation exists for configuring, running or governing content-operations agents inside the CMS, and there is no agent marketplace, recipe catalog, or natural-language task console in jContent. The genuine in-product agentic surface is the MCP server plus its JCR-stored Skills, which let external agents (Claude, Cursor, Copilot) chain multi-step content work under Jahia's approval workflows and permissions — real infrastructure, but customer-assembled rather than a packaged agent product.

Page Quality Audit supplies real per-page content health scoring — performance, readability, accessibility, SEO and AI review tabs, each badged with the number of issues to review and led by severity-chipped recommendations — which is more than the auto-tagging-only floor, and jExperience adds A/B and personalization dashboards over Unomi behavioral data. Jahia AI claims full metadata and content audit reports across all sites. Kept in the 35–50 band because intelligence is per-page and on demand rather than a portfolio dashboard: no content gap analysis, topic clustering, stale-content detection, editorial priority recommendations or ROI attribution were found.

Page Quality Audit 1.6.0 is a concrete, versioned auditing product rather than a product-page claim: axe-core 4.13 drives the Accessibility tab and picks up new rules automatically because it runs by WCAG tag rather than a hardcoded list, and the audit spans SEO, performance, readability and an AI review tab, each pairing severity-rated findings with LLM-generated fixes. Jahia AI layers on metadata, compliance and full content audits across sites. Held below 70 because brand-voice compliance scoring and duplicate/thin-content detection are absent, audits run per page on demand rather than across thousands of pages inside the product, and the module ships under org.jahia.community.modules — community-maintained, not enterprise-supported.

Corrects a stale citation: Augmented Search 4.0 shipped in November 2025 on Elasticsearch 9 (the 7.17.x policy in the prior evidence came from 3.3-era docs), which puts a vector-capable engine underneath the product. But Jahia states it is still only evaluating Elasticsearch 9's LLM integration layer for conversational agents, weighing the extra Elastic licensing and server-sizing cost — so no vector search, natural-language query, embedding pipeline or hybrid ranking ships today. The MCP server gives external LLM agents GraphQL retrieval over content, a RAG-adjacent path, but that is agent-driven fetching, not native semantic search.

jExperience personalization is still rule-based — segments, individual profile properties, static list membership and A/B tests executed by Apache Unomi — and the product page's 'from machine learning to rule-based decisioning' phrasing is unaccompanied by any named ML decisioning engine, predictive scoring feature, next-best-content recommender or cold-start handling in the documentation. The archived unomi-predictionio-plugin has had no first-party successor. Jahia AI generates personalized variants and journeys, but execution remains the traditional rules engine, which keeps this at the rule-based floor per the category's explicit anti-pattern.

The Jahia MCP Community Server (first released April 2026, formerly jahia-mcp-servlet) is an OSGi bundle registered at /modules/community-mcp implementing stateless MCP over HTTP and exposing four tools — executeGraphQL, introspectSchema, listSkills, getSkill — giving agents full schema awareness plus read, write and publish through graphql-dxm-provider mutations. Governance is real: an operation whitelist configurable in Administration → MCP Server or org.jahia.community.mcp.cfg, API-token scopes, per-user JCR permission enforcement, and blocked-operation logging; it is also listed in the public Glama MCP registry. Sits at the top of the community band rather than 75+ because it is explicitly community-branded under the org.jahia.community groupId, with no Academy documentation or Store listing backing it as a supported product.

The supported model list is now enumerated at eight named options — OpenAI, Anthropic, Google Gemini, Mistral (EU-hosted), DeepSeek, Azure OpenAI, OVHcloud AI and self-hosted models — with Azure OpenAI and OVHcloud AI adding genuine sovereignty and residency choice on top of the self-host path, and switching models described as updating an API key rather than renegotiating a contract. Crucially this is corroborated at the implementation layer rather than only on the product page: Page Quality Audit takes AI_PROVIDER (anthropic, openai, deepseek) plus AI_MODEL and AI_MAX_TOKENS in its own .cfg, and the CKEditor 5 AI Assistant requires the customer's own OpenAI key. That combination of multi-provider choice, self-hosting and per-module key configuration is first-tier BYOK.

The AI developer surface holds three concrete pieces: the MCP server exposing schema introspection and GraphQL execution as agent tools; the Skills system, which stores reusable Markdown instructions as mcp:skill JCR nodes organizable in sub-folders and delivers them dynamically into any MCP client session; and JavaScript/TypeScript module development, with Jahia itself reporting that modules, components and views can now be built almost entirely with AI-assisted dev tooling. Page Quality Audit also demonstrates a documented pattern for wiring an LLM provider into a module via OSGi .cfg. Below 70 because there is no branded AI SDK and no official LangChain/LlamaIndex/CrewAI integration guides.

Governance is enforced by construction rather than by policy: every AI action triggers the validation process configured for that content type, so AI cannot skip an approval step the organization requires, and every operation lands in the activity journal. The MCP server constrains agents with an operation whitelist, scoped API tokens, per-user JCR permission enforcement and blocked-operation logging, while Page Quality Audit defaults to safety — AI is opt-in per site and its suggestions are display-and-copy only, never written to the repository. Privacy controls are strong through BYOK with EU-hosted and self-hosted model options. Below 75 because there is no brand-voice enforcement, no hallucination detection or confidence scoring, no prompt-template governance and no IP indemnification.

Upgraded from inference to a verified artifact: Page Quality Audit reports token consumption in and out plus an estimated cost in the footer of every audit run, with AI_COST_INPUT_PER_MTOKENS and AI_COST_OUTPUT_PER_MTOKENS configurable per model — real cost visibility at the point of use. The activity journal records every AI operation and MCP logs blocked operations with user, path and client IP, giving per-user AI action traceability. Still capped at the top of the minimal band because that cost readout covers one module and one run at a time with self-maintained rates: there is no org-wide AI usage dashboard, no per-user or per-team consumption metrics, no quota management and no quality-trend analytics, and BYOK pushes authoritative billing telemetry to the model provider.