Squiz DXP is a fully managed SaaS platform built around the Matrix CMS, the Funnelback enterprise search engine and a native customer data platform, and it is most at home running hundreds of government and university sites from one installation.
Both platforms are popular with government buyers and both offer strong in-context editing, but Concrete CMS is open source, free to run yourself and far cheaper to try, while Squiz is a sales-led managed SaaS with opaque pricing. Squiz wins decisively on enterprise search, native customer data and personalization, multi-site governance at scale and vendor-run operations with a contractual SLA. Concrete CMS wins on cost transparency, time to a first working site, developer familiarity and freedom from vendor lock-in.
Full Comparison →Acquia sells enterprise Drupal into the same public-sector accounts and brings FedRAMP authorization, a mature DAM and the largest open-source talent pool in the category, which Squiz cannot match. Squiz counters with a tighter, more integrated suite: Funnelback search, a native CDP and a page builder that need no module assembly, plus simpler operations because Squiz renders and hosts everything. Choose Acquia for compliance depth, headless flexibility and hiring ease; choose Squiz for search-led experiences and a smaller team.
Full Comparison →Progress Sitefinity and Squiz both pair a visual page builder with a native customer data platform, so marketers get a similar authoring and personalization experience on either. Sitefinity offers a .NET developer path with a larger partner network, published licensing tiers and the choice of self-hosting, while Squiz is cloud-only and sales-gated. Squiz pulls ahead on enterprise search, estate-wide content health auditing and multi-site delegation for very large site portfolios.
Full Comparison →For intranet and portal work, HCL Digital Experience brings deeper authentication, authorization and regulated-industry compliance from its portal heritage, along with on-premises deployment that Squiz no longer leads with. Squiz Workplace and Funnelback deliver a lighter but more modern employee hub with communities, a staff directory and permission-aware search across SharePoint and Google Drive, at far lower operational cost because it is fully managed. HCL suits heavily regulated enterprises with their own infrastructure; Squiz suits public-sector and education intranets that want search and a managed service.
Full Comparison →Our analysts rate 9 platforms as replacements, with a recommendation for who should move and who should stay. Ratings updated Oct 18, 2026.
Squiz Search (Funnelback) is a 25-year-old dedicated search product rather than a bolt-on, with faceted navigation, synonyms, more than 70 ranking factors, Curator rules and best bets for editorial control, and analytics that expose zero-result queries and content gaps. It indexes SharePoint, Google Drive, Alfresco, Jira, Documentum and databases alongside the CMS, resolving document permissions at index time so results never leak content a user cannot open. Conversational Search layers a retrieval-augmented generation (RAG) answer engine on top, with a second language model verifying each answer against approved sources. For an organisation whose users mostly arrive through a search box, this is the most capable search in a CMS suite at this price point.
The Visual Page Builder lets editors assemble pages by drag and drop from a governed component library, edit text inline on the live preview, and reuse templates and layouts that shipped in 2026. Because Squiz renders the production site, in-context editing extends to component properties, personas and display conditions. The Component Service enforces semantic versioning on every component, controls which versions each site may use, and allows rollback to an earlier version, so a central team can hand page building to departments without losing control of the design system.
A single Matrix instance routinely runs hundreds of sites, and one customer story covers more than 400 publishers on one deployment. Content and components are shared across sites in a single asset tree, permissions and workflow schemas are applied per branch, and the same approval role resolves to different people on different sites. Read, write and admin rights can be granted on any individual asset to a user, group or role with automatic cascade to children, which is exactly the delegated-but-overseen model that government and higher education buyers ask for.
Squiz hosts and renders the entire site on its own AWS infrastructure behind Cloudflare CDN, a web application firewall and edge workers, with monthly vendor-managed releases and security patches applied centrally. The subscription bundles a published support agreement with a 99.9% monthly uptime commitment and contractual targets: a P1 incident gets a response within 30 minutes and a resolution target of six hours, 24 hours a day. Customers never patch, scale or monitor servers, so a small web team can run a large estate without an operations function.
Squiz ships its own customer data platform (CDP), which builds rule-based and event-driven segments from first-party behaviour, geography, referral source, campaign parameters and CRM attributes, and evaluates them server-side on every request. Marketers create per-segment variants of page blocks directly in the page builder and preview what each audience will see. Advanced Forms writes answers into the same visitor profile and pre-fills from it, and portal users signed in through the organisation's identity provider sync automatically into the CDP. The capabilities are licensed separately from the base CMS, but they are one product rather than an integration project.
Experience Monitoring watches every enrolled domain for slow pages, caching problems, broken links, failing forms and missing content, and Content Intelligence (generally available since May 2026) crawls the whole content estate, including non-Squiz sites, and scores it for accessibility against WCAG 2.2 (the Web Content Accessibility Guidelines) and for readiness to be cited by AI assistants. Scheduled review jobs, metadata-driven expiry triggers and a 100-version history keep ageing content under control. Audit logs are retained for twelve months and stream to Datadog and Dynatrace in near real time. For compliance-minded buyers this is a lot of hygiene tooling in one place.
There is no price list, no trial and no sandbox; the only public figures were four-year-old floor prices on a UK procurement framework that Squiz has since left. The subscription agreement meters page views, indexed documents, storage and data transfer, bills overage in blocks of 1,000 units, forfeits unused allowance at the end of the year, re-baselines renewal at any mid-term increase, and lets Squiz reprice at renewal. Fees are invoiced annually in advance with a 60-day non-renewal notice. Buyers should model traffic growth carefully, because adding sites or audiences adds both licensed scope and metered consumption.
Matrix treats everything as an asset in one hierarchical tree, with its own lifecycle states, Designs, Paint Layouts, Contexts, locks and workflow schemas, and no amount of interface polish removes that learning load. Component development has moved onto mainstream JavaScript, but anything deeper still needs people with years of Matrix experience, who cluster in Australia and the UK and are hired through a handful of specialist agencies. Independent courses, Stack Overflow answers and community activity are close to nonexistent, so a team new to the platform relies on Squiz Academy and paid services to ramp up.
Beyond Conversational Search and the Content Intelligence auditors, AI in Squiz is limited to pre-configured headline and tone prompts in the page builder. There is no AI image generation, no machine translation inside the editor, no predictive or machine-learned segmentation, and no Model Context Protocol (MCP) server for connecting agents. The language model behind Conversational Search is chosen and managed by Squiz, with fixed core prompts and no option to bring your own OpenAI, Anthropic or Azure key. The Squiz Spark agent suite is still early access with no documentation or release note behind it.
The read-only Content API ships as a Marketplace extension rather than core, GraphQL exists only as a beta connector for calling other services, rich text comes out as HTML, and the only official SDKs are JavaScript tooling for the component layer. Nothing generates types from the content model, there is no Next.js, Nuxt or Astro starter, and preview and in-context editing work only on pages Squiz renders. Teams that want Squiz as a content backend for their own frontend will be building the plumbing themselves.
Squiz holds its own ISO 27001 certification and a Texas TX-RAMP Level 2 listing, but its SOC 2 report is Type 1 rather than Type 2, the sub-processor list is available only on request, and the subscription agreement states outright that Squiz is not HIPAA or PCI DSS accredited and offers no business associate agreement. Hosting regions are the UK, North America and Australia only, with no EU option. No Voluntary Product Accessibility Template (VPAT) for the authoring interface can be found anywhere, a surprising gap for a vendor selling into universities and government.
Squiz has no product catalog, cart, checkout, pricing or inventory, and commerce is reached only through Squiz Connect flows for Shopify, BigCommerce, Magento 2, Stripe and PayPal, or a Shopify Buy Button pasted into a code component. There is no product picker in the editor, no shoppable content pattern, and no way to inject CMS content into cart, checkout or post-purchase pages. Search result curation can be pointed at a product index, but that is the only merchandising tool on offer.
Component content models are defined in JSON Schema with custom input types (FormattedText, SquizImage, SquizLink) and deployed as code through the dxp-component-library CLI, while Matrix metadata schemas add typed fields grouped into sections with defaults, editability and required settings. A genuine two-tier model rather than rigid templates, but there are no union or polymorphic field types and schema-as-code covers components, not the asset types themselves.
The Matrix Linking screen exposes where an asset is linked from, NOTICE links record dependencies so deletions surface their impact, and %asset_linking_info% returns linking data including parent lineage; page-builder usage reporting adds where-used for templates, layouts and components. That meets the one-to-many-with-reverse-lookup band, but the model is a hierarchical asset tree with no polymorphic references, native many-to-many fields or graph-style querying through the delivery API.
The Component Service provides reusable, nestable components from a central design-system library, and templates and layouts became first-class reusable building blocks in 2026, so composition spans component, layout and template tiers. Component content is structured JSON, but rich text inside it is HTML rather than a portable structured format and nesting depth is undocumented, which keeps it below 75.
JSON Schema underpins component models, giving the standard vocabulary (required, type, min/max, enum, pattern), and Matrix metadata fields enforce required values and defaults. No cross-field rule engine or pre-save validation hook is documented, and it is unclear whether schema rules are enforced on writes through the management API, so this stays in the standard built-in band.
Matrix keeps automatic version history per asset and the Page Builder gained a dedicated version history UI in 2026 that selects, compares and restores versions; Safe Edit holds a draft alongside the live version for comparison before approval, and the trash allows deleted assets to be recovered. No content branching or release-based versioning and no documented programmatic version API keep it below 75.
Matrix metadata schemas can be applied across any asset type (pages, files, DAM assets) with typed select and hierarchical fields, and the Thesaurus asset provides a controlled vocabulary with term relations and synonyms that Funnelback search also uses; asset-level permissions govern who can edit schemas and vocabularies, and metadata is returned through the Content API. Held below 75 because there is no dedicated taxonomy manager with term-level governance or bulk reclassification UI, and the newer component and page-builder layer has a thinner classification story than core Matrix.
Because Squiz renders the production site itself, the Visual Page Builder and Matrix inline edit mode let editors change draft content in place on the real page, with Matrix 6.6 extending inline editing to component properties, personas and display conditions, Safe Edit previewing unpublished changes, and 2026 language variants allowing per-language preview. The ceiling is that in-context editing applies only to Squiz-rendered pages: there is no draft preview or click-to-edit overlay SDK for a separate headless frontend.
The FormattedText input provides a WYSIWYM editor with a standard toolbar (formatting, alignment, lists, images, links, tables, raw HTML) that emits clean HTML aligned to the design system, configurable per component through JSON Schema, and Matrix's WYSIWYG offers asset embedding by link. Output is an HTML blob rather than a portable AST with custom renderers, which caps it at the standard WYSIWYG band.
The built-in asset library handles images, video and documents with metadata, centrally managed alt text and captions, and versioning; uploads are automatically converted to WebP (v6.18) and AVIF, image varieties are generated automatically or by trigger for responsive use, an in-built editor crops and resizes, and linking data shows where an asset is used. No URL-parameter transform API or focal-point control is documented, which keeps it below 75.
Matrix prevents last-write-wins: asset locking blocks concurrent edits and names the lock holder, separate attributes can be edited concurrently, Safe Edit isolates in-progress changes, and comment assets plus workflow comments and change requests provide async annotation with author-attributed history. There is no real-time co-editing, presence indicator or @mention notification documented, so it sits in the locking-with-async-comments band.
Workflow schemas are configured in the admin interface without code: multi-step approval chains with conditions, steps bound to roles and user groups, email notifications, approve and reject with comments, and an attributed audit trail, applied per asset or subtree so different content can follow different paths. Parallel approval paths and due dates or SLAs on review tasks are not documented, which keeps it from the top of the band.
Future Status schedules any asset to publish, archive (unpublish) or go up for review at a set date and time, covering embargo and expiry, and the Scheduled Jobs Manager lists every pending job system-wide. There is no calendar view of upcoming content and no release bundles that publish many assets atomically, so it sits in the scheduled-publish-without-bundles band.
Matrix Contexts store alternate field values per language on the same asset, falling back to the default context when no translation exists, component fields can be marked translatable, and 2026 Page Builder language variants manage all of a page's languages in one interface. Fallback is to a single default rather than configurable chains, and locale-aware validation and per-locale publishing are thinly documented, so it stays below the 75+ field-level-with-fallback-chains band.
DXP primary roles govern service access organisation-wide while Matrix applies granular read, write and admin permissions at asset and subtree level, with roles usable as workflow steps and SAML 2.0 SSO with attribute mapping (extended in June 2026 with an Add SAML Link trigger action) plus Search custom roles. SCIM provisioning and field-level permissions are not documented, which caps it in the good-role-model-with-SSO band.
The read-only Content API (in Matrix core since 6.16) uses bearer tokens minted in Content API Manager and scoped to an asset subtree, with a data parameter to select properties plus filtering and pagination, and a separate REST API covers management. GraphQL exists only as a Beta Connect component for calling external services, not as a native delivery API, which keeps this in the REST-only band.
Squiz DXP SaaS fronts delivery with Cloudflare CDN, WAF and Squiz Edge Workers, and Edge Side Includes let dynamic fragments assemble at the edge, giving a managed CDN with real edge compute. Cache purge latency on publish is not documented, which keeps it out of the 80+ sub-second band.
Trigger Manager events (status change, web path update, publish and more) fire outbound into Squiz Connect flows, which provide filterable execution logs, operator-initiated error retry, custom error handlers and credential-secured webhook triggers. Retry is manual reprocessing rather than automatic backoff, HMAC payload signing is undocumented and there is no event-streaming alternative, so it sits in the solid-webhooks band.
A traditional CMS with a headless API layer added: the Content API supports hybrid delivery and component content is JSON, but the architecture is page-first, rich text is emitted as HTML, and no official SDK fleet across several languages is published. That places it in the traditional-CMS-with-API band.
Squiz's own CDP builds rule-based and event-driven segments from first-party behaviour, evaluated server-side each session, with Single Customer View profiles, per-site segment sets and segment templates added in 2026, automatic portal-user sync, and a Tealium integration that queries external profiles at request time. It is licensed as part of the separately sold Personalization capability rather than the base CMS, so the add-on ceiling applies, and the attribute palette is narrower than dedicated enterprise CDPs.
Authors create per-segment variants of content blocks directly in the Visual Page Builder and preview what each segment sees before publishing, with CDP-driven server-side delivery. Strong native variant handling, held below the add-on ceiling because priority and fallback across overlapping segments are thinly documented and the capability sits in the separately licensed Personalization module.
The Optimization service provides adjustable traffic distribution, conversion goals by element selector or destination URL, a duration and significance calculator, variants edited in the Visual Page Builder and in-platform reporting, with segment-scoped tests added in 2026. It is strictly two-variant A/B testing with no multivariate or bandit mode, and it is licensed alongside Personalization rather than in the base CMS.
Funnelback ships a recommender that suggests related items from query and click logs (CO_CLICKS, RELATED_CLICKS, RELATED_RESULTS), a real algorithmic signal rather than manual curation. It is search-package-centric, not an editorial recommendation engine wired into page authoring or CDP profiles, and requires the separately licensed Search product.
Squiz Search (Funnelback) is a first-party enterprise search product with full-text and faceted search, relevance tuning across 70+ ranking factors, autocomplete, synonyms, multi-source indexing of external systems and search analytics, under active 16.x development in 2026. It is the platform's strongest DXP capability, scored at the add-on ceiling because Search is sold as its own product in the suite.
Squiz DXP has no product catalog, cart, checkout, pricing or inventory; its capability set is content, search, CDP, personalization, forms, DAM and integrations. Commerce is reached only through connectors, scored in 2.3.2.
Squiz Connect has first-party connectors for BigCommerce (SKU to product ID mapping), Shopify with Buy Button embedding, Magento 2, PayPal and Stripe. These are API-level flows rather than an in-editor product picker or live catalog federation, and commercetools, SFCC and SAP Commerce are not covered.
Squiz ships behavioural analytics with visual journey mapping and drop-off identification, A/B conversion reporting and Funnelback search analytics on query intent and content gaps, while the base CMS adds 2026 usage reporting for templates, layouts and components. The journey and conversion analytics sit in the Personalization and Optimization modules, and there is no content-lifecycle or author-productivity reporting.
Google Analytics is a prebuilt entry in the integration library and Connect adds Tealium, Mixpanel and Power BI connectors, with Matrix pages accepting any tag manager snippet. No Segment, Amplitude or Adobe Analytics connector is documented and there are no event helpers for the page builder.
A single Matrix system routinely runs hundreds of sites, with shared assets linkable across sites in one tree, component libraries shared across sites with per-site or per-channel availability, and per-site configuration; one customer story covers 400+ publishers on one DXP. Below 85 because cross-site reuse is component- and tree-led rather than a governed shared-content repository with site-level overrides.
Squiz Connect provides first-party connectors for RWS (SDL) and Lionbridge plus a Google Translate machine-translation connector, and the page builder manages language variants in one interface. These are Connect flows rather than an in-platform translation job UI with translation memory, and Phrase, Smartling, Lokalise and Crowdin are not covered.
The Component Service is a design-system governance layer: a central library of brand-approved components, control over which components and versions each site or channel may use, and brand rules compiled into components; a documented two-brand deployment themes one design system per brand from one codebase. Cross-brand approval routing and brand-level analytics are not documented as distinct features.
The built-in DAM, included without an extra licence, provides metadata schemas, tagging, versioning and permissions with centrally managed alt text and captions, guided to libraries of roughly 10,000 assets, and Squiz maintains two-way Bynder and Asset Bank integrations for larger estates. There is no rights or expiry management, asset approval workflow or brand portal, which keeps it at the bottom of the library-with-taxonomy-and-versioning band.
Video uploads into the asset library with playback in the preview screen and centrally managed captions, transcripts and descriptions, and a MediaValet connector serves external media workflows. There is no transcoding, adaptive streaming or Squiz video player, so production video is normally embedded from YouTube or Vimeo.
The Visual Page Builder offers drag-and-drop assembly from a governed component library, inline editing with live preview, reusable templates and layouts (2026), per-site component availability as brand guardrails, and usage reporting before changing a building block. It composes Squiz-rendered pages only, with no visual composition for an external headless frontend, and template locking is less granular than the leading builders.
Squiz DXP is a SaaS platform that both renders and hosts the full site: Matrix produces the pages, delivery runs on Squiz-operated infrastructure behind Cloudflare CDN and WAF with custom domains, TLS and Edge Workers, and the Component Service runs component code on Squiz infrastructure. Hybrid headless delivery is supported through the Content API, but Squiz does not host a customer's separate JavaScript frontend, which keeps it below the 90+ band.
Advanced Forms delivers drag-and-drop design, chained conditional logic including hidden fields, multi-page forms, payments, save-and-resume, submission token validation (January 2026) and progressive profiling that writes answers into CDP profiles and pre-fills from them; Matrix's base Custom Form asset covers simpler needs natively. Scored as add-on because Advanced Forms is its own licensed capability, and native spam protection and field-level drop-off analytics are not documented.
Official connectors cover Mailchimp, Marketo and HubSpot, and the CDP tracks email campaign link clicks into profiles. There is no native send, no in-CMS email composition or preview and no documented triggered sends from content events.
Squiz feeds automation tools rather than running automation: CDP events and form submissions flow into Marketo, HubSpot and Salesforce through Connect, and journey mapping visualises journeys without orchestrating them. No native drip, nurture, lead scoring or lifecycle stages are documented.
Matrix manages meta titles and descriptions through metadata schemas, generates XML sitemaps through the Google Sitemap asset, handles redirects through the Remap Manager with bulk import, and controls URLs per site, while canonical and hreflang tags are output through designs and metadata. Structured data is hand-built in templates rather than authored with validation, and there are no on-page SEO recommendations, which keeps it in the 60–74 band.
Squiz-hosted sites sit behind Cloudflare and Matrix can serve a hand-edited robots.txt and any text asset, so llms.txt, per-bot crawler rules and JSON-LD can be assembled by the implementation team. No native llms.txt generation, Markdown endpoints, managed AI-crawler controls or AI-referral reporting is documented.
marketplace.squiz.net and the integration library advertise 100+ integrations, backed by around 61 Squiz-built Connect connectors across CRM, DAM, commerce, translation and analytics plus generic REST, SOAP, GraphQL and webhook components, with Google Calendar, ServiceNow, SharePoint, Microsoft Fabric and MediaValet added in 2026. Nearly all connectors are Squiz-built, with little partner-contributed ecosystem, which keeps it below 75.
Matrix supports front-end visitor accounts natively: Account Manager registration and profile pages, SAML, OAuth 2.0 and LDAP authentication for site users, permission-based gated content and personalised portal pages, with 2026 automatic portal-user sync into the CDP so personalization keys off authenticated identity. Consent and preference management and social login are assembled from these building blocks rather than shipped as a portal product, which keeps it just below 75.
docs.squiz.net/dxp-api is now a genuine API portal indexing 14 interfaces with public/private markers — Matrix SOAP/JavaScript/Content Delivery/Asset Management, Integrations REST, Logging Service, Job Runner, File Store, and six Funnelback APIs — a real improvement over the two-page stub of the prior pass. The content delivery surface is still read-only REST with bearer tokens, the GraphQL component remains explicitly Beta and is an outbound connector to third-party GraphQL APIs (with documented parsing, attachment and OAuth2 limitations) rather than a native GraphQL delivery API, and there is no interactive playground. Fragmentation across eight product modules keeps it below the well-designed-single-REST-API band.
Delivery is CDN-backed via Squiz Edge on AWS with Elastic Load Balancing across multiple availability zones, and the Datastore provides server-side pagination (limit(), page object for multi-collection requests). However, no rate limits, throttling policy, pagination ceiling, or include-depth limit is published for the core Content, Asset Management, or Integrations APIs — the only documented rate limit found belongs to the third-party Bynder connector. Absence of published limits is the binding constraint on this item.
The official SDK surface remains JavaScript/TypeScript-only and is actively maintained — @squiz/dx-json-schema-lib (1.90.1) and @squiz/local-component-dev-ui (0.8.1) both published 2026-09-14, @squiz/dxp-cli-next 5.35.0 in July 2026, @squiz/db-lib at 510 published versions. No official SDK exists for Python, Java, .NET, PHP, Swift, or Android, and the @squiz npm scope returns zero results in npm's public search index, indicating no discoverable community layer either. Strong release cadence cannot lift a single-language ecosystem out of the community-only band.
The integration library at dxp.squiz.net/integrations now enumerates exactly 100 distinct named integrations across 20 categories — CRM (Salesforce, Dynamics, Pipedrive, Zoho, Sugar, Creatio), DAM (Bynder, MediaValet, Frontify, Asset Bank), commerce (Shopify, Adobe Commerce, BigCommerce, WooCommerce), payments (Stripe, PayPal, Braintree, Westpac PayWay), AI (ChatGPT, Claude, Gemini, Grok, Manus), translation (DeepL, Wordbee, Lionbridge), analytics and LMS — substantiating the vendor's 100+ claim that the prior pass could only verify at 61. A separate marketplace.squiz.net adds extensions, templates, blueprints and recipes. Held below 75+ because every listing is Squiz-built and Squiz-maintained: the Marketplace carries only five extensions and there is no third-party publishing model or revenue share.
Component Service supports custom web components with typed JSON Schema input definitions, inline editing integration, enforced SemVer with documented rollback to earlier versions, per-site component libraries, and Components-at-Edge server-side execution with fetch access; the Job Runner API adds programmatic scheduled server-side jobs, and Marketplace Extensions (HTML CodeSniffer, JSON Web Token, Matrix Keyword Helper) extend the Matrix authoring UI. This is materially more than webhook-plus-UI extension. It stays short of 75+ because there is no app framework for building custom DXP console panels or sidebar widgets, and no platform-level content lifecycle hook API.
DXP console SSO is SAML 2.0 only and is not self-service — the docs state setup "can be arranged by contacting your Customer Success Manager," and there is no SCIM or directory sync ("Users in your directory are not automatically created within your DXP service, you must manually invite users"). OIDC is documented only for front-end Portal authentication, not console login, and MFA is explicitly delegated to the IdP ("the password (or 2FA) associated with your single sign-on") with no native enforcement. SSO being bundled rather than tier-gated holds it in the mid-60s; the vendor-mediated setup and missing SCIM, which the prior pass did not capture, prevent more.
The DXP console ships fixed primary roles (Owner, Admin, other primary roles) plus four service-scoped secondary roles — Customer data agent, Forms admin, Logs auditor, Chatbot reviewer — with SAML attribute mapping; custom role creation is documented only within Search. Matrix supplies granular asset-level and tree-scoped permissions, and Content API tokens can restrict access to specific branches of the asset tree with most-restrictive-wins precedence. The modern DXP layer still documents no field-level or content-instance-level permissions and no general custom role builder, which caps this at the predefined-roles-plus-granular-legacy-layer midpoint.
Squiz holds ISO/IEC 27001:2022, CSA STAR Level 1, TX-RAMP Level 2 (certification TX1591016, expiry 2028-08-25, via the lightweight Acknowledgement and Inventory Form path), and GDPR commitments — but its SOC 2 is Type 1, not Type 2. Critically, the prior score of 76 rested on an EU data residency claim that is false: squiz.net/security/squiz-saas-platform lists Squiz-managed AWS hosting as United Kingdom, North America and Australia only, and post-Brexit the UK is not an EU region. No HIPAA BAA is offered. Correcting the residency error and the Type 1/Type 2 distinction drops this well out of the 80+ band.
No CVEs or breaches specific to the Squiz DXP SaaS platform surfaced for 2025–2026; the platform runs an ISO 27001-certified ISMS with bi-annual third-party penetration tests, TLS 1.2+ with BYOK, and monthly releases that bundle dependency security upgrades plus specific hardening fixes (September 2026 corrected form-submission assets becoming publicly readable when disconnected from their parent form). Disclosure is a published security-team@squiz.net contact and an NDA-gated trust center at trust.squiz.net rather than a public advisory feed. No bug bounty program exists, which holds this at the top of the clean-history-with-basic-disclosure band.
The modern DXP is SaaS on Squiz-managed AWS with a customer choice of United Kingdom, North America or Australia, single-region deployment across multiple AZs, logical tenant separation at the database level, and BYOK for TLS certificates. Squiz Matrix 5 remains self-hostable for on-premises or private cloud, giving more flexibility than pure SaaS. The score is capped because Matrix 5 is now filed under "Legacy Products" in the docs navigation and the current DXP capability set — Component Service, CDP, Content Intelligence, Connect — is cloud-only, and there is no EU-resident option.
Squiz publishes a 99.9% Monthly Uptime Percentage SLA measured at the CDN, a live public status page at status.squiz.cloud with incident history, and — unusually for this tier — a contractual support agreement with both response and resolution targets (P1 immediate and no greater than 30 minutes response, 6 hours resolution; P2 2 working hours; P3 2 working days) on 24/7 coverage, bundled into the subscription rather than sold as a premium tier. The published resolution commitments lift this above a bare 99.9%-plus-status-page posture. It stays under 80 because the SLA itself is 99.9% rather than 99.95%+, and no resolution target is published for non-outage functional defects.
Squiz documents Elastic Load Balancing distributing workloads across multiple AWS availability zones within a region, scaling "both automatically and on demand" in response to traffic spikes, Squiz Edge CDN delivery, and Components-at-Edge rendering, with substantial public-sector and higher-education reference deployments. What is missing for the 75+ band is any published quantitative ceiling — no documented limits on assets, entries, concurrent authors, or API calls per second — so buyers cannot size against the platform without a vendor conversation.
Substantially better documented than the prior pass found: Squiz operates a primary/secondary data centre model with Squiz Edge failing traffic over to a read-only secondary during a primary outage, states it performs DR "against measured Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)," and the subscription agreement commits to backups every 24 hours retained 30 days plus a 30-day post-termination data export window. Export tooling exists — Matrix Export assets to XML and Export files tools, plus asset version control retaining the previous 100 changes. It cannot reach 75+ because the actual RTO/RPO figures sit behind an access-request form at trust.squiz.net rather than being published, backups are explicitly "not for archival purposes," and the export window is request-based with a proprietary XML schema.
@squiz/local-component-dev-ui (0.8.1, published 2026-09-14) and @squiz/dxp-cli-next provide a genuine local development server for the component layer with auto-reload, local environment variables, and local layout testing, so developers can build and preview components without a live DXP connection. This is real local tooling rather than remote-only workflow. It falls short of a higher score because the emulator covers only components — there is no local Matrix/CMS instance, Content API, Datastore, or Connect emulator, so anything touching content or integrations requires a live environment.
Component Service enforces Semantic Versioning — every code change requires a version increment and redeploying a changed component under an existing version is impossible — and Squiz documents reverting DXP environments to an earlier component version, which is real deployment rollback rather than just version labelling; bring-your-own CI/CD runs through the CLI with deployment enablement controls and lint/format gates, and Connect documents staging/production workspace separation. It remains mid-band because there is no schema migration tooling for content model changes and no branch-per-PR or ephemeral content environment pattern, so content-model changes are still promoted manually.
The help centre has grown materially: roughly 17 capability sections now including new Content Intelligence, Advanced Forms and Optimization trees, a dedicated DXP Releases site, a centralized DXP APIs portal indexing 14 interfaces with public/private markers (previously a two-page stub), a 100-entry integration library with category and sector filters, a Marketplace of recipes and blueprints, and an Academy. Release notes are current through September 2026 and specific. It stays below 80 because content is still fragmented across separate product doc trees with inconsistent depth, there is no interactive API playground, and there are no framework-specific quickstarts for Next.js, Nuxt or similar.
The component toolchain is TypeScript-first and actively maintained — @squiz/dx-json-schema-lib at 1.90.1 (published 2026-09-14, 516 versions), render-runtime-lib, and the TS/React dxp-component-library — with component inputs defined through JSON Schema typed input types, and manifests now supporting previewPlaceholder hints. However there is still no automated type generation from the component manifest or the content model, and the read-only Content API ships no typed client at all, so anything consuming content is untyped. Typed build tooling without codegen and without a typed delivery SDK lands below the typed-SDK band midpoint.
Squiz DXP's monthly release cadence is now confirmed unbroken across all of 2026 — the Help Center release index carries per-month pages from January through September 2026 spanning Component Service, Content Management, Search, CDP and Datastore. Beyond routine increments, 2026 shipped a genuinely new product (Content Intelligence, GA May 2026) plus Visual Page Builder templates/layouts, language variants and improved version history/restore, which is more than maintenance shipping. Still short of 75+ because the per-month payloads are mostly incremental service updates rather than platform-level feature drops.
Squiz maintains a dedicated, searchable releases site with per-month pages distinguishing new features, bug fixes and improvements, cumulative yearly rollups, changelog errata, and separate per-product release notes for Component Service, Datastore, Connect and Funnelback. What still caps it below 75 is that individual monthly entries do not consistently flag breaking changes inline or link to per-release migration guides — that material lives in a separate deprecations register rather than in the release stream itself.
Squiz publishes a public roadmap alongside a companion Product Releases page, and the 2026 roadmap has proven predictive rather than aspirational — Content Intelligence, page builder templates and layouts, language variants and improved version history all moved from 'coming' to shipped within the year, which is a credibility signal a private roadmap cannot offer. It stays below 70 because there is still no community feedback or voting portal (no Canny, Ideas board or GitHub Discussions), so prioritization remains entirely vendor-controlled.
Prior scoring recorded no public deprecation policy; that was wrong. Squiz Content Management/Matrix documents a four-part MAJOR.MINOR.MICRO.PATCH versioning scheme, a three-year full-support window per release branch followed by security-only support, and a dedicated 'Deprecated assets and features' register recording the version each item was Deprecated In and Removed In — with automatic upgrade scripts that remove or convert deprecated assets so existing implementations do not break. It does not reach 75 because the newer SaaS-side services (Component Service, Datastore, Connect) publish no equivalent deprecation register or notice window, so the guarantee is uneven across the DXP.
Squiz DXP is a proprietary SaaS platform with no public GitHub repository or npm package to measure, and G2 still shows only 27 reviews across the whole seller profile — very thin for a vendor claiming 500+ enterprise customers. The following remains niche and concentrated in government, higher education and utilities across ANZ and the UK.
Squiz runs an official Discourse community at forums.squiz.net with separate Matrix, Developers, Support, Documentation and Community Website categories for bugs, feature requests and implementation tips — a real touchpoint beyond documentation. Engagement remains low relative to peers: no Discord or Slack, discussion is Matrix-centric and modest in volume, and the developer base stays concentrated among a handful of specialist agency partners.
Squiz operates a formal tiered partner program — entry at a 'Community' tier with no prior Squiz knowledge required, progression by expertise and delivery record, regional enablement teams, free Squiz Academy onboarding and joint marketing — covering agency, SI, ISV and consultant categories, with a public directory listing partners such as Deepend, FrontStage Digital, Carnegie and XCentium plus the Slalom relationship for public-sector delivery. It stays mid-band because there is still no Accenture, Deloitte or Valtech presence, so enterprise buyers outside ANZ/UK have a shallow pool of delivery choices.
Independent learning material for Squiz DXP/Matrix remains sparse — September 2026 searches surfaced no Udemy or Pluralsight courses and no notable community blog output for the year, with results dominated by Squiz's own documentation, tutorials and Academy. The only substantive video resource is a 'Learning Squiz Matrix 6' YouTube playlist, and conference and tech-blog coverage stays minimal versus traditional-CMS peers.
Squiz Matrix/DXP remains a niche skillset concentrated in Australia and the UK, hired mainly through specialist agencies or Squiz itself (~28–30 open roles worldwide, mixing PHP/Matrix with TypeScript/Node/React/AWS engineering). The mitigating factor previously missed is Squiz Academy: free registration, free courses and structured developer learning plans for Component Service, which materially lowers ramp cost for a team new to the platform. It stays below 50 because there is still no market-recognized certification exam and Stack Overflow coverage is negligible, so buyers carry real delivery-talent risk outside core geographies.
Squiz keeps a steady case-study pipeline in its core verticals — UniSC's 15,000-student portal, James Cook University's multi-site consolidation, University of Newcastle's 400-publisher upgrade, Greenwich's conversational search and a Queensland Health network overhaul — and Content Intelligence's CMS-agnostic standalone packaging opens a land-and-expand motion outside the existing CMS base. Momentum reads as steady rather than accelerating: G2 reviews are flat at 27 and no flagship North American enterprise logo was announced in 2026 despite the Slalom channel.
Squiz is an established private company (founded 1998, CEO Gavin Dumsday) with Mercury Capital holding a ~30% stake since 2019, headcount essentially flat at ~386–393 across offices in Australia, NZ, UK, US and Poland, and no funding rounds, acquisitions or layoff reports through September 2026. Third-party revenue estimates diverge sharply — getLatka reports $43.2M for 2025 while Owler lists $70.1M for 2026 — so the growth trajectory cannot be verified, and PE ownership implies disciplined rather than aggressive product investment.
Squiz remains a Gartner Magic Quadrant Niche Player with clear vertical focus on government, higher education and service-led organizations, offering SaaS or on-premises deployment with vertical accelerators. The prior score assumed its AI answer was unshipped roadmap; that is now stale — Content Intelligence went GA globally in May 2026 as a CMS-agnostic crawler-based product (AI Readiness Auditor plus a WCAG 2.2 AA/AAA Accessibility Auditor), a differentiated wedge sellable into non-Squiz CMS estates. It stays below 65 because the wider auditor set (SEO, broken links, brand compliance) and the 'fix it for me' remediation are still roadmap, and Gartner's innovation-pace caution on personalization and journey management is unresolved.
G2 holds at 4.2/5 from 27 reviews, which under the scoring formula lands in the 45–60 band on review volume alone. Reviewers consistently praise support responsiveness, search, integration options and ease of use (8.7 vs AEM's 7.7), but the negative pattern is recurring rather than isolated — rocky onboarding with an implementation team that turned over four times on one account, documentation described as poor or missing, an editor and developer experience that is hard to navigate and extend, and support quality varying with staff turnover. Those themes offset the high ratings and hold this at the band midpoint.
Squiz DXP pricing is sales-gated on squiz.net — no published tiers or figures, with SaaSworthy, Capterra, GetApp, Software Advice and TrustRadius all reporting quote-only custom pricing and no free plan. The only channel that ever carried real Squiz figures was UK G-Cloud 13 (May 2022: Matrix CMS from £12,100/yr, +Funnelback Search from £17,000/yr, +Data Service from £20,600/yr, ex-VAT), but that framework has expired and Squiz is a supplier on neither G-Cloud 14 nor G-Cloud 15, so a 2026 buyer finds no current Squiz rate card in any public procurement catalogue. Held at 35 rather than higher: four-year-old floor prices from a dead framework are not usable price discovery, though the Subscription Agreement does publish the billing structure (which metrics are metered, minus every rate).
The published Subscription Agreement confirms consumption metering on Page views, Indexed documents, Storage and Data Transfer, with excess billed at Order-specific Overage rates in minimum increments of 1,000 units for page views and indexed documents. Three compounding ratchets make growth unpredictable: unused allocation is forfeited at period end, any mid-term limit increase re-baselines the renewal invoice at the higher limit, and Squiz may unilaterally change pricing at renewal. Page-view metering with forfeiture and no published rate card is the anti-pattern this item penalizes; the single bundled fee keeps it from scoring lower.
Squiz prices 'based on the capabilities you actually use' across a 15-capability menu (Content Management, Funnelback Search, DAM, CDP, Data Management, Integrations, Component Service, API Suite, Visual Page Builder, Forms, Personalization, Behavioral Analytics, Optimization, Delivery, Platform, plus the new Content Intelligence), making essentially every capability beyond core publishing a separately-priced line item rather than a tier inclusion. A customer review reports 'not a lot of custom capability without paying more money.' Above the worst band because core CMS publishing is bundled and à-la-carte buying avoids forcing an Enterprise upgrade to unlock one feature.
Fees are invoiced annually in advance with payment due before the Subscription Period starts, and terms auto-renew for successive one-year periods unless either party gives 60 days' written notice — no monthly billing, startup program, or published nonprofit/education pricing exists. Squiz also holds renewal leverage: the agreement lets it withhold renewal or suspend service where overage invoices are unpaid, and reprice at renewal. Not lower than 30 because the 60-day non-renewal right is documented and symmetric, which beats an evergreen term with no exit clause.
No free tier, trial, or self-serve sandbox exists — SaaSworthy, GetApp, Capterra and Software Advice all explicitly record no free plan, and squiz.net advertises no trial signup. The 'Migrate to Squiz DXP for free' campaign covers migration services for customers who sign a paid subscription, not free product access. Not zero only because Matrix's open-source heritage and the free-migration incentive marginally lower the entry barrier.
There is no self-serve sandbox or instant trial — first access requires sales engagement and vendor provisioning of the multi-service stack, and G2 rates Squiz DXP's ease of setup at 6.9 against WordPress.org's 8.2. Once provisioned, the Component Service does offer a genuinely modern local loop (components built in any JS framework, Matrix itself in a local Docker container), but it requires Matrix 6.29+ on an already-provisioned tenant. First value is days-to-weeks, not hours.
Squiz markets an accelerated four-step path to go live 'in as little as 30 days' and offers free migration to compress lift-and-shift work, but real-world delivery is inconsistent — one higher-ed customer reported the implementation team turning over four times before the product was operational and onboarding being 'rocky at best,' against others delivered on time and to budget. Government and higher-ed procurement plus multi-capability scope keep typical timelines in the months range.
Matrix remains a niche skillset — SEEK/Indeed listings cluster in Australia, and dedicated brokers exist precisely because the pool is thin (frontstage.digital sells pre-vetted 'Squiz DXP & Matrix developer profiles'), with one customer citing internal ramp-up 'longer than expected.' The premium is lower than previously scored because the Component Service moved front-end work onto mainstream JavaScript frameworks with a local Docker loop, so a portion of delivery no longer needs Matrix-specific expertise. Still a moderate-to-high premium outside AU/UK, where Matrix admin, asset-tree and parse-file knowledge is scarce.
Squiz DXP is fully managed cloud SaaS with infrastructure, CDN (Cloudflare with Squiz Edge Workers) and platform operations bundled into the single subscription — buyers provision no servers, databases, or CDN separately, and there is no self-hosted DXP path. Lowered from 80 because hosting is included only up to a cap: Storage and Data Transfer are contractual Usage Metrics billed as overages beyond the Order limits, so infrastructure consumption is not truly all-inclusive.
As fully managed SaaS with a vendor-run monthly release cadence, customers never patch, scale, or monitor infrastructure — ongoing effort is platform configuration and content administration. Not higher because the multi-capability suite (CMS, CDP, DAM, Funnelback Search, Component Service) still demands non-trivial platform administration, and the metered contract adds a real consumption-monitoring duty: teams must watch page views, indexed documents, storage and data transfer against Order limits or absorb overage invoices.
Documented bulk-export tooling does exist, correcting the prior assessment: the Export assets to XML tool exports an asset and all its children while preserving attributes, links, applied designs, permissions, metadata and nested assets, alongside an Export files tool, an Asset syncing tool, and an Asset Management API with CRUD. This is moderate rather than severe lock-in — but the XML is a Matrix-proprietary format whose documented purpose is reconstructing 'an identical asset structure in a target Matrix system,' not neutral interchange, and it covers neither CDP Single Customer View profiles nor Funnelback configuration, with Hierarchy and Thesaurus metadata field types still unsupported by the API. Transformation effort plus proprietary CDP data gravity keeps this mid-band.
Squiz Matrix keeps its 'everything is an asset' model where sites, pages, images, workflows, and users all live in one hierarchical Asset Tree — a fundamental departure from standard web dev mental models. Developers must internalize a multi-state asset lifecycle (Under Construction, Live, Safe Edit, Archived), overlapping presentation layers (Designs, Paint Layouts, Content Templates), HIPO Jobs, Contexts, Workflow Schemas, and editing locks. Matrix 6 improved navigation (new screen header, revamped Linking screen, unified component picker) but these are UX fixes on top of the same proprietary model, so the concept load is unchanged.
Squiz Academy now runs a free, structured Component Service learning plan sequencing six courses from ecosystem overview through create/preview/deploy/delete, component sets, complex input fields, local preview, and environment variables — an actual guided path rather than docs alone, backed by a YouTube training playlist and in-person, live-online, and webinar training confirmed in 2026 review profiles. It stays out of the 65+ band because onboarding is split across three hubs (docs.squiz.net, matrix.squiz.net, academy.squiz.net), there is no in-console onboarding tour and no framework-specific (Next.js/Nuxt) guide, and 2026 reviewers still say the learning curve 'can be hard for new starters.'
Component Service is documented and marketed as framework-agnostic — components can be built with JavaScript, React, and other modern tooling, and the product page pitches 'familiar frameworks like React and JavaScript.' But the official squizlabs/dxp-component-library is still vanilla JS + Handlebars, the manifest.json component contract is proprietary, the Content API is a bespoke REST surface with no GraphQL, and no first-class Next.js integration path is documented — React is permitted, not paved, which keeps this in the proprietary-patterns band.
Squiz does publish a first-party starter: the Matrix 6 Bootstrap 5 Website Starter Template on Squiz Marketplace, built by the Squiz Matrix team, shipping Bootstrap 5 SCSS, Font Awesome, default content and form styling, and robots.txt, with a live demo — plus a Marketplace component/template catalog and `cmp init` component scaffolds. The prior 'no official starters' read was too harsh. It does not reach the 50+ band because there is still zero official boilerplate for Next.js, Nuxt, Astro, or SvelteKit, no TypeScript or CI/CD config, and no content-model-plus-example-content starter; the starter targets Matrix's own design layer, not a modern decoupled frontend.
The scaffolding step is better than previously credited: `npx @squiz/dxp-cli-next cmp init <path>` generates a component from a basic or advanced/bundled template, and `cmp dev` / `cmp dev-ui` give a local runner and UI with no DXP access required for local building. The remaining surface is still heavy — CLI install via NPM, manifest.json configuration (mainFunction, inputs, previews, environment variables), Developer-level console access that must be provisioned through Customer Success, separate Content API and Asset Management API token setup, then component-set creation and wiring to Content Management — which is well past a 3-env-var integration.
The write path keeps widening: the REST Asset Management API does full CRUD with a PATCH contextid parameter for context-specific attributes and metadata, Data Record assets can now be created through it, the Content API gained data parameters returning more asset attributes, and the asset syncing tool got auto-refreshing sync status for moving assets between Matrix environments — a real environment-promotion path. It stays below 50 because Hierarchy and Thesaurus metadata field types are still unsupported by the Asset Management API, required metadata fields are not enforced through the Content API, editing locks persist, and there is no declarative schema migration tooling.
Preview is manifest-driven: the 'previews' field takes named preview identifiers, wrapper HTML, and sample data, with `cmp dev-ui` giving a local component UI and HMR in local development — structured, well-documented setup work rather than plug-and-play. On the authoring side the Page Builder does inline editing directly on the page preview, drag-and-drop composition and reorder, multi-viewport modes, and May 2026 added placeholder support to formatted-text inline editors. Not plug-and-play, so it stays in the documented-but-code-required band.
No certification is required and Academy training is free, and the Component Service layer is genuinely reachable by generalist JavaScript developers — local building needs no DXP access and React is supported. The score stays at 40 because that is only the component tier: full Matrix work still means PHP-level asset types, Designs and Paint Layouts, Contexts, and workflow schemas, and the market for it runs through agencies and contractors with 15+ years of Matrix-specific experience rather than transferable skills.
Squiz sells to enterprise and public-sector buyers on a co-build model with professional services attached; there is no free tier and no instant self-service signup, deploying components requires Developer-level console access provisioned by Customer Success, and Matrix upgrades run through Squiz's Streamline Upgrade and Maintenance Service on Squiz Cloud rather than customer-controlled deploys. Component development, Matrix administration, API/token setup, and frontend delivery are effectively three or four distinct skill areas, so a solo developer without prior platform exposure faces real friction.
Post-go-live editor self-service is the platform's strongest build-simplicity dimension: Page Builder offers a unified core-plus-custom component picker with filtering, drag-and-drop composition and reorder, inline editing on the live preview, multi-viewport checks, A/B and personalization variants, and workflow-controlled publishing, and Marketplace lets teams pull in pre-built components and templates without a custom build. The ceiling is scope — any new component type, integration, metadata schema, or personalization segment still needs a developer, so editors work inside the space developers pre-built.
Squiz DXP (Matrix 6) is SaaS with continuous vendor-managed releases — the Matrix release notes have reached 6.26 with a steady point-release cadence, and Squiz transfers instances in the background with no customer-run upgrade. The one-time Matrix 5 to 6 migration took ~2 weeks including UAT and a readiness program, and 2026 reviewers still cite the cost and duration of major upgrades as a downside. Held below the SaaS 80–90 band because major version moves remain a customer project rather than a transparent vendor operation.
Vendor-managed SaaS on AWS; security updates are included in the bundled subscription price and applied centrally with no customer action. All known Squiz Matrix CVEs (PHP unserialization RCE in 5.5.0–5.5.3, time_format tag RCE in 5.3/5.4, File Bridge path traversal) date from the self-hosted 5.x era, and cvedetails/NVD/OpenCVE searches surface no 2026 CVEs against the SaaS platform. Docked from the SaaS maximum because Squiz publishes no security-advisory feed, CVE disclosure policy, or patch SLA.
Squiz pushed legacy self-hosted Matrix customers onto Matrix 6 SaaS via a UAT-driven migration program that has now largely completed, so the forced-migration wave is receding rather than active, and the maintained deprecations page lists both released and upcoming deprecations with the version each is deprecated and removed in. Against that, Matrix 5 docs remain frozen, features still retire on vendor timelines inherent to SaaS, and no published minimum deprecation window exists. Kept mid-band: the recent forced-migration history and undocumented notice periods rule out the 70+ tier despite Squiz marketing 'no forced migrations' going forward.
AWS-hosted SaaS with Elastic Load Balancing across multiple AZs — runtime, database, search, cache, and CDN layers are all vendor-managed, and customers carry only minimal client-side SDK and integration dependencies. Near-zero operational dependency burden for typical deployments. Slightly below the SaaS maximum because composable integrations (Connect, custom components) add a client-side dependency surface customers must maintain themselves.
Squiz ships more native monitoring than most SaaS peers: Experience Monitoring is a fully documented DXP service with its own UI, category tabs (page load time, caching, broken links, malfunctioning forms, absent content) and troubleshooting scenario guides, and Content Intelligence now adds a separate Content Health dashboard. A public status page at squiz.statuspage.io is tracked by StatusGator, IsDown and EagleStatus. Uplifted to the top of the 65–75 SaaS band, but not higher because there is still no native APM, API-usage metering, or integration-health dashboard — those remain customer-built.
Squiz Content Intelligence has shipped as a GA product rather than a roadmap item: a CMS-agnostic crawler audits the full content estate, an Accessibility Auditor flags WCAG 2.2 AA/AAA issues with impact ranking and AI-generated code/content fixes, an AI Readiness Auditor scores topic quality, and findings land in a single Content Health dashboard — on top of Experience Monitoring's broken-link and absent-content detection. That clears the prompt's 60+ bar for automated content hygiene tooling. Held in the low 60s because Content Intelligence is a separately gated capability rather than bundled into every DXP subscription, and core Matrix still has no orphan detection or content-expiry workflow.
SaaS on AWS with auto-scaling, Elastic Load Balancing, the built-in Squiz Edge CDN and vendor-monitored cache means near-zero day-to-day performance tuning for customers, which would otherwise place this in the 75–85 band. However, the public status page shows a persistent incident stream — roughly 4 incidents per 90-day window with 2 classed major, median duration around 6.5 hours, and 130+ incidents tracked since March 2021 — so customers do absorb platform-side disruption they cannot mitigate themselves. Held at 70 for that incident track record, with reviewers separately noting the admin UI can feel flaky.
Squiz publishes a contractual Support Agreement with concrete targets — P1 response immediate and no greater than 30 minutes with resolution within 6 hours, P2 within 2 working hours, P3 within 2 working days — and 24/7 coverage for P1/P2 through the My Squiz portal, with support bundled into the single subscription price rather than gated behind a premium tier. 2026 reviews on G2, Gartner Peer Insights and SoftwareReviews praise the relationship-oriented model and dedicated CSMs. Uplifted for the published SLA and universal inclusion, but kept below 70 because reviewers consistently report support is 'hit and miss due to high turnover' and that response time varies by region, on a thin ~26–27 review base.
forums.squiz.net remains the only real peer channel, with Matrix, Developers, Documentation and General Discussion categories for bugs, feature suggestions and implementation techniques, but thread volume is sparse and the community is niche (ANZ/UK government and education). There is essentially no Squiz presence on Stack Overflow or Reddit, so peer-to-peer help outside official channels is minimal, and reviewers report product documentation is 'often poor or doesn't exist', which pushes users back to paid Squiz services. Held in the sparse-community band.
Squiz does publish resolution targets, not just response targets — P1 resolution within 6 hours under the Support Agreement — and SaaS continuous deployment plus an ongoing Matrix point-release cadence through 6.26 means fixes reach customers without any upgrade action, backed by a public tracker at bugs.matrix.squiz.net. Uplifted from the prior assumption that no resolution commitment existed. Still mid-band because observed median incident duration of ~6.5 hours sits right at that P1 target rather than comfortably inside it, 2 major outages occur per typical 90-day window, and no resolution SLA is published for non-outage functional bugs.
Squiz's Visual Page Builder is a genuine drag-and-drop, no-code tool marketed to non-technical editors — Squiz claims a landing page in under an hour with no developer. Inline editing works directly on the page preview, templates and layouts ship as reusable building blocks, and 2026 added language variants and an improved version history retaining the last 100 versions with compare-and-restore. Marketers compose new pages freely, but the component palette is still developer-built via Component Service, so truly novel component types remain a developer task.
Squiz supports scheduled publish, archive and scheduled-review actions plus multi-stage approval workflows, and the CDP can build campaign segments from utm_campaign parameters — but that is personalization plumbing, not campaign management. Targeted searches found no content calendar view, no multi-channel campaign coordination, no campaign-as-a-unit construct, and no campaign analytics rollup. This remains the scheduling-only band.
Stronger than previously credited. Remap Manager provides full 301 redirect management with PCRE pattern rules, CSV import for bulk remaps and a system-wide 404 asset; metadata schemas render meta/OG tags with keyword replacements; and Squiz ships three separate shipped auditors — the Funnelback SEO Auditor (on-page and technical signals, benchmarked against the top 10 results for a target keyword, with prioritized optimization advice), the Content Auditor (duplicate titles, missing metadata, readability, slow pages, outdated content) and Experience Monitoring (broken links, absent content). The prior score treated SEO auditing as thin; it is a first-class, documented product surface. Schema.org structured data is achievable through metadata design areas but is not guided, and sitemap/canonical handling is not prominently documented — that keeps this out of the 75+ band.
Advanced Forms is a real drag-and-drop builder with conditional logic, multi-page forms, auto-calculation, booking, and payment fields across Pin Payments, PayPal and Westpac PayWay including dynamically priced amounts driven by form selections. The CDP Advanced Forms destination auto-populates fields from the Single Customer View for progressive profiling, and Optimization A/B tests carry explicit conversion goals (target page view, click events on elements like Buy Now / Sign Up). UTM awareness is now confirmed rather than absent — the CDP captures utm_campaign and other campaign parameters and can trigger personalized page versions from them, correcting the prior 'no native UTM tracking' finding. A dedicated lead-management workflow still does not exist; leads hand off to CRM via Squiz Connect.
This is a genuine platform strength and now clears the native-real-time-targeting threshold. The CDP is built into Squiz DXP rather than bolted on, and segments combine real-time behavioral signals (pages viewed, downloads, interest tags), geo/location, referral source, UTM campaign parameters, lifecycle stage and CRM attributes. Marketers build segment-targeted variants directly in Visual Page Builder with per-audience preview, no code. 2026 added per-site segment sets (Jan), segment templates with ready-made tracking events for common cases like location and engagement, automatic portal-user sync from the IdP into the Single Customer View on login, and a real-time Tealium integration that queries visitor profiles at page-request time. Targeting remains rule-based — no predictive or lookalike modeling — which caps it below 75.
Optimization provides native A/B testing for whole pages or individual components with a structured test-plan workflow and conversion goals measurable in-platform. Documentation still covers only test mechanics — no statistical significance calculation, confidence intervals, auto-winner selection or multivariate testing is documented. The one notable improvement, targeting A/B tests to specific CDP segments, is explicitly a roadmap item on squiz.net/roadmap rather than a shipped capability, so it earns no credit here.
Bulk operations are no longer a gap. Matrix ships asset cloning plus a Mass Clone Tool that produces a specified number of copies into a chosen destination, alongside 2026 content templates and reusable layouts with reference links, reusable components that update once and propagate everywhere, inline editing in Page Builder, and 100-version history with one-click restore to recover from a bad edit. Squiz markets sub-hour brief-to-publish for landing pages. The component palette is still developer-defined and there is no bulk field/metadata edit across many assets, keeping it below 75.
Content can be delivered headlessly — the Content API exposes Matrix content over REST with scoped API tokens restricting which sections of the asset tree are reachable — and Squiz positions DXP as hybrid-headless. But the Content API is a Marketplace extension rather than core, GraphQL access remains beta, and there are no channel-specific renditions. Email, SMS, social and push all require handing off to external platforms through Squiz Connect rather than authoring once into native channel outputs. This is web-first with API delivery, squarely in the 40–60 band.
Standard tag integration is solid — GA4 is documented with a UA migration path, FullStory provides session replay and behavioral heatmaps, Behavioral Analytics ships as a core module, and Funnelback's Insights dashboard gives search-side reporting (query volume, clicks, zero-result, location, trends) with drill-down and export. What still does not exist is a content performance dashboard inside the authoring UI: there is no most-viewed / lowest-engagement / conversion-by-page-type view for web content without leaving for GA4. The new Content Intelligence health dashboard scores content quality and AI readiness, not traffic or conversion performance.
Guardrails are enforced at the platform level, not merely conventional. Component Service holds a central library of brand-approved components; component sets function as design systems; libraries can be exposed only to selected sites or channels; and governance works by controlling which component versions are available to editors, so an editor cannot reach an unapproved or superseded component. Styling runs through global CSS custom properties acting as theme tokens so a token change propagates across every component using it. This clears the 'enforced brand guardrails at the platform level' bar. It falls short of 75 because the token layer is a CSS-variable convention documented for developers rather than a managed, governed token UI with approval.
Open Graph and Twitter card fields are produced through metadata schemas using keyword replacements (%asset_name%, %asset_url%, %asset_metadata_Description%), giving proper social preview control. That is where it ends: repeated searches found no social scheduling, no push-to-social workflow, no UGC embed components and no social-proof widgets. Publishing to social requires an external tool wired through Squiz Connect. Basic OG card management only — the 30–50 band.
The DAM is better than a plain media library. Images are automatically resized for device and converted to modern formats (WebP, AVIF) with compression and served over CDN through Squiz Edge Workers; image varieties give explicit control over renditions; a built-in image editor handles crop and resize; asset permissions scope which assets a given content team can even see; and watermarking plus automatic replacement of an outdated asset across every property that references it are documented. It stops short of the 65+ full-DAM band: no focal-point editor, no licensing/rights-expiry management, no usage tracking across external channels, and video hosting is listed but not detailed.
Materially better than the prior score allowed. Page Builder language variants let editors manage multilingual pages in one place, and the same variant workflow used for personalization and A/B testing extends to languages — so a locale-specific campaign variant can itself be personalized and tested. Translation is workflow-driven, not manual: the Wordbee integration pushes page name, summary, content and configurable metadata fields to a TMS with no manual file export, automatically tracks which source content is new or changed, and flags translated content edited in Matrix as needing re-approval by the translation provider; a Google Translate connector covers machine translation. That is a real translation governance loop, short of full transcreation. Still missing: cookie consent and legal-disclaimer management (third-party), and market-level regulatory tooling.
Squiz Connect is a purpose-built low-code iPaaS with 100+ pre-built connectors spanning well over three MarTech categories — CRM (Salesforce, HubSpot, Zoho, Pipedrive, Close, SugarCRM), marketing automation and email (Marketo, Klaviyo, Mailchimp, Swift Digital), SMS (ClickSend), CDP (Tealium, with real-time profile lookup added in 2026), analytics (Tableau Cloud), translation (Wordbee, Google Translate) and payments — over REST, SOAP and GraphQL with OAuth2, plus a generic component for any unlisted API. Flows are triggerable from CDP event feeds and form submissions. It misses 70+ because no ad-platform connectors (Google Ads, Meta, LinkedIn) are documented and per-connector depth varies between full event orchestration and simple API actions.
Squiz is not a commerce content platform and nothing in 2026 changed that — no purpose-built product content types, no variant or SKU-level attribute modeling, no product taxonomy tooling, no editorial-commerce co-authoring. Matrix metadata schemas do give formally structured content models and Squiz's own documentation cites 'custom fields for a product page' as a use case, so generic types can be deliberately repurposed. That is the generic-types-repurposed band and no higher.
Still essentially absent, but one of the rubric's five merchandising capabilities does exist: search result merchandising. Funnelback Curator lets an administrator define trigger/action rules against queries, and Best Bets pin chosen results (with HTML and thumbnails) for key queries, both editable in the Insights dashboard with a draft-then-publish step. Applied to a product index that is genuine result merchandising. Everything else is missing — no category management, no commerce promotional scheduling, no cross-sell/upsell content management, no product spotlights — and the curation tooling is built for content, not catalogs. Top of the no-merchandising band rather than the middle of it.
Broader connector coverage than previously credited, but the same shallow depth. Squiz Connect ships a Shopify connector with documented actions plus BigCommerce, Magento 2, PayPal and Stripe components under a Digital commerce category, and Matrix has an official tutorial for selling through a Shopify Buy Button embedded via the Code component. These are API-level flows and payment rails. There is no in-editor product picker, no product reference field type, no catalog federation and no real-time bidirectional sync, and no commercetools or Salesforce Commerce Cloud connector exists. That keeps it at the top of the webhook/custom-integration band, not the product-picker band.
There is no shoppable-content authoring pattern. Product references exist only as Shopify Buy Button widgets dropped into a generic Code component — not inline product references with purchase CTAs woven through editorial. Editors cannot co-author rich content against structured product data, so buying guides or shop-the-look formats would be hand-built each time.
No documented ability to inject CMS-managed content into cart or checkout flows. Transactional pages belong entirely to the embedded commerce widget or the external commerce platform, with no CMS overlay, slot or template hook.
Order confirmation, delivery tracking, product onboarding and loyalty content are all handled inside the embedded widget or the external commerce platform. Nothing ties CMS content to order events, and no order-triggered content delivery mechanism is documented.
The building blocks for basic B2B gating are real: authenticated portals with SSO, per-asset Read permissions granted to user groups or roles (so a spec-sheet library or catalog section can be gated to named accounts), and Advanced Forms with conditional logic and auto-calculation that could carry a quote-request flow. None of it is B2B-specific or packaged as such — no customer-specific pricing display, no account-based catalog segmentation, no quote workflow, no documented B2B deployment pattern. Access control applicable to B2B, which is the 30–50 band.
The content-side search machinery is strong and better-documented than the prior score reflected: faceted navigation for result refinement, user-defined synonyms for query expansion, Curator trigger/action rules and Best Bets for editorial result control, configurable results pages that function as search landing pages, automated relevance tuning that derives ranking attributes, and staged draft/publish of tuning changes from the Insights dashboard. What is missing is precisely the commerce half — no product-content result blending, no price/attribute facet hierarchies, no search landing pages mapped to product categories, and no product catalog connector. Strong general search applied to commerce, not commerce search.
Scheduled publishing gives time-activated banners, and Page Builder blocks can be varied by CDP segment, which delivers audience-targeted promotional content — more than plain scheduled banners. But none of the commerce-specific promotional primitives exist: no countdown timers, no promo code messaging blocks, no tiered pricing tables, and no channel-specific promotional targeting beyond web segments.
Multi-site on a single instance with per-site content trees and shared components could in principle back several storefronts, and Squiz genuinely runs hundreds of sites per customer. But there is no documented multi-storefront commerce pattern, no shared product catalog with storefront-specific editorial layering, and no commerce reference architecture. The rubric explicitly penalizes 'could be used for this'.
The DAM handles basic product imagery competently — image varieties for controlled renditions, a built-in crop/resize editor, and automatic WebP/AVIF conversion with CDN delivery, which matters for PDP performance. None of the commerce-grade media capabilities are present: no 360-degree spin, no AR/3D model references, no image hotspots for shop-the-look, no deep zoom, and no documented video-in-PDP pattern. Basic galleries and embeds, the 30–50 band.
No marketplace content capability at all — no seller profiles, no seller-contributed authoring, no review aggregation, no moderation at marketplace scale. Squiz's documented verticals are government, higher education and corporate web, and no marketplace customer or reference pattern exists.
The generic localization stack — Page Builder language variants plus the Wordbee TMS workflow and Google Translate connector — applies cleanly to product pages, which is a real (if unspecialized) capability. What does not exist is anything commerce-aware: no currency-aware content blocks, no regulatory product content handling (EU labels, CA Prop 65), and no market-specific promotional calendar.
Behavioral Analytics and Optimization conversion goals track page-view and click conversions, and GA4 integration carries data out to external tools. There is no content-to-revenue attribution, no content-assisted conversion tracking tied to purchases, no ecommerce/revenue event model, and no product content performance reporting inside the CMS.
Higher than previously scored — the prior note that content-instance permissions were undocumented was wrong. Matrix grants Read, Write or Admin on any individual asset to the public, a named user, a user group or a role, with optional automatic cascade to child assets and inheritance on creation, so visibility can be scoped to a department, team or individual at the content-instance level rather than only by content type. Roles are dynamic per-asset assignments, so the same role resolves to different people on different branches of the tree. Authentication is SSO-backed via SAML 2.0 and OpenID providers. Field-level sensitivity is still absent, which keeps it out of the 75+ range.
The lifecycle half is genuinely complete: assets can be scheduled to flip to an 'Up For Review' status on a recurring interval, Metadata Triggers fire scheduled actions against expiry dates held in metadata fields, version history retains the last 100 versions with compare and restore, and multi-step workflow schemas route approvals through user groups and roles with email notification per step. Internal findability is excellent via DXP Search with RAG-backed conversational Q&A. The gap is structure, not lifecycle — no dedicated knowledge base article type, no pre-built knowledge taxonomy (metadata schemas can express one, but nothing ships), and no article-level analytics for knowledge gaps beyond search zero-result reporting.
Squiz Workplace is a genuinely purpose-built employee hub — staff directory, org chart, configurable social feed ('What's Happening' plus a followed-users collaboration tab), public and private communities with discussions and categories, classifieds, community events with a calendar, homepage alerts in four severity levels including emergency, comments with likes/bookmarks/share/flag, and per-user email notification frequency. That is real EX tooling, not a CMS pretending. Two things hold it at this level: there is no native mobile app, offline mode, PWA or push notification (email is the only push channel), and Workplace looks investment-starved — its documentation tops out at v3.8 and Workplace features are effectively absent from the 2026 Squiz DXP release notes, which are dominated by Page Builder, CDP, Component Service and Content Intelligence.
Workplace ships three distinct news item types — news articles, events and announcements — plus community-scoped news, homepage alerts with an emergency severity for urgent broadcast, and email notification on a per-user immediate/daily/weekly cadence. Audience targeting runs through 'content preferences' on the personalized news and events listing. What is still missing is the accountability layer that separates good internal comms from good publishing: no read receipts, no acknowledgment tracking, and no mandatory-read workflow. Targeting is also preference-based rather than the CDP's richer segmentation.
Lowered on closer reading. The staff directory (with sorting and advanced search across staff attributes), staff profile pages and a clickable organizational chart showing reporting lines are all native, purpose-built features — that part stands. But the implementer documentation sources both from CSV files (example-staff-data.csv, org-chart-data.csv), and no HRIS connector for Workday, BambooHR or Entra/Azure AD profile sync is documented anywhere. The rubric's 55+ band expects a native directory with org chart and HR integration; Squiz has two of three and a file-feed dependency that means profile data goes stale between imports. Skills/expertise fields are also not documented.
Better than previously credited on the version-control axis. Documents get 100-version history with compare and restore, recurring scheduled review that moves an asset to 'Up For Review', Metadata Trigger jobs that fire actions on metadata-held expiry dates, and multi-step approval workflows whose email trail gives a de facto change record. That is solid versioned document publishing — the top of the 30–50 band. It cannot go higher because the compliance-specific layer is entirely missing: no mandatory acknowledgment tracking, no dedicated policy template or register, and no purpose-built tamper-evident audit trail report.
Workplace can host onboarding pages and a new-starter community, and per-asset permissions could gate content by group — but searches found no role-specific content paths, no 30/60/90 progressive disclosure, no task checklists and no HR-triggered new-hire portal provisioning. Basic onboarding pages are buildable from generic structures; nothing is onboarding-specific.
Squiz's standout capability, and stronger than the prior score. Funnelback / DXP Search is a 25-year-old dedicated enterprise search product that indexes far beyond the CMS — SharePoint 365 and non-365, Google Drive, Alfresco and CMIS repositories, Jira, LiveLink, Documentum and FileNet via ManifoldCF connectors, plus authenticated crawling, LDAP, database and SFTP feeds. Critically for intranet use it applies early-binding security, resolving document permissions at index time so results never leak content a user cannot open. On top sit faceted filtering, synonyms, Curator rules and best bets, automated relevance tuning, five analytics reports including zero-result and trend spikes, and Conversational Search using RAG restricted to approved indexed content with a second guardian agent verifying the generative agent's answers. It stops short of 80 because retrieval is unified-index rather than true real-time federation, and Confluence is not a confirmed connector.
Workplace is a responsive web application on Squiz Cloud. Repeated targeted searches found no native mobile app, no offline support, no PWA packaging, no kiosk or shared-device mode, and no push notification of any kind — the only proactive channel is email on an immediate/daily/weekly cadence. Deskless and frontline workers get browser access and email, which is the responsive-web-without-app band and not the top of it.
No LMS story. Searches for Cornerstone, Workday Learning and Moodle integrations with Squiz returned nothing, and no course assignment, completion tracking, certification or micro-learning features exist in Workplace or DXP. Training material can be published as ordinary pages with no tracking attached.
A real social layer: public and private communities that can be categorized and filtered by category tabs, threaded discussions with community-administrator moderation, comments on any news item, page or discussion with likes, bookmarks and sharing, a flag-for-moderation flow with a reworked moderation experience, classifieds, community news, and community events with a calendar view for physical or virtual events. Polls, surveys and formal peer recognition or badges remain absent, and comments/likes are not a recognition system.
Connectivity is flow-level, not experience-level. Squiz Connect carries SharePoint 365 and non-365 connectors (including a Matrix SharePoint Connector asset for sending, receiving and managing SharePoint records), Google Drive, Google Calendar, ServiceNow, Microsoft Fabric and MediaValet components across 2025–2026, and Moveworks offers a third-party Squiz Intranet integration. Funnelback separately indexes SharePoint and Google Drive with permission-aware results, which is the most useful workplace-tool behavior Squiz actually delivers. What is still missing is the deep experience integration the 65+ band requires: no Microsoft Teams app, no bot-driven notifications, no embedded content cards, no single-pane experience. Dedicated searches this round could not independently re-confirm a first-party Slack connector, so confidence stays MEDIUM.
This clears the automated-review-and-stale-flagging bar. Assets can be scheduled to move to an 'Up For Review' status at a set date or recurring interval (for example every six months), the Metadata Triggers scheduled job fires actions against expiry dates stored in metadata fields, workflow schemas route the resulting review through named groups and roles, and 100-version history backs any rollback. Stale-content detection is now active rather than manual: the Content Auditor surfaces outdated content, duplicate titles and missing metadata across the site, and Experience Monitoring proactively detects broken links and absent content across all of an organization's domains. Explicit per-asset ownership assignment for accountability is still not a distinct field, and there is no single archival workflow product surface.
Substantially better than previously scored. Workplace ships its own engagement analytics: a reporting dashboard covering total users, live items and social interactions, per-item analytics on any news article or page showing views, comments, favorites, time spent and last-updated date, and a Users Analytics view listing top publishers, visitor counts and time spent in Workplace — that is an adoption dashboard, which the prior score said did not exist. GA4 can be layered on top. Failed search terms are covered properly by Funnelback's zero-result report, explicitly framed as revealing content gaps, alongside trend-spike reporting. The remaining gap is segmentation: analytics are organization-wide with no views-by-department breakdown, and there are no engagement heatmaps.
Squiz runs multi-brand as many sites inside one instance — customers manage hundreds of sites with separate content trees, per-site permissions and per-site component libraries from a single installation. Isolation is therefore silo-based within a shared instance: brands do not get independent content models, independent environments or independent API endpoints, and a platform-level administrator sees everything. Squiz's SaaS security documentation describes logical tenant separation with individually credentialed databases, but that boundary is between Squiz customers, not between brands inside one customer's deployment, so it does not lift this item.
Cross-site sharing is native and well-documented, not a workaround. Component Service maintains one central library of reusable components consumed by every site, components can be grouped into libraries exposed only to selected sites or channels, a single component update propagates to all consuming sites at once, and global CSS custom properties act as shared theme tokens. Component Service also supports reusing rich asset-based data between instances through a standardized exchange format, so an editor can reference assets from either instance under a shared API identifier. It stays below the 70+ native-cross-tenant band because sharing is cross-site within an instance; cross-instance support covers data exchange rather than full component federation.
Governance is an explicit Squiz DXP pillar and the mechanisms are real: site-level permission delegation lets a central team hand day-to-day management to department or agency teams without losing central oversight, roles resolve per-asset so the same approval role maps to different people per branch, workflow schemas enforce content standards per site, Component Service governs which component versions any site can use, and 2026 per-site segment sets scope personalization assets so editors only see segments relevant to their site. Squiz's government positioning is built on exactly this centralized-control-with-local-autonomy pattern. What is not documented is a global policy configuration surface or an approval workflow that spans sites, which keeps it out of the 75+ range.
Lowered. Pricing remains entirely contact-only with no public tiers, no documented volume licensing and no multi-site bundle, and Squiz is no longer on the UK G-Cloud framework where its day rates and subscription figures were previously visible — so the one public pricing reference point is gone. More importantly, Squiz's subscription agreement meters usage across several dimensions including page views, with overage charges, forfeiture of unused allowance and renewal uplift. Adding brands therefore adds both licensed sites and metered traffic, which sits at the harsher end of linear rather than offering economies of scale. Insufficient public evidence for anything better, and confidence stays LOW.
Each component set functions as a design system, an organization can run several sets with different themes, and sites are assigned only the component libraries they should have — then customize how those shared components look without maintaining forked copies. Theming runs on global CSS custom properties, so a brand's colors and typography change through token values rather than component rewrites. That is per-brand visual identity over shared component structures. It lands just below the 65 line because the token layer is a documented developer styling convention (src/styles/common, src/styles/themes) rather than a governed per-brand token store with its own approval and versioning.
The brand x locale intersection is workable but not governed as such. Multi-site gives separate content trees per brand or locale, Page Builder language variants manage multilingual pages in place, and the Wordbee integration adds a per-site translation workflow that tracks changed source content and flags Matrix-side edits to translations as needing translator re-approval — a genuine translation approval loop, and it works across any number of sites in an instance. What does not exist is brand-aware governance over that loop: no per-brand translation approval configuration, no shared-versus-isolated translation workflow model, and no regional legal content governance scoped per brand.
Aggregation across sites now exists, though it measures content health rather than content performance. Experience Monitoring registers multiple domains and presents statistics for every enrolled domain in one dashboard reached from the organization dashboard, and Content Intelligence crawls an organization's full content estate CMS-agnostically — including microsites and non-Squiz properties — grouping pages by topic and rolling AI-readiness and accessibility into a single health dashboard for leaders. Per-site engagement and search analytics remain in Funnelback Insights and GA4. What is still absent is a portfolio dashboard comparing engagement, content velocity or publishing cadence between brands, so cross-brand performance benchmarking is manual.
Workflow schemas are applied per asset branch, so each brand or site can carry independently defined review stages and approval chains, with steps assigned to user groups (so cover is maintained when an approver is away) or to roles that resolve to different people per asset. Scheduling and review intervals are likewise configured per site. Central auditability is partial rather than designed: workflow step emails and 100-version history provide a per-asset trail, but there is no cross-site audit dashboard or portfolio-level workflow compliance report.
Shared components and reusable content created centrally can be consumed by any site in the instance, and a single update propagates to all consumers — which covers the corporate-to-brand push for componentized content like disclaimers or announcements. Component Service's cross-instance asset data exchange extends this a step further. But targeted searches found no syndication feature as such: no parent-to-child content push with defined override points, no local adaptation model with change notification, and no documented press-release or corporate-content distribution pattern. Content reuse, not governed syndication.
Compliance is handled at platform level, not per brand. Customers choose a UK, North America or Australia hosting region and data stays there including offsite backup replication — but there is no EU region, so EU-data-residency brands fall back to the UK, and residency cannot be varied per brand inside one deployment. Accessibility is genuinely well served: the Accessibility Auditor scans any publicly accessible URL or domain against WCAG 2.2 AA/AAA plus ADA and EAA, whether or not the site is hosted on Squiz, and prioritizes issues with AI-generated fixes — useful across a brand portfolio. The CDP supports GDPR obligations. What is absent is guardrails: nothing prevents a non-compliant page from publishing, and there are no per-brand cookie or regional publishing restrictions.
The largest correction in this re-score — the prior note that versioning and rollback were undocumented was wrong. Component Service enforces Semantic Versioning: every code change to a component, feature or bugfix alike, requires a version increment, and redeploying a changed component under its existing version is impossible. Squiz documents the explicit purpose as allowing DXP environments to revert to an earlier version when needed, giving real rollback. Governance follows from it — you control which component versions are available to which sites, so brand extensions come from assigning different component sets and libraries per site while the core library stays central, and May 2026 added renaming and removal of component sets. This clears the 60+ band comfortably. It is held below 75 because brand extension is set assignment rather than a formal inheritance/extension model, and update propagation across tenants has no staged rollout or deprecation workflow.
One user base spans every site in the instance, authenticated through SAML 2.0 or OpenID SSO, organized into user groups with membership conditions, and granted access per asset branch — which is exactly the central-admin-with-autonomous-brand-teams pattern the rubric asks about, and Squiz's government positioning describes delegating day-to-day management to teams while retaining central oversight. Roles give a clean cross-brand contributor model since the same role resolves to different people per site. It stays below 65 because SSO federation across genuinely independent tenants is not documented (the model assumes one identity provider for the whole deployment) and there is no per-brand identity-provider configuration.
Metadata schemas are the extension mechanism and they do support the pattern in a limited way: a schema defines fields (date, hierarchy, asset picker, select, text) and is applied to a section of the asset tree, so one brand's branch can carry extra fields on the same underlying asset type that another brand's branch does not — extension without forking the base type. That is better than fully separate models. But it is field-level metadata layering rather than genuine content-type inheritance: there is no documented base-model/derived-model relationship, no way to version a global model and propagate changes to brand extensions, and no enforcement that brand extensions stay compatible with the core.
Raised because estate-wide reporting genuinely arrived in 2026, though it is content health rather than executive portfolio management. Content Intelligence crawls an organization's entire content estate CMS-agnostically, groups pages into topics and produces a single colour-scored content health dashboard spanning AI readiness and accessibility across all properties — explicitly pitched at giving leaders one view of where content stands and what to fix first. Experience Monitoring separately reports page load, caching, broken links and absent content per enrolled domain from one dashboard. Two caveats hold it at the top of the manual-aggregation band rather than above it: reporting is organized by domain and topic rather than by brand, and Content Intelligence is a separately purchased product priced by estate size. Publishing SLA adherence, content freshness by brand and per-tenant cost allocation are all still absent.
Squiz publishes a DPA (last updated February 2025) incorporating Standard Contractual Clauses with delete-or-return of personal data at the customer's discretion on termination, and it is available to all customers rather than enterprise-gated. Two gaps hold it inside the 60-78 band: the sub-processor list is supplied only on request to privacy@legal.squiz.net rather than published, and there is no EU-resident hosting option — the DXP Logs Service API confirms the only regions are 'au', 'us' and 'uk', and UK is not EU post-Brexit.
The current Squiz subscription agreement states verbatim that Squiz is not HIPAA accredited and disclaims all liability for protected health information, which it defines as Sensitive Personal Information. No BAA is offered and no healthcare compliance documentation exists anywhere in the public estate; this disclaimer was re-verified as still live in September 2026.
Squiz DXP is independently verifiable on the Texas DIR TX-RAMP certified products list at Level 2 status (ID TX1591016, expiring 25 Aug 2028) — a correction to the prior pass, which could not find it — and contract and security documentation covers GDPR, UK GDPR, CCPA/US privacy law, the Australian Privacy Act 1988 and the New Zealand Privacy Act. It stays well below the 75+ band because the IRAP and FedRAMP claims are inherited from AWS rather than held by Squiz, PCI DSS is expressly disclaimed, there is no C5 or HITRUST, and the UK G-Cloud channel has lapsed (Squiz appears on neither the G-Cloud 14 nor 15 supplier list).
Squiz's public wording is consistently unqualified — /security says only 'Squiz holds SOC 2 accreditation' and the Shared Responsibility Model commits to 'adherence to the SOC 2 framework' and 'relevant SOC 2 reports' on request, never naming Type 2 or a Trust Service Criteria scope. The only dated public artifact is the DNX Solutions case study documenting a Type 1 engagement, and no Type 2 attestation announcement exists in 2025-2026 sources; the Vanta-hosted trust center gates its document list behind a request form, so the type cannot be confirmed externally. That places this at the top of the rubric's Type 1 / no-Type-2 band rather than above it.
Squiz maintains its own ISO/IEC 27001:2022 certified ISMS covering platform scope — not inherited AWS certification — with DevSecOps integrated across processes, third-party audits against the framework, and a Statement of Applicability released to customers on request alongside the certificate. ISO 27018 for cloud PII processing is absent from every Squiz source checked, which is the single requirement keeping this out of the 80+ band.
The verifiable portfolio beyond ISO 27001 is a CSA STAR Level 1 CAIQ self-assessment that Squiz links to directly from /security (registry entry live, listed since 2016), TX-RAMP Level 2 certification confirmed on the Texas DIR list, Cyber Essentials certificates released on request, and annual independent penetration tests with executive summaries available to customers. It stops short of the 65-80 band because every one of these is either a self-assessment or a single-jurisdiction authorization: there is no CSA STAR Level 2 third-party audit, no PCI DSS (disclaimed), no FedRAMP or StateRAMP, no platform-level IRAP, no Cyber Essentials Plus, C5 or ENS, and the former UK G-Cloud listing has lapsed.
Customers pick one of three Squiz-managed AWS regions — United Kingdom, North America or Australia — deployed in a single region across multiple availability zones, with a documented commitment that storage and processing of PII stays inside the deployed region; the regional split is corroborated independently by the Logs Service API's au/us/uk routing. Two things cap it below the 78+ band: there is no EU-resident option at all (UK is not EU), and Squiz Edge/Cloudflare distribute cached content from nodes worldwide, so delivery-tier caching leaves the chosen residency region.
The post-termination window the prior pass could not find is published in the subscription agreement: a 30-day period in which Squiz makes Customer Data and Customer Applications available for export or download, after which Squiz may delete or render them inaccessible, paired with DPA delete-or-return at the customer's discretion and documented Matrix bulk export tooling (Export assets to XML, Export files, Asset Management API). It does not reach 75+ because the post-termination export is request-based rather than self-service, the XML schema is Matrix-proprietary rather than a standard interchange format, DAM, CDP and Search configuration have no documented bulk-export path, and Squiz explicitly disclaims archival backup — backups run nightly with 30-day retention for disaster recovery only.
The DXP Logs service has a dedicated Audit log type for 'security and compliance events, including access to sensitive information and system configuration changes', masks PII by default and writes a further audit entry recording who revealed it, gates access behind an Owner-assigned Logs Auditor secondary role, retains audit logs for 12 months in hot storage, exports to CSV, exposes a regional Logs Service API, and natively streams to external platforms (Datadog, Dynatrace) in near real time with compliance retention given as the documented rationale. It falls short of the top band because the streaming destinations are observability tools rather than mainstream SIEMs, retention is a fixed platform policy rather than customer-configurable, and audit trails are fragmented — CMS, Integrations and Search logs are explicitly excluded from the DXP Logs service and live in three separate tools.
Every accessibility artifact Squiz publishes is about delivered content rather than the editing interface: the Accessibility Auditor tests customer sites against WCAG 2.0/2.1/2.2 A/AA/AAA plus ADA and EAA, and squiz.net/accessibility is a statement about squiz.net's own marketing website measured against the superseded WCAG 2.0. No stated WCAG 2.1 AA target, ATAG 2.0 assessment, or keyboard/screen-reader conformance claim for the DXP authoring UI exists in any Squiz source, and the one VPAT that did cover the editing product is no longer retrievable. That is a general corporate commitment without a product-level target, which sits at the bottom of the stated-target band.
There is now no publicly obtainable VPAT or ACR for any Squiz product — the Matrix v5.4.1.3 report previously hosted by Middlesex University returns HTTP 404, and repeated searches across vendor, .edu, .ac.uk and .gov.au sources surfaced no replacement, current or otherwise. What remains is an accessibility statement page written about squiz.net itself against WCAG 2.0, with no Section 508 conformance statement and no ATAG 2.0 assessment, which is the accessibility-page-without-a-VPAT band and a material procurement gap for the higher-education and government buyers Squiz targets.
The Visual Page Builder still ships GA "GenAI content tools" — headline variations, tone adjustment and clarity rewrites driven by AI prompts that admins pre-configure and test, with brand guardrails built into the prompts themselves. Nothing new shipped Jun–Sep 2026 (release notes for those months contain no gen-AI entries), Page Builder product documentation carries no AI pages at all, and the Spark Assistant's brief-to-page generation is early-access only. Stays below the 70+ mature-native band: no bulk generation, no content-type awareness, no documented review workflow.
Still no native AI image generation, smart crop, or automated alt-text workflow in the DAM as of September 2026. The File Store "What's new" page lists no AI capability, and no Firefly/DALL-E/Stable Diffusion integration appears in any 2026 release note or on the roadmap. Alt-text remediation is only reachable indirectly as an Accessibility Auditor smart-fix suggestion, not as a DAM feature.
Squiz shipped language variants in the Visual Page Builder during H1 2026, but that is multilingual content management, not machine translation — the Page Builder translation docs describe building pages with translated content supplied externally. No MT engine, AI-assisted TMS hookup, or bulk AI translation appears anywhere in 2026 release notes or the roadmap. Confidence raised from LOW to MEDIUM because the full Jan–Sep 2026 release record was reviewed directly.
Content Intelligence's AI Readiness Auditor remains the main asset here: an LLM is fed raw page content, page type and topic mapping to extrapolate the questions a page should answer, then scores and prioritises gaps, and the Accessibility Auditor's "Generate smart fix" button returns ready-to-use code or content remedies. But auto-generation of SEO titles, meta descriptions, OG tags, schema markup and taxonomy tags inside the editing workflow still does not exist — enhanced SEO and content-quality auditing remain on the Future section of the roadmap. Partial-automation band.
Alongside the in-editor AI prompt library and Content Intelligence's prioritised smart fixes, Squiz now states its AI-powered migration tooling is in production — automatically moving existing sites into Squiz DXP while applying AI-driven best practices — which is real bulk AI content work, though it is delivered as a Squiz-led migration engagement rather than a self-serve editorial feature. Fixes are still surfaced rather than applied ('fix it for me' and Spark's Optimization agents are not GA), and there is no auto-tagging, smart scheduling, content routing, duplicate detection or AI publishing trigger. Two or three lightweight assists, so it stays well below the 60+ band.
Squiz has published a named agentic product — Squiz Spark — with four named agent classes (Build, Audit, Optimization, Migration agents) and a Spark Assistant that "confirms, clarifies and explains key actions before execution", plus design-system and organisational-context grounding. Shipping state is pre-GA: the page recruits users for early access and beta testing, describes the first release in future tense, and Spark appears in no product documentation and no 2026 release note (the only 'Spark' entry in the Jan–Sep 2026 changelogs is an unrelated Page Builder configuration reference). Early/beta agentic band, not GA — the previously announced AI-powered A/B testing also remains absent from the A/B testing docs.
Content Intelligence remains GA and is bedding in: a CMS-agnostic crawler clusters pages into AI-generated topics, an LLM generates and tests the questions each topic should answer, and a Content Health dashboard tracks optimization scores and prioritised recommendations over time, with monthly rescans that only re-audit changed pages. Jun–Sep 2026 brought documentation and FAQ expansion rather than new capability, and the product still has no performance scoring, ROI attribution or stale-content detection, and topics cannot be filtered to a granular taxonomy. Comfortably built-in AI content intelligence, but that narrow scope holds it just under the leaders.
The Accessibility Auditor runs continuous estate-wide WCAG 2.2 AA/AAA scans ranked by severity weight and frequency, with AI-generated code and content remedies behind a "Generate smart fix" action, and the AI Readiness Auditor scores answerability per topic. Brand-voice and content-policy monitoring, spell check, broken-link detection and Flesch-Kincaid readability are all still Future roadmap items, and the FAQ confirms the accessibility rules are predominantly technical conformance checks. Covers accessibility and answerability well, so it clears 45–60 but not the 70+ quality + brand + accessibility band.
Conversational Search is GA and documented as an LLM experience over Squiz Search using vector search and RAG, with a second LLM verifying every generated answer and answers drawn solely from approved indexed sources; H1 2026 delivered a ~3× retrieval speed-up and answer caching returning common questions in just over half a second. It stays below the headless leaders because the docs state plainly that it "is not a development platform" and that core prompt structures are fixed — there is no developer-facing embedding or vector API to build on.
Segment assignment in the Squiz CDP is still rule-based with no ML scoring, predictive assignment, next-best-content model or cold-start handling. The one genuinely AI-touched element is Conversational Search: Squiz's demo documentation states the LLM tailors each generated answer using the query, the content, and user behaviour signals including location, on-site interactions and defined audience segments — an AI-generated response layered on human-authored segments. That is enough to lift it off the floor of the rule-based band but nowhere near the AI-assisted 40–60 band.
No MCP server for Squiz DXP exists as of September 2026. MCP is not mentioned anywhere across docs.squiz.net, the roadmap, the capability pages, or the Jan–Sep 2026 release notes, and no official or community Squiz server appears in MCP registries — this despite the protocol reaching a stateless-core spec release and 10,000+ production servers by mid-2026.
The Conversational Search documentation states directly that it "is not a development platform" and that while you can supply instructions shaping tone, focus and topics, "our core prompt structures are fixed to maintain safety and governance standards" — the LLM is Squiz-selected and Squiz-managed. No AI feature anywhere in the DXP accepts a customer OpenAI, Anthropic, Azure or Gemini key, and no BYOK/BYOM capability is announced or on the roadmap.
Squiz still offers the well-documented Funnelback REST API, DXP APIs with API-key management, an event service for webhook subscriptions, and a ChatGPT Integration Component in the Marketplace — all usable for AI integration work. Against that, the conversational AI layer is explicitly closed to developers (fixed prompts, "not a development platform"), and there is no AI SDK, no agent-optimised or RAG-ready delivery endpoint, no LangChain/LlamaIndex guidance and no MCP. Firmly in the standard-API-usable-for-AI band.
Governance is materially stronger than previously credited: Conversational Search exposes AI behaviour controls (declared purpose, off-limits topics, tone of voice, answer detail, configurable fallback response), grounds answers only in approved indexed sources, runs a second LLM to verify every answer and can suppress or modify answers that fail accuracy thresholds, and the platform ships a dedicated Chatbot Reviewer secondary role — assignable only by an Owner — that gates access to conversation transcripts containing PII with explicit GDPR/CCPA and least-privilege framing. Editor-side AI prompts carry admin-configured brand guardrails and Content Intelligence inherits DXP RBAC. Held to the bottom of the 50–70 band because there is no AI-specific audit trail of who invoked AI in the editor or what it generated, no IP indemnification, and Spark's human-in-the-loop approval gates are not GA.
More AI visibility exists than previously scored: Conversational Search retains complete conversation history and surfaces monitoring-and-insights reporting on what visitors actually asked and where content fell short, the Chatbot Reviewer role exists specifically so nominated staff can review transcripts for quality assurance and chatbot performance monitoring, and Content Intelligence meters consumption against a contracted page-audit allocation with audit-usage views in the console. It stays in the minimal-observability band because those usage views are explicitly restricted in the initial release, there is no per-user or per-team AI consumption metric for editor prompts, no cost/credit tracking, and no model-performance or prompt-effectiveness dashboard.
How composite scores (0–100) have changed over time. Click legend items to show/hide metrics.
Framework v1.2·Mar 24, 2026·AI Enablement added as Category 10 and folded into the capability composite. Scores before and after this line are not directly comparable.
Framework v2.0·Oct 10, 2026·Categories 1 and 2 restructured: Core Content Management now holds everything a CMS must do regardless of architecture, and Category 2 scores only the DXP feature layer with a packaging rule. Pure headless platforms score lower in Category 2 by design. Scores before and after this line are not directly comparable.
Squiz DXP is improving modestly across the board, with Platform Velocity and Build Simplicity leading the gains and Operational Ease close behind, while Suite Capability and Cost Efficiency edge up and Compliance & Trust holds flat. The movement is driven almost entirely by evidence corrections rather than new product releases: a documented four-phase deprecation policy, XML bulk-export tooling, component versioning with rollback and asset-level edit locking were all found to exist where earlier assessments recorded gaps. For practitioners the standout shifts are the sharp rise in vendor lock-in and exit-cost standing and in AI observability through Conversational Search history, both of which make Squiz a less risky commitment than its previous profile suggested, though its cost and build-effort positions remain in the lower half of the field.
Score Changes
More AI visibility exists than previously scored: Conversational Search retains complete conversation history and surfaces monitoring-and-insights reporting on what visitors actually asked and where content fell short, the Chatbot Reviewer role exists specifically so nominated staff can review transcripts for quality assurance and chatbot performance monitoring, and Content Intelligence meters consumption against a contracted page-audit allocation with audit-usage views in the console. It stays in the minimal-observability band because those usage views are explicitly restricted in the initial release, there is no per-user or per-team AI consumption metric for editor prompts, no cost/credit tracking, and no model-performance or prompt-effectiveness dashboard.
Documented bulk-export tooling does exist, correcting the prior assessment: the Export assets to XML tool exports an asset and all its children while preserving attributes, links, applied designs, permissions, metadata and nested assets, alongside an Export files tool, an Asset syncing tool, and an Asset Management API with CRUD. This is moderate rather than severe lock-in — but the XML is a Matrix-proprietary format whose documented purpose is reconstructing 'an identical asset structure in a target Matrix system,' not neutral interchange, and it covers neither CDP Single Customer View profiles nor Funnelback configuration, with Hierarchy and Thesaurus metadata field types still unsupported by the API. Transformation effort plus proprietary CDP data gravity keeps this mid-band.
Matrix prevents last-write-wins: asset locking blocks concurrent edits and names the lock holder, separate attributes can be edited concurrently, Safe Edit isolates in-progress changes, and comment assets plus workflow comments and change requests provide async annotation with author-attributed history. There is no real-time co-editing, presence indicator or @mention notification documented, so it sits in the locking-with-async-comments band.
Prior scoring recorded no public deprecation policy; that was wrong. Squiz Content Management/Matrix documents a four-part MAJOR.MINOR.MICRO.PATCH versioning scheme, a three-year full-support window per release branch followed by security-only support, and a dedicated 'Deprecated assets and features' register recording the version each item was Deprecated In and Removed In — with automatic upgrade scripts that remove or convert deprecated assets so existing implementations do not break. It does not reach 75 because the newer SaaS-side services (Component Service, Datastore, Connect) publish no equivalent deprecation register or notice window, so the guarantee is uneven across the DXP.
The largest correction in this re-score — the prior note that versioning and rollback were undocumented was wrong. Component Service enforces Semantic Versioning: every code change to a component, feature or bugfix alike, requires a version increment, and redeploying a changed component under its existing version is impossible. Squiz documents the explicit purpose as allowing DXP environments to revert to an earlier version when needed, giving real rollback. Governance follows from it — you control which component versions are available to which sites, so brand extensions come from assigning different component sets and libraries per site while the core library stays central, and May 2026 added renaming and removal of component sets. This clears the 60+ band comfortably. It is held below 75 because brand extension is set assignment rather than a formal inheritance/extension model, and update propagation across tenants has no staged rollout or deprecation workflow.
Raised because estate-wide reporting genuinely arrived in 2026, though it is content health rather than executive portfolio management. Content Intelligence crawls an organization's entire content estate CMS-agnostically, groups pages into topics and produces a single colour-scored content health dashboard spanning AI readiness and accessibility across all properties — explicitly pitched at giving leaders one view of where content stands and what to fix first. Experience Monitoring separately reports page load, caching, broken links and absent content per enrolled domain from one dashboard. Two caveats hold it at the top of the manual-aggregation band rather than above it: reporting is organized by domain and topic rather than by brand, and Content Intelligence is a separately purchased product priced by estate size. Publishing SLA adherence, content freshness by brand and per-tenant cost allocation are all still absent.
Squiz has published a named agentic product — Squiz Spark — with four named agent classes (Build, Audit, Optimization, Migration agents) and a Spark Assistant that "confirms, clarifies and explains key actions before execution", plus design-system and organisational-context grounding. Shipping state is pre-GA: the page recruits users for early access and beta testing, describes the first release in future tense, and Spark appears in no product documentation and no 2026 release note (the only 'Spark' entry in the Jan–Sep 2026 changelogs is an unrelated Page Builder configuration reference). Early/beta agentic band, not GA — the previously announced AI-powered A/B testing also remains absent from the A/B testing docs.
Materially better than the prior score allowed. Page Builder language variants let editors manage multilingual pages in one place, and the same variant workflow used for personalization and A/B testing extends to languages — so a locale-specific campaign variant can itself be personalized and tested. Translation is workflow-driven, not manual: the Wordbee integration pushes page name, summary, content and configurable metadata fields to a TMS with no manual file export, automatically tracks which source content is new or changed, and flags translated content edited in Matrix as needing re-approval by the translation provider; a Google Translate connector covers machine translation. That is a real translation governance loop, short of full transcreation. Still missing: cookie consent and legal-disclaimer management (third-party), and market-level regulatory tooling.
Squiz Connect provides first-party connectors for RWS (SDL) and Lionbridge plus a Google Translate machine-translation connector, and the page builder manages language variants in one interface. These are Connect flows rather than an in-platform translation job UI with translation memory, and Phrase, Smartling, Lokalise and Crowdin are not covered.
Video uploads into the asset library with playback in the preview screen and centrally managed captions, transcripts and descriptions, and a MediaValet connector serves external media workflows. There is no transcoding, adaptive streaming or Squiz video player, so production video is normally embedded from YouTube or Vimeo.
Squiz holds ISO/IEC 27001:2022, CSA STAR Level 1, TX-RAMP Level 2 (certification TX1591016, expiry 2028-08-25, via the lightweight Acknowledgement and Inventory Form path), and GDPR commitments — but its SOC 2 is Type 1, not Type 2. Critically, the prior score of 76 rested on an EU data residency claim that is false: squiz.net/security/squiz-saas-platform lists Squiz-managed AWS hosting as United Kingdom, North America and Australia only, and post-Brexit the UK is not an EU region. No HIPAA BAA is offered. Correcting the residency error and the Type 1/Type 2 distinction drops this well out of the 80+ band.
Substantially better documented than the prior pass found: Squiz operates a primary/secondary data centre model with Squiz Edge failing traffic over to a read-only secondary during a primary outage, states it performs DR "against measured Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)," and the subscription agreement commits to backups every 24 hours retained 30 days plus a 30-day post-termination data export window. Export tooling exists — Matrix Export assets to XML and Export files tools, plus asset version control retaining the previous 100 changes. It cannot reach 75+ because the actual RTO/RPO figures sit behind an access-request form at trust.squiz.net rather than being published, backups are explicitly "not for archival purposes," and the export window is request-based with a proprietary XML schema.
Squiz does publish a first-party starter: the Matrix 6 Bootstrap 5 Website Starter Template on Squiz Marketplace, built by the Squiz Matrix team, shipping Bootstrap 5 SCSS, Font Awesome, default content and form styling, and robots.txt, with a live demo — plus a Marketplace component/template catalog and `cmp init` component scaffolds. The prior 'no official starters' read was too harsh. It does not reach the 50+ band because there is still zero official boilerplate for Next.js, Nuxt, Astro, or SvelteKit, no TypeScript or CI/CD config, and no content-model-plus-example-content starter; the starter targets Matrix's own design layer, not a modern decoupled frontend.
Better than previously credited on the version-control axis. Documents get 100-version history with compare and restore, recurring scheduled review that moves an asset to 'Up For Review', Metadata Trigger jobs that fire actions on metadata-held expiry dates, and multi-step approval workflows whose email trail gives a de facto change record. That is solid versioned document publishing — the top of the 30–50 band. It cannot go higher because the compliance-specific layer is entirely missing: no mandatory acknowledgment tracking, no dedicated policy template or register, and no purpose-built tamper-evident audit trail report.
Substantially better than previously scored. Workplace ships its own engagement analytics: a reporting dashboard covering total users, live items and social interactions, per-item analytics on any news article or page showing views, comments, favorites, time spent and last-updated date, and a Users Analytics view listing top publishers, visitor counts and time spent in Workplace — that is an adoption dashboard, which the prior score said did not exist. GA4 can be layered on top. Failed search terms are covered properly by Funnelback's zero-result report, explicitly framed as revealing content gaps, alongside trend-spike reporting. The remaining gap is segmentation: analytics are organization-wide with no views-by-department breakdown, and there are no engagement heatmaps.
Governance is materially stronger than previously credited: Conversational Search exposes AI behaviour controls (declared purpose, off-limits topics, tone of voice, answer detail, configurable fallback response), grounds answers only in approved indexed sources, runs a second LLM to verify every answer and can suppress or modify answers that fail accuracy thresholds, and the platform ships a dedicated Chatbot Reviewer secondary role — assignable only by an Owner — that gates access to conversation transcripts containing PII with explicit GDPR/CCPA and least-privilege framing. Editor-side AI prompts carry admin-configured brand guardrails and Content Intelligence inherits DXP RBAC. Held to the bottom of the 50–70 band because there is no AI-specific audit trail of who invoked AI in the editor or what it generated, no IP indemnification, and Spark's human-in-the-loop approval gates are not GA.
The published Subscription Agreement confirms consumption metering on Page views, Indexed documents, Storage and Data Transfer, with excess billed at Order-specific Overage rates in minimum increments of 1,000 units for page views and indexed documents. Three compounding ratchets make growth unpredictable: unused allocation is forfeited at period end, any mid-term limit increase re-baselines the renewal invoice at the higher limit, and Squiz may unilaterally change pricing at renewal. Page-view metering with forfeiture and no published rate card is the anti-pattern this item penalizes; the single bundled fee keeps it from scoring lower.
The content-side search machinery is strong and better-documented than the prior score reflected: faceted navigation for result refinement, user-defined synonyms for query expansion, Curator trigger/action rules and Best Bets for editorial result control, configurable results pages that function as search landing pages, automated relevance tuning that derives ranking attributes, and staged draft/publish of tuning changes from the Insights dashboard. What is missing is precisely the commerce half — no product-content result blending, no price/attribute facet hierarchies, no search landing pages mapped to product categories, and no product catalog connector. Strong general search applied to commerce, not commerce search.
Higher than previously scored — the prior note that content-instance permissions were undocumented was wrong. Matrix grants Read, Write or Admin on any individual asset to the public, a named user, a user group or a role, with optional automatic cascade to child assets and inheritance on creation, so visibility can be scoped to a department, team or individual at the content-instance level rather than only by content type. Roles are dynamic per-asset assignments, so the same role resolves to different people on different branches of the tree. Authentication is SSO-backed via SAML 2.0 and OpenID providers. Field-level sensitivity is still absent, which keeps it out of the 75+ range.
This clears the automated-review-and-stale-flagging bar. Assets can be scheduled to move to an 'Up For Review' status at a set date or recurring interval (for example every six months), the Metadata Triggers scheduled job fires actions against expiry dates stored in metadata fields, workflow schemas route the resulting review through named groups and roles, and 100-version history backs any rollback. Stale-content detection is now active rather than manual: the Content Auditor surfaces outdated content, duplicate titles and missing metadata across the site, and Experience Monitoring proactively detects broken links and absent content across all of an organization's domains. Explicit per-asset ownership assignment for accountability is still not a distinct field, and there is no single archival workflow product surface.
Aggregation across sites now exists, though it measures content health rather than content performance. Experience Monitoring registers multiple domains and presents statistics for every enrolled domain in one dashboard reached from the organization dashboard, and Content Intelligence crawls an organization's full content estate CMS-agnostically — including microsites and non-Squiz properties — grouping pages by topic and rolling AI-readiness and accessibility into a single health dashboard for leaders. Per-site engagement and search analytics remain in Funnelback Insights and GA4. What is still absent is a portfolio dashboard comparing engagement, content velocity or publishing cadence between brands, so cross-brand performance benchmarking is manual.
One user base spans every site in the instance, authenticated through SAML 2.0 or OpenID SSO, organized into user groups with membership conditions, and granted access per asset branch — which is exactly the central-admin-with-autonomous-brand-teams pattern the rubric asks about, and Squiz's government positioning describes delegating day-to-day management to teams while retaining central oversight. Roles give a clean cross-brand contributor model since the same role resolves to different people per site. It stays below 65 because SSO federation across genuinely independent tenants is not documented (the model assumes one identity provider for the whole deployment) and there is no per-brand identity-provider configuration.
Squiz Search (Funnelback) is a first-party enterprise search product with full-text and faceted search, relevance tuning across 70+ ranking factors, autocomplete, synonyms, multi-source indexing of external systems and search analytics, under active 16.x development in 2026. It is the platform's strongest DXP capability, scored at the add-on ceiling because Search is sold as its own product in the suite.
The Component Service is a design-system governance layer: a central library of brand-approved components, control over which components and versions each site or channel may use, and brand rules compiled into components; a documented two-brand deployment themes one design system per brand from one codebase. Cross-brand approval routing and brand-level analytics are not documented as distinct features.
The integration library at dxp.squiz.net/integrations now enumerates exactly 100 distinct named integrations across 20 categories — CRM (Salesforce, Dynamics, Pipedrive, Zoho, Sugar, Creatio), DAM (Bynder, MediaValet, Frontify, Asset Bank), commerce (Shopify, Adobe Commerce, BigCommerce, WooCommerce), payments (Stripe, PayPal, Braintree, Westpac PayWay), AI (ChatGPT, Claude, Gemini, Grok, Manus), translation (DeepL, Wordbee, Lionbridge), analytics and LMS — substantiating the vendor's 100+ claim that the prior pass could only verify at 61. A separate marketplace.squiz.net adds extensions, templates, blueprints and recipes. Held below 75+ because every listing is Squiz-built and Squiz-maintained: the Marketplace carries only five extensions and there is no third-party publishing model or revenue share.
Squiz Content Intelligence has shipped as a GA product rather than a roadmap item: a CMS-agnostic crawler audits the full content estate, an Accessibility Auditor flags WCAG 2.2 AA/AAA issues with impact ranking and AI-generated code/content fixes, an AI Readiness Auditor scores topic quality, and findings land in a single Content Health dashboard — on top of Experience Monitoring's broken-link and absent-content detection. That clears the prompt's 60+ bar for automated content hygiene tooling. Held in the low 60s because Content Intelligence is a separately gated capability rather than bundled into every DXP subscription, and core Matrix still has no orphan detection or content-expiry workflow.
Guardrails are enforced at the platform level, not merely conventional. Component Service holds a central library of brand-approved components; component sets function as design systems; libraries can be exposed only to selected sites or channels; and governance works by controlling which component versions are available to editors, so an editor cannot reach an unapproved or superseded component. Styling runs through global CSS custom properties acting as theme tokens so a token change propagates across every component using it. This clears the 'enforced brand guardrails at the platform level' bar. It falls short of 75 because the token layer is a CSS-variable convention documented for developers rather than a managed, governed token UI with approval.
Still essentially absent, but one of the rubric's five merchandising capabilities does exist: search result merchandising. Funnelback Curator lets an administrator define trigger/action rules against queries, and Best Bets pin chosen results (with HTML and thumbnails) for key queries, both editable in the Insights dashboard with a draft-then-publish step. Applied to a product index that is genuine result merchandising. Everything else is missing — no category management, no commerce promotional scheduling, no cross-sell/upsell content management, no product spotlights — and the curation tooling is built for content, not catalogs. Top of the no-merchandising band rather than the middle of it.
Squiz's standout capability, and stronger than the prior score. Funnelback / DXP Search is a 25-year-old dedicated enterprise search product that indexes far beyond the CMS — SharePoint 365 and non-365, Google Drive, Alfresco and CMIS repositories, Jira, LiveLink, Documentum and FileNet via ManifoldCF connectors, plus authenticated crawling, LDAP, database and SFTP feeds. Critically for intranet use it applies early-binding security, resolving document permissions at index time so results never leak content a user cannot open. On top sit faceted filtering, synonyms, Curator rules and best bets, automated relevance tuning, five analytics reports including zero-result and trend spikes, and Conversational Search using RAG restricted to approved indexed content with a second guardian agent verifying the generative agent's answers. It stops short of 80 because retrieval is unified-index rather than true real-time federation, and Confluence is not a confirmed connector.
Cross-site sharing is native and well-documented, not a workaround. Component Service maintains one central library of reusable components consumed by every site, components can be grouped into libraries exposed only to selected sites or channels, a single component update propagates to all consuming sites at once, and global CSS custom properties act as shared theme tokens. Component Service also supports reusing rich asset-based data between instances through a standardized exchange format, so an editor can reference assets from either instance under a shared API identifier. It stays below the 70+ native-cross-tenant band because sharing is cross-site within an instance; cross-instance support covers data exchange rather than full component federation.
The brand x locale intersection is workable but not governed as such. Multi-site gives separate content trees per brand or locale, Page Builder language variants manage multilingual pages in place, and the Wordbee integration adds a per-site translation workflow that tracks changed source content and flags Matrix-side edits to translations as needing translator re-approval — a genuine translation approval loop, and it works across any number of sites in an instance. What does not exist is brand-aware governance over that loop: no per-brand translation approval configuration, no shared-versus-isolated translation workflow model, and no regional legal content governance scoped per brand.
The Visual Page Builder offers drag-and-drop assembly from a governed component library, inline editing with live preview, reusable templates and layouts (2026), per-site component availability as brand guardrails, and usage reporting before changing a building block. It composes Squiz-rendered pages only, with no visual composition for an external headless frontend, and template locking is less granular than the leading builders.
Squiz remains a Gartner Magic Quadrant Niche Player with clear vertical focus on government, higher education and service-led organizations, offering SaaS or on-premises deployment with vertical accelerators. The prior score assumed its AI answer was unshipped roadmap; that is now stale — Content Intelligence went GA globally in May 2026 as a CMS-agnostic crawler-based product (AI Readiness Auditor plus a WCAG 2.2 AA/AAA Accessibility Auditor), a differentiated wedge sellable into non-Squiz CMS estates. It stays below 65 because the wider auditor set (SEO, broken links, brand compliance) and the 'fix it for me' remediation are still roadmap, and Gartner's innovation-pace caution on personalization and journey management is unresolved.
Matrix remains a niche skillset — SEEK/Indeed listings cluster in Australia, and dedicated brokers exist precisely because the pool is thin (frontstage.digital sells pre-vetted 'Squiz DXP & Matrix developer profiles'), with one customer citing internal ramp-up 'longer than expected.' The premium is lower than previously scored because the Component Service moved front-end work onto mainstream JavaScript frameworks with a local Docker loop, so a portion of delivery no longer needs Matrix-specific expertise. Still a moderate-to-high premium outside AU/UK, where Matrix admin, asset-tree and parse-file knowledge is scarce.
Squiz DXP is fully managed cloud SaaS with infrastructure, CDN (Cloudflare with Squiz Edge Workers) and platform operations bundled into the single subscription — buyers provision no servers, databases, or CDN separately, and there is no self-hosted DXP path. Lowered from 80 because hosting is included only up to a cap: Storage and Data Transfer are contractual Usage Metrics billed as overages beyond the Order limits, so infrastructure consumption is not truly all-inclusive.
The scaffolding step is better than previously credited: `npx @squiz/dxp-cli-next cmp init <path>` generates a component from a basic or advanced/bundled template, and `cmp dev` / `cmp dev-ui` give a local runner and UI with no DXP access required for local building. The remaining surface is still heavy — CLI install via NPM, manifest.json configuration (mainFunction, inputs, previews, environment variables), Developer-level console access that must be provisioned through Customer Success, separate Content API and Asset Management API token setup, then component-set creation and wiring to Content Management — which is well past a 3-env-var integration.
Stronger than previously credited. Remap Manager provides full 301 redirect management with PCRE pattern rules, CSV import for bulk remaps and a system-wide 404 asset; metadata schemas render meta/OG tags with keyword replacements; and Squiz ships three separate shipped auditors — the Funnelback SEO Auditor (on-page and technical signals, benchmarked against the top 10 results for a target keyword, with prioritized optimization advice), the Content Auditor (duplicate titles, missing metadata, readability, slow pages, outdated content) and Experience Monitoring (broken links, absent content). The prior score treated SEO auditing as thin; it is a first-class, documented product surface. Schema.org structured data is achievable through metadata design areas but is not guided, and sitemap/canonical handling is not prominently documented — that keeps this out of the 75+ band.
Advanced Forms is a real drag-and-drop builder with conditional logic, multi-page forms, auto-calculation, booking, and payment fields across Pin Payments, PayPal and Westpac PayWay including dynamically priced amounts driven by form selections. The CDP Advanced Forms destination auto-populates fields from the Single Customer View for progressive profiling, and Optimization A/B tests carry explicit conversion goals (target page view, click events on elements like Buy Now / Sign Up). UTM awareness is now confirmed rather than absent — the CDP captures utm_campaign and other campaign parameters and can trigger personalized page versions from them, correcting the prior 'no native UTM tracking' finding. A dedicated lead-management workflow still does not exist; leads hand off to CRM via Squiz Connect.
The DAM is better than a plain media library. Images are automatically resized for device and converted to modern formats (WebP, AVIF) with compression and served over CDN through Squiz Edge Workers; image varieties give explicit control over renditions; a built-in image editor handles crop and resize; asset permissions scope which assets a given content team can even see; and watermarking plus automatic replacement of an outdated asset across every property that references it are documented. It stops short of the 65+ full-DAM band: no focal-point editor, no licensing/rights-expiry management, no usage tracking across external channels, and video hosting is listed but not detailed.
The lifecycle half is genuinely complete: assets can be scheduled to flip to an 'Up For Review' status on a recurring interval, Metadata Triggers fire scheduled actions against expiry dates held in metadata fields, version history retains the last 100 versions with compare and restore, and multi-step workflow schemas route approvals through user groups and roles with email notification per step. Internal findability is excellent via DXP Search with RAG-backed conversational Q&A. The gap is structure, not lifecycle — no dedicated knowledge base article type, no pre-built knowledge taxonomy (metadata schemas can express one, but nothing ships), and no article-level analytics for knowledge gaps beyond search zero-result reporting.
Each component set functions as a design system, an organization can run several sets with different themes, and sites are assigned only the component libraries they should have — then customize how those shared components look without maintaining forked copies. Theming runs on global CSS custom properties, so a brand's colors and typography change through token values rather than component rewrites. That is per-brand visual identity over shared component structures. It lands just below the 65 line because the token layer is a documented developer styling convention (src/styles/common, src/styles/themes) rather than a governed per-brand token store with its own approval and versioning.
Workflow schemas are applied per asset branch, so each brand or site can carry independently defined review stages and approval chains, with steps assigned to user groups (so cover is maintained when an approver is away) or to roles that resolve to different people per asset. Scheduling and review intervals are likewise configured per site. Central auditability is partial rather than designed: workflow step emails and 100-version history provide a per-asset trail, but there is no cross-site audit dashboard or portfolio-level workflow compliance report.
The Matrix Linking screen exposes where an asset is linked from, NOTICE links record dependencies so deletions surface their impact, and %asset_linking_info% returns linking data including parent lineage; page-builder usage reporting adds where-used for templates, layouts and components. That meets the one-to-many-with-reverse-lookup band, but the model is a hierarchical asset tree with no polymorphic references, native many-to-many fields or graph-style querying through the delivery API.
Because Squiz renders the production site itself, the Visual Page Builder and Matrix inline edit mode let editors change draft content in place on the real page, with Matrix 6.6 extending inline editing to component properties, personas and display conditions, Safe Edit previewing unpublished changes, and 2026 language variants allowing per-language preview. The ceiling is that in-context editing applies only to Squiz-rendered pages: there is no draft preview or click-to-edit overlay SDK for a separate headless frontend.
Google Analytics is a prebuilt entry in the integration library and Connect adds Tealium, Mixpanel and Power BI connectors, with Matrix pages accepting any tag manager snippet. No Segment, Amplitude or Adobe Analytics connector is documented and there are no event helpers for the page builder.
Squiz Matrix/DXP remains a niche skillset concentrated in Australia and the UK, hired mainly through specialist agencies or Squiz itself (~28–30 open roles worldwide, mixing PHP/Matrix with TypeScript/Node/React/AWS engineering). The mitigating factor previously missed is Squiz Academy: free registration, free courses and structured developer learning plans for Component Service, which materially lowers ramp cost for a team new to the platform. It stays below 50 because there is still no market-recognized certification exam and Stack Overflow coverage is negligible, so buyers carry real delivery-talent risk outside core geographies.
Squiz Academy now runs a free, structured Component Service learning plan sequencing six courses from ecosystem overview through create/preview/deploy/delete, component sets, complex input fields, local preview, and environment variables — an actual guided path rather than docs alone, backed by a YouTube training playlist and in-person, live-online, and webinar training confirmed in 2026 review profiles. It stays out of the 65+ band because onboarding is split across three hubs (docs.squiz.net, matrix.squiz.net, academy.squiz.net), there is no in-console onboarding tour and no framework-specific (Next.js/Nuxt) guide, and 2026 reviewers still say the learning curve 'can be hard for new starters.'
Squiz publishes a contractual Support Agreement with concrete targets — P1 response immediate and no greater than 30 minutes with resolution within 6 hours, P2 within 2 working hours, P3 within 2 working days — and 24/7 coverage for P1/P2 through the My Squiz portal, with support bundled into the single subscription price rather than gated behind a premium tier. 2026 reviews on G2, Gartner Peer Insights and SoftwareReviews praise the relationship-oriented model and dedicated CSMs. Uplifted for the published SLA and universal inclusion, but kept below 70 because reviewers consistently report support is 'hit and miss due to high turnover' and that response time varies by region, on a thin ~26–27 review base.
Squiz does publish resolution targets, not just response targets — P1 resolution within 6 hours under the Support Agreement — and SaaS continuous deployment plus an ongoing Matrix point-release cadence through 6.26 means fixes reach customers without any upgrade action, backed by a public tracker at bugs.matrix.squiz.net. Uplifted from the prior assumption that no resolution commitment existed. Still mid-band because observed median incident duration of ~6.5 hours sits right at that P1 target rather than comfortably inside it, 2 major outages occur per typical 90-day window, and no resolution SLA is published for non-outage functional bugs.
This is a genuine platform strength and now clears the native-real-time-targeting threshold. The CDP is built into Squiz DXP rather than bolted on, and segments combine real-time behavioral signals (pages viewed, downloads, interest tags), geo/location, referral source, UTM campaign parameters, lifecycle stage and CRM attributes. Marketers build segment-targeted variants directly in Visual Page Builder with per-audience preview, no code. 2026 added per-site segment sets (Jan), segment templates with ready-made tracking events for common cases like location and engagement, automatic portal-user sync from the IdP into the Single Customer View on login, and a real-time Tealium integration that queries visitor profiles at page-request time. Targeting remains rule-based — no predictive or lookalike modeling — which caps it below 75.
Bulk operations are no longer a gap. Matrix ships asset cloning plus a Mass Clone Tool that produces a specified number of copies into a chosen destination, alongside 2026 content templates and reusable layouts with reference links, reusable components that update once and propagate everywhere, inline editing in Page Builder, and 100-version history with one-click restore to recover from a bad edit. Squiz markets sub-hour brief-to-publish for landing pages. The component palette is still developer-defined and there is no bulk field/metadata edit across many assets, keeping it below 75.
Squiz Connect is a purpose-built low-code iPaaS with 100+ pre-built connectors spanning well over three MarTech categories — CRM (Salesforce, HubSpot, Zoho, Pipedrive, Close, SugarCRM), marketing automation and email (Marketo, Klaviyo, Mailchimp, Swift Digital), SMS (ClickSend), CDP (Tealium, with real-time profile lookup added in 2026), analytics (Tableau Cloud), translation (Wordbee, Google Translate) and payments — over REST, SOAP and GraphQL with OAuth2, plus a generic component for any unlisted API. Flows are triggerable from CDP event feeds and form submissions. It misses 70+ because no ad-platform connectors (Google Ads, Meta, LinkedIn) are documented and per-connector depth varies between full event orchestration and simple API actions.
The building blocks for basic B2B gating are real: authenticated portals with SSO, per-asset Read permissions granted to user groups or roles (so a spec-sheet library or catalog section can be gated to named accounts), and Advanced Forms with conditional logic and auto-calculation that could carry a quote-request flow. None of it is B2B-specific or packaged as such — no customer-specific pricing display, no account-based catalog segmentation, no quote workflow, no documented B2B deployment pattern. Access control applicable to B2B, which is the 30–50 band.
Lowered on closer reading. The staff directory (with sorting and advanced search across staff attributes), staff profile pages and a clickable organizational chart showing reporting lines are all native, purpose-built features — that part stands. But the implementer documentation sources both from CSV files (example-staff-data.csv, org-chart-data.csv), and no HRIS connector for Workday, BambooHR or Entra/Azure AD profile sync is documented anywhere. The rubric's 55+ band expects a native directory with org chart and HR integration; Squiz has two of three and a file-feed dependency that means profile data goes stale between imports. Skills/expertise fields are also not documented.
Metadata schemas are the extension mechanism and they do support the pattern in a limited way: a schema defines fields (date, hierarchy, asset picker, select, text) and is applied to a section of the asset tree, so one brand's branch can carry extra fields on the same underlying asset type that another brand's branch does not — extension without forking the base type. That is better than fully separate models. But it is field-level metadata layering rather than genuine content-type inheritance: there is no documented base-model/derived-model relationship, no way to version a global model and propagate changes to brand extensions, and no enforcement that brand extensions stay compatible with the core.
Segment assignment in the Squiz CDP is still rule-based with no ML scoring, predictive assignment, next-best-content model or cold-start handling. The one genuinely AI-touched element is Conversational Search: Squiz's demo documentation states the LLM tailors each generated answer using the query, the content, and user behaviour signals including location, on-site interactions and defined audience segments — an AI-generated response layered on human-authored segments. That is enough to lift it off the floor of the rule-based band but nowhere near the AI-assisted 40–60 band.
The Component Service provides reusable, nestable components from a central design-system library, and templates and layouts became first-class reusable building blocks in 2026, so composition spans component, layout and template tiers. Component content is structured JSON, but rich text inside it is HTML rather than a portable structured format and nesting depth is undocumented, which keeps it below 75.
Trigger Manager events (status change, web path update, publish and more) fire outbound into Squiz Connect flows, which provide filterable execution logs, operator-initiated error retry, custom error handlers and credential-secured webhook triggers. Retry is manual reprocessing rather than automatic backoff, HMAC payload signing is undocumented and there is no event-streaming alternative, so it sits in the solid-webhooks band.
Squiz DXP has no product catalog, cart, checkout, pricing or inventory; its capability set is content, search, CDP, personalization, forms, DAM and integrations. Commerce is reached only through connectors, scored in 2.3.2.
Official connectors cover Mailchimp, Marketo and HubSpot, and the CDP tracks email campaign link clicks into profiles. There is no native send, no in-CMS email composition or preview and no documented triggered sends from content events.
The help centre has grown materially: roughly 17 capability sections now including new Content Intelligence, Advanced Forms and Optimization trees, a dedicated DXP Releases site, a centralized DXP APIs portal indexing 14 interfaces with public/private markers (previously a two-page stub), a 100-entry integration library with category and sector filters, a Marketplace of recipes and blueprints, and an Academy. Release notes are current through September 2026 and specific. It stays below 80 because content is still fragmented across separate product doc trees with inconsistent depth, there is no interactive API playground, and there are no framework-specific quickstarts for Next.js, Nuxt or similar.
The component toolchain is TypeScript-first and actively maintained — @squiz/dx-json-schema-lib at 1.90.1 (published 2026-09-14, 516 versions), render-runtime-lib, and the TS/React dxp-component-library — with component inputs defined through JSON Schema typed input types, and manifests now supporting previewPlaceholder hints. However there is still no automated type generation from the component manifest or the content model, and the read-only Content API ships no typed client at all, so anything consuming content is untyped. Typed build tooling without codegen and without a typed delivery SDK lands below the typed-SDK band midpoint.
Squiz DXP's monthly release cadence is now confirmed unbroken across all of 2026 — the Help Center release index carries per-month pages from January through September 2026 spanning Component Service, Content Management, Search, CDP and Datastore. Beyond routine increments, 2026 shipped a genuinely new product (Content Intelligence, GA May 2026) plus Visual Page Builder templates/layouts, language variants and improved version history/restore, which is more than maintenance shipping. Still short of 75+ because the per-month payloads are mostly incremental service updates rather than platform-level feature drops.
Squiz keeps a steady case-study pipeline in its core verticals — UniSC's 15,000-student portal, James Cook University's multi-site consolidation, University of Newcastle's 400-publisher upgrade, Greenwich's conversational search and a Queensland Health network overhaul — and Content Intelligence's CMS-agnostic standalone packaging opens a land-and-expand motion outside the existing CMS base. Momentum reads as steady rather than accelerating: G2 reviews are flat at 27 and no flagship North American enterprise logo was announced in 2026 despite the Slalom channel.
The write path keeps widening: the REST Asset Management API does full CRUD with a PATCH contextid parameter for context-specific attributes and metadata, Data Record assets can now be created through it, the Content API gained data parameters returning more asset attributes, and the asset syncing tool got auto-refreshing sync status for moving assets between Matrix environments — a real environment-promotion path. It stays below 50 because Hierarchy and Thesaurus metadata field types are still unsupported by the Asset Management API, required metadata fields are not enforced through the Content API, editing locks persist, and there is no declarative schema migration tooling.
Squiz ships more native monitoring than most SaaS peers: Experience Monitoring is a fully documented DXP service with its own UI, category tabs (page load time, caching, broken links, malfunctioning forms, absent content) and troubleshooting scenario guides, and Content Intelligence now adds a separate Content Health dashboard. A public status page at squiz.statuspage.io is tracked by StatusGator, IsDown and EagleStatus. Uplifted to the top of the 65–75 SaaS band, but not higher because there is still no native APM, API-usage metering, or integration-health dashboard — those remain customer-built.
Standard tag integration is solid — GA4 is documented with a UA migration path, FullStory provides session replay and behavioral heatmaps, Behavioral Analytics ships as a core module, and Funnelback's Insights dashboard gives search-side reporting (query volume, clicks, zero-result, location, trends) with drill-down and export. What still does not exist is a content performance dashboard inside the authoring UI: there is no most-viewed / lowest-engagement / conversion-by-page-type view for web content without leaving for GA4. The new Content Intelligence health dashboard scores content quality and AI readiness, not traffic or conversion performance.
Broader connector coverage than previously credited, but the same shallow depth. Squiz Connect ships a Shopify connector with documented actions plus BigCommerce, Magento 2, PayPal and Stripe components under a Digital commerce category, and Matrix has an official tutorial for selling through a Shopify Buy Button embedded via the Code component. These are API-level flows and payment rails. There is no in-editor product picker, no product reference field type, no catalog federation and no real-time bidirectional sync, and no commercetools or Salesforce Commerce Cloud connector exists. That keeps it at the top of the webhook/custom-integration band, not the product-picker band.
Scheduled publishing gives time-activated banners, and Page Builder blocks can be varied by CDP segment, which delivers audience-targeted promotional content — more than plain scheduled banners. But none of the commerce-specific promotional primitives exist: no countdown timers, no promo code messaging blocks, no tiered pricing tables, and no channel-specific promotional targeting beyond web segments.
The DAM handles basic product imagery competently — image varieties for controlled renditions, a built-in crop/resize editor, and automatic WebP/AVIF conversion with CDN delivery, which matters for PDP performance. None of the commerce-grade media capabilities are present: no 360-degree spin, no AR/3D model references, no image hotspots for shop-the-look, no deep zoom, and no documented video-in-PDP pattern. Basic galleries and embeds, the 30–50 band.
The generic localization stack — Page Builder language variants plus the Wordbee TMS workflow and Google Translate connector — applies cleanly to product pages, which is a real (if unspecialized) capability. What does not exist is anything commerce-aware: no currency-aware content blocks, no regulatory product content handling (EU labels, CA Prop 65), and no market-specific promotional calendar.
Workplace ships three distinct news item types — news articles, events and announcements — plus community-scoped news, homepage alerts with an emergency severity for urgent broadcast, and email notification on a per-user immediate/daily/weekly cadence. Audience targeting runs through 'content preferences' on the personalized news and events listing. What is still missing is the accountability layer that separates good internal comms from good publishing: no read receipts, no acknowledgment tracking, and no mandatory-read workflow. Targeting is also preference-based rather than the CDP's richer segmentation.
A real social layer: public and private communities that can be categorized and filtered by category tabs, threaded discussions with community-administrator moderation, comments on any news item, page or discussion with likes, bookmarks and sharing, a flag-for-moderation flow with a reworked moderation experience, classifieds, community news, and community events with a calendar view for physical or virtual events. Polls, surveys and formal peer recognition or badges remain absent, and comments/likes are not a recognition system.
Governance is an explicit Squiz DXP pillar and the mechanisms are real: site-level permission delegation lets a central team hand day-to-day management to department or agency teams without losing central oversight, roles resolve per-asset so the same approval role maps to different people per branch, workflow schemas enforce content standards per site, Component Service governs which component versions any site can use, and 2026 per-site segment sets scope personalization assets so editors only see segments relevant to their site. Squiz's government positioning is built on exactly this centralized-control-with-local-autonomy pattern. What is not documented is a global policy configuration surface or an approval workflow that spans sites, which keeps it out of the 75+ range.
Lowered. Pricing remains entirely contact-only with no public tiers, no documented volume licensing and no multi-site bundle, and Squiz is no longer on the UK G-Cloud framework where its day rates and subscription figures were previously visible — so the one public pricing reference point is gone. More importantly, Squiz's subscription agreement meters usage across several dimensions including page views, with overage charges, forfeiture of unused allowance and renewal uplift. Adding brands therefore adds both licensed sites and metered traffic, which sits at the harsher end of linear rather than offering economies of scale. Insufficient public evidence for anything better, and confidence stays LOW.
Alongside the in-editor AI prompt library and Content Intelligence's prioritised smart fixes, Squiz now states its AI-powered migration tooling is in production — automatically moving existing sites into Squiz DXP while applying AI-driven best practices — which is real bulk AI content work, though it is delivered as a Squiz-led migration engagement rather than a self-serve editorial feature. Fixes are still surfaced rather than applied ('fix it for me' and Spark's Optimization agents are not GA), and there is no auto-tagging, smart scheduling, content routing, duplicate detection or AI publishing trigger. Two or three lightweight assists, so it stays well below the 60+ band.
Component content models are defined in JSON Schema with custom input types (FormattedText, SquizImage, SquizLink) and deployed as code through the dxp-component-library CLI, while Matrix metadata schemas add typed fields grouped into sections with defaults, editability and required settings. A genuine two-tier model rather than rigid templates, but there are no union or polymorphic field types and schema-as-code covers components, not the asset types themselves.
JSON Schema underpins component models, giving the standard vocabulary (required, type, min/max, enum, pattern), and Matrix metadata fields enforce required values and defaults. No cross-field rule engine or pre-save validation hook is documented, and it is unclear whether schema rules are enforced on writes through the management API, so this stays in the standard built-in band.
The built-in asset library handles images, video and documents with metadata, centrally managed alt text and captions, and versioning; uploads are automatically converted to WebP (v6.18) and AVIF, image varieties are generated automatically or by trigger for responsive use, an in-built editor crops and resizes, and linking data shows where an asset is used. No URL-parameter transform API or focal-point control is documented, which keeps it below 75.
A traditional CMS with a headless API layer added: the Content API supports hybrid delivery and component content is JSON, but the architecture is page-first, rich text is emitted as HTML, and no official SDK fleet across several languages is published. That places it in the traditional-CMS-with-API band.
Squiz's own CDP builds rule-based and event-driven segments from first-party behaviour, evaluated server-side each session, with Single Customer View profiles, per-site segment sets and segment templates added in 2026, automatic portal-user sync, and a Tealium integration that queries external profiles at request time. It is licensed as part of the separately sold Personalization capability rather than the base CMS, so the add-on ceiling applies, and the attribute palette is narrower than dedicated enterprise CDPs.
Squiz ships behavioural analytics with visual journey mapping and drop-off identification, A/B conversion reporting and Funnelback search analytics on query intent and content gaps, while the base CMS adds 2026 usage reporting for templates, layouts and components. The journey and conversion analytics sit in the Personalization and Optimization modules, and there is no content-lifecycle or author-productivity reporting.
The built-in DAM, included without an extra licence, provides metadata schemas, tagging, versioning and permissions with centrally managed alt text and captions, guided to libraries of roughly 10,000 assets, and Squiz maintains two-way Bynder and Asset Bank integrations for larger estates. There is no rights or expiry management, asset approval workflow or brand portal, which keeps it at the bottom of the library-with-taxonomy-and-versioning band.
docs.squiz.net/dxp-api is now a genuine API portal indexing 14 interfaces with public/private markers — Matrix SOAP/JavaScript/Content Delivery/Asset Management, Integrations REST, Logging Service, Job Runner, File Store, and six Funnelback APIs — a real improvement over the two-page stub of the prior pass. The content delivery surface is still read-only REST with bearer tokens, the GraphQL component remains explicitly Beta and is an outbound connector to third-party GraphQL APIs (with documented parsing, attachment and OAuth2 limitations) rather than a native GraphQL delivery API, and there is no interactive playground. Fragmentation across eight product modules keeps it below the well-designed-single-REST-API band.
Component Service supports custom web components with typed JSON Schema input definitions, inline editing integration, enforced SemVer with documented rollback to earlier versions, per-site component libraries, and Components-at-Edge server-side execution with fetch access; the Job Runner API adds programmatic scheduled server-side jobs, and Marketplace Extensions (HTML CodeSniffer, JSON Web Token, Matrix Keyword Helper) extend the Matrix authoring UI. This is materially more than webhook-plus-UI extension. It stays short of 75+ because there is no app framework for building custom DXP console panels or sidebar widgets, and no platform-level content lifecycle hook API.
DXP console SSO is SAML 2.0 only and is not self-service — the docs state setup "can be arranged by contacting your Customer Success Manager," and there is no SCIM or directory sync ("Users in your directory are not automatically created within your DXP service, you must manually invite users"). OIDC is documented only for front-end Portal authentication, not console login, and MFA is explicitly delegated to the IdP ("the password (or 2FA) associated with your single sign-on") with no native enforcement. SSO being bundled rather than tier-gated holds it in the mid-60s; the vendor-mediated setup and missing SCIM, which the prior pass did not capture, prevent more.
No CVEs or breaches specific to the Squiz DXP SaaS platform surfaced for 2025–2026; the platform runs an ISO 27001-certified ISMS with bi-annual third-party penetration tests, TLS 1.2+ with BYOK, and monthly releases that bundle dependency security upgrades plus specific hardening fixes (September 2026 corrected form-submission assets becoming publicly readable when disconnected from their parent form). Disclosure is a published security-team@squiz.net contact and an NDA-gated trust center at trust.squiz.net rather than a public advisory feed. No bug bounty program exists, which holds this at the top of the clean-history-with-basic-disclosure band.
Squiz publishes a 99.9% Monthly Uptime Percentage SLA measured at the CDN, a live public status page at status.squiz.cloud with incident history, and — unusually for this tier — a contractual support agreement with both response and resolution targets (P1 immediate and no greater than 30 minutes response, 6 hours resolution; P2 2 working hours; P3 2 working days) on 24/7 coverage, bundled into the subscription rather than sold as a premium tier. The published resolution commitments lift this above a bare 99.9%-plus-status-page posture. It stays under 80 because the SLA itself is 99.9% rather than 99.95%+, and no resolution target is published for non-outage functional defects.
Component Service enforces Semantic Versioning — every code change requires a version increment and redeploying a changed component under an existing version is impossible — and Squiz documents reverting DXP environments to an earlier component version, which is real deployment rollback rather than just version labelling; bring-your-own CI/CD runs through the CLI with deployment enablement controls and lint/format gates, and Connect documents staging/production workspace separation. It remains mid-band because there is no schema migration tooling for content model changes and no branch-per-PR or ephemeral content environment pattern, so content-model changes are still promoted manually.
Squiz publishes a public roadmap alongside a companion Product Releases page, and the 2026 roadmap has proven predictive rather than aspirational — Content Intelligence, page builder templates and layouts, language variants and improved version history all moved from 'coming' to shipped within the year, which is a credibility signal a private roadmap cannot offer. It stays below 70 because there is still no community feedback or voting portal (no Canny, Ideas board or GitHub Discussions), so prioritization remains entirely vendor-controlled.
Post-go-live editor self-service is the platform's strongest build-simplicity dimension: Page Builder offers a unified core-plus-custom component picker with filtering, drag-and-drop composition and reorder, inline editing on the live preview, multi-viewport checks, A/B and personalization variants, and workflow-controlled publishing, and Marketplace lets teams pull in pre-built components and templates without a custom build. The ceiling is scope — any new component type, integration, metadata schema, or personalization segment still needs a developer, so editors work inside the space developers pre-built.
Squiz's Visual Page Builder is a genuine drag-and-drop, no-code tool marketed to non-technical editors — Squiz claims a landing page in under an hour with no developer. Inline editing works directly on the page preview, templates and layouts ship as reusable building blocks, and 2026 added language variants and an improved version history retaining the last 100 versions with compare-and-restore. Marketers compose new pages freely, but the component palette is still developer-built via Component Service, so truly novel component types remain a developer task.
Authors create per-segment variants of content blocks directly in the Visual Page Builder and preview what each segment sees before publishing, with CDP-driven server-side delivery. Strong native variant handling, held below the add-on ceiling because priority and fallback across overlapping segments are thinly documented and the capability sits in the separately licensed Personalization module.
The Optimization service provides adjustable traffic distribution, conversion goals by element selector or destination URL, a duration and significance calculator, variants edited in the Visual Page Builder and in-platform reporting, with segment-scoped tests added in 2026. It is strictly two-variant A/B testing with no multivariate or bandit mode, and it is licensed alongside Personalization rather than in the base CMS.
Squiz DXP is essentially holding steady this cycle, with the only meaningful composite movement being a modest lift in Compliance & Trust and a one-point slip in Capability. The Compliance & Trust gain is driven by newly verifiable disclosures — a published 30-day post-termination data window, a dedicated DXP audit-log type for security events, and independent confirmation of TX-RAMP Level 2 certification — all of which strengthen the platform's defensibility for regulated buyers. The offsetting Capability softness reflects a more sober reassessment of collaboration and media handling: real-time co-editing was downgraded once it was clear Matrix relies on asset locking rather than true concurrent authoring, and video management scored lower as a basic DAM file type without transformation tooling — both worth weighing for teams with heavy multimedia or multi-editor workflows.
Score Changes
The post-termination window the prior pass could not find is published in the subscription agreement: a 30-day period in which Squiz makes Customer Data and Customer Applications available for export or download, after which Squiz may delete or render them inaccessible, paired with DPA delete-or-return at the customer's discretion and documented Matrix bulk export tooling (Export assets to XML, Export files, Asset Management API). It does not reach 75+ because the post-termination export is request-based rather than self-service, the XML schema is Matrix-proprietary rather than a standard interchange format, DAM, CDP and Search configuration have no documented bulk-export path, and Squiz explicitly disclaims archival backup — backups run nightly with 30-day retention for disaster recovery only.
Squiz is not a last-write-wins platform: Matrix locks assets and names the lock holder, allows different attributes of one asset to be edited concurrently, isolates drafts through Safe Edit so reviewers can compare against live, and supports async annotation via comment assets and per-stage workflow comments and change requests, with version history attributed by author and restorable from the Page Builder UI. That places it in the 'commenting but limited simultaneous editing' band. It stays at the bottom of that band because there is genuinely no simultaneous co-editing, no presence indicators, and no @mention notifications in any docs or release notes.
The DXP Logs service has a dedicated Audit log type for 'security and compliance events, including access to sensitive information and system configuration changes', masks PII by default and writes a further audit entry recording who revealed it, gates access behind an Owner-assigned Logs Auditor secondary role, retains audit logs for 12 months in hot storage, exports to CSV, exposes a regional Logs Service API, and natively streams to external platforms (Datadog, Dynatrace) in near real time with compliance retention given as the documented rationale. It falls short of the top band because the streaming destinations are observability tools rather than mainstream SIEMs, retention is a fixed platform policy rather than customer-configurable, and audit trails are fragmented — CMS, Integrations and Search logs are explicitly excluded from the DXP Logs service and live in three separate tools.
Video is a first-class DAM file type rather than an afterthought: videos upload into the asset library, the preview screen plays them back so reviewers can check visuals and audio, and captions, transcripts, alt text and descriptions are managed centrally alongside other asset metadata. The MediaValet connector (component refresh April 2026) adds external media workflows. Capped at 40 — the bottom of the 'basic upload/hosting without transcoding' band — because there is no transcoding, no adaptive-bitrate streaming, and no video delivery pipeline of Squiz's own.
Squiz DXP is independently verifiable on the Texas DIR TX-RAMP certified products list at Level 2 status (ID TX1591016, expiring 25 Aug 2028) — a correction to the prior pass, which could not find it — and contract and security documentation covers GDPR, UK GDPR, CCPA/US privacy law, the Australian Privacy Act 1988 and the New Zealand Privacy Act. It stays well below the 75+ band because the IRAP and FedRAMP claims are inherited from AWS rather than held by Squiz, PCI DSS is expressly disclaimed, there is no C5 or HITRUST, and the UK G-Cloud channel has lapsed (Squiz appears on neither the G-Cloud 14 nor 15 supplier list).
There is now no publicly obtainable VPAT or ACR for any Squiz product — the Matrix v5.4.1.3 report previously hosted by Middlesex University returns HTTP 404, and repeated searches across vendor, .edu, .ac.uk and .gov.au sources surfaced no replacement, current or otherwise. What remains is an accessibility statement page written about squiz.net itself against WCAG 2.0, with no Section 508 conformance statement and no ATAG 2.0 assessment, which is the accessibility-page-without-a-VPAT band and a material procurement gap for the higher-education and government buyers Squiz targets.
The DXP Optimization service is a real experimentation product: configurable traffic distribution (default 50/50, adjustable), conversion goals defined by JavaScript element selector or exact destination URL match, a built-in duration calculator that takes current conversion rate, target rate and daily visitors to advise when a test reaches significance, variant editing inline in the Visual Page Builder, and in-platform performance reporting with export. 2026 added segment-specific A/B tests so experiments can be scoped to a CDP segment. Capped at 70 because it is strictly two-variant A/B — there is no multivariate or multi-armed-bandit capability and no post-hoc p-value readout.
Every accessibility artifact Squiz publishes is about delivered content rather than the editing interface: the Accessibility Auditor tests customer sites against WCAG 2.0/2.1/2.2 A/AA/AAA plus ADA and EAA, and squiz.net/accessibility is a statement about squiz.net's own marketing website measured against the superseded WCAG 2.0. No stated WCAG 2.1 AA target, ATAG 2.0 assessment, or keyboard/screen-reader conformance claim for the DXP authoring UI exists in any Squiz source, and the one VPAT that did cover the editing product is no longer retrievable. That is a general corporate commitment without a product-level target, which sits at the bottom of the stated-target band.
The Component Service is an explicit design-system governance product, not just a component store: a central library of brand-approved components, control over which components and which component versions are available to a given site or channel, and design-system rules compiled into the components so every page inherits brand guidelines without manual checks. A documented two-brand deployment built one shared design system and themed it separately per brand from a single codebase. Below 75 because cross-brand approval routing and tenant-level isolation are not documented as distinct features.
Delivery runs through Cloudflare CDN with caching, WAF and reverse proxy, and the DAM automatically optimizes images on upload — converting to modern formats including WebP (added in v6.18) and AVIF — while auto-generating image varieties for responsive and per-device use, with an in-built editor for crop and resize. That is the top of the 'CDN delivery with basic transforms' band. It cannot reach 70+ because there is no URL-parameter transform API and no focal-point control, so arbitrary on-the-fly rendition requests aren't possible.
CMS trigger events (asset status change, web path update, publish) fire into Squiz Connect flows, and the Connect side is better instrumented than previously credited: error retry lets you reprocess failed messages, and clicking a failed step shows the error with a detailed log trace plus request headers and mapper logs. May 2026 improved webhook multipart reliability. Below 70 because payload signing is undocumented, there is no event-filtering or topic-selection console, and outbound coverage is assembled through the trigger system rather than a purpose-built webhook manager.
Squiz's public wording is consistently unqualified — /security says only 'Squiz holds SOC 2 accreditation' and the Shared Responsibility Model commits to 'adherence to the SOC 2 framework' and 'relevant SOC 2 reports' on request, never naming Type 2 or a Trust Service Criteria scope. The only dated public artifact is the DNX Solutions case study documenting a Type 1 engagement, and no Type 2 attestation announcement exists in 2025-2026 sources; the Vanta-hosted trust center gates its document list behind a request form, so the type cannot be confirmed externally. That places this at the top of the rubric's Type 1 / no-Type-2 band rather than above it.
Squiz maintains its own ISO/IEC 27001:2022 certified ISMS covering platform scope — not inherited AWS certification — with DevSecOps integrated across processes, third-party audits against the framework, and a Statement of Applicability released to customers on request alongside the certificate. ISO 27018 for cloud PII processing is absent from every Squiz source checked, which is the single requirement keeping this out of the 80+ band.
Personalization is built directly into the Visual Page Builder: authors create per-segment variants of content blocks in the visual interface, preview exactly what each segment sees, and publish without switching tools or writing code — which is the rubric's 70+ bar of native variants plus in-editor per-audience preview. Delivery is CDP-driven server-side, with the Tealium integration feeding external profiles into the same decisioning. Only just over the line because fallback/priority handling across overlapping segments is thinly documented and variant management depth trails Bloomreach or Acquia.
Beyond operational metrics, Squiz ships native behavioral analytics with a visual user journey mapping interface aimed at non-technical teams — visualizing visitor interactions and identifying drop-off points in critical flows — plus A/B test conversion reporting, search analytics that surface query intent and content gaps, and new 2026 usage reporting for templates, layouts and components so teams can see where each building block is used before changing it. Held below 70 because there is no content-lifecycle or author-productivity reporting (time-to-publish, editorial throughput) and dashboard depth trails dedicated analytics suites.
Advanced Forms is a full DXP-tier builder: drag-and-drop design, conditional logic that can chain off other hidden fields, multi-page forms with progress indicators, a payment field, save-and-resume by link or email reminder, a centralized dashboard for all forms and responses, and January 2026 submission token validation against duplicates. Progressive profiling is explicit — answer capture automatically maps submissions into Single Customer View profile properties, and form auto-fill reads back from those profiles. Below 80 because per-field drop-off analytics and native CAPTCHA/spam protection aren't documented.
The integration library documents official connectors for Mailchimp (subscriber sync and embedded signup forms), Marketo (email engagement, campaign data, segmentation) and HubSpot, with the CDP tracking email campaign link clicks and creating profiles from them for downstream personalization. That is a broader ESP set than a single connector. Held below 70 because there is no native send capability, no in-CMS email composition or preview, and no documented triggered sends fired from CMS content events.
Squiz's native CDP builds rule-based and event-driven segments from first-party behavioral data (page views, downloads, location) that are evaluated server-side on every visitor session — genuine real-time segmentation, not batch. 2026 added per-site segment sets for multi-site governance, pre-configured segment templates for common cases, automatic portal-user sync into the CDP for authenticated experiences, and a Tealium integration that queries external visitor profiles at request time. Held below 75 because the segment builder still exposes a narrower attribute palette than firmographic/enterprise CDPs.
Squiz Connect documents REST connectors for BigCommerce (including mapping product SKUs to BigCommerce product IDs and working with catalogs), Shopify Admin with Buy Button / Buy Button collection embedding in Content Management, Magento 2, plus PayPal and Stripe for payments. That is a broader connector set than a bare webhook path, but it remains API-level plumbing — there is no in-editor product picker, live catalog federation, or commercetools/SFCC connector — so it sits mid-band.
The built-in DAM ships metadata schemas, tagging, version control and permissions at no extra licence cost (Squiz guides it to libraries under roughly 10,000 assets), supports images, video and documents, and centralizes alt text, captions and descriptions so accessibility metadata stays consistent across properties; a File Store Service exposes it over REST. Official two-way Bynder and Asset Bank integrations (April 2026 added shared credentials) let authors insert enterprise DAM assets from the page builder. Still short of the 70+ purpose-built tier: no usage tracking across content and no rights or expiry management.
The Visual Page Builder does drag-and-drop component assembly, WYSIWYG inline editing on the page and live preview, with A/B variants and per-segment personalization editable in the same surface. 2026 added reusable templates and layouts, language variants, a dedicated version history UI that selects, compares and restores versions, and usage reporting showing where each template, layout and component is used before you change it. Short of 75+ because it composes Squiz-rendered pages only — there is no visual editing of an external headless frontend.
Workflow schemas are configurable per asset without code — multi-step approval chains with conditions, steps bound to roles and user groups, and email notifications — and the Workflow screen shows the running workflow with approve/reject plus comments and change requests at each stage. Safe Edit isolates in-progress changes so reviewers with Write permission can compare the draft against live before approving, and version history gives an attributed audit trail. Exactly at 70 because parallel approval paths and SLA/due-date management on tasks are still undocumented.
Squiz feeds automation rather than performing it: CDP behavioral events, form submissions and campaign-link profiles flow into Marketo, HubSpot, SugarCRM and Salesforce via Connect, and the new visual journey mapping surfaces drop-off points to act on. But there is still no native automation builder, no drip or nurture orchestration, no lead scoring and no lifecycle-stage management inside the platform — journey mapping visualizes journeys, it does not run them. That is the 'tight integration with an automation tool' band, not native automation.
Squiz ships a native CDP with Single Customer View unified profiles, real-time server-side segmentation, automatic anonymous profile creation from tracked campaign links, Advanced Forms answer capture writing submissions straight into SCV profile properties, automatic portal-user synchronization for authenticated experiences, and a June 2026 flattened CDP content architecture. The Tealium integration adds bidirectional enterprise-CDP interoperability by querying external visitor profiles at page request. Below 80 because identity resolution across offline and CRM sources is thinner than dedicated CDPs.
The verifiable portfolio beyond ISO 27001 is a CSA STAR Level 1 CAIQ self-assessment that Squiz links to directly from /security (registry entry live, listed since 2016), TX-RAMP Level 2 certification confirmed on the Texas DIR list, Cyber Essentials certificates released on request, and annual independent penetration tests with executive summaries available to customers. It stops short of the 65-80 band because every one of these is either a self-assessment or a single-jurisdiction authorization: there is no CSA STAR Level 2 third-party audit, no PCI DSS (disclaimed), no FedRAMP or StateRAMP, no platform-level IRAP, no Cyber Essentials Plus, C5 or ENS, and the former UK G-Cloud listing has lapsed.
Future Status lets any asset be scheduled to change status — publish, archive, or flag for review — at a specified future date and time, covering both embargo and auto-expiry, and the Scheduled Jobs Manager gives administrators a single list of every pending scheduled job across the system. What is missing is the editorial half: no calendar UI view of upcoming content and no release bundles for publishing multiple assets atomically, which is what the 70+ band requires.
DXP primary roles govern service access org-wide, Matrix layers granular asset-level permission types with a documented quick-reference, roles are usable as steps in workflow schemas, and SAML 2.0 SSO supports attribute mapping — extended in June 2026 by an Add SAML Link trigger action that links a user to SAML IDs across multiple account managers, plus dedicated Search custom roles with a two-step authorization flow. Capped at 66 because SCIM provisioning and field-level permissions remain undocumented, and both are explicit requirements of the 70+ band.
Squiz DXP shows modest but broad-based improving momentum, with all six composite dimensions ticking upward and Operational Ease (+1.5) and Build Simplicity (+1.2) leading the movement, driven largely by new automated content-hygiene tooling that reduces day-to-day maintenance overhead. The standout shift is the May 2026 GA launch of Squiz Content Intelligence, which lifted content intelligence and insights by 30 points and AI content auditing by 25 points through CMS-agnostic estate-wide crawling and WCAG accessibility auditing — a genuine capability step-change even though its effect on the Capability composite (+0.5) is diluted across the category. Practitioners evaluating Squiz for large, sprawling content estates — particularly in accessibility-sensitive sectors like government and higher education — should weigh Content Intelligence and the expanded 100+ connector MarTech integration layer as meaningful new differentiators, while noting that Cost Efficiency and Build Simplicity remain the platform's weakest dimensions in absolute terms.
Score Changes
Squiz Content Intelligence launched GA in May 2026: a CMS-agnostic crawler audits the full content estate, automatically clusters pages into topics, uses AI to test how well content answers likely audience questions, identifies gaps, and surfaces prioritised recommendations with AI-generated fixes — all feeding a unified content health dashboard. This is a genuine built-in AI content intelligence dashboard in production, meeting the 60-band threshold. Scored just under leaders because it is only a couple of months old, ROI attribution and performance scoring are absent, and brand/SEO audit dimensions are still expanding.
Content Intelligence (GA May 2026) delivers AI-powered auditing at estate scale: the Accessibility Auditor pinpoints WCAG 2.2 AA/AAA issues prioritised by impact with AI-generated code and content fix suggestions, and the AI Readiness Auditor scores content quality/answerability by topic. This covers accessibility and quality dimensions well with AI, clearing the 45–60 band. Brand voice compliance checking remains a roadmap expansion, and the legacy Content Auditor stays rule-based, so it falls short of the 70+ comprehensive band.
Funnelback ships a documented recommender that suggests related items from query and click logs using collaborative-filtering-style signals (CO_CLICKS, RELATED_CLICKS, RELATED_RESULTS) — a genuine built-in algorithmic recommender, not just manual curation. It remains search-package-centric rather than an editorial 'you may also like' engine integrated into page authoring, so it stays below the 60+ tier for dedicated recommendation engines.
Squiz now ships genuine automated content-hygiene tooling: Experience Monitoring detects broken links and absent content across sites, and the 2026 roadmap adds Content Intelligence — an auditing platform that identifies what's broken and prescribes fixes — as part of a stated content-health focus. This is stronger than the manual-only picture previously assumed. Held just below the full-suite 60+ tier because no orphan detection, content-expiry workflows, or unified content-health dashboards were found in the core DXP docs.
Squiz's MarTech connectivity is strong via the Squiz Connect / Integrations low-code flow platform, which offers 100+ pre-built connectors spanning multiple MarTech categories: CRM (Salesforce, HubSpot, Zoho CRM, Pipedrive, Close CRM), email marketing (Klaviyo, Mailchimp), SMS (ClickSend), and analytics (Tableau Cloud), with event-triggered orchestration. Depth of each connector (event triggers vs simple API actions) is not fully documented, keeping the score at the threshold rather than above it.
Squiz Content Intelligence (GA May 2026) adds an AI Readiness Auditor that tests how well content answers likely audience questions and surfaces prioritised, AI-generated fix recommendations for AI-search visibility — a step beyond the rule-based Funnelback SEO Auditor. Alt-text generation remains available via the AI Prompt Library. Auto-generation of SEO titles, meta descriptions, and taxonomy tags in the editing workflow is still not shipped (SEO auditing expansion and 'fix it for me' automation are roadmap), keeping this in the partial-automation band.
Squiz's commerce integration story remains shallow. Official tutorials document Shopify Buy Button embeds, and the Squiz Connect library includes pre-built Shopify Admin, BigCommerce, PayPal, and Magento 2 components — API-level connectors, not editor-level product pickers. No deep integration (real-time sync, product reference UI in the content editor) with Shopify, commercetools, Salesforce Commerce Cloud, or BigCommerce is documented, keeping the score at the top of the webhook/custom-integration band.
Squiz's workplace tool connectivity improved across 2025–2026 via the Squiz Connect platform: SharePoint, ServiceNow, and Google Calendar components shipped in 2026, and Slack was enhanced with a Google Drive component added in 2025; Microsoft Fabric and MediaValet connectors were also added. Moveworks offers a third-party Squiz Intranet integration for search-driven content delivery. These are API/flow-level integrations — deep Microsoft Teams or Google Workspace experiences (embedded content cards, bots, single-pane) are still not documented.
Squiz's roadmap describes AI-assisted task automation — natural language instructions coordinating tasks across CMS, CDP, and Search with approval gates — and names AI-powered A/B testing as the first such feature, alongside planned conversational page building, Figma-to-DXP, and a DXP Orchestration Assistant. None of these appear in 2026 release notes or product docs as of July 2026; the A/B testing service documentation shows no AI capability. Announced direction with a first feature imminent, but no GA agentic product today.
Squiz Connect now advertises 100+ fully developed integrations maintained by a dedicated team, with an integration library and continued 2026 additions (ServiceNow, SharePoint, Google Calendar, Microsoft Fabric, MediaValet) spanning CRM, DAM, commerce, translation, AI, and analytics; generic REST/SOAP/GraphQL/Webhook/Mapper components cover long-tail systems. The verifiable connector count in the docs sitemap sits at ~61, so the score reflects a strong-but-not-top-tier, still-growing ecosystem rather than the full 100+ marketing claim.
Experience Monitoring is a fully documented DXP service (docs.squiz.net/squiz-dxp/latest/monitoring) with a dedicated UI, using-guides, and proactive detection of page-load, caching, broken-link, and absent-content issues. A public status page exists at squiz.statuspage.io and is tracked by third parties (StatusGator, IsDown, StatusSight). Fits the 65–75 SaaS band; application-layer monitoring (API usage, integration health) still requires customer setup, preventing a higher score.
Squiz publicly describes its model as one single price bundling license, usage, platform, and support into a 12-month subscription, priced on the capabilities actually used. Bundling is more predictable than modular add-on stacking, but the usage-based component carries spike risk and no published rate card or usage-tier breakpoints let buyers model growth. Mid-band: predictable envelope, unpredictable interior.
Squiz Connect now documents both a Shopify connector (component plus Buy Button / Buy Button collection embedding) and a BigCommerce connector, alongside PayPal and Stripe for payments. This is a broader connector set than prior reviews, but it remains a basic connector tier — no in-editor product picker UI, live catalog federation, or commercetools/SFCC connectors — so it sits in the mid connector band.
The Component Service is now consistently documented as framework-agnostic across docs and product pages: components can be built with JavaScript, React, Vue, and other modern frameworks, and Squiz markets 'familiar frameworks like React' — a meaningful shift from the previously Handlebars-only posture. However, the official dxp-component-library remains vanilla JS + Handlebars, the proprietary manifest.json component model and legacy SOAP API persist, and no first-class Next.js integration path exists, so React support is possible rather than paved.
The headless API surface has improved: a REST-based Asset Management API supports full CRUD on assets, including a PATCH method with a contextid parameter for context-specific attributes and metadata, and the Content Delivery API gained extra data parameters — the API layer is no longer read-only. However, Hierarchy and Thesaurus metadata field types remain unsupported by the Asset Management API, required metadata fields are not enforced through the Content API, asset locking persists, and no schema migration tooling is documented.
Squiz DXP has strong SEO tooling: the Remap Manager provides a full redirect management UI for 301 redirects with PCRE pattern-matching rules and a system-wide 404 asset, metadata schemas render HTML meta tags and support structured fields, sitemap generation is built in, and the Optimization tool provides SEO and accessibility auditing with scheduled scans. Schema.org structured data is achievable via metadata design areas but is not a guided first-class feature, keeping the score just above the 65 threshold rather than higher.
Squiz DXP is not positioned as a commerce content platform — no purpose-built product content types, variant management, or SKU-level attribute modeling exist. However, Squiz documentation explicitly describes metadata schemas as a mechanism for structured content models 'such as custom fields for a product page', confirming generic content types can be formally repurposed for product content. No product taxonomy tools or editorial-commerce co-authoring features exist.
CMS trigger events (asset status change, web path updates, publish events) can fire outbound webhooks into Squiz Connect integration flows, and the Connect Webhook component works as a flow trigger; May 2026 improved webhook multipart request reliability. However, there is no documented unified webhook system with HMAC-signed payloads, retry logic, delivery logs, or event filtering at the level of headless platforms.
A/B testing is a documented first-class DXP Optimization service: any content author can create, configure, and connect an A/B test to any Page Builder content page, with explicit conversion goals (page-view and click-event tracking tied to page elements) feeding Behavioral Analytics. This is genuine built-in experimentation. Held below 70 because statistical significance reporting and multivariate testing depth are not documented at the level of dedicated experimentation platforms.
Squiz DXP's built-in DAM documents metadata, tagging, version control, and permissions without additional licensing (suited to libraries under ~10,000 assets), alongside a File Store Service with REST API. Official two-way integrations with Bynder and Asset Bank (April 2026 added shared-credentials support) let teams browse and insert enterprise DAM assets directly from the page builder. Still below purpose-built DAM tier (70+) as usage tracking across content and rights/expiry management are not documented.
Squiz has a formal, tiered partner program with a Partner Directory, Learning Academy onboarding, and certification progression across agency, SI, ISV, and consultant categories. The Slalom partnership — a major global consultancy focused on public and social-impact institutions — is a meaningful step beyond the previous niche-agency network (FrontStage, Carnegie, Alpha Solutions, XCentium). Still no Accenture/Deloitte/Valtech presence, keeping it below strong-ecosystem scores.
Squiz Advanced Forms is a genuine drag-and-drop form builder with conditional logic, multi-page forms, pre-built templates, auto-calculation, payment gateway, and booking support, embeddable on landing pages. Forms auto-fill from CDP-stored profile data and feed the CDP for progressive profiling, and Squiz Optimization A/B tests support explicit conversion goals (page-view and click-event tracking tied to page elements). The Klaviyo connector plus CRM connectors (Salesforce, HubSpot) support lead-capture handoff via the Integrations platform, and 2026 added form submission token validation. Native form building plus conversion tracking now clearly crosses the 60+ threshold; a dedicated lead-management workflow and native UTM parameter tracking remain undocumented, keeping the score in the mid-60s rather than higher.
Beyond ISO 27001, Squiz's Security Shared Responsibility Model now explicitly lists Cyber Essentials certificates alongside CSA STAR Level 1 (self-assessment CIAQ, not Level 2 third-party audit), TX-RAMP references for Texas government, UK G-Cloud listing, and bi-annual third-party penetration tests with executive summaries available on request. The portfolio still lacks PCI DSS (explicitly disclaimed), FedRAMP, platform-level IRAP, Cyber Essentials Plus, and C5, keeping this modestly above the base band.
Conversational Search records complete conversation history including fallback responses (Jan 2026 release), giving administrators basic visibility into AI search interactions. Beyond that, no AI-specific observability exists — no per-user AI consumption metrics, AI credit or cost tracking, model performance dashboards, or prompt effectiveness analytics. AI usage across editor prompts and Content Intelligence remains opaque.
Squiz DXP includes a native CDP with real-time segmentation on behavioral web events, location, and demographics, extended by January 2026 per-site segment sets and April 2026 templated segmentation with quick-start segment groups. A 2026 Tealium integration lets Squiz query external visitor profiles in real time and evaluate segmentation rules against them, broadening the data feeding native segments. DXP-tier native segmentation with active investment and now first-party enterprise CDP interoperability.
Squiz's official SDK surface is JavaScript-only: the Datastore JS SDK, @squiz/dxp-cli-next, and @squiz/local-component-dev-ui are actively maintained on npm. No official SDKs exist for Python, Java, .NET, PHP, Swift, or Android, and community coverage beyond JS is sparse. Active maintenance cadence earns a small bump, but single-language coverage caps the score.
The Component Service supports custom web components with typed input schemas, inline editing integration, custom layouts, and a documented Components-at-Edge model where components execute server-side at the edge with fetch API access (Node.js 20.13.1+). This goes beyond pure UI extension, but there is no full app framework with custom admin UI panels or platform-level server-side hooks comparable to leading headless platforms.
No official starter templates for Next.js, Nuxt, Astro, or SvelteKit exist. The official dxp-component-library provides vanilla JS + Handlebars component and layout examples, explicitly positioned as educational with detailed code comments. Squiz markets 'Marketplace starters' as a launch path, a small structural improvement, but these are platform component sets rather than modern frontend boilerplates. The Queensland Government community component-system repo remains unofficial.
Component development requires a multi-step workflow: DXP CLI install via NPM, file structure creation, manifest.json configuration (mainFunction, inputs, previews, environment variables), local dev server, deploy via CLI, preview in console, manage Component Sets, connect to Content Management, add Set to page. Building a component locally requires no Squiz DXP access, but deploy/manage still requires Developer-level console access provisioned via Customer Success, and Content API token setup remains a separate admin-gated process.
Squiz pushed legacy self-hosted Matrix customers onto Matrix 6 SaaS via a 2–4 week UAT-driven migration, and that program has now largely completed as of mid-2026, so the forced-migration wave is receding rather than active. A maintained deprecations page shows features retire on vendor timelines inherent to SaaS, while Squiz markets 'no forced migrations' going forward. Uplifted as the migration is now behind most customers, but the recent history and ongoing deprecation cadence keep it mid-band.
SaaS on AWS with auto-scaling, Elastic Load Balancing, built-in CDN (Squiz Edge), and vendor-monitored cache means low day-to-day performance burden. However, the public status page shows a persistent incident stream — 4 incidents in the last 90 days (2 major) with a median duration of ~6.5 hours, plus 130+ incidents tracked since March 2021 — so customers do experience platform-side disruptions they must work around. Held mid-70s for this incident track record.
2026 reviews on G2, Gartner Peer Insights, and SoftwareReviews consistently praise Squiz's relationship-oriented support: 'the customer service crew is outstanding... problems are resolved as soon as possible' and 'remarkably flexible and responsive support options' with dedicated success managers and 24/7 live support. Earlier notes about variable response times persist, and strong support appears tied to enterprise engagement with a small (~26) review base, keeping this below the 70+ band.
SaaS continuous deployment lets Squiz ship fixes without customer action, and monthly DXP release notes through 2026 show steady delivery. However, status-page data shows incidents with a median duration of ~6.5 hours and 2 major outages in the last 90 days, suggesting middling operational response speed, and no public bug-resolution SLA exists. Small vendor size and niche base keep velocity below tier-1 vendors.
Squiz explicitly markets sub-hour brief-to-publish for landing pages using the Visual Page Builder, and 2026 releases shipped content templates — reusable page designs with reference-link support — strengthening template-based velocity. Inline editing, drag-and-drop component placement, and approval shortcuts are all confirmed. Bulk operations remain undocumented and the component library is developer-defined, keeping the score below 70.
Squiz DXP is largely stable this cycle, with Compliance & Trust providing the only meaningful upward nudge (+1.1) while Capability, Platform Velocity, Cost Efficiency, Build Simplicity, and Operational Ease all hold flat. The Compliance gain is driven by clearer documentation of customer-selectable hosting regions across the UK, North America, and Australia, which materially strengthens the data residency and sovereignty story for regulated buyers. Practitioners should weigh that residency improvement against a small step back in webhook coverage, where the Squiz Connect Webhook component remains useful but did not advance enough to offset other gaps in the event-system evaluation.
Score Changes
Squiz documents customer-selectable hosting regions — United Kingdom, North America, and Australia — with each deployment in a single AWS region across multiple availability zones, and states that storage and processing of PII takes place within the deployed region under an agreed jurisdiction. This is multi-region choice with a contractual jurisdiction guarantee; the absence of an explicitly documented EU region (UK is post-Brexit) and a public sub-processor data-flow map keeps it below the 78+ band.
Beyond Git bridge webhooks, Squiz Connect includes a Webhook component usable as a trigger in integration flows, and the Matrix Trigger Manager supports content lifecycle events (e.g., Before Status Changed to Live) that can drive outbound actions such as Slack notifications. However, there is no documented unified webhook system with HMAC-signed payloads, retry logic, delivery logs, or event filtering at the level of headless platforms.
Squiz DXP holds steady as a capable but niche composable DXP, strongest in APAC and UK government and education verticals. Platform velocity dips slightly as the market matures and larger competitors absorb composable messaging. Cost and complexity remain structural challenges, while operational ease and compliance capabilities continue to be differentiators.
Platform News
Continued refinement of the composable DXP suite with focus on stability and enterprise customer retention
Squiz DXP continues steady but unspectacular progress. The composable architecture is now well-established with good API coverage, but the platform struggles to differentiate in an increasingly crowded composable DXP market. Operational ease remains a relative strength thanks to managed cloud hosting, but build simplicity lags due to limited community resources and proprietary tooling.
Platform News
Deeper AI integration for content generation, translation, and personalization within editorial workflows
New connector framework for easier integration with third-party martech and commerce platforms
Squiz DXP solidifies its position as a mid-tier composable DXP with particular strength in government, education, and regulated sectors. The platform's compliance and accessibility capabilities are well-regarded, but the relatively small partner ecosystem and higher-than-average TCO limit broader market penetration. Platform velocity moderates as the composable transition stabilizes.
Platform News
Built-in accessibility checking and remediation tools updated for WCAG 2.2 standards
Better orchestration between Content, Search, and DAM modules with unified admin experience
Squiz continues incremental improvements to its composable DXP but faces intensifying competition from both pure headless CMS players and larger DXP vendors investing heavily in composable approaches. Platform velocity peaks as the company pushes AI-assisted content features and improved search capabilities. Build complexity remains a challenge due to the proprietary nature of many platform components.
Platform News
Introduction of AI-assisted content creation and optimization tools within the CMS
ML-powered search relevance tuning and natural language query support
CDN and caching improvements for faster headless content API responses
Squiz DXP matures its composable architecture with improved API coverage and better developer tooling. The platform sees steady adoption in government and regulated industries due to strong compliance posture and data sovereignty options. However, community ecosystem and third-party integrations remain limited compared to market leaders, constraining platform velocity.
Platform News
Expanded hosting regions with data residency controls for compliance-sensitive customers
Improved developer portal with better API documentation, SDKs, and getting-started guides
Multi-stage approval workflows and scheduled publishing improvements for enterprise content teams
The composable DXP strategy gains traction with existing enterprise customers migrating from Matrix. Squiz invests in its marketplace and integration ecosystem, though it remains small compared to larger DXP vendors. Cost structure remains enterprise-tier with limited self-service options, keeping TCO high for mid-market buyers.
Platform News
Growing library of pre-built integrations and connectors for the composable DXP ecosystem
Improved drag-and-drop editing experience for content teams working with component-based content
Squiz announces its composable DXP vision, rebranding from Squiz Matrix toward 'Squiz DXP' with modular components for content, search, and DAM. Platform velocity increases as the company invests in headless content delivery and GraphQL APIs. Developer experience is still catching up to pure headless competitors.
Platform News
Squiz repositions as a composable DXP with modular Content, Search, and DAM components
New headless content delivery APIs to support decoupled front-end architectures
Introduction of structured, component-based content model for modern content workflows
Squiz Matrix remains a solid traditional CMS with strong government and education sector presence across Australia, UK, and New Zealand. The platform offers robust content management and compliance capabilities but lags in modern developer experience and API-first architecture. Platform velocity is modest as the company begins exploring a composable strategy.
Platform News
Mature traditional CMS with strong WCAG accessibility and multi-site management for government clients
Squiz continues to win government and higher education contracts, particularly in Australia and the UK
Reach out to these highly trusted implementation partners, agencies and specialists.
Agencies, dev shops, and systems integrators vary wildly in how well they deliver on Squiz DXP. We don't take on implementation work ourselves.
Tell us what you're building and we'll come back with a shortlist of firms with a genuine track record on this platform.
