■ Platform
Built to be run, wherever you like.
One deployment serves many organizations, each isolated by the database itself. It runs on four portable services, on any cloud or a single host, and makes no calls home.
§ 01 Tenancy
Organization, instance, site.
An instance is a logical tenant: its own content, media, users, keys, and settings. Sites are content trees inside it, each with its own hostnames and languages.
Enforced by PostgreSQL
Tenant tables lead with the instance identifier and are protected by row-level security. A query without a tenant sees nothing.
Scoped everywhere
Every cache key, storage path, search index, queue message, and lock carries the instance identifier.
Tested on every endpoint
A cross-tenant isolation test runs against every repository and endpoint, in CI, on every change.
Fair under load
Background jobs are scheduled fairly across instances, so one tenant's import never starves another's publishing.
§ 02 Hosting
Cloud-neutral by rule, not by aspiration.
Every capability that touches infrastructure goes through an interface with a self-hostable baseline. AWS was the first environment; nothing requires it.
Kubernetes with Helm
The primary target. API, job worker, media worker, and backoffice images; migrations as a hook; probes on every workload; rolling restarts that keep backoffice sessions alive.
Docker Compose
The whole platform on a single host, including PostgreSQL, Redis, Keycloak, and storage. Good for small teams, labs, and local development.
Terraform
Modules for the managed dependencies per cloud, starting with AWS: the Kubernetes cluster, PostgreSQL, Redis, object storage, secrets, and the CDN in front of it all.
| Capability | Self-hostable baseline | Or plug in |
|---|---|---|
| Object storage | Local volume | S3-compatible, Azure Blob, Google Cloud Storage |
| CDN | Served by the API with full cache headers | CloudFront, Front Door, Cloudflare, Fastly |
| Search | PostgreSQL full-text search | OpenSearch, Elasticsearch |
| SMTP | Any transactional email service | |
| Secrets | Key-per-file secrets | Your cloud's secret store |
| Geolocation | Country header from your CDN or ingress | No IP database, ever |
| Analytics | First-party store in PostgreSQL | Matomo, GA4, Clarity, warehouse export |
| Malware scanning | ClamAV | Off, or your own scanner |
| Observability | OpenTelemetry | Any OTLP backend |
Each implementation passes its plugin point’s shared contract test suite, so swapping one for another changes configuration, not behaviour.
§ 03 Performance
Targets are constraints. Here's how they held.
A feature that cannot meet the performance targets is not complete. These were measured with k6 on one workstation running the whole Compose topology.
| Check | Target | Measured |
|---|---|---|
| Delivery, cached (output cache) | p95 < 150 ms | 8.5 ms at 2,741 req/s |
| Delivery, composed from the database | p95 < 500 ms | 59 ms at 2,741 req/s |
| Publish to visible at the origin | 5 s | p95 555 ms |
| First rendition of a 20-megapixel image | 2 s | p95 299 ms |
| Warm rendition | p95 < 150 ms | 47 ms |
| Backoffice open, save, tree expand | p95 < 300 ms | 20, 39, and 73 ms with 50 editors |
| 15-minute soak at 200 req/s | errors < 0.1% | 0 errors in 180,003 requests |
| Redis stopped for 90 seconds | errors < 0.5% | 0 errors in 12,002 requests |
Designed for, per deployment
- Pages per site
- 250,000
- Sites per instance
- 100
- Instances per deployment
- 1,000
- Concurrent editors
- 500
- Languages per site
- 50
- Origin requests behind the edge
- 10,000 / s, horizontal
Single-host Docker Compose verification, September 2026: 5,000 published items, PostgreSQL, Redis, Keycloak, and MinIO on the same 16 GB machine as the load generator. Edge-cache and multi-node figures are measured on staging.
§ 04 Security and privacy
Secure defaults, and the receipts to prove it.
Security is checked on every build, not audited once a year: images are scanned, bills of materials produced, and every API crawled by a scanner before a release.
Strict Content Security Policy
Hash-based CSP on the backoffice, security headers on every path, and no third-party scripts or fonts.
No outbound calls
No telemetry and no licence checks. The update check and the store connection are opt-in.
Controlled egress
Webhooks, migrations, and connectors go through one egress component that refuses private and internal addresses.
Encryption where it matters
Form answers under per-instance keys with AES-256-GCM, protected secrets for every stored credential, encrypted snapshot downloads.
Rate limits
Per key for the Delivery API, per user for expensive Management operations.
Signed plugins
Only packages signed by allow-listed publishers can be installed, with a trust model reviewed for 1.0.
Supply chain
CycloneDX SBOMs for every image and lock file; Trivy with zero critical or high findings at release.
Scanned APIs
ZAP baseline on the backoffice and API scans of Management and Delivery with no high-risk alerts.
Accessible
WCAG 2.2 AA, checked with axe on every place in the backoffice, in both themes, at three widths.
■ Ready for press
See your content set in modules.
We’ll walk through the backoffice with your own site in mind, or import a copy of your Umbraco site and show you the result.