Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (14)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| Builder.io ↗ | 7.6* | 3.3* |
| Contentful ↗ | 7.6* | 4.9* |
| DatoCMS ↗ | 7.6* | 4.5* |
| Directus ↗ | 7.6* | 5.0* |
| Ghost ↗ | 7.6* | 3.0* |
| Hygraph ↗ | 7.6* | 5.0* |
| Payload ↗ | 7.6* | 5.0* |
| Prismic ↗ | 7.6* | 3.4* |
| Sanity ↗ | 7.6* | 4.5* |
| Storyblok ↗ | 7.6* | 3.0* |
| Strapi ↗ | 7.6* | 5.0* |
| Webflow ↗ | 7.6* | 5.4* |
| WordPress ↗ | 7.6* | 5.1* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
Content entries, media bytes, presentation and editorial history require separate extraction. Published content access does not establish a complete CMS restore.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
Builder.io
Content management · Checked 2026-10-22
Builder.io / Content API v3 model entries using a space API key; Write API, private-key operations, code generation and full space migration are excluded.
Read findings and sources ↗Contentful
Content management · Checked 2026-10-22
Contentful / Content Management API entries in selected spaces and environments; Delivery API sync, binary assets and full space restore are excluded.
Read findings and sources ↗| Customer control | Builder.io ↗ | Contentful ↗ | DatoCMS ↗ | Directus ↗ | Ghost ↗ | Hygraph ↗ | Payload ↗ | Prismic ↗ | Sanity ↗ | Storyblok ↗ | Strapi ↗ | Webflow ↗ | WordPress ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Content management | Databases and data platforms |
| Overall control | ||||||||||||||
| Data access | ||||||||||||||
| Third-party accessibility | ||||||||||||||
| External action | ||||||||||||||
| Continuity | ||||||||||||||
| Data exit | ||||||||||||||
| Business logic and customization | ||||||||||||||
| Assessment scope | Builder.io / Content API v3 model entries using a space API key; Write API, private-key operations, code generation and full space migration are excluded. | Contentful / Content Management API entries in selected spaces and environments; Delivery API sync, binary assets and full space restore are excluded. | DatoCMS / Content Management API current record list and record creation; asset binaries, model schemas, webhooks and full project restore are excluded. | Directus / REST collection items and item CRUD with customer-authorized tokens; database-native dumps, files, flow definitions and full project migration are excluded. | Ghost / Content API published-post reads using a Content API key; Admin API writes, members, billing, original media bytes and full site migration are excluded. | Hygraph / Content API model-entry GraphQL queries and mutations using permanent auth tokens; Management API schema changes, assets and full project migration are excluded. | Payload / configured REST collection records and CRUD using user-bound API keys; database dumps, uploads, globals and full application migration are excluded. | Prismic / REST Content API document queries for a selected repository ref and language; Migration API writes, original media bytes and full repository migration are excluded. | Sanity / Content Lake GROQ document queries and mutations in selected datasets; binary assets, release history and full project migration are excluded. | Storyblok / Content Delivery API v2 stories in a selected space, language and publication version; Management API writes, original asset bytes and full space migration are excluded. | Strapi / Strapi 5 REST Content API collection documents and CRUD; deployment operations, binary assets and complete CMS backup are excluded. | Webflow / Data API v2 selected collection items, staged-item updates and site-admin tokens; page design, assets and complete site migration are excluded. | WordPress / self-hosted WordPress REST API posts and post mutations; WordPress.com, plugin-specific fields, media bytes and whole-site migration are excluded. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-22 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
Builder.io ↗
Builder.io’s Content API returns model entries and visual content JSON. Targeting, scheduling and caching can change which entries appear.
Builder.io / Content API v3 model entries using a space API key; Write API, private-key operations, code generation and full space migration are excluded.
Contentful ↗
Contentful CMA retrieves localized and unpublished entry fields within the token owner’s permissions. Delivery API responses have different semantics.
Contentful / Content Management API entries in selected spaces and environments; Delivery API sync, binary assets and full space restore are excluded.
DatoCMS ↗
DatoCMS returns model records through its Content Management API. Current and published versions are separate selections.
DatoCMS / Content Management API current record list and record creation; asset binaries, model schemas, webhooks and full project restore are excluded.
Directus ↗
Directus exposes collection items as structured records. Returned fields and related data depend on query selection and the acting role’s permissions.
Directus / REST collection items and item CRUD with customer-authorized tokens; database-native dumps, files, flow definitions and full project migration are excluded.
Ghost ↗
Ghost’s Content API returns published-post records and rendered content. Tags and authors require explicit include selection.
Ghost / Content API published-post reads using a Content API key; Admin API writes, members, billing, original media bytes and full site migration are excluded.
Hygraph ↗
Hygraph generates GraphQL entry queries for each content model. Stage, locale, relations and workflow selection affect returned content.
Hygraph / Content API model-entry GraphQL queries and mutations using permanent auth tokens; Management API schema changes, assets and full project migration are excluded.
Payload ↗
Payload mounts REST collection APIs at each configured collection slug. Access Control and query depth determine visible records and relationships.
Payload / configured REST collection records and CRUD using user-bound API keys; database dumps, uploads, globals and full application migration are excluded.
Prismic ↗
Prismic’s Content API returns document data at a selected repository ref. A ref identifies a published, draft or scheduled content version.
Prismic / REST Content API document queries for a selected repository ref and language; Migration API writes, original media bytes and full repository migration are excluded.
Sanity ↗
Sanity returns dataset documents through GROQ. The chosen perspective controls published, draft and release visibility.
Sanity / Content Lake GROQ document queries and mutations in selected datasets; binary assets, release history and full project migration are excluded.
Storyblok ↗
Storyblok’s Delivery API returns story records and their content components. Language and publication-version selection affect the returned set.
Storyblok / Content Delivery API v2 stories in a selected space, language and publication version; Management API writes, original asset bytes and full space migration are excluded.
Strapi ↗
Strapi’s REST API exposes content-type documents. documentId identifies a document, while locale, publication status and populated fields affect returned content.
Strapi / Strapi 5 REST Content API collection documents and CRUD; deployment operations, binary assets and complete CMS backup are excluded.
Webflow ↗
Webflow exposes collection item fields and locale identifiers through its Data API. Staged and published content use separate routes.
Webflow / Data API v2 selected collection items, staged-item updates and site-admin tokens; page design, assets and complete site migration are excluded.
WordPress ↗
WordPress exposes post records through its REST API. Authentication and permissions determine access to drafts, private posts and edit-context fields.
WordPress / self-hosted WordPress REST API posts and post mutations; WordPress.com, plugin-specific fields, media bytes and whole-site migration are excluded.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.