FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
CMS

321 CMS

UnclassifiedOfficial website

321 CMS is an open source content management system (formerly Mura CMS) used to build and manage websites with PHP. Self hosted deployments stay first party only, but optional modules can introduce third party trackers that fall under GDPR and ePrivacy.

Block 321 CMS until consentScan my site
Overview

What does 321 CMS do?

What is 321 CMS

321 CMS is an open source content management system (formerly known as Mura CMS) developed in PHP by Mura Software. It is typically self hosted on the deployer infrastructure and provides editor tools, content modelling, role based access and a module ecosystem for forms, e commerce and third party integrations.

Cookies and data collected

Out of the box, 321 CMS sets only strictly necessary first party cookies: a session identifier (PHPSESSID), a CSRF token, an editor session and a language preference. Visitor IP, user agent and request logs are kept by the web server. Any further cookies depend on the modules you activate.

GDPR and ePrivacy implications

Strictly necessary session cookies are exempt from consent under Article 5(3) of the ePrivacy Directive. Modules that add analytics (Google Analytics, Matomo cloud), marketing (Meta Pixel, Mailchimp), social embeds (YouTube, Twitter) or hCaptcha all require prior, granular and revocable consent under Article 6(1)(a) GDPR.

Hosting and international transfers

Hosting region is fully under the deployer control. Choose an EU hosting provider (e.g. OVHcloud, Scaleway, Hetzner, Infomaniak) to keep data inside the EEA. Each integration with a US service must be evaluated under the SCC framework with a Transfer Impact Assessment.

Implementing consent correctly

Plug a Consent Management Platform in front of every optional module. Wrap third party scripts so they only execute after the visitor opts in to the relevant category. On withdrawal, clear the corresponding cookies and stop loading external assets.

Practical compliance steps

Keep the core CMS up to date, document each module in the Records of Processing, sign a hosting DPA, configure log retention, anonymize IPs in web server logs where possible, run regular security and accessibility reviews and audit cookies actually written by the published site.

Compliance

321 CMS and the GDPR

321 CMS is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Strictly necessary session cookies (editor login, CSRF, language) rely on Article 6(1)(f) GDPR. Any optional module that adds analytics, marketing or social media trackers requires consent under Article 6(1)(a) GDPR and Article 5(3) of the ePrivacy Directive.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, applicable national hosting and data protection laws

Impact assessment (DPIA)

A DPIA is generally not required for the core 321 CMS engine. It becomes relevant if you add modules that perform behavioural analytics, profiling, automated decision making or large scale processing of sensitive content.

Sample text for your banner

This site runs on the open source 321 CMS. Strictly necessary session cookies are set without consent. Optional analytics or marketing modules only load after you accept them.
Cookies and trackers

What 321 CMS sets and contacts

Tracking method
PHP based open source CMS by Mura Software, optionally bundled with module level analytics, form processing, and third party integrations. Sets session cookies for editor and visitor sessions; further trackers depend on activated modules.
Server location
Self hosted (deployer infrastructure). The product was developed by Mura Software (USA), but no central data collection happens by default.
Cookieless mode available
Yes

Cookies set (4)

NameTypeDurationPurpose
PHPSESSIDfirst_partySessionStrictly necessary PHP session identifier used to keep visitor and editor sessions.
csrf_tokenfirst_partySessionStrictly necessary token used to protect form submissions from cross site request forgery.
editor_sessionfirst_party14 daysStrictly necessary cookie that keeps logged in editors authenticated to the 321 CMS admin panel.
localefirst_party1 yearStores the visitor language preference so the right localized content is served on subsequent visits.

Third-party domains contacted (2)

  • 321cms.org
  • getmura.com
Questions

Frequently asked questions about 321 CMS

Can't find your question? Write to us, we answer fast.

What cookies does 321 CMS set?

The core 321 CMS engine sets only strictly necessary first party cookies: session ID (PHPSESSID), CSRF token, editor session and language preference. Any additional cookies depend on the modules you activate.

Is consent required for 321 CMS?

Strictly necessary session cookies are exempt from consent under Article 5(3) of the ePrivacy Directive. Optional analytics, marketing or social embed modules require prior, granular and revocable consent.

What is the legal basis for 321 CMS?

Strictly necessary cookies rely on legitimate interest (Art. 6(1)(f) GDPR). Editor accounts rely on contract performance (Art. 6(1)(b)). Optional trackers loaded by modules need consent (Art. 6(1)(a)).

Are there transfers to the United States?

The core engine itself does not transfer data anywhere. Transfers only happen if you connect modules to US services (Mailchimp, Google Analytics, Meta Pixel). Each must be governed by Standard Contractual Clauses and a Transfer Impact Assessment.

Is a DPIA required?

Generally no for the core CMS. A DPIA becomes necessary if you enable modules performing behavioural analytics, automated decisions or large scale processing of sensitive content (health, political, biometric).

How do I implement 321 CMS compliantly?

Self host on an EU provider, keep the core up to date, sign a hosting DPA, plug a CMP in front of every optional module, document each cookie in your policy and audit the deployed site to verify what cookies are actually written.

Are there alternatives?

Open source alternatives include WordPress, Drupal, TYPO3, Strapi, Directus, Payload CMS and Statamic. European SaaS options like Storyblok or Hygraph reduce vendor lock in while preserving GDPR friendly hosting.

How do I update the cookie policy?

List the strictly necessary 321 CMS session cookies. For every active module, add a separate entry with provider, country, purpose, retention and a link to its privacy policy. Refresh after every module change or upgrade.

Same category

More services: CMS

See the whole category

GeneratePress GP Premium

GeneratePress GP Premium is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. GeneratePress GP Premium supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, GeneratePress GP Premium enables informed decisions that improve.

Analytics

Webcake

Webcake is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Webcake supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Webcake enables informed decisions that improve experience and drive results.

CMS

AgentFire

AgentFire is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. AgentFire provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, AgentFire helps deliver the right message to the right audience at the right time.

Marketing

JACKLIST

Jacklist is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Jacklist offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Jacklist empowers organizations to optimize strategy and maximize return on investment.

Analytics

BlogHunch

BlogHunch is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. BlogHunch offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, BlogHunch empowers organizations to optimize strategy and maximize return on investment.

Analytics

GetSimple CMS

GetSimple CMS provides a robust content management platform that enables organizations to create, organize, and distribute web content efficiently. Built with scalability and performance in mind, GetSimple CMS supports multi-site management, role-based access control, and advanced publishing workflows. Whether running a corporate website or a complex digital portal, GetSimple CMS delivers the flexibility and reliability needed to manage content at scale while maintaining optimal page load speeds and.

CMS

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site