Craft CMS

What is Craft CMS

Craft CMS is a commercial content management system written in PHP and built on the Yii framework. It was created in 2013 by Pixel & Tonic, Inc., a company based in Bend, Oregon, United States. The platform targets professional editorial websites and is widely adopted by digital agencies, especially in Europe, for content rich corporate sites, magazines, and brand publications. Craft CMS is distributed under a commercial licence with three tiers: Solo (free for personal or single editor projects), Pro (paid, multi user) and Enterprise (custom). The same company offers Craft Commerce, an ecommerce extension, and Craft Cloud, a managed hosting service that runs on DigitalOcean infrastructure.

What data Craft CMS stores by default

Out of the box, Craft CMS only processes data related to back end administration. It stores administrator and editor accounts (email, hashed password, name, optional profile fields), content created by those users, and basic session information for authenticated administrative requests. The CMS sets a small number of strictly necessary cookies for the administration panel: a CSRF token to protect against cross site request forgery, a session identifier for logged in users, and an optional persistent authentication cookie when the remember me feature is used. The public facing website does not receive any tracking cookies from Craft itself, and there is no built in analytics, telemetry or visitor profiling.

Self hosted versus Craft Cloud

Craft CMS can be installed on any infrastructure that supports PHP and a compatible database, giving the controller full freedom over the hosting region and data residency. European agencies frequently deploy Craft on EU based providers such as Hetzner, OVH, Scaleway or Combell to ensure that personal data remains within the European Economic Area. Alternatively, Pixel & Tonic offers Craft Cloud, a turn key managed hosting platform built on DigitalOcean that lets the controller choose a region, including EU locations. Regardless of the hosting choice, the licence activation and the optional plugin store communicate with Pixel & Tonic systems in the United States; these exchanges concern licence keys and software metadata, not visitor personal data.

GDPR implications

From a GDPR perspective the Craft CMS core is one of the most privacy friendly mainstream solutions available. There are no tracking cookies, no third party network calls on the public site, and the controller can keep the entire data flow inside the EU. The applicable legal bases for the data Craft does process are performance of contract (Art. 6(1)(b) GDPR) for the administrative relationship with editors, and legitimate interest (Art. 6(1)(f) GDPR) for securing the back end. The picture changes as soon as the website integrates third party services such as Google Analytics, Meta Pixel, embedded YouTube or Vimeo players, marketing automation forms or a tag manager: each of these may require a consent banner under the ePrivacy Directive and a documented legal basis. Plugins installed from the Craft Plugin Store can also extend the processing scope, so each addition must be reviewed.

Compliance steps for controllers

To deploy Craft CMS in a fully compliant manner, choose an EU based hosting region or a Craft Cloud EU region; sign a data processing agreement with the hosting provider; document the Pixel & Tonic licence exchange as ancillary processing; maintain an inventory of installed plugins and the data they process; implement a consent management platform for any third party scripts added on the front end; configure secure cookie attributes (Secure, HttpOnly, SameSite) on administrative cookies; enable backups and an incident response procedure; and update the privacy policy to reflect the actual data flows including hosting region and any sub processors.

Craft Commerce: additional considerations

If the site uses Craft Commerce, the processing footprint expands significantly. Customer accounts, order history, billing and shipping addresses are stored in the same database. Payment processing is typically delegated to third parties such as Stripe, PayPal, Mollie or Adyen, each of which acts as an independent controller or processor and must be reflected in the privacy notice. Marketing features (abandoned cart emails, transactional notifications) may require separate consent. A dedicated DPIA is recommended when Craft Commerce is deployed at scale or when sensitive product categories are involved.