> Kontent.ai and the GDPR: a Czech headless CMS on Microsoft Azure with an EU region, a cookieless Delivery API, editor cookies and DPA guidance. > > Canonical: https://www.flowconsent.com/en/services/cms/kontent-ai CMS # Kontent.ai Unclassified · [Official website](https://kontent.ai) Kontent.ai is a Czech headless CMS by Kontent.ai s.r.o. (Kentico group), hosted on Microsoft Azure with a Western Europe region. The Delivery API serves JSON without setting cookies on visitors, so the public delivery layer is GDPR friendly by default. Editor authentication on app.kontent.ai uses strictly necessary cookies. [Block Kontent.ai until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 6 - Servers Kontent.ai s.r.o. (Brno, Czech Republic, part of the Kentico group). Hosting on Microsoft Azure with regions including Western Europe (Netherlands), Eastern US (Virginia) and Australia East (Sydney). EU customers can pin their environment to the Western Europe region. CDN by Azure Front Door and Microsoft Edge nodes. Overview ## What does Kontent.ai do? ## **What Kontent.ai is and how it serves content** Kontent.ai is a headless content platform originally launched as Kentico Cloud in 2016 and renamed Kontent.ai in 2022. The publisher is Kontent.ai s.r.o. based in Brno, Czech Republic, part of the Kentico group. Editors create content items in app.kontent.ai. Published items are served as JSON via the Delivery API (deliver.kontent.ai). Frontends fetch the JSON and render the page. The public delivery layer is stateless and does not need any cookie on the visitor browser. ## **Cookies and identifiers set on visitors** The public Kontent.ai Delivery API does not set cookies on visitors. Editor side, app.kontent.ai sets authentication, session and CSRF cookies. The optional Web Spotlight feature loads the customer site inside an authenticated iframe so editors can click and edit, this preview is never reached by anonymous visitors. The Kontent.ai marketing site kontent.ai sets analytics cookies (Google Analytics, HubSpot, LinkedIn) that are scoped to that domain only. ## **GDPR and ePrivacy implications** Because the public Kontent.ai delivery does not place identifiers on the visitor terminal, Article 5(3) of the ePrivacy Directive does not require prior consent. Article 6(1)(f) GDPR (legitimate interest) covers the limited request metadata at the Azure CDN. Kontent.ai s.r.o. acts as processor under Article 28 GDPR. As a Czech company, Kontent.ai is fully subject to GDPR enforcement and the Czech Personal Data Processing Act, which is reassuring for European customers. ## **Data transfers and Schrems II** For European projects, create the environment in the Western Europe Azure region. Content storage and the Delivery API origin stay inside the EEA. Azure Front Door cache nodes are global, which is acceptable since only published JSON is cached. Some support and product analytics tools used internally by Kontent.ai may include US based providers, this is documented in the Kontent.ai privacy notice. ## **Practical compliance steps** Create the project in the Western Europe region at creation, sign the Kontent.ai DPA, document the processor in your RoPA, enable SSO and MFA for editor accounts, scope API keys to a single environment and use the secured delivery key when needed. Govern any third party script injected through Kontent.ai content via a consent management platform. Restrict Web Spotlight access to authorized editors. Compliance ## Kontent.ai and the GDPR - Legal basis Article 6(1)(f) GDPR (legitimate interest) for content delivery and abuse prevention. Strictly necessary cookies are used for editor authentication in app.kontent.ai. No consent required for the public delivery API. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, DSGVO, RGPD, LSSI, Czech Personal Data Processing Act ### Impact assessment (DPIA) A DPIA is generally not required for the public Kontent.ai delivery when the EU region is used. It should be considered when the project handles user generated content with personal data, when AI assisted features are enabled or when sensitive data is stored in items. Document the EU region selection, the DPA with Kontent.ai s.r.o. and the SSO setup for editor accounts. ### Sample text for your banner > This website uses Kontent.ai to deliver editorial content. The Kontent.ai Delivery API does not set cookies on visitors. No consent is required for the public delivery. Authentication cookies only apply to editors signed into app.kontent.ai. Cookies and trackers ## What Kontent.ai sets and contacts - Tracking method Headless CMS with content stored in a multi region cloud and exposed via the Delivery API (deliver.kontent.ai) and the Preview / Management APIs. The frontend fetches JSON, no cookies are set on the public site. The Kontent.ai app (app.kontent.ai) uses session cookies for editors. An optional Web Spotlight feature creates an authenticated preview iframe used by editors. - Server location Kontent.ai s.r.o. (Brno, Czech Republic, part of the Kentico group). Hosting on Microsoft Azure with regions including Western Europe (Netherlands), Eastern US (Virginia) and Australia East (Sydney). EU customers can pin their environment to the Western Europe region. CDN by Azure Front Door and Microsoft Edge nodes. - Cookieless mode available Yes ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------ | --------------------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------- | | kontent-auth | first-party (app.kontent.ai) | Session (up to 24 hours) | Editor authentication session cookie on app.kontent.ai. Strictly necessary, not set on the public website. | | kontent-csrf | first-party (app.kontent.ai) | Session | Anti CSRF token used by the Kontent.ai app to protect state changing operations. Strictly necessary. | | \_ga | third-party (marketing site only) | 2 years | Google Analytics cookie used on kontent.ai marketing site. Not set on customer websites. | ### Third-party domains contacted (6) - `kontent.ai` - `app.kontent.ai` - `deliver.kontent.ai` - `preview-deliver.kontent.ai` - `manage.kontent.ai` - `assets-eu-01.kc-usercontent.com` Questions ## Frequently asked questions about Kontent.ai Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Kontent.ai set cookies on website visitors? No. The public Delivery API serves JSON without cookies. Editor side cookies exist on app.kontent.ai for authentication, session and CSRF protection, and on the kontent.ai marketing site for analytics, but neither propagates to the customer website that consumes the Delivery API. ### Do I need consent for Kontent.ai under GDPR and ePrivacy? No consent is required for the public Delivery API because no identifier is stored on the visitor terminal. Editor cookies on app.kontent.ai are strictly necessary. Consent only applies to third party scripts you embed in your frontend. ### What is the legal basis for processing visitor data with Kontent.ai? Article 6(1)(f) GDPR (legitimate interest) covers the request metadata processed at the Azure CDN edge. Kontent.ai s.r.o., a Czech company, is documented as processor under Article 28 GDPR with a DPA available. ### Does Kontent.ai transfer data to the United States? When the Western Europe Azure region is selected, content storage and the Delivery API origin stay in the EEA. Some internal support and product analytics tools used by Kontent.ai may rely on US providers, listed in the privacy notice. As a Czech entity, Kontent.ai is fully under GDPR jurisdiction. ### Is a DPIA required for Kontent.ai? A DPIA is generally not required for a public editorial deployment when the EU region is used. It should be considered when AI assisted features are enabled, when sensitive data is stored in items or when Kontent.ai is combined with personalization features. ### How do I implement Kontent.ai compliantly? Pick the Western Europe region at creation, sign the DPA, document the processor in your RoPA, enable SSO and MFA, use Secured Delivery Keys when needed, scope API keys per environment, restrict Web Spotlight access and govern third party scripts in your frontend. ### What are the alternatives to Kontent.ai? Other EU headless CMS options include Storyblok (Austria), Contentful (Germany), Sanity (Norway), Strapi (France), Hygraph (Germany), Prismic (France) and self hosted Directus or Payload CMS. ### How do I update the cookie policy for Kontent.ai? List Kontent.ai as a content processor in your privacy policy with EU region, purpose and DPA reference. The public site does not need Kontent.ai in the cookie banner because no cookies are placed on visitors. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [JetTabs](https://www.flowconsent.com/en/services/cms/jettabs) [JetTabs is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. JetTabs offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, JetTabs empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/jettabs) [Analytics](https://www.flowconsent.com/en/services/cms/jettabs) · ### [Kleeja](https://www.flowconsent.com/en/services/cms/kleeja) [Kleeja is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Kleeja integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Kleeja helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/kleeja) [CMS](https://www.flowconsent.com/en/services/cms/kleeja) · ### [HashThemes Total](https://www.flowconsent.com/en/services/cms/hashthemes-total) [HashThemes Total is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. HashThemes Total supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, HashThemes Total remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/hashthemes-total) [CMS](https://www.flowconsent.com/en/services/cms/hashthemes-total) · ### [Twenty Thirteen](https://www.flowconsent.com/en/services/cms/twenty-thirteen) [Twenty Thirteen is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Twenty Thirteen supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Twenty Thirteen remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/twenty-thirteen) [CMS](https://www.flowconsent.com/en/services/cms/twenty-thirteen) · ### [Drupal Multisite](https://www.flowconsent.com/en/services/cms/drupal-multisite) [Drupal Multisite is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Drupal Multisite supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Drupal Multisite remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/drupal-multisite) [CMS](https://www.flowconsent.com/en/services/cms/drupal-multisite) · ### [ProfilePress](https://www.flowconsent.com/en/services/cms/profilepress) [ProfilePress is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. ProfilePress offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, ProfilePress empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/cms/profilepress) [Essential](https://www.flowconsent.com/en/services/cms/profilepress) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)