Statamic

What Statamic is

Statamic is a Laravel based content management system created in 2012 by Jack McDade and Jason Varga. It started as a flat file CMS where every piece of content lives in YAML or Markdown files on disk, and has since been extended to support traditional databases such as MySQL, PostgreSQL and SQLite. Statamic is published under a commercial licence by Wilderborn Software LLC in the United States, with a free Statamic Solo edition available for small single user sites. It is very popular in the Laravel ecosystem because it integrates natively with Laravel features such as Eloquent, queues, Blade and the Artisan command line.

Self hosted by design

Statamic is installed on infrastructure that the customer chooses and operates. It can run on any PHP capable host: a virtual private server, a managed PaaS, Laravel Forge, Laravel Vapor, or the official Statamic Cloud offering which is itself built on top of Laravel Forge. In every case the customer remains in full control of where the data lives, which directly simplifies GDPR data residency analysis. Statamic Cloud lets the customer pick the deployment region, so European projects can keep their data within the EEA when they need to.

What data Statamic stores

The core CMS stores three categories of data: content authored by editors (pages, entries, taxonomies, assets), administrative user accounts (email, hashed password, optional profile fields, roles and permissions), and authentication artefacts such as the statamic_session cookie, the XSRF-TOKEN cookie used by Laravel for CSRF protection, and the optional laravel_session cookie when database sessions are enabled. No analytics, no fingerprinting and no behavioural tracking are performed on public visitors. The licence key validation contacts the Wilderborn servers in the United States during activation, which is a one off administrative call rather than ongoing user tracking.

GDPR implications

Because Statamic itself runs on customer infrastructure and does not embed third party scripts, it is one of the more GDPR friendly CMS options on the market. The data controller (the website operator) remains the sole party in contact with personal data, and there is no need to sign a data processing agreement with Statamic for the CMS engine itself. A processing agreement may however be required with the hosting provider, and with Wilderborn if Statamic Cloud is used. The GDPR footprint grows quickly when addons are installed: form builders, comment systems, analytics integrations, search providers and marketplace addons can each introduce their own cookies, telemetry and third country transfers, and must be evaluated individually.

Compliance steps for headless deployments

Statamic supports a headless mode through its REST and GraphQL APIs, where the administration interface runs on a private origin and a separate front end (Next.js, Nuxt, Astro, mobile app) consumes the content. In a headless deployment the public front end does not see the statamic_session or XSRF-TOKEN cookies at all, so the cookie banner only needs to cover the front end stack. The compliance checklist typically includes: hosting in an appropriate region, enforcing TLS, restricting the admin panel by IP or VPN, configuring secure cookie flags, documenting the role of Wilderborn as a licensor in the records of processing, and reviewing every Statamic addon for its own data flows.

Alternatives

Teams looking for similarly privacy friendly self hosted CMS options can consider Kirby (PHP flat file), Craft CMS (PHP, database backed), ProcessWire (PHP, very flexible), October CMS (Laravel based, similar audience), Laravel Nova (admin panel for custom Laravel apps) or Bagisto (Laravel e-commerce). All of these can be deployed under sole customer control, which keeps the GDPR analysis as straightforward as it is for Statamic.