Storyblok

What Storyblok is and how it serves content

Storyblok is a headless content management system founded in Linz, Austria in 2017. Editors compose pages inside a Visual Editor and the published content is exposed as JSON through a Content Delivery API. The frontend, built with any framework (Next.js, Nuxt, Astro, Hugo and others), fetches that JSON server side or client side and renders the HTML. Because the public delivery layer is a stateless REST and GraphQL API, it does not write cookies on the visitor browser and behaves like a normal asset fetch.

Cookies and identifiers set on visitors

On the public website Storyblok sets no cookies. The CDN edge only stores standard request logs containing IP address, timestamp and user agent for caching and abuse prevention. Cookies appear in two specific contexts. First, when an editor is logged into app.storyblok.com a session cookie identifies the user. Second, when the Visual Editor preview is loaded for content authoring, the bridge script app.storyblok.com/f/storyblok-v2-latest.js opens an iframe inside the live preview to allow click to edit. This preview mode is for editors only and is not seen by anonymous visitors.

GDPR and ePrivacy implications

Because the public Storyblok delivery API does not place identifiers on the visitor terminal, Article 5(3) of the ePrivacy Directive (the cookie rule transposed into TTDSG in Germany, the LCEN in France and the LSSI in Spain) does not require prior consent. Article 6(1)(f) GDPR (legitimate interest) covers the limited processing of the visitor IP at the CDN edge for delivery and security. Storyblok GmbH acts as data processor when it stores editorial content, and a standard Article 28 data processing agreement is available in the Storyblok dashboard.

Data transfers and Schrems II

Storyblok offers two delivery regions. The EU region runs on AWS Frankfurt and serves the content from inside the European Economic Area, which keeps the project free from a Schrems II analysis on the delivery path. The US region runs on AWS Virginia and requires Standard Contractual Clauses plus an assessment of US surveillance laws (FISA 702, EO 12333). For European projects we recommend always selecting the EU region at space creation, since changing it later is not possible without exporting and reimporting the content.

Practical compliance steps

Document Storyblok as a processor in the record of processing activities (RoPA) with purpose, EU region and asset CDN (Cloudflare). Sign the Storyblok DPA from the dashboard. Restrict editor accounts with single sign on or two factor authentication. If you embed third party scripts (Google Analytics, Meta Pixel, video) through Storyblok components, those scripts have their own consent requirements and must be gated by your consent management platform, the Storyblok delivery itself is out of scope. Make sure the Visual Editor preview URL is protected behind authentication so the bridge cookies are never set on anonymous visitors.