> Wiki.js is a self hosted open source wiki. Review of its data flows, authentication cookies, legal basis and GDPR implications for European organisations. > > Canonical: https://www.flowconsent.com/en/services/cms/wiki-js CMS # Wiki.js Unclassified · [Official website](https://js.wiki) Wiki.js is a modern, open source, self hosted wiki and knowledge management platform built in Node.js with a Vue.js front end. Teams use it as an internal documentation portal, a public knowledge base or a customer help center, with role based access, multiple storage backends and federation features. [Block Wiki.js until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 3 - Third-party domains 3 - Servers Anywhere the administrator chooses. Wiki.js is a self hosted application: production deployments typically run on a private VM, on managed Postgres in the EU, or in a Kubernetes cluster controlled by the operator. Overview ## What does Wiki.js do? Wiki.js is a modern, open source, self hosted wiki and knowledge management platform. It is written in Node.js with a Vue.js front end and stores content in a relational database (PostgreSQL, MySQL, MariaDB or SQLite). Organisations use it as an internal documentation portal, a customer knowledge base, a developer handbook or a public wiki, with full markdown and WYSIWYG editing. ## **What Wiki.js does** Wiki.js handles authentication (local accounts, OAuth, LDAP, SAML, OIDC), page editing with versioning, search through a configurable backend (built in, PostgreSQL full text or external such as Elasticsearch), media storage on disk or on S3 compatible buckets, and access control by group and page path. Optional modules add analytics (server side, opt in) and external rendering. ## **Data and cookies set** Wiki.js sets only strictly necessary cookies: a session identifier (jwt or wiki\_jwt) once a user logs in, a CSRF protection cookie, and a theme preference cookie when the dark mode toggle is used. Editor and reader IP addresses, user agents and edit timestamps are stored in the database for moderation and version history. No analytics, advertising or third country tag is loaded by Wiki.js itself. ## **GDPR and ePrivacy implications** Because Wiki.js is self hosted, the operator is the data controller and bears responsibility under GDPR. The strictly necessary session and CSRF cookies fall under the consent exemption of Article 5(3) ePrivacy Directive. Public reading of pages requires no consent. When the wiki uses external authentication (Microsoft, Google, GitHub) those identity providers may set their own cookies, which must be disclosed and, depending on the integration, consented to. ## **Consent requirements** No consent is required for the wiki itself in a typical deployment. Consent becomes necessary when the operator activates non essential modules: third party comment widgets, embedded videos or marketing pixels. The operator should map these in the cookie scan and present them through a CMP. The wiki privacy notice should disclose the editor list, the legal basis and the retention of page revisions and uploads. ## **Data transfers and hosting** Wiki.js sends no data to the upstream project by default. Data transfers are determined entirely by the operator: a Wiki.js on a German VM with a managed Postgres in Frankfurt has no third country transfer, while a Wiki.js using an external storage bucket in us east 1 does. Document the geography in the records of processing. ## **Practical compliance steps** Host Wiki.js and its database in the EU/EEA. Configure short retention for visitor IPs in the database (or hash them at write time). If single sign on is used, sign a DPA with the identity provider and add it to the records of processing. Disable any analytics module not strictly needed. Audit the user role matrix and delete inactive editor accounts at least once a year. Compliance ## Wiki.js and the GDPR - Legal basis For internal editorial use: legitimate interest of the controller (Art 6(1)(f) GDPR) and, for authenticated editors, performance of contract or employment relationship (Art 6(1)(b)). For public wiki access: the standard delivery cookies are strictly necessary and exempt from Art 5(3) ePrivacy consent. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, DSGVO/TDDDG (Germany), Loi Informatique et Libertes (France), LSSI CE (Spain) ### Impact assessment (DPIA) A DPIA is not required for a typical Wiki.js deployment, since the platform is self hosted, processes limited editorial data on a defined legal basis and does not perform automated decision making. A DPIA becomes relevant when the wiki holds large volumes of special category data (health, biometric), when single sign on involves cross border transfers, or when public editing is enabled and IP addresses are stored for moderation. Document the wiki in the records of processing as an internal collaboration system with editorial purpose. ### Sample text for your banner > This site uses Wiki.js, an open source self hosted wiki, to publish documentation. Only strictly necessary cookies are set when you log in or save a draft. No telemetry, analytics or advertising cookies are loaded by Wiki.js itself. Cookies and trackers ## What Wiki.js sets and contacts - Tracking method Self hosted Node.js application that authenticates editors and readers via local accounts, OAuth or LDAP, persists pages in a PostgreSQL or MySQL database, and serves a Vue.js front end. No telemetry is sent to the upstream Wiki.js project unless the administrator enables analytics modules. - Server location Anywhere the administrator chooses. Wiki.js is a self hosted application: production deployments typically run on a private VM, on managed Postgres in the EU, or in a Kubernetes cluster controlled by the operator. ### Cookies set (3) | Name | Type | Duration | Purpose | | ----------- | ------------------ | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- | | wiki\_jwt | Strictly Necessary | Session or as configured | First party authentication cookie storing the encoded JSON Web Token used to maintain the editor session after login. | | wiki\_csrf | Strictly Necessary | Session | First party CSRF protection cookie used to mitigate cross site request forgery on form submissions in the editor and the admin interface. | | wiki\_theme | Preferences | 1 year | First party preference cookie remembering the dark or light theme chosen by the user. | ### Third-party domains contacted (3) - `js.wiki` - `docs.requarks.io` - `github.com` Questions ## Frequently asked questions about Wiki.js Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Wiki.js set? Wiki.js sets only strictly necessary cookies: a session cookie (wiki\_jwt) once a user logs in to record the authenticated session, a CSRF cookie used to protect form submissions, and an optional theme cookie when the dark mode toggle is used. No analytics or advertising cookie is set by the upstream project. ### Do visitors have to consent to Wiki.js? No. The cookies set by Wiki.js are strictly necessary for authentication and CSRF protection, which fall under the consent exemption of Article 5(3) of the ePrivacy Directive. Public reading of pages and editing through an authenticated session do not require additional consent. ### What is the legal basis for processing on Wiki.js? For an internal team wiki: legitimate interest of the controller (Art 6(1)(f) GDPR) for documentation purposes and, for authenticated editors, the performance of the contract or employment relationship (Art 6(1)(b)). For public wikis where anonymous edits are allowed, legitimate interest of the controller for moderation may justify IP logging. ### Are data transferred to the United States? Not by Wiki.js itself. The upstream project sends no telemetry. Third country transfers depend entirely on the operator: a self hosted Wiki.js on a German VM with EU storage performs no transfer, while a Wiki.js using S3 in us east 1 or Microsoft 365 SSO does. The operator must document the hosting in its records of processing. ### Is a DPIA required for Wiki.js? A DPIA is not required for a typical internal Wiki.js deployment. It becomes necessary when the wiki processes special category data (health, biometric), runs at very large scale or is used as the single record system for HR documentation. Run a screening assessment first, then a full DPIA if any criterion is met. ### How do I implement compliance correctly? Host Wiki.js and its database in the EU/EEA. Disable any optional analytics module not needed. Hash visitor IP addresses or set a short retention. If SSO is enabled, sign a DPA with the identity provider and add it to the records of processing. Audit user roles and delete inactive accounts at least yearly. ### What are the alternatives to Wiki.js? Open source alternatives include BookStack, Outline, MediaWiki, DokuWiki, XWiki and Hugo based static sites. Hosted options include Notion, Confluence, GitBook and Slab. The choice depends on collaboration model, hosting flexibility and data residency requirements. ### How do I update the cookie policy? List the three strictly necessary cookies (wiki\_jwt, CSRF, theme) with their duration and purpose. Mention that no analytics or marketing cookie is set. If you have added external modules (Disqus comments, embedded YouTube, Google Tag Manager) document them separately and route them through the CMP. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [Zensical](https://www.flowconsent.com/en/services/cms/zensical) [Zensical is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Zensical integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Zensical helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/zensical) [CMS](https://www.flowconsent.com/en/services/cms/zensical) · ### [QoreAI](https://www.flowconsent.com/en/services/cms/qoreai) [QoreAI is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. QoreAI integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, QoreAI helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/qoreai) [CMS](https://www.flowconsent.com/en/services/cms/qoreai) · ### [Web Stories for WordPress](https://www.flowconsent.com/en/services/cms/web-stories-for-wordpress) [Web Stories for WordPress is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Web Stories for WordPress supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Web Stories for WordPress remains a leading.](https://www.flowconsent.com/en/services/cms/web-stories-for-wordpress) [CMS](https://www.flowconsent.com/en/services/cms/web-stories-for-wordpress) · ### [WordPress](https://www.flowconsent.com/en/services/cms/wordpress) [WordPress is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. WordPress supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, WordPress remains a leading web development choice.](https://www.flowconsent.com/en/services/cms/wordpress) [CMS](https://www.flowconsent.com/en/services/cms/wordpress) · ### [DataLife Engine](https://www.flowconsent.com/en/services/cms/datalife-engine) [DataLife Engine is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. DataLife Engine integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, DataLife Engine helps organizations maintain robust websites that meet user expectations and.](https://www.flowconsent.com/en/services/cms/datalife-engine) [CMS](https://www.flowconsent.com/en/services/cms/datalife-engine) · ### [Flarum](https://www.flowconsent.com/en/services/cms/flarum) [Flarum is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Flarum supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Flarum ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/flarum) [CMS](https://www.flowconsent.com/en/services/cms/flarum) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)