What should you expect from an enterprise CMS?
When we advise a client on a CMS, we first decide what kind of programme it is, and only then which platform fits. We sort programmes into tiers, and the enterprise tier is the top one. It is also the tier where the feature list decides the least, because every platform we would consider can model content, run a workflow and serve an API.
This article describes what we expect from an enterprise CMS on top of that, and why we don’t expect it from every CMS.
What makes a programme enterprise?
We don’t call a programme enterprise because the company behind it is large. We call it that when it covers several brands, markets or channels, when it is regulated or audited, and when the client runs its own digital team of five people or more. Programmes like that typically come to €500,000 or more in total investment.
€500k+ is the typical total investment of an enterprise programme: several brands, markets or channels, audited, with its own digital team.
Those signals change who is involved. A single-brand website has one team, and that team can agree its rules in a meeting. An enterprise programme has editors in several countries and agencies working beside internal teams. It also has security, legal and procurement departments that each have to approve the platform before anyone uses it.
So we judge an enterprise CMS on three things beyond content management. People who never log in must be able to approve it. It must keep many teams inside the same rules. And it must still be a sound choice at the end of the contract.
A platform in a lower tier doesn’t have to do any of this, and we don’t hold that against it. Those platforms put their effort elsewhere, for example into an editing environment a team can shape around its own way of working, or into personalisation that works on the first day.
Can security, legal and procurement approve it?
In our experience, enterprise CMS selections rarely stall on features. They stall on the security questionnaire, the data processing agreement, the question of where the data lives, and getting a new supplier through procurement.
Procurement wants to know whether this is one more vendor to onboard. We expect an enterprise platform to be available through a channel the company already buys from. Contentstack’s Azure Marketplace listing is marked “Azure benefit eligible”, so a purchase through the Azure portal counts towards the yearly amount many enterprises have already committed to Microsoft. AWS Marketplace offers a similar route. Contentful became part of Salesforce on 1 September 2026, which for a Salesforce customer means a supplier it already knows.
Legal wants to know where the content lives, and expects the answer to include the backups. Both platforms can keep content and backups in the EU. Both also make you choose up front. Contentstack sets the home region when the organisation is created and can’t change it afterwards. Contentful sells EU data residency as an add-on and provisions a new organisation for it. We settle the region in the first architecture workshop, with the client’s security team in the room.
Storing data in the EU is a narrower promise than it sounds. Contentful states on the same page that it can’t guarantee EU data is only processed in and accessed from the EU. A client with that requirement has to raise it in the contract, whichever platform it picks.
Security wants certificates, and both platforms have them. Contentstack and Contentful each list ISO 27001 and a SOC 2 Type 2 report. Certificates get a platform onto the shortlist. What separates platforms after that is the detail a security review finds later, and we would rather find it first. Contentstack’s organisation audit log looks back 30 days, so an auditor who asks for a year of history needs those logs exported somewhere else.
Does it keep many teams inside the same rules?
A small team keeps its rules by talking to each other. Across several brands and countries that stops working, so the platform has to enforce what the organisation has agreed.
The four controls we look for:
- 1
Roles that go down to a single field. In Contentstack a custom role can allow someone to edit only the SEO fields of an entry.
- 2
Approval that authors can’t give themselves. Contentstack’s publish rules can block the last editor from approving, and can require a workflow stage such as “Legal approved” before content reaches production.
- 3
User accounts that follow the company directory, so that someone who leaves loses access the same day. Both platforms do this through SCIM.
- 4
A log of who changed what.
Then there is the structure. An enterprise has to decide whether its brands share one content space or each get their own. Contentful offers Orchestration, which reuses content and content models across connected spaces. A Contentstack organisation can hold several stacks, but we found no documented way to share a content model between them. On Contentstack we therefore choose between one stack with a set of roles per brand and one stack per brand, and we make that choice during architecture, before any content is entered. It is the decision that is hardest to reverse.
Several of these controls depend on the plan. Publish rules and SCIM are plan-dependent in Contentstack, and single sign-on, SCIM and audit logs are Premium features in Contentful. The governance requirements therefore partly decide the licence tier, and we bring them into the commercial conversation while procurement is still at the table.
Will it still be a sound choice when the contract ends?
An investment of this size has to last for years, so we look at who owns the vendor and at what the platform includes.
Ownership changed this year for one of the two platforms we recommend. Salesforce completed its acquisition of Contentful on 1 September 2026, and says Contentful will be integrated natively across Customer 360 and made accessible to Agentforce. For an organisation that runs on Salesforce, that is an advantage, because its content will sit beside its customer data. For any other organisation, it means a roadmap set by a company whose main product it doesn’t use.
Contentstack is an independent vendor today. We don’t treat that as a guarantee, because independent vendors change direction and owners as well. What protects a client is a content model that avoids vendor-specific constructs where it can, and content that can leave through the API. We check both on every platform.
What the platform includes matters more each year, mostly because of AI. An agent that writes a page and publishes it should be bound by the same roles, approvals and audit log as a person. That is far easier to enforce when the agent runs inside the CMS than when it works through a separate tool. Contentstack’s assistant works with the same rules and permissions as the person using it, and its agent platform keeps its own audit log. We expect that from an enterprise platform, and we would not put publishing agents in front of a regulated client without it.
Contentful or Contentstack: which one fits?
In the enterprise tier we work with two platforms, and one question decides between them. If the organisation runs on Salesforce, with its customer data in Sales, Service, Marketing or Commerce Cloud, we recommend Contentful. If it doesn’t, Contentstack is our default.
Neither platform meets every expectation in this article. The table shows where they differ on the questions a buying committee asks.
When is an enterprise CMS not worth it?
Everything above has a price. The governance features push the licence into a higher tier. The region and the brand structure have to be decided before the first content is entered, which means workshops with security and legal before the build starts. Editors work inside approval steps that a small team would find slow.
A programme with one brand, one market and no auditor gets nothing back for that. We advise those clients against an enterprise platform, even when the budget would allow one. Scale doesn’t settle it either. A programme at enterprise scale that needs product data and commerce composed together, or editing screens built around its own teams, is better served by a different kind of platform.
Our advise
Our advice is to describe the programme before comparing platforms. Count the brands and markets, ask whether an auditor will read the logs, and look at the size of the team that will run it.
If the answers describe an enterprise programme, test each platform on the three expectations in this article, and let the Salesforce question decide between Contentful and Contentstack. If they don’t, a platform from a lower tier will cost less and suit the team better.
Book a call with us