SECURITY & COMPLIANCE

Enterprise Security You Can Verify

Protect your content, data, and infrastructure with security controls built across the dotCMS platform. Independently assessed security, privacy, and AI governance programs help organizations meet rigorous security and compliance requirements.

ISO/IEC 27001 · ISO/IEC 42001 · SOC 2 Type II · TX-RAMP Level II

Access and Security Docs dotCMS Trust Center

ISO/IEC 42001:2023 Certified
AI governance, independently verified.

dotCMS is certified to ISO/IEC 42001:2023, the international standard for AI management systems. The certification covers the governance and risk management practices applied to customer-facing dotAI capabilities and internal AI use.

In dotCMS, an AI agent is another actor in the system: it works inside the same roles, permissions, and workflows as a person, and every change it makes stays traceable and reversible through version history.

How dotCMS governs AI-assisted work about How dotCMS governs AI-assisted work
TX-RAMP Level II
Security requirements for Texas public-sector organizations.

dotCMS is certified at TX-RAMP Level II, demonstrating that dotCMS Cloud meets the security requirements established for cloud service providers working with Texas state agencies and other eligible public-sector organizations.
SOC 2 Type II
Security controls tested over time.

dotCMS has completed a SOC 2 Type II examination. An independent CPA firm assessed dotCMS controls against the AICPA Trust Services Criteria for security, availability, and confidentiality and tested their operating effectiveness over time.

The full report and auditor test results are available through the dotCMS Trust Center.
Request the SOC 2 report about Request the SOC 2 report
ISO/IEC 27001:2022
Information security managed to an international standard.

dotCMS is ISO/IEC 27001:2022 certified, demonstrating that its information security management system follows internationally recognized requirements for managing security risks and protecting information across its cloud services and supporting operations.
CAIQ
Cloud security controls, documented and accessible.
dotCMS maintains a completed Consensus Assessments Initiative Questionnaire (CAIQ) from the Cloud Security Alliance, providing customers and auditors with detailed information about its cloud security practices and controls.
View the CAIQ about View the CAIQ

01 / 05

ISO/IEC 42001:2023 Certified

AI governance, independently verified.

dotCMS is certified to ISO/IEC 42001:2023, the international standard for AI management systems. The certification covers the governance and risk management practices applied to customer-facing dotAI capabilities and internal AI use.

In dotCMS, an AI agent is another actor in the system: it works inside the same roles, permissions, and workflows as a person, and every change it makes stays traceable and reversible through version history.

How dotCMS governs AI-assisted work

02 / 05

TX-RAMP Level II

Security requirements for Texas public-sector organizations.

dotCMS is certified at TX-RAMP Level II, demonstrating that dotCMS Cloud meets the security requirements established for cloud service providers working with Texas state agencies and other eligible public-sector organizations.

03 / 05

SOC 2 Type II

Security controls tested over time.

dotCMS has completed a SOC 2 Type II examination. An independent CPA firm assessed dotCMS controls against the AICPA Trust Services Criteria for security, availability, and confidentiality and tested their operating effectiveness over time.

The full report and auditor test results are available through the dotCMS Trust Center.

Request the SOC 2 report

04 / 05

ISO/IEC 27001:2022

Information security managed to an international standard.

dotCMS is ISO/IEC 27001:2022 certified, demonstrating that its information security management system follows internationally recognized requirements for managing security risks and protecting information across its cloud services and supporting operations.

05 / 05

CAIQ

Cloud security controls, documented and accessible.

dotCMS maintains a completed Consensus Assessments Initiative Questionnaire (CAIQ) from the Cloud Security Alliance, providing customers and auditors with detailed information about its cloud security practices and controls.

View the CAIQ

Check which dotCMS deployment meets your infrastructure and security standards

dotCMS runs where your policy requires it to run, under the same certified governance model. dotCMS Cloud on AWS is one deployment option, not the only one. Meet infrastructure, security, and data-residency requirements without locking your content strategy into one deployment model.

dotCMS Cloud

Fully managed on dotCMS's AWS infrastructure, including monitoring, patches, and upgrades.

Cloud Anywhere

Fully managed by dotCMS on AWS, Azure, or GCP, with you contracting directly with your own cloud provider.

Self-hosted

You own and control the infrastructure, whether for company policy or geographic requirements.

For your security review

The infrastructure, encryption, and operational controls explained

dotCMS Cloud has been hosted on Amazon Web Services since 2009. AWS manages security from the host operating system and virtualization layer through the physical infrastructure, while dotCMS manages the application and cloud configuration controls used to operate the dotCMS platform.

The dotCMS Cloud environment is set up based on dotCMS’ best-practices for performance and security as it follows. Each environment is made up of multiple layers: Load balance layer, Web proxy layer, Application layer and Database layer. Each virtual machine in each layer has its own host-based firewall rules. And because a typical environment contains multiple instances (nodes) of the site application server and the CMS application server, it ensures delivering high performance and availability. Environments in our context are indeed physically separate servers.
dotCMS performs full daily backups of all customer data. Because the dotCMS repository stores all content within the database, a complete database backup ensures full data protection. Backups are securely transmitted over a dedicated private connection to a secondary data center located in a geographically separate region, ensuring resilience and disaster recovery readiness. For quality assurance and operational needs, it is standard practice to restore Production backups into Development or Testing environments to support testing during projects or new releases. The dotCMS Infrastructure Team, responsible for managing the dotCMS Cloud platform, conducts regular testing of backup and restoration procedures to validate data integrity and ensure recovery readiness.

In addition to its backup and security protocols, dotCMS maintains a comprehensive Business Continuity and Disaster Recovery (BCDR) plan to ensure the continuity of operations and rapid recovery during disruptive events. The plan is supported by annual rehearsals, including tabletop exercises and simulated recovery scenarios, to validate readiness and maintain alignment with current operational requirements. Full details are documented in the dotCMS Business Continuity Plan, available as a separate document upon request.
dotCMS development staff are trained in secure coding practices and the OWASP Top 10. All code changes undergo both automated analysis and code review before reaching production.

Internally, dotCMS staff access to customer data follows least-privilege principles - employees are granted only the access a given task requires. Each client's data uses a unique rotating credential set, with credentials granted only to the employees and systems needed for support and maintenance.
Every employee completes privacy, data protection and security training at onboarding and at least annually. Employee devices are monitored for ongoing compliance with dotCMS security protocols, and every employee contract includes confidentiality clauses.
Applications are built using dotCMS’ tested and secure application delivery framework, which enforces a security session and is always present, making it possible to restrict access up to field level on content objects. dotCMS is functionally separated into the authoring tier, the repository and the delivery tier, but also logically separated into load balance layer, web proxy layer, application layer, and a database layer. Each virtual machine in each layer has its own host based firewall rules. Data lives less than seconds in the web layer as it’s only passed through by the proxies, unless (disk) caching is enabled in the proxy layer.
dotCMS ensures the protection of all data—both in transit and at rest—using industry-standard, robust encryption methods.

All stored data is encrypted using enterprise cloud services such as AWS server-side encryption with AES 256 cipher, one of the strongest block ciphers available. Encryption keys are AWS-owned or AWS-managed and stored in AWS Key Management Service (KMS) or Amazon S3. Customers may optionally configure AWS services to use customer-managed KMS keys or customer-supplied keys.
All data exchanged between dotCMS Cloud tiers (Authoring, Repository, Delivery) is encrypted using TLS, with TLS v1.2 as the minimum acceptable standard. Public-facing web properties, infrastructure components, and applications employ SSL/TLS, IPsec, or SSH to secure communications over public networks, with certificates signed by a trusted Certificate Authority (CA).
Encryption Key Management
Encryption keys generated, stored, and managed by dotCMS are protected against loss, theft, and compromise. Key generation uses an industry-standard cryptographically secure random number generator (CSRNG).
dotCMS insulates the cloud platform from inappropriate or malicious Internet traffic by utilizing multiple network defenses, from firewalls and network intrusion detection to 24/7/365 network surveillance and incident response program.

Customers may connect to the CMS in any fashion over the internet as CMS security is independent of customer network connectivity. dotCMS Cloud is protected from network intrusions and attacks by a redundant pair of perimeter firewalls. Bi-directional rules control the flow of traffic to and from the dotCMS Cloud platform, permitting only packets that are explicitly required to deliver the dotCMS Cloud service. Only secure sessions that pass inspection by the perimeter firewall can reach the dotCMS Cloud platform.

Protecting Your Data & Infrastructure

dotCMS Cloud has been hosted on Amazon Web Services since 2009. AWS manages security from the host operating system and virtualization layer through the physical infrastructure, while dotCMS manages the application and cloud configuration controls used to operate the dotCMS platform.

The dotCMS Cloud environment is set up based on dotCMS’ best-practices for performance and security as it follows. Each environment is made up of multiple layers: Load balance layer, Web proxy layer, Application layer and Database layer. Each virtual machine in each layer has its own host-based firewall rules. And because a typical environment contains multiple instances (nodes) of the site application server and the CMS application server, it ensures delivering high performance and availability. Environments in our context are indeed physically separate servers.

AUTHENTICATION AND ACCESS

How do authentication and role mapping work in dotCMS?

dotCMS authenticates against your identity provider and enforces authorization with its own roles and permissions.

Read Roles and Permissions Docs

SAML single sign-on

Configured through the SAML App in the Apps tool. dotCMS documents configuration for Okta, Azure AD, Google, Amazon, and Shibboleth.

Role mapping

Identity-provider role names are mapped onto existing dotCMS roles, so access is governed by the roles your IdP already assigns.

Per-site configuration

A different SAML configuration can be specified for each site, or one configuration applied across all sites.

API tokens

REST API calls authenticate with JWT API tokens, and every call uses the permissions of the user the token was created for. Content returned by the REST API always respects dotCMS permissions.

Security & Privacy Policies

dotCMS has implemented a set of corporate policies to take maximum security measures for our clients and our company. These policies are reviewed periodically (at a minimum once per year) as part of our business continuity plan. dotCMS currently has the following security & privacy policies implemented:

Read our privacy policies

Code of Conduct
Cryptography Policy
Data Classification Policy
Data Deletion Policy
Data Protection Policy
Disaster Recovery Plan
Incident Response Plan
Information Security Policy

Privacy policy
Cookie Policy
GDPR policy
Acceptable Use Policy
Asset Management Policy
Backup Policy
Business Continuity Plan
Change Management Policy

Password Policy
Physical Security Policy
Responsible Disclosure Policy
Risk Assessment Program
Security Questionnaires Policy
System Access Control Policy
Vendor Management Policy
Vulnerability Management Policy

Read on Security at dotCMS

Browse all articles

19 Aug 26
Product
Content Modeling Best Practices: How to Structure Content for Reuse Across Pages, Sites, and AI
Learn content modeling best practices to structure entity-centric, reusable content for pages, multi-site and multi-channel delivery, and AI search.
3 Mar 26
Driving Content Innovation: Our 2026 Roadmap
Join VP of Product Freddy Montes for a walk through of the exciting things dotCMS is working on in 2026
20 Feb 26
Content Style Editor: Visual Design Control Inside Your CMS
Eliminate developer bottlenecks with the dotCMS Content Style Editor, empowering content teams to instantly customize component styling, improve content reuse, and accelerate publishing without code.
28 Jan 26
8 Best Open Source Intranet Software in 2026
Looking for the best open source intranet software? Find the top 8 solutions for 2026 to boost productivity and collaboration in your workplace.
15 Jan 26
A UX-Driven Approach to Modernizing dotCMS
Modernizing a CMS isn’t about fixing what’s broken, it’s about leading its evolution. In this post, we share how dotCMS is taking a UX-led approach to future-proof the platform, aligning usability, scalability, and long-term product strategy to support what’s next.

SECURITY & COMPLIANCE

Enterprise Security You Can Verify

ISO/IEC 42001:2023 Certified

TX-RAMP Level II

SOC 2 Type II

ISO/IEC 27001:2022

CAIQ

ISO/IEC 42001:2023 Certified

TX-RAMP Level II

SOC 2 Type II

ISO/IEC 27001:2022

CAIQ

Check which dotCMS deployment meets your infrastructure and security standards

dotCMS Cloud

Cloud Anywhere

Self-hosted

Protecting Your Data & Infrastructure

AUTHENTICATION AND ACCESS

How do authentication and role mapping work in dotCMS?

SAML single sign-on

Role mapping

Per-site configuration

API tokens

Security & Privacy Policies

Read on Security at dotCMS

Content Modeling Best Practices: How to Structure Content for Reuse Across Pages, Sites, and AI

Driving Content Innovation: Our 2026 Roadmap

Content Style Editor: Visual Design Control Inside Your CMS

8 Best Open Source Intranet Software in 2026

A UX-Driven Approach to Modernizing dotCMS

Explore dotCMS for your organization

dotCMS Named a Major Player

Explore an interactive tour

Built for Compliance. Certified for AI.

Content Modeling Best Practices: How to Structure Content for Reuse Across Pages, Sites, and AI

Driving Content Innovation: Our 2026 Roadmap

Content Style Editor: Visual Design Control Inside Your CMS

8 Best Open Source Intranet Software in 2026

A UX-Driven Approach to Modernizing dotCMS