Acquia

Drupal's Field API ships 20+ core field types, unlimited custom content types and entity types, Paragraphs for nested and polymorphic components, and allowed-values constraints. Schema is exportable as YAML through configuration management, which gives a real schema-as-code workflow. Not higher because schema-as-code is config export rather than a typed programmatic schema API.

Entity Reference fields support many-to-many references with target-bundle filtering across multiple types, and Views relationships traverse references in both directions. JSON:API includes and GraphQL queries resolve referenced entities. Bidirectional sync of reference fields needs the Corresponding Entity References contrib module, and there is no graph-native traversal, so it stops at 80.

Paragraphs gives unlimited nesting of typed components inside entries, Single Directory Components and Drupal Canvas Content Templates bind fields into reusable component slots, and Block Content entities provide reusable fragments. Composition is mature and widely used. Rich text remains HTML rather than a portable structured format, which keeps it below the top band.

Drupal's Typed Data layer uses Symfony constraints for required, unique, length, range, allowed values and file type/size, and those constraints run on every entity save, including JSON:API and REST writes. Custom constraint plugins allow cross-field and arbitrary rule logic in code, and Field Validation adds UI-configured rules. Not higher because cross-field rules need developer work rather than a UI rule engine.

Core revisions keep unlimited history with author attribution and revision log messages, revert is one click, and Workspaces (stable since 10.3, in Drupal 11 core) gives site-wide staging with atomic publishing. Field-level diff comes from the widely used Diff contrib module, and restoring deleted content needs the Trash contrib module. Not higher because diff and undelete are contrib and there is no merge or conflict resolution between workspaces.

Core Taxonomy provides unlimited vocabularies with hierarchical terms, terms are fieldable entities reusable across any content type, per-vocabulary permissions govern who may create or edit terms, and terms are exposed through JSON:API and GraphQL. Bulk reclassification is available through Views Bulk Operations, and Acquia DAM adds governed metadata schemas for assets. Not higher because synonyms and approval workflows on terms need contrib modules.

On coupled Drupal sites, draft preview is the real rendered site, Workspaces previews a whole staged site, and Drupal Canvas 1.0 (default in Drupal CMS 2.0) adds in-place editing on the page. For headless frontends, next-drupal provides draft preview on Next.js, but there is no click-to-edit overlay on a decoupled frontend, and shareable preview links need the Preview Link contrib module. Strong for coupled sites, adequate for headless, so it sits mid-70s.

CKEditor 5 in core offers configurable toolbars and text formats, Media Library embeds, entity embeds, source editing with allowed-tag filtering, and clean paste from Word and Google Docs. Output is a filtered HTML string rather than a portable structured format, which caps it below 75 under the rubric.

Core Media and Media Library handle upload, alt text, metadata fields and reuse, and core image styles generate resized, cropped and WebP-converted derivatives with responsive image support. Focal point cropping comes from the Focal Point contrib module and usage tracking from Entity Usage. Not 75+ because transforms are preconfigured styles rather than URL-based on-the-fly transforms and key pieces are contrib.

Drupal has no simultaneous co-editing or presence indicators in core; Content Lock offers pessimistic locking and core detects concurrent edits by rejecting stale saves. CKEditor 5 Premium real-time collaboration exists but needs a separate CKEditor license and integration. Comments and mentions on draft content are not native, so it sits at the low edge of the limited band.

Core Workflows and Content Moderation support unlimited custom states, role-based transition permissions, per-content-type workflows and a revision log audit trail of each transition. Task assignment, due dates, notifications and conditional routing need contrib modules or ECA rules. Configurable but not turnkey, so just below 70.

Scheduled publish and unpublish come from the Scheduler module, which ships in Drupal CMS and in Acquia Source, and Scheduled Transitions handles moderation-state scheduling. Workspaces publishes a set of changes atomically, which works as a release bundle, though scheduling a workspace publish is not native. No core publishing calendar view, so it lands in the 60s.

Core Content Translation gives field-level translation with per-field translatability, 90+ languages, language negotiation, per-language revisions and moderation states, and JSON:API access per language prefix. Fallback to the original language is native, while configurable multi-step fallback chains need contrib. Strong field-level model, slightly short of best because of the fallback gap.

Drupal offers unlimited custom roles with granular per-content-type and per-operation permissions, Field Permissions for field-level access, Group for entry-level access, and SAML SSO on Acquia Cloud. Acquia's own docs state SCIM is not supported for Cloud Platform and IdP role mapping is manual. Strong role model without SCIM keeps it in the 45 to 65 band.

JSON:API in core provides spec-compliant filtering, sorting, pagination, sparse fieldsets and includes, core REST is also available, and the GraphQL contrib module adds schema-customizable GraphQL. Drupal 11.4 improved entity loading for JSON:API. Not higher because delivery and management share one API surface and GraphQL is contrib.

Acquia Cloud includes Varnish, and Acquia Edge adds a Cloudflare or Akamai CDN with cache-tag based purging through the Purge module for granular invalidation on publish. Edge computing and edge personalization are not part of the standard offering, and Edge is a separately purchased add-on. Solid but not best in class.

Internal hooks and the Symfony event dispatcher cover every entity and workflow event, ECA automates event-driven actions, and Acquia Source ships node webhooks with a delivery history page. On Acquia Cloud Drupal sites, outbound webhooks with signing and retry rely on contrib modules, and there is no managed event streaming. Solid coverage, uneven delivery tooling.

JSON:API and GraphQL make content available to any channel, next-drupal supports Next.js, and Content Hub syndicates content across sites. There are no official multi-language SDKs or mobile SDKs and rich text is HTML, so this reads as a traditional CMS with a strong API layer.

Acquia CDP provides unified profiles, 300+ segment filters, identity resolution and ML segments, and Acquia Convert adds behavioral segments for web targeting. Both are separately licensed from the Cloud Platform and Drupal, which have no segmentation of their own. Strong add-on capability held below the 75 ceiling because audiences reach Drupal content only through the separate products.

Acquia Personalization reached end of life on January 31, 2026, and its replacement, Acquia Convert, delivers segment-based variants through a no-code visual editor layered on the rendered page. Variants are not authored as Drupal content with per-audience preview in the editor. Add-on with a weaker content integration than the product it replaced.

Acquia Convert runs A/B, multivariate and split tests with Bayesian statistics, results reporting and one-click rollout, plus heatmaps and session recordings. It is a genuine experimentation product but a separate SKU. No bandit or auto-allocation, so below the add-on ceiling.

Acquia CDP includes predictive models and personalized recommendation outputs, but they are pushed to channels rather than delivered as an in-CMS recommendation component. With Personalization retired, content recommendations on Drupal pages need integration work. A real ML engine behind significant setup.

Acquia Search, now delivered on SearchStax, provides managed Solr with Search API integration, faceting, autocomplete and search analytics, and Drupal core search is available for basic needs. Typo tolerance, merchandising and relevance tuning trail dedicated search products. Add-on with solid but not leading capability.

Drupal Commerce provides catalog, variations, pricing, cart, checkout and orders, but it is a community-maintained ecosystem project rather than an Acquia product, and Acquia's commerce strategy is integration with external platforms. Real commerce capability with substantial build effort, scored as an ecosystem integration.

Acquia Commerce Framework documents integrations with Shopify Plus, BigCommerce and commercetools, Acquia DAM syncs assets to Shopify, and Acquia Exchange lists Adobe Commerce and commercetools connectors. Most connections need middleware and custom work rather than live API federation out of the box.

Content and page performance analytics come from separate products: Convert Insights for heatmaps and recordings, CDP dashboards for customer analytics, Acquia Optimize for site quality and accessibility reporting, and DAM Insights for asset usage. Drupal and Cloud Platform themselves report operational metrics only. Real analytics, fragmented across add-ons.

Google Analytics, Google Tag Manager and Adobe Analytics contrib modules are widely used and mature, and Acquia Exchange lists Adobe Analytics. These are ecosystem connectors rather than vendor-built integrations, so the integration ceiling applies.

Acquia Cloud Site Factory runs hundreds of sites on a shared codebase with central governance, and Content Hub syndicates content across them; Multi-Experience Operations on Cloud Next extends this. Both Site Factory and Content Hub are separate products, while plain Drupal multisite on Cloud Platform shares code but not content. Mature add-on just under the ceiling.

TMGMT provides an in-Drupal translation job workflow with batch export and import and connectors to Smartling, Lionbridge, Phrase and machine translation, and Site Studio offers a Lionbridge workflow. These connectors are ecosystem and partner maintained rather than Acquia products.

Site Factory groups sites by brand with shared codebases and per-brand themes, Site Studio provides shared component libraries and design-system governance, and Content Hub distributes central content. Cross-brand approval and brand-level analytics need custom work. Good add-on tooling without full policy enforcement.

Acquia DAM is a full first-party DAM: custom metadata schemas, rights and license-expiry enforcement, multi-stage approval workflows, usage insights, brand portals, versioning, AI tagging and a maintained Drupal connector. It meets the 75+ bar in full and is held at the add-on ceiling because it is licensed separately.

Acquia DAM hosts video with on-demand transcoding, HLS adaptive bitrate, thumbnails, clip creation, captions in DFXP, SRT and VTT, and an embeddable player. It meets the native-hosting bar but sits inside the separately licensed DAM.

Drupal Canvas 1.0, the default page builder in Drupal CMS 2.0 and Acquia Source, offers drag-and-drop composition from a component palette of Single Directory and code components with live preview, and Layout Builder in core supports section-based layouts with per-type template locking. Site Studio adds a further visual builder as an add-on. Not higher because Canvas is new and governed brand guardrails are still maturing.

Acquia Cloud Platform renders and hosts the full Drupal site with managed TLS, custom domains, Dev/Stage/Prod environments, a deploy pipeline and a site-level uptime SLA, and Node.js hosting covers decoupled frontends from the same platform. The rubric names Acquia Cloud in the top band. Not higher because the full CDN layer (Acquia Edge) is sold separately.

Campaign Studio forms provide progressive profiling and anonymous-to-known contact conversion with CRM sync, and the Webform ecosystem module adds conditional logic, multi-step forms, spam protection and submission storage with Salesforce and HubSpot handlers. The deepest marketing form features live in the separate Campaign Studio product.

Campaign Studio sends email with a drag-and-drop builder, dynamic content, A/B testing and native Salesforce and Dynamics sync, and Acquia CDP pushes audiences to Salesforce Marketing Cloud. There is no tight CMS-to-email preview loop from Drupal, and Marketo and HubSpot rely on ecosystem modules.

Campaign Studio provides a visual journey builder, lead scoring with custom models, drip campaigns and multi-channel orchestration across email, SMS, push and ads with journey analytics. It is genuine marketing automation sold as a separate product.

Drupal CMS ships an SEO recipe that installs Metatag, Pathauto, Redirect and Simple XML Sitemap, giving meta management, URL patterns, 301/302 redirect management and XML sitemaps, with Schema.org Metatag for JSON-LD and Metatag fields exposed through JSON:API. On-page SEO recommendations come from Acquia Optimize, a separate product. Complete metadata layer with recommendations held back by packaging.

Drupal ecosystem modules can generate llms.txt and Schema.org JSON-LD, and Acquia Edge on Cloudflare can apply bot rules at the CDN. No first-party AI crawler controls, per-page Markdown endpoints or AI citation reporting were found in the Acquia product line. Achievable through ecosystem modules and the CDN rather than native features.

Acquia Exchange lists 200+ integrations across 25 categories with native, partner and community tiers, and Drupal.org's contrib ecosystem adds tens of thousands of modules installable through Composer and Project Browser. A 700+ partner network supports it. Large and healthy, though quality across contrib varies.

Drupal has a native visitor account system with registration, login, roles that gate content and self-service profile pages, and it powers many member portals. Federation with Okta, Auth0, Azure AD B2C and social login relies on mature ecosystem modules (OpenID Connect, SAML Auth, Social Auth) rather than a vendor-maintained CIAM product, and consent management is contrib. Native identity layer, federation through the ecosystem.

Drupal's JSON:API is spec-compliant with consistent resource naming, filtering, includes, and sparse fieldsets, Acquia adds a JSON:API Query Builder for visual query construction/code generation and the sitestudio_jsonapi submodule to expose Site Studio layout data, and Acquia Cloud Platform API v2 exposes 200+ RESTful endpoints with OAuth 2.0 and interactive docs at cloudapi-docs.acquia.com. Not higher because Drupal's entity system complexity (entity types, bundles, field naming) leaks through in API responses and developer ergonomics lag purpose-built API-first platforms like Contentful or Sanity.

Acquia Cloud provides Varnish caching, Nginx reverse proxy, and integrated CDN with global POPs for cached content delivery, and Cloud Next's re-architected file system delivers up to 10 GB/s. Uncached API requests still hit Drupal's PHP stack which is inherently slower than purpose-built API services, rate limits are configurable but not well-documented publicly, and performance at scale requires deliberate caching architecture.

No official Acquia/Drupal multi-language SDK ecosystem comparable to Contentful or Sanity — the community-maintained next-drupal package provides Next.js integration (SSG/SSR/ISR, multi-language) with TypeScript support, Acquia DAM has an official TypeScript SDK (acquia-dam-ts-sdk on npm) with typed requests/responses, and PHP SDKs exist for backend integration. Python, Ruby, Go, and .NET SDKs are absent — teams use raw HTTP against JSON:API. Not lower because next-drupal is well-maintained and the DAM SDK is TypeScript-first.

Drupal.org hosts 50,000+ contributed modules covering virtually every integration category, Acquia CMS includes automated integrations with Acquia products (Site Studio, Acquia Search), Drupal Canvas 1.0 launched as default page-building experience with Site Template Marketplace, and the Acquia AI Provider service in Cloud Platform Enterprise acts as a gateway to supported LLMs. Module quality varies enormously — many are unmaintained — and the Acquia-curated enterprise integration set is much smaller.

Drupal's hook/plugin/event system is one of the most extensible architectures in any CMS: custom field types, custom entity types, form alters, middleware, Symfony event subscribers, and an attribute-based plugin system in Drupal 10/11. Drupal AI module provides an LLM integration framework, Drupal Canvas adds visual page composition, and there is virtually nothing you cannot customize or extend — this is a genuine platform strength.

SAML SSO via Acquia Cloud Shield, OIDC via contrib module, MFA via the TFA module, and API authentication via Simple OAuth (OAuth 2.0). The enterprise SSO stack requires assembling contrib modules rather than being built-in, adding friction compared to purpose-built enterprise platforms. Not lower because the functionality is fully achievable.

Drupal's permission system offers granular RBAC with unlimited custom roles, the Group module enables content-level access, Field Permissions enables field-level access, and the Node Access API enables instance-level restrictions. The permission UI is complex with hundreds of checkboxes and permission inheritance is limited — mostly flat role-permission mapping. Not higher because field-level and instance-level permissions require contrib modules.

Acquia Cloud holds SOC 1 & SOC 2 Type 2 (2025 cycle, Jan–Dec 2025), ISO 27001, CSA STAR, HIPAA, a 2026 PCI DSS Attestation of Compliance (released May 8, 2026), and FedRAMP authorization — Acquia is the only non-governmental Drupal hosting provider with FedRAMP, with a positive 3PAO recommendation secured March 2025. This is one of the strongest compliance postures in the CMS/DXP space and a meaningful differentiator versus peer DXPs.

Drupal has a dedicated Security Team with responsible disclosure and published Security Advisories, but 2026 is a heavy year: a highly critical core SQL injection (SA-CORE-2026-004, May), a critical core PHP object injection via JSON:API (SA-CORE-2026-005, June), further moderately critical core fixes in July and September (SA-CORE-2026-010 to 013), and a September 23 contrib wave that included critical remote code execution in Webform (SA-CONTRIB-2026-175), one of the most widely installed modules, and a critical CSRF in Project Browser, which ships with Drupal CMS. All were patched through coordinated disclosure and Acquia adds platform-level protections, but there is no public Acquia bug bounty and the core-plus-contrib exposure keeps this in the low 60s.

Acquia now offers three deployment paths: Acquia Source CMS, a fully managed Drupal SaaS; Acquia Cloud Platform / Cloud Next, a managed PaaS on AWS (EKS, EFS, Aurora) for teams that want full code control; and self-hosted open-source Drupal as an exit. The September 2026 rebrand positions Acquia Source as a shared workspace spanning sites on either platform. Not higher because all managed hosting is AWS-only with no multi-cloud or customer-cloud option.

99.95% uptime SLA on Cloud Platform Enterprise with a public, actively updated status page at status.acquia.com, but incident volume across the product estate is high: since July 2026 the page logs repeated Pipelines job-start failures (Aug 4, Sep 3, Sep 7), three Acquia DAM outages or degradations (Jul 22, Aug 31, Sep 3), a Site Studio endpoint outage (Sep 4), delayed database backups and code deployments (Aug 6), Edge CDN provisioning and onboarding issues, and an Acquia Search interruption on Oct 2, 2026. Most of these hit tooling and adjacent services rather than site delivery, so the SLA is credible, but actual reliability is mixed for an enterprise vendor.

Cloud Next runs on Kubernetes (EKS) with a Cluster Autoscaler tuned for Drupal, self-healing infrastructure with auto pod pruning, a re-architected file system up to 10 GB/s, Aurora with up to 5x database throughput, and integrated CDN with global POPs plus Varnish/Nginx caching. Not higher because Drupal's PHP/database architecture still has inherent horizontal scaling limits at extreme scale.

Well-documented DR: RPO of 1 hour for production, RTO of 1 hour per 50GB, snapshot schedule of hourly (3h retention) / daily (7d) / weekly (4w) / monthly (3mo) stored in S3 via EBS, with multi-region failover available as an add-on with hot cloud recovery and real-time DB replication, plus drush sql:dump for content export. Multi-region failover is an add-on at extra cost and RPO degrades for environments over 500GB.

DDEV provides official Acquia integration for pulling databases and files into local Docker environments, Lando with Acquia plugin is supported, Acquia CLI replaced BLT (March 2025) for cloud platform interaction, and Cloud IDE plus Cloud Development Environments (CDEs) provide browser-based dev with Composer, Drush, and Git. Not higher because there is no official Acquia local dev server and local-production parity requires effort.

Code Studio (GitLab partnership, upgraded to GitLab 18.6 in early 2026) provides managed CI configuration with pre-built Drupal automation — no YAML config needed for standard workflows — alongside Acquia Pipelines, Acquia CLI (replacing BLT as of March 2025), dev/staging/prod environment management, Drupal config sync (drush config:import/export) for schema migration, and CDEs for branch-based environments. Not higher because there are no built-in deploy preview URLs and the workflow is not as streamlined as modern JAMstack platforms.

Documentation is split between docs.acquia.com (platform-specific, restructured developer portal, well-organized) and drupal.org/docs (community-maintained, inconsistent quality), with Acquia Copilot AI assistant for product docs and troubleshooting. Code examples are adequate but not excellent and the split documentation ecosystem creates friction for developers who must context-switch.

next-drupal provides TypeScript support with typed helper methods for Next.js integration, Acquia DAM has an official TypeScript SDK (acquia-dam-ts-sdk), and the TypeScript Definition Generator module on drupal.org can generate TS types from Drupal entity types. Auto-generated types from content models are still not a seamless first-party workflow and there is no typed JS SDK for the content API.

Acquia kept shipping through Q3 2026: Acquia Source updates in July, read-only MCP access to Acquia DAM for AI assistants in August, and a Vercel alliance with a one-command Drupal Canvas headless scaffold (npx @drupal-canvas/create) in September, on top of Acquia AI GA in April/May. Upstream, Drupal 11.4.0 shipped July 1, 2026 with eight patch releases by late September, and Drupal 12.0.0 reached alpha1 (Sept 2) and beta1 (Sept 30). A steady cadence for a traditional DXP, but still not the weekly feature velocity of pure SaaS headless platforms.

Acquia maintains structured release notes across Cloud Platform, DAM, Optimize, and CLI at docs.acquia.com, and Drupal core change records plus release notes are detailed and version-tagged. Changelogs remain fragmented across product docs rather than unified, breaking changes are not consistently flagged at the Acquia product level, and Acquia Source release communication leans on press releases and blog posts.

Drupal publishes its AI 2026 roadmap and a dated core release schedule (Drupal 12 alpha and beta landed on plan in September 2026), and Acquia maintains a public roadmap page with roadmap webinars. Acquia's own roadmap is still high-level without hard dates, and there is no public Canny-style voting portal for Acquia products.

Drupal's formal deprecation policy, @deprecated annotations, long deprecation windows, and Drupal Rector plus Upgrade Status keep the 10 to 11 to 12 path predictable; Drupal 12 beta removes only APIs deprecated during the 11.x cycle. Contrib module compatibility lag at each major remains a real pain point, and Acquia Source as managed SaaS shields customers from most of it.

Drupal still has one of the largest open-source CMS communities: 8,000+ individual and 1,100+ corporate contributors annually, 51,000+ modules, 1M+ registered drupal.org users, and DrupalCon plus Acquia Engage as major events. Mass remains huge, but new-developer share continues to drift toward JavaScript-native platforms.

The Drupal AI Initiative has 32+ organizations and 50+ contributors with weekly velocity updates, Acquia's May 2026 Fair Trade Initiative directs 2% of eligible partner-deal revenue to the Drupal Association, and the September 2026 rebrand comes with a stated commitment to fund Drupal evangelism. Acquia remains the top contributor to core. Outside these initiatives, day-to-day engagement is still concentrated among a small group.

Acquia's partner network spans 800+ agencies, SIs, and technology providers with formal certification, a partner finder, Drupal AI Certified Partners, and annual partner awards. Q3 2026 added a Vercel technology alliance (brokered by JAKALA) and an expanded global partnership with Havas CX, and the Fair Trade Initiative ties every partner deal to Drupal Association funding.

Drupal and Acquia content volume remains substantial: DrupalCon recordings, Acquia Academy, TheDropTimes, and steady trade press (CMS Critic, TechTarget, CMSWire covered Acquia Source and the rebrand in Q3 2026). Third-party tutorials and books continue to age, and independent content on Acquia Source and Acquia AI is still sparse outside official channels.

LinkedIn shows roughly 1,000 US Drupal Developer jobs and ZipRecruiter lists Drupal roles at $92k-$141k, with dedicated Drupal job boards active and Acquia certifications in place. Demand is concentrated in government, higher-ed, and enterprise agencies, and senior Drupal developers command premium rates due to relative scarcity as new developers gravitate to JavaScript platforms.

2026 Engage Awards highlighted strong outcomes (Arizona State University running 426 sites on Site Factory, Rathbones, Yuhaaviatam of San Manuel Nation), and the Vercel alliance and Havas CX expansion open new delivery channels. Net new tier-1 enterprise logo announcements outside the existing base remain moderate, and Acquia publishes no customer count growth figures.

Vista Equity has owned Acquia since 2019 with no external funding since the 2015 Series G and no exit signals; CEO Chris Tranquill took over in August 2025. Headcount sits around 1,100 after a roughly 5.6% decline from 2023 to March 2026 and the 2024-2025 onshore layoffs with offshoring to India and Costa Rica. Continued product investment and a scaled base offset the PE cost squeeze, but long-term stability is a moderate risk.

On Sept 14, 2026 Acquia dropped the 'digital experience platform' label for 'agentic content platform', relaunching its brand as 'Powered by Drupal' around Acquia Source and Acquia AI, a coherent governed-content story for AI agents. It was a Gartner DXP MQ Leader through 2025, but has not promoted a 2026 DXP MQ placement while Optimizely took the top spot on both axes, and stepping out of the DXP category weakens that analyst lever. Clear differentiation remains, but this is a second repositioning in five years.

Acquia DXP holds 4.3-4.4/5 on G2 with strong review volume and Leader badges across 41 Winter Grid Reports, and Gartner Peer Insights shows 4.4 overall (4.5 Integration & Deployment, 4.5 Service & Support). Praise centers on customizability, support, and managed infrastructure; complaints persist on pricing, complexity, and learning curve.

Acquia Cloud Platform now publishes four enterprise tiers (Standard/Plus/Premium/Elite, Entry dropped) as annual-subscription feature grids with no dollar amounts. The Professional line does show list prices: Personal $148–$158/mo and Small $296–$364/mo. Source CMS, DAM, CDP, Personalization, Content Hub and Site Studio stay fully sales-gated, and the Source CMS page tells buyers to request a demo for pricing. Among the least transparent platforms in the dataset; a little higher than before because the Professional price ladder is now plainly published.

Per-product licensing with bundled infrastructure; enterprise deployments commonly $100K+/year per buyer reviews. Views/Visits overages billed at $100 per 15,000 Monthly Views or 4,500 Monthly Visits over allowance (whichever is greater), with a 30% buffer and 100% overage protection for each subscriber's initial launch. Bot traffic still inflates Views/Visits at the infrastructure level despite Acquia's filtering, creating unpredictable spikes; each Acquia product (DAM, CDP, Personalization, Content Hub) adds a separate subscription line.

Drupal core and contrib are free open source, providing a solid baseline. But every meaningful enterprise capability is a separate paid product: Site Factory (multi-site), Content Hub (syndication), Personalization (targeting), CDP (customer data), DAM (assets), Site Studio (visual editing). Each capability requires its own subscription, creating heavy upsell pressure as use cases expand. Not bad gating per se — the open-source core helps — but the suite is bundled-by-design.

Enterprise Cloud Platform tiers are sold as annual subscriptions, with multi-year commits common. Professional plans are listed per month ($148–$364/mo), and the hosted trial is now 14 days with no credit card and no auto-charge. A nonprofit solutions page exists, but there is no public startup program or education discount; Capchase third-party financing lets buyers pay annual contracts monthly. Exit provisions depend on negotiation.

There is no free tier on Acquia's managed platform. The old Acquia Cloud Free URL now redirects to Professional, which starts at $148/mo, and the Cloud Platform trial lasts 14 days (no credit card required, but it expires). Drupal CMS itself is free open source, with a no-expiration desktop trial and free download for evaluating the underlying CMS. Acquia's managed cloud, Source CMS, DAM, CDP and Personalization all need paid subscriptions.

Acquia's self-serve Cloud Platform trial now provisions a fully configured Drupal 11 site with a built-in Cloud IDE and Dev/Stage/Prod environments in minutes, with no local setup, credit card or sales call. That removes most of the provisioning friction that used to take days. A production site still needs content modeling, theming and a deployment pipeline, all of which require Drupal expertise. Faster to first content than before, but still well behind SaaS headless platforms, where an API returns content within an hour.

Acquia DXP implementations typically run 3–9 months. Simple Drupal sites on Acquia Cloud can be delivered in 6–10 weeks; full DXP rollouts with Site Factory, Personalization, Content Hub, and DAM run 6–12 months. CRM/ERP/ecommerce/CDP integrations add significant complexity and SI partner involvement. Accelerated timelines require team scaling and higher cost.

Drupal/Acquia specialists carry a meaningful premium over generalist web devs. US averages cluster at $111,938–$115,303/year ($53.82–$55/hr); 25th–75th percentile $92K–$128.5K with top earners ~$147.5K. Freelance rates $61–80/hr globally, $50–$100/hr in US markets; Acquia-certified developers cost more upfront but deliver ~15% faster on enterprise setups. PHP/Drupal talent pool remains a specialist niche as JavaScript-first frameworks dominate broader hiring markets.

Acquia Cloud bundles hosting in platform licensing, eliminating separate infrastructure management. Professional Personal starts $148/mo with bundled storage, plus data transfer overages at $0.25/GB beyond 50GB/mo and disk storage at $0.275/GB/mo. The 30% capacity buffer helps with predictable months but bot-driven CDN cost spikes (cited up to 70% increase) create unpredictable hosting bills. Cheaper to self-host raw Drupal but you lose managed services.

Acquia Cloud meaningfully reduces ops burden vs. self-hosted Drupal — infrastructure, backups, security patching, and platform updates are managed. App-level ops remain: Drupal module updates, cache management, performance tuning, content migrations, security monitoring, and increasingly bot traffic management (WAF rules, traffic filtering). Most enterprise Acquia deployments require part-time to full-time DevOps attention.

Drupal core is open source with full data portability via MySQL dumps, Migrate API, and JSON:API — no proprietary content format — and Acquia's terms commit to making Customer Data and Applications available within 7 days of a termination request. But Acquia-specific products create meaningful lock-in: Site Factory configs, Content Hub syndication rules, Personalization segments, CDP profiles, and DAM assets are not portable to non-Acquia environments. Acquia's acquisitions (Widen DAM, AgilOne CDP, Monsido) form a closed ecosystem, and Drupal major-version upgrades remain expensive forklift efforts.

Developers must learn 15+ Drupal-specific concepts (entities, bundles, fields, render arrays, plugin system, hooks/events, config management, Twig theming, Views) plus Acquia-specific layers (Site Studio, Content Hub, Cloud Platform APIs, Acquia Source/Canvas). Canvas 1.0 (default in Drupal CMS 2.0, early 2026) adds a React/Tailwind component and page-building model on top, easing the author surface but not reducing the developer concept count. Not higher because Drupal's concept count remains among the highest in the CMS market.

Acquia Academy provides structured learning paths and certification courses, Acquia Source SaaS offers site installs in under three minutes with templates, and Drupal CMS 2.x ships guided site templates, Recipes and a zero-setup desktop Launcher. New in 2026, the Nebula Canvas scaffold and the acquia/acquia-skills repo ship agent skills (acli, Pipelines CLI, Drupal maintenance playbooks) so coding agents can guide setup. Not higher because resources remain scattered across Acquia Academy, Drupal.org, drupalcode.org and community sites, and enterprise Drupal onboarding still requires deep platform knowledge.

Drupal remains PHP/Symfony with Twig, fundamentally different from the React/Next.js ecosystem, but Canvas code components are React + Tailwind with a Vite toolchain, and the Canvas Headless SDK (July 2026) adds framework-native adapters for Next.js, Astro, Nuxt, TanStack Start and Angular so a decoupled frontend uses its own framework conventions. Not higher because backend module development, content modeling and site configuration still require deep PHP/Drupal expertise that does not transfer from mainstream JS frameworks, and the headless adapters are still 0.x.

`npx @drupal-canvas/create` (v1.9.1, Sept 2026) now scaffolds either the default Canvas-rendered React template (acquia/nebula, with tooling, examples and agent skills) or framework-native headless starters for Next.js, Astro, Nuxt, TanStack Start and Angular from drupal-canvas/headless-templates, and the Next.js-specific next-acms starter remains maintained with OAuth, preview and on-demand revalidation. Drupal CMS 2.x adds site templates and Recipes on the Drupal side. Not higher because the headless templates are new (repo created July 2026, SDK still 0.x and documented as experimental until recently) and lack the polished example content models and deployment configs of headless-first vendors.

Drupal's configuration surface area is enormous — enterprise sites generate hundreds of YAML configuration files, requiring Config Split for per-environment management plus settings.php, services.yml, and environment overrides, and Acquia platform layers (Cloud Platform, Site Studio, Content Hub) each add significant surface. Acquia Source SaaS eliminates hosting/infra config, but enterprise self-hosted deployments remain complex. Not lower because config-as-code via config sync is well-supported and Acquia Source reduces initial setup burden.

Adding new content types and fields is straightforward in Drupal, but modifying or removing existing fields with data is risky and requires careful migration via update hooks and the Migrate API, and field type changes on populated fields require data migration scripts. Breaking changes cascade to Views, templates, and API responses. Not higher because schema changes with existing content carry real risk compared to schemaless headless platforms like Sanity or Contentful.

Canvas is the default editor in Drupal CMS 2.x and Acquia Source, with drag-and-drop page building, live preview and in-place editing. For decoupled builds, the canvas_headless module (shipped in Canvas 1.11/1.12) plus the Canvas Headless SDK lets the Canvas editor embed the external frontend, render draft content in the app itself and register the app's components, using a config wrapper, a middleware export and a CANVAS_SITE_URL env var in Next.js. Not higher because headless preview still needs frontend code, OAuth (simple_oauth, consumers) and CSP/frame-ancestors setup, and the SDK is pre-1.0.

Significant Drupal specialization is required for production work — Acquia offers four distinct certification tracks (Site Builder, Developer, Front End Specialist, Back End Specialist), reflecting the breadth of specialized knowledge needed across PHP, Drupal APIs, module development, theming, and config management, so a generalist web developer needs weeks to months of focused learning. Not lower because Acquia Source SaaS and Canvas reduce the barrier for simpler, non-enterprise projects.

Enterprise Acquia implementations typically require 3-8 people in specialized roles (backend Drupal developer, frontend/themer, DevOps/infra, and often Site Studio and platform specialists), and full multi-product DXP deployments commonly need 5-10+ team members. Acquia Source SaaS and AI Site Builder agents reduce the burden for simpler campaign sites. Not higher because multi-product DXP deployments demand larger specialized teams than headless CMS competitors.

Canvas 1.0 (default in Drupal CMS 2.0) lets marketers and content authors drag-and-drop components onto pages with live preview and no Drupal knowledge required, and Acquia Source AI agents automate site building from briefs, SEO/AEO content writing, and accessibility/governance scanning, while Site Studio adds no-code page assembly. Not higher because the Drupal admin interface still requires training for advanced content operations and complex workflows.

Drupal 10 reaches end of support on December 9, 2026, so every Acquia customer still on D10 now faces a hard D11 deadline about ten weeks out; Rector and Upgrade Status automate much of the deprecation work, but contrib readiness and config changes still make complex sites a multi-week project. Acquia handles the infrastructure layer and keeps adding runtimes in parallel (PHP 8.5 on Cloud Next since Feb 2026, Ubuntu 24.04 since May/June 2026), yet Cloud Next and Cloud Classic still run side by side, so many customers carry a platform migration track on top of the core upgrade. Not higher because the application-layer upgrade remains the customer's job on a fixed upstream calendar.

Acquia patches the platform layer on a steady cadence: PHP point releases rolled to both Cloud Next and Cloud Classic roughly monthly in 2026 (8.4.19 in April, 8.4.20 in May, 8.4.25 in September), and hardening changes such as disabling the ImageMagick MIFF format ship without customer action. The Drupal Security Team keeps its predictable Wednesday advisory cadence with clear severity ratings. Not higher because Drupal core and contrib patches still require customer-initiated Composer updates and deployments; Acquia does not patch application code.

Vendor-set deadlines keep stacking in 2026: Node.js 20 was removed on April 15, 2026 with remaining environments force-upgraded to Node 22, Site Studio 7.x reaches end of support on December 9, 2026 with Acquia stating the date 'will not be extended', the September 2026 Pipelines infrastructure change required every customer to replace allowlisted IPs or builds stop, and the Cloud Classic to Cloud Next migration is still in progress with a short postponement window. Legacy Acquia Search is still operated (Solr 9 upgrades, AL2023 OS in July 2026) with a SearchStax migration path offered, so search is an upgrade track rather than a hard sunset. Not higher because the cadence and short notice of these mandatory changes is heavy for an enterprise platform.

Drupal uses Composer, and enterprise sites typically run 30 to 80+ contrib modules, producing a large transitive tree with variable maintainer responsiveness; the December 2026 Drupal 10 end of support is driving another round of contrib compatibility work. Acquia manages OS, PHP, database and cache, and added automated software updates for Pipelines in August 2026, but Composer update cycles and contrib testing remain a recurring customer responsibility. Not higher because the contrib ecosystem still produces meaningful per-release coordination work.

Acquia keeps adding operational visibility: storage usage dashboards at subscription, application and environment level (July 2026), live log streaming for Pipelines 2.0 (April 2026), clearer failed-vs-error task states, and New Relic bundled with Drupal hook instrumentation, plus a public status page. Against that, the bundled New Relic agent was rolled back twice in 2026 (May 1 and July 23, the latter noting missing APM data is not restored), and the status page logged Log Download Failures (Aug 2026) and a Security and Performance Metrics vendor API issue (Aug 2026). Not higher because full application observability still needs customer-layered tooling and the bundled tooling has been unreliable.

Drupal content operations stay manual-heavy: taxonomy management, broken-link detection (via contrib Link Checker), orphaned content cleanup and content model upkeep rely on editorial discipline plus contrib tooling. Acquia's web governance tooling (formerly Monsido) and the September 2026 repositioning of Acquia Source as CMS plus DAM plus governance add hygiene scanning for customers who license it, but that is a separate product rather than part of the Cloud Platform baseline. Not higher because reference integrity is not self-healing and Paragraphs-heavy models multiply the ops surface.

Acquia Cloud bundles Edge CDN and Varnish, Cloud Actions automate cache clearing on deploys, and 2026 changes help at the edges: platform-level 404s during scaling events are now uncacheable (Sept 2026), PHP opcache limits were raised, and Multi-Region Failover arrived for Cloud Elite. But teams still need to understand Drupal's multi-layer caching and tune queries, and Edge Standard had several provisioning and onboarding incidents in 2026. Not higher because performance is not a hands-off concern on Drupal.

Acquia offers 24/7 tiered support with TAMs and CSMs on enterprise plans, and in July 2026 added Support Exchange, a complimentary 30-minute scheduled session with a support engineer for eligible customers. Reviews continue to praise deep Drupal expertise and named contacts while flagging slow or generic first responses and quality that scales sharply with tier. Not higher because good support still tracks plan level, and ticket creation in the Cloud UI portal itself went down in August 2026.

Drupal has one of the largest open-source communities, with active Drupal.org issue queues, Drupal Slack channels and Stack Exchange coverage, and Drupal 12 is moving through alpha and beta in Sept 2026. Acquia contributes significantly upstream and runs Acquia Academy for free e-learning. Not higher because answers on niche contrib problems can stall for weeks and developer mindshare continues a gradual decline relative to headless ecosystems.

Acquia ships platform fixes frequently (multiple Cloud Next fix notes per month in 2026), but its status page shows a high incident load: roughly 40 incidents from late February to early October 2026, seven rated critical, including TFA authentication 403 errors (April), multi-region load balancer outage (March), Pipelines jobs stuck queued (August), and same-day DAM and Site Studio outages (September). Recurring Pipelines and code-deployment incidents suggest root causes are not being closed quickly. Lowered because the incident frequency across core services in 2026 is high for a tier-2 DXP.

Drupal Canvas — now the default page-building experience in Drupal CMS 2.0 (Jan 2026) and free in core — provides a no-code drag-and-drop page builder with inline editing, component libraries, content templates, and AI-assisted layout generation from text prompts. Site Studio continues as the design-system-focused visual component editor; the Acquia Source Site Builder Agent converts a creative brief into a live multi-page campaign site in hours. Marketers have three page-building paths without developer involvement. Not higher because Canvas's component ecosystem is still maturing and marketer autonomy still requires upfront component library setup.

Acquia Campaign Studio (Mautic-based) provides genuine campaign management: visual campaign builder, multi-channel orchestration (email, SMS, web), journey automation, lead scoring, campaign analytics and contact segmentation, with Campaign Factory for multi-instance deployments. Acquia CDP adds ML-powered segmentation and predictive analytics. Both remain on sale but are in a maintenance cadence in 2026 (Campaign Studio releases are mostly fixes; CDP shipped one release) and are absent from Acquia's new 'agentic content platform' navigation. Campaign Studio is separately licensed with shallow CMS integration, so campaign content and CMS content live in different systems. Not higher because content calendaring inside the CMS requires custom work and the campaign-CMS bridge remains shallow.

Drupal's SEO module ecosystem remains among the strongest in CMS: Metatag, Simple XML Sitemap, Redirect (co-maintained by Acquia), Pathauto and Schema.org modules, bundled in the Drupal CMS SEO Tools recipe. Acquia Content Optimization by Conductor is now embedded in the Source CMS node edit form: the Writing Assistant gives a real-time 0–100 Content Score with intent-alignment sub-scores and AI-generated outlines before publication (Sept 2026). The August 2026 Source release added a Markdown service for LLMs and AI discoverability controls so site owners manage how AI agents crawl and cite content, alongside Conductor's tracking of brand citations in ChatGPT, Perplexity, Gemini and Google AI Overviews. Not higher because Conductor is separately licensed and Acquia Cloud (non-Source) sites still assemble the underlying Drupal SEO modules themselves.

Webform provides excellent form handling and lead capture with conditional logic, multi-step forms and CRM integrations. On Source CMS, Drupal Canvas Forms (experimental since July 2026) lets administrators define a form and submission table inside the Canvas editor without code, with typed fields including consent, spam protection and captcha, CSV export, cryptographically signed webhooks to external systems, and per-form retention policies with data subject request support; forms can also be created and managed by agents through the MCP server. Campaign Studio adds lead scoring and conversion tracking, and Acquia Conversion Optimization adds funnels, form analytics and heatmaps. Not higher because Canvas Forms is still experimental, CTA management has no native solution, and the performance marketing story spans several separately licensed products with no unified dashboard.

Acquia Personalization reached end-of-life on January 31, 2026, but its replacement has since grown beyond testing. Acquia Conversion Optimization, powered by Wingify (VWO), now sells no-code personalization alongside experimentation: AI-built audiences, delivery by behavior, traffic source or profile data, and segmentation from a customer's own data layer (CRM, loyalty and other first- or third-party data), with native Drupal and Acquia DAM integrations so variants use governed content and assets. Acquia CDP still provides ML-driven segments and predictive models. This is real rule-based and behavioral targeting, but it runs in an OEM third-party engine through a client-side snippet rather than in the CMS, and Drupal Canvas's own personalization module is still a hidden feature flag. Not higher because there is no native CMS personalization engine and the capability depends on a separately licensed Wingify-powered product.

Acquia Conversion Optimization, powered by Wingify (VWO), provides A/B, multivariate and split URL testing on Bayesian statistics with results readable at any time, plus an AI Co-Pilot that proposes hypotheses and generates variations, feature flags and progressive rollouts, heatmaps, session recordings, funnels and surveys. It has native Drupal and Acquia DAM integrations and two-way GA4 among 40+ integrations, so it is a tight first-party integration rather than a generic third-party tool. Campaign Studio also supports multivariate landing page tests with winner criteria. Not higher because testing runs in a separately licensed OEM engine through a site snippet rather than natively inside the CMS authoring interface.

Drupal Canvas enables drag-and-drop layout creation without development, with AI-assisted layout generation from prompts. Acquia Source Site Builder Agent can generate a complete multi-page campaign site from a brief in hours. Template cloning and reusable content blocks reduce cycle time. Content Moderation with configurable approval stages supports rapid-approval shortcuts. Inline editing is available in Drupal. Not higher because standard Drupal publishing cycles — particularly for sites requiring content review — involve multiple moderation steps, and complex new page templates still require developer involvement to create new Canvas components.

Acquia Content Hub enables content syndication across channels and sites. Campaign Studio orchestrates multi-channel delivery to email, SMS, web, and social. Drupal's API-first architecture enables structured content delivery to mobile apps and other digital touchpoints. Acquia DAM serves assets across channels with 80+ integrations. Not higher because multi-channel orchestration is assembled across three separate products (Content Hub + Campaign Studio + Drupal API) rather than being managed from a single publishing workflow.

Source CMS added a native Google Tag Manager integration in August 2026, so administrators connect and configure tracking without a module install, and GA4 integration remains standard. Acquia Content Optimization by Conductor now puts a real-time Content Score inside the node edit form and, in Conductor itself, connects AI and search visibility to traffic, conversions and revenue with holistic content ROI reporting. Acquia CDP provides campaign-level engagement analytics, and Conversion Optimization adds two-way GA4 and behavioral analytics. Not higher because content performance dashboards (views, engagement, decay) still live in Conductor, GA4 or VWO rather than inside the CMS, and most of it is separately licensed.

Site Studio is explicitly positioned as Acquia's design system management tool — enforcing brand guidelines through locked component palettes, style tokens, typography configuration, and approved overrides at the platform level. Marketers create within pre-approved component libraries, preventing off-brand pages. Site Factory extends this to multi-brand scenarios with brand-level theme isolation. Not higher because implementing Site Studio requires significant upfront design system work and the enforcement model depends on correct curation of the approved component set.

Metatag module provides comprehensive OG/Twitter card management with field-level control over social previews. Schema.org module adds structured data for content discovery. However, there is no native social scheduling, push-to-social workflow, or social media queue management. Social sharing buttons require contributed modules. UGC embedding requires custom development. Not higher because Acquia offers no native social scheduling — publishing to social requires external tools like Hootsuite or Buffer.

Acquia DAM (formerly Widen Collective) is a genuine enterprise DAM: AI auto-tagging, video transcription, alt text generation, image transforms, rights management, usage tracking, workflow and brand portals, with 80+ integrations including Salesforce Marketing Cloud. 2026 additions deepen it: DAM Portals and an Asset Gallery component inside Source CMS for branded asset microsites, DAM video and document support in Drupal Canvas, event-driven webhooks for task automation, a native Amazon Translate integration for metadata localization, AI tag history for auditing, bulk archiving, PDF summaries, and a read-only MCP server so AI assistants search assets under the user's permissions. This is one of Acquia's strongest capabilities. Not higher because DAM is licensed separately and advanced rights workflows still need configuration.

Drupal's multilingual architecture is mature: core Language, Content Translation, Configuration Translation and Interface Translation modules plus TMGMT. Source CMS has strengthened the authoring side through 2026: symmetric translation with unified layouts via TMGMT (July), a translation entry in main navigation and a translation management UI for in-progress jobs, translatable menu links, and support for translating into languages that are not yet public (September), which helps market-launch staging. Acquia DAM auto-translates asset metadata via Amazon Translate, and Klaro or EU Cookie Compliance handles per-locale consent. Not higher because transcreation workflows with brand-voice adaptation and market-level campaign scheduling are still assembled rather than native.

Acquia's MarTech connectivity is broad: Campaign Studio (Mautic) includes 100+ out-of-the-box MarTech integrations spanning CRM, MAP, and CDP categories. Acquia DAM has native Salesforce Marketing Cloud integration. Drupal's connector library covers Salesforce CRM, HubSpot, Marketo, and Pardot. Acquia CDP connects to ad platforms for audience activation. Webhook and event-based triggers available via Campaign Studio and REST APIs. Not higher because some integrations are community-contributed rather than first-party maintained, and the overall connectivity requires assembly across separate Acquia products.

Acquia PIM centralizes product data with configurable product data models, import from ERP, PLM and MDM systems of record, gap flagging for missing information or assets before launch, automatic workflow routing across the product content lifecycle, AI assistance, channel portals, and syndication through 200+ automatic retailer and marketplace connections kept in sync with each channel's requirements. Combined with Acquia DAM for product media and Drupal Commerce for product modeling, the product content story is solid. Not higher because PIM is a separate product from the CMS and deep variant hierarchy management lags dedicated PIM leaders.

Acquia PIM adds product catalog management and distribution channel configuration, improving the merchandising content story. Acquia Digital Commerce with Commerce Framework provides commercetools-powered merchandising on the commerce side. Drupal taxonomy and Views enable basic category/collection pages. Native CMS-side merchandising features like search merchandising, visual merchandising, or automated cross-sell remain absent — merchandising intelligence still comes from the commerce backend. Not higher because Acquia has no purpose-built merchandising UI in the CMS layer.

Acquia Commerce Framework (ACF) is listed on the commercetools marketplace and includes BigCommerce integration via Third and Grove (the connector imports BigCommerce product data into Drupal as content nodes). Commerce Factory (TA Digital, Acquia's preferred composable commerce solution) integrates commercetools with planned deeper content integrations to Acquia DAM and PIM. Drupal Commerce offers a native commerce engine. ACF integrations remain partner-built rather than first-party Acquia connectors, and UI-level product reference in the content editor still requires implementation work. Not higher because integrations lack the deep API federation of AEM CIF or native marketplace connectors.

Drupal Commerce enables contextual commerce patterns — articles can embed add-to-cart buttons, and buying guides with inline product references are documented use cases. Acquia blogged about 'opening new doors for contextual commerce in Drupal' as an architectural pattern. However, shoppable editorial content (lookbooks, shop-the-look) is not a first-class authoring experience in the Drupal/Acquia UI — it requires custom content type design and frontend theming. Not higher because there is no native shoppable content editor or inline product picker in the CMS authoring interface.

Drupal Commerce owns the checkout flow, and CMS-managed content blocks can technically be injected into checkout templates through custom block regions. Acquia provides no documented native mechanism for CMS-managed trust badges, upsell banners, or shipping callouts in cart/checkout without modifying Drupal Commerce templates. This requires custom development work per deployment. Not higher because cart/checkout content management is not a documented or first-class Acquia capability.

Campaign Studio (Mautic) handles post-purchase email sequences triggered by commerce events — order confirmation, delivery tracking, review solicitation, loyalty messaging. This covers email post-purchase content management effectively. However, CMS-managed post-purchase web page content (order confirmation pages, onboarding sequences tied to purchase) remains in Drupal Commerce templates and requires custom development to make marketer-editable. Not higher because the CMS layer has no native mechanism to bind order events to CMS-managed content delivery.

Drupal Commerce includes B2B modules for quoting, invoicing, and group purchasing. The Group module enables account-based content visibility — gated catalogs, spec sheets, and account-specific content are achievable via Drupal's permission system. Drupal's 'Byte' template enables production-ready B2B SaaS site setup rapidly. Acquia Cloud adds enterprise-grade SSO for account authentication. Not higher because dedicated B2B UX patterns (customer-specific pricing display, quote-request flows with approval chains) require significant custom implementation rather than being native platform features.

Acquia Search (Apache Solr-powered) provides faceted search with content enrichment capabilities. Search API module enables blended content-product search results. Acquia + Yext AI search integration adds natural language understanding and AI-powered relevance for more intelligent product discovery. Search landing pages are buildable via Drupal Views. Not higher because dedicated search merchandising (pinned results, synonym management, search-driven promotional content) requires custom implementation, and the Yext integration adds cost.

Drupal's Scheduler module enables time-based content activation and deactivation — promotional banners, sale messaging, and countdown-adjacent content can be scheduled precisely. Drupal Views + Blocks enable channel-specific promotional content configuration. Campaign Studio adds promo-driven email and SMS campaigns with time triggers. However, there is no dedicated promotional content management UI — no countdown timer widget, no promo code display management, and no visual merchandising calendar. Marketers must work through Drupal's content editing interface. Not higher because the lack of a promo-specific layer means significant editorial overhead.

Acquia Site Factory provides the multi-storefront architecture — separate Drupal instances per brand/region sharing a codebase, with Acquia PIM providing shared product content distributed to each storefront. Content Hub Pull Syndication enables shared editorial content across storefronts with storefront-specific customization. Each storefront can have independent editorial and legal content while drawing from shared PIM product data. Not higher because the integration between Site Factory, PIM, and storefront-specific editorial layers requires deliberate architectural setup and adds operational complexity.

Acquia DAM provides strong foundational media management: image transforms (auto crop, resize, format conversion), video hosting with transcription, alt text generation, and structured media delivery. Product image galleries and video embeds in PDPs are well-supported. However, 360-degree product views, AR/3D model references, and image hotspot experiences require custom frontend implementation and third-party integration. Not higher because commerce-grade interactive media (360°, AR, zoom) is not native to the Drupal/Acquia stack.

Drupal's multi-author content system supports multiple contributors creating product descriptions, and Content Moderation enables editorial oversight. However, there are no marketplace-specific features: no seller profile management, no seller-contributed product description workflows, no review aggregation system, and no content quality moderation queue designed for marketplace scale. This use case is achievable only through extensive custom development. Not higher because Acquia has no marketplace content management product or documented marketplace implementation pattern.

Drupal's multilingual stack applies fully to product content — locale-specific product descriptions, translated attributes, and market-specific metadata are all achievable via Drupal's Content Translation module. Acquia PIM distributes product content by channel and region with locale-specific product listings. Market-specific regulatory content (EU labels, Prop 65) is manageable via locale-specific content variants. Not higher because currency-aware content blocks and regional promo calendar automation require custom implementation, and Acquia PIM's localization depth is limited compared to dedicated PIM platforms.

Acquia CDP can ingest commerce transactions and correlate them with content engagement for attribution analysis. Acquia Content Optimization by Conductor now explicitly connects content and search visibility to traffic, conversions and revenue, and Conversion Optimization measures revenue per session against tested variants with two-way GA4. Campaign Studio tracks campaign-driven conversions. None of this surfaces content-to-revenue attribution inside the CMS editor, so content performance relative to commerce outcomes is still read in external tools. Not higher because there is no native CMS dashboard connecting content engagement to revenue.

Drupal's permission system remains among the most granular in CMS: the Group module enables audience-based content visibility by department/team, content-instance permissions are native, and field-level access control is possible. Acquia Cloud provides SAML SSO via Cloud Shield for enterprise authentication. LDAP integration is mature. This is one of Drupal/Acquia's genuine strengths for intranet use cases. Not higher because the permission architecture requires careful planning and significant upfront configuration effort.

Drupal's taxonomy system provides strong content organization. Acquia Search (Solr-powered) delivers quality internal search, enhanced by Yext AI search integration for Drupal-powered intranets with natural language understanding. Content lifecycle management via Content Moderation and Scheduler. Version history is built into Drupal core. Not higher because there are no purpose-built knowledge management features — no knowledge graph, no FAQ patterns, no article feedback — everything must be assembled from Drupal building blocks.

Acquia has a defined Employee Experience solution with Yext AI search integration for intelligent intranet search. Acquia Source's AI capabilities (content creation, governance scanning) improve the authoring experience for portal managers. Proven case studies like Pegasystems' Pega Portal show viability. However, there's still no native notification system, no employee directory, no personalized dashboard, and no mobile app. Not higher because Acquia remains a development platform for intranets, not a purpose-built employee experience product — building a full EXP requires extensive custom frontend work.

Drupal's content types and taxonomy support department-targeted news and announcements. The Group module enables department-specific content visibility for audience-targeted communications. Scheduler supports timed publication of internal announcements. Content Moderation provides approval workflows for communications content. However, there is no acknowledgment tracking, mandatory-read workflow, or read-receipt capability natively — these require custom module development. Not higher because targeted internal comms without acknowledgment tracking falls short of enterprise intranet requirements.

Drupal's Profile module enables basic employee directory with custom fields for skills and expertise. Team pages are buildable as content types. However, org chart visualization is not native — it requires third-party visualization libraries integrated with custom development. HR system integration (Workday, BambooHR) requires custom connector development. Acquia has no documented employee directory or org chart product feature. Not higher because a functional employee directory with org chart requires substantial custom Drupal development.

Drupal provides solid foundations for policy management: versioned content with full revision history, Content Moderation for approval workflows, Scheduler for review reminders, and content ownership via user assignment. File entity management for policy documents. However, acknowledgment tracking (required reads), automated expiry notifications, and audit trails for policy compliance are not native — they require custom development. Acquia Source's AI Web Governance Agent adds automated compliance scanning but focuses on accessibility and brand policy rather than document acknowledgment. Not higher because enterprise policy management requirements exceed Drupal's native capabilities.

Drupal's Role system and Group module enable role-specific content access restrictions, allowing new-hire content paths to be scoped by job function. Content types can be structured for onboarding sequences. However, progressive disclosure over 30/60/90 days, task checklists, HR-triggered portal access, and structured onboarding journeys are not native Drupal/Acquia features — they require significant custom module development or integration with an HCM system. Acquia has no documented onboarding delivery product or solution accelerator. Not higher because onboarding delivery requires extensive custom implementation.

Acquia Search powered by Apache Solr provides solid enterprise search with full-text indexing, faceted filtering, and relevance tuning. The Yext AI search integration adds natural language understanding, conversational search, and AI-powered relevance for Drupal intranets, meaningfully raising search quality for employees. Search API module enables multiple content source indexing. Not higher because federated search across external systems (SharePoint, Confluence, Google Drive) requires custom connectors, and the Yext AI integration carries additional licensing cost.

Drupal themes are mobile-responsive by default, providing basic mobile web access. Drupal PWA (Progressive Web App) modules exist for installable web app experiences with limited offline capabilities. However, Acquia provides no native mobile app for intranet access, no push notification system, and no documented frontline or deskless worker solution. Low-bandwidth optimization requires custom frontend work. Not higher because responsive web without native app, push notifications, or offline support is insufficient for frontline workforce access requirements.

Drupal can host training content as structured content types and serve as a learning content repository. Some community-contributed modules add basic course management. However, there is no native Acquia LMS integration with Cornerstone, Workday Learning, or similar platforms. Completion tracking, certification management, and course assignment require custom development or third-party LMS integration. Acquia has no documented learning or training product feature. Not higher because learning content hosting without tracking and certification is insufficient for enterprise L&D use cases.

Drupal provides foundational social features via the Comment module (commenting on content), Flag module (likes/reactions), and community-contributed Forum module for discussion boards. Polls module is available. However, there are no native peer recognition features, idea submission workflows, or structured community spaces by department or interest group without significant custom development. Acquia has no documented social or engagement layer product for intranets. Not higher because basic commenting without community management, engagement analytics, or peer recognition falls short of modern employee engagement platforms.

Drupal supports REST APIs and webhooks that can push content notifications to Slack or Teams, and community modules exist for basic Microsoft 365 or Slack webhooks. Acquia has since shipped AI-assistant connectivity: the Source CMS MCP server (beta) with setup for Claude Code, Claude Desktop, Cursor, VS Code and Codex, and a read-only Acquia DAM MCP server usable from Microsoft Copilot Studio or ChatGPT. These target AI assistants and developers rather than employee workplace experiences. Acquia has no first-party Microsoft Teams, Google Workspace or Slack integration with embedded content cards, bots or single-pane experiences. Not higher because the lack of deep workplace tool integration significantly limits the platform for digital workplace deployments.

Drupal's Scheduler module handles automated publish and unpublish dates, enabling content expiry workflows. Content Moderation provides archival states in the content lifecycle. Content ownership is tracked via Drupal's user system. With the April 2026 Acquia AI launch, Acquia Web Governance is part of the unified Acquia Source workspace — automated governance scanning for stale and non-compliant content runs across sites from within the unified Acquia Source workspace. However, automated review-date reminders and content freshness dashboards still depend on the separately licensed governance tooling rather than core platform features. Not higher because governance capabilities require the Acquia Source/AI add-on rather than being core platform features.

Basic page view analytics are available via GA4 integration or Drupal's statistics module. Acquia CDP can provide audience-segmented engagement data. Acquia Search's Solr analytics can surface failed search terms. However, there is no native department-level content analytics dashboard, engagement heatmaps, adoption dashboards, or intranet ROI reporting built into the Acquia platform. Surfacing meaningful intranet analytics requires custom dashboard development combining multiple data sources. Not higher because the gap between basic page view data and actionable intranet engagement analytics is substantial.

Acquia Site Factory provides genuine multi-tenant architecture with separate databases per site, configuration isolation, brand-level settings, and independent content. Each site is a separate Drupal instance sharing a codebase. Site Factory Stacks support multiple dev teams, regions, brands, and even different Drupal versions. Confirmed deployments at scale: 437 sites in 50+ languages in 18 months. Not higher than AEM because the isolation model is codebase-shared rather than fully independent content models.

Site Factory's shared codebase model enables centralized component libraries consumed by all brand sites. Site Studio focuses on design system management and brand governance (explicitly differentiated from Canvas), enabling centralized component sharing with brand-level overrides. Content Hub with Pull Syndication enables cross-site content sharing. Acquia DAM serves as a shared media library. Not higher because there's no native design token versioning system — brand variations depend on theme configuration and the shared-with-overrides pattern requires deliberate architecture.

Site Factory provides centralized governance with granular permissions, enforced code standards, centralized updates, and cross-brand content policies. Content Hub enables cross-brand content publishing with approval workflows. Acquia Web Governance, now part of the Acquia Source workspace, provides automated accessibility and policy compliance scanning across sites from a unified workspace. Multi-level governance (global → region → brand → site) is well-documented. Not higher because cross-brand approval workflows still require custom implementation via Content Moderation + Group patterns rather than being native to Site Factory.

Site Factory's shared codebase model provides genuine infrastructure efficiency — adding a new brand site costs less than deploying a separate Drupal instance. Centralized updates reduce per-site maintenance overhead. Volume licensing exists for multi-site. Acquia Source's SaaS model may further reduce per-site operational overhead. However, each site still requires database and hosting resources, Content Hub and PIM add cost for cross-site capabilities, and the absolute cost remains enterprise-level. Not higher because per-brand licensing increments are moderate rather than minimal.

Site Studio is explicitly designed for brand governance with per-brand theming: design tokens, typography, color palettes, logo treatment, and approved component overrides applied at the tenant level while sharing underlying component structures. Site Factory's brand-level configuration isolation enables independent visual identity per brand. This is a genuine differentiator for Acquia in multi-brand deployments. Not higher because implementing brand theming requires significant Site Studio configuration work, and true design token versioning (propagating token updates to downstream brands) requires deliberate architecture.

Site Factory's brand isolation combined with Drupal's multilingual stack enables per-brand localization with independent translation workflows per site. Content Hub can manage cross-brand translation coordination. Regional legal content can be isolated per brand site. However, a unified governance dashboard for the brand × locale matrix — managing per-brand translation approvals alongside cross-brand shared content — requires custom implementation. Not higher because managing the intersection of brand governance and locale governance is a complex operational problem that Acquia does not solve natively.

Site Factory's centralized dashboard provides operational visibility across sites (status, deployments, code versions) but does not provide content performance analytics. Per-brand GA4 integration delivers brand-level page analytics. Acquia CDP can aggregate engagement data. However, a portfolio-level analytics dashboard showing content velocity, engagement comparison across brands, publishing cadence benchmarking, and aggregate content performance is not a native Acquia feature. Not higher because cross-brand analytics requires manual aggregation from separate brand analytics accounts.

Content Moderation module supports independently configurable approval workflows per Drupal site on Site Factory — each brand can have its own review stages, approval chains, and scheduling logic. Site Factory's centralized management console provides some audit visibility across brands. However, a unified cross-brand audit log and centrally auditable workflow compliance dashboard requires custom implementation. Not higher because while per-brand workflow configuration is achievable, centralized audit trail management is not native.

Acquia Content Hub with Pull Syndication directly addresses corporate-to-brand content syndication: content created at the corporate level is published to a hub, brand sites subscribe and pull content with configurable override control. Legal disclaimers, product announcements, and press releases can be syndicated with local adaptation points. Controlled push updates propagate content changes to subscriber sites. This is a genuine first-class capability in Acquia's product. Not higher because override management requires deliberate configuration, and real-time push updates across large site portfolios can encounter latency.

Site Factory's per-brand site isolation enables independent compliance configurations per brand and region. EU Cookie Compliance module manages GDPR consent per site. Acquia Cloud's data residency options support regional data storage requirements. Acquia Web Governance (in the Acquia Source workspace since April 2026) scans for accessibility and policy compliance violations across sites. However, publishing guardrails that prevent non-compliant content publication are not native — compliance enforcement depends on workflow configuration and governance agent scanning rather than pre-publication blocking. Not higher because compliance is reactive rather than preventive at the platform level.

Site Studio is purpose-built for federated design system management: a core component library maintained centrally, brand-level extensions with controlled overrides, and centralized update propagation across tenant sites. With Drupal Canvas now the default page builder, Acquia has confirmed Site Studio's go-forward focus is specifically design system management and brand governance — features Canvas will not cover. Components are versioned and brands can be restricted to approved component subsets. This is Acquia's strongest multi-brand capability alongside tenant isolation. Not higher because design token versioning and structured update propagation to downstream brands requires careful orchestration and the tooling for managing component version updates at scale is not fully automated.

Site Factory provides centralized user management with SSO across all brand sites, granular per-brand permissions, and a central admin role that manages all brands from a single dashboard. Brand teams can operate autonomously within their site while central administrators maintain oversight and cross-brand access rights. SAML/SSO via Acquia Cloud Shield ensures consistent authentication. Not higher because cross-brand contributor roles (an editor who contributes to multiple brands but not all) require custom permission configuration and Site Factory's user management UI can be complex to administer at large brand counts.

Site Factory's shared codebase model allows globally defined content types to be shared across all brand sites. Brand-specific extensions to content models are achievable via Drupal's field system — Brand A can add video fields and Brand B can add comparison table fields to a shared base type via codebase-level configuration. However, this requires codebase management coordination rather than UI-level self-service model extension. Brands cannot independently extend content models without developer involvement at the codebase level. Not higher because the extension model is developer-mediated rather than brand-team self-service.

Site Factory's centralized dashboard provides operational portfolio visibility: site status, code versions, deployment history, and security patch status across all brand sites. This is operational reporting, not editorial or business performance reporting. Content freshness by brand, publishing SLA adherence, and cost allocation per tenant are not available natively. Building executive portfolio reporting requires integrating Site Factory operational data with per-brand analytics from GA4 and custom data warehousing. Not higher because the gap between operational monitoring and executive editorial reporting is substantial.

Acquia offers a pre-signed, self-serve DPA to all customers, not only enterprise ones. It includes EU/Swiss SCCs, the UK IDTA, CCPA/CPRA and US state privacy law sections, and a Security Annex of technical and organizational measures. A public sub-processor list with change notifications, per-product GDPR Product Notices and EU hosting regions complete the picture. Not higher because the sub-processor footprint is large and varies by product and add-on, which makes strict GDPR governance more complex.

Acquia sells a documented HIPAA offering on Cloud Platform. HIPAA customers sit in a logically separated shared environment with extra encryption on filesystem and database volumes, and they sign a BAA with Acquia. The annual SOC 2 Type 2 report includes a section mapping controls to HIPAA Security Rule requirements, available under NDA. Not higher because the BAA needs extra contract language through the account team, covers Acquia's infrastructure only, and leaves application-level HIPAA controls to the customer.

The FedRAMP Marketplace lists Acquia Cloud as FedRAMP Authorized at Moderate impact, with an agency authorization dating from 2016, 26 agency authorizations and A-LIGN as assessor (+15). Acquia is also validated as a PCI DSS Level 1 service provider by a QSA, with ROC and AOC, and supports FISMA, CCPA/CPRA, UK IDTA and US state privacy laws through the DPA. Not higher because there is no IRAP, C5, HITRUST or other non-US government certification, and PCI and FedRAMP scope excludes CD environments and Cloud IDE.

Acquia's annual SOC 2 Type 2 report (2025 period, January to December) covers the Security, Availability and Confidentiality criteria for Cloud Platform (Classic and Next), CDP, Campaign Studio and DAM. SOC 1 Type 2 is also maintained, and reports are available through the trust center under NDA. Scored slightly lower than before because the Source CMS privacy notice says that product is still 'Working toward SOC2 Type 2'. Source CMS is the managed SaaS offering Acquia now promotes most heavily, so buyers choosing it get no attestation yet.

Acquia holds its own ISO 27001 certification for its ISMS, rather than relying on AWS's certificate, and the 2025 certificate and Statement of Applicability are on the trust center. ISO 27018 for cloud PII processing is not listed anywhere in Acquia's compliance pages, which keeps the score below 80. Not lower because the ISO 27001 certification belongs to Acquia's own management system and is kept current.

Acquia has a strong set of additional certifications: CSA STAR at both Level 1 (self-assessment) and Level 2 (third-party audit), FedRAMP Moderate, PCI DSS Level 1 service provider validated by a QSA, FISMA support and SOC 1 Type 2. Few DXP vendors match this, thanks to its focus on US government and healthcare buyers. Not higher because it has no IRAP, C5, ENS, Cyber Essentials Plus, HITRUST or ISO 27017/27701.

Cloud Platform customers choose AWS regions in the US, EU and APAC when they sign. Acquia commits not to move subscriber data outside Cloud Platform or to third parties without the customer's authorization. Source CMS offers only US-East or EU-Central, and its notice says other data centre locations are not supported at this time. Not higher because content cached on the Cloudflare CDN is served globally, and APAC hosting is not available for every product.

Retention after termination is now documented. The Source CMS notice says Acquia purges all customer data, personal data included, no later than 90 days after the contract ends. Cloud Platform infrastructure is terminated and application data deleted when a customer cancels, and media is sanitized to NIST 800-88 or DoD 5220.22-M. Customers can export, update and erase personal data themselves through the admin console and Drupal, and Acquia runs a DSR portal. Not higher because export relies on Drupal's own tools and backups rather than a purpose-built export product.

Acquia logs at the application and platform layers into a SIEM that keeps logs for up to 390 days. The Notifications API gives organization-level audit logs of team and permission actions, and Site Factory has its own audit events. Log forwarding pushes logs natively to Splunk, Sumo Logic and other syslog destinations on Cloud Classic and Cloud Next. Not higher because log forwarding is a paid add-on enabled through the account manager, New Relic is not a supported destination, and customers cannot configure retention themselves.

Acquia's Product Accessibility page sets the goal that every Acquia product will meet WCAG 2.2 AA. Its testing combines manual review, Lighthouse, axe, VoiceOver and keyboard checks. The Drupal authoring UI underneath follows the Drupal project's WCAG 2.1 AA and ATAG 2.0 commitments, and the Cloud Platform VPAT documents WCAG 2.0/2.1 A and AA results. Not higher because Acquia says its software 'is not yet fully AA compliant', and the Cloud VPAT reports only partial Section 508 conformance.

Acquia publishes a VPAT 2.4 for Cloud Platform covering Cloud Classic and Cloud Next against WCAG 2.0 and 2.1 A/AA, plus feature-level ACRs for DAM, the latest dated February 2025. It also has an accessibility statement and a product accessibility page. Not higher because the Cloud VPAT dates from October 2023, most DAM ACRs are from 2021 to 2023, and there is no ACR for Source CMS or the Drupal authoring experience Acquia sells.

The Conductor Writing Assistant now runs inside the Source CMS node edit form (release notes 2026-09-17 and 2026-09-28). It generates AI outlines, inserts text directly into body fields and scores content 0–100 for intent alignment. On Cloud Platform, the Drupal AI framework adds generation through the Acquia AI Provider gateway. Held below 70 because the assistant is an OEM partner component, brand-voice controls and governed prompt templates are not documented, and CKEditor AI was spun out of the core Drupal AI package in 1.5.0.

Acquia DAM ships AI alt text (via a customer-supplied OpenAI key), AI tags, AI product descriptions and opt-in AI document summaries on Asset Digest, and its MCP server documents automatic focal-point cropping. Drupal CMS-based sites can also auto-generate alt text in the Media Library. There is still no native image generation, which caps the score below 65.

AI translation on Acquia comes from the Drupal AI ecosystem. ai_translate was deprecated as a submodule in Drupal AI 1.5.0 and now ships as a standalone stable project, which can be routed through the Acquia AI Provider or another provider module. Older evidence of DAM transcreation is not backed by current DAM docs, and DAM document summaries are English-only. This is a basic MT hookup without brand-voice preservation or quality scoring, so the score sits in the low 50s.

Several layers of SEO and metadata automation: the Conductor Writing Assistant scores intent and search alignment before publication; the Acquia AI Provider lists auto meta descriptions, keywords, tags and alt text as supported Drupal AI use cases; DAM auto-tags and writes alt text; Web Governance runs SEO and readability checks. Held below 70 because these pieces are spread across products, with no single built-in workflow that generates titles, descriptions and schema.

Multiple AI assists are part of editorial work: DAM AI tagging and bulk metadata updates over MCP, Drupal AI automators for tagging and enrichment, Web Governance Policy Assistant (a Gemini chatbot that writes custom scan policies), an ML model that holds back anomalous scan releases for human review, and the Writing Assistant. Scheduled or saved AI automations are not available yet (out of scope in Acquia AI Early Access), which keeps the score in the low 60s.

Acquia's own Acquia AI Product Guide states that Acquia AI is an Early Access release with no SLA. Work Mode offers one default Site builder agent, open to Early Access participants only, which acts only in a provisioned sandbox Source CMS environment and never in production. Custom agent creation, saved or scheduled workflows and connectors beyond Slack are out of scope. The April 2026 'no-code agent builder' claim is therefore not shipping, and the Web Governance Remediation Companion is still Limited Availability. Plan-approval gates and the Cloud Platform AI skills for coding agents keep it at the top of the early/beta band, not lower.

The Writing Assistant's new Intent tab analyzes objective, audience and journey stage, alongside a 0–100 content score. Web Governance tracks content health, readability, SEO and broken or stale content across domains. Acquia CDP still offers predictive models, but it is in maintenance cadence. There is still no AI dashboard for topic clustering, gap analysis or ROI attribution, so the score stays below 60.

Web Governance (formerly Monsido) audits accessibility (WCAG 2.2 AA), readability, SEO, spelling and data protection at scale. Its MCP server has 13 live tools, including an accessibility_remediation_source_code tool that returns fixed HTML with explanations. The AI Remediation Companion is still Limited Availability rather than GA, and brand-voice compliance scoring is not documented. That puts it in the mid-60s rather than 70+.

Acquia Search powered by SearchStax provides NLP, Smart Match Assist, related searches and AI handling of misspellings, documented in Acquia's own help articles. Solr 9 vector search is used in production on Drupal sites. Source CMS now serves Markdown and AI-discoverability controls for LLM crawlers. Held below 65 because the strongest AI search tiers are paid SearchStax add-ons and Drupal's ai_search is now a standalone alpha project.

Acquia CDP still documents predictive ML models, persona clusters and recommendations, but in 2026 it has shipped one release and has dropped out of the acquia.com product nav. Day-to-day personalization now runs through Acquia Conversion Optimization by Wingify, an OEM product with an AI Co-Pilot and segment targeting. The ML layer exists but is mostly OEM or in maintenance, so the score is in the mid-50s rather than near 70.

Acquia now has three official MCP servers. The Source CMS server is per-site and authenticated with OAuth dynamic client registration; it has around 30 resources and tools for content, content modeling (types, fields, JSON Schema), Canvas pages, forms and menus, and it gained new tools in June–August 2026. The DAM server supports search, metadata, security and tag writes under each user's RBAC. The Web Governance server has 13 live tools. Held below 75 because the Source CMS server is still labelled an 'experimental feature' and documents no publish operation.

On Cloud Platform, the Drupal AI framework accepts any provider module (OpenAI, Anthropic, Gemini, Azure, Bedrock and others), and DAM alt text uses a customer-supplied OpenAI key. However, Acquia's own AI features are fixed to vendor choices: Acquia AI runs on an 'Acquia-managed backend service', the Acquia AI Provider is a gateway to a 'curated selection' of models billed in AI Credits, and Web Governance's Policy Assistant uses Gemini. The '48+ providers' claim from the April press release reflects the Drupal ecosystem, not a BYOK setting in Acquia AI. That makes this partial BYOK, and no model-routing residency controls are documented.

Acquia publishes agent-oriented developer tooling with official guides: Cloud Platform AI skills (github.com/acquia/acquia-skills, with llms.txt and AGENTS.md) for coding agents; a Drupal Canvas AI Builder guide for building sites with coding agents plus Source MCP; an Acquia AI module (2026-07-16) with JWT authentication and a configurable agent access policy; Drupal MCP plugin guides; MCP client setup for Claude Code, Cursor, VS Code and Codex; and Markdown endpoints for LLMs. This meets the 70 bar. No LangChain or LlamaIndex guides or packaged AI SDK keep it from going higher.

In Acquia AI Work Mode, every change needs customer approval of a plan, publishing always requires approval, there are per-agent resource access controls, and the agent cannot act on production. The same product guide, though, lists customer-facing audit trails, full RBAC, and an organization-level AI opt-out with opt-out audit logging as out of scope for the current release. That contradicts the April press release's 'full audit trails'. Web Governance AI can be disabled only by support request. Strong approval gates without customer-visible audit trails put it at the bottom of the 50–70 band.

Cloud Platform now shows an AI Credits card in the Subscriptions entitlements view, with balance, budget and usage synced every 30 minutes for the Acquia AI Provider. Drupal AI's ai_observability module can log AI calls on Cloud sites. Per-user or per-team consumption, prompt effectiveness and quality trends are not documented, and Acquia AI Early Access says customer-facing logging is not available. That leaves it at the basic end of cost visibility.