By Drupal Association

Drupal

Modular CMS widely used by NGOs and public bodies. Heavier than WordPress; strong access-control and multilingual features.

Log in to add an offering to your organisation’s current stack.

GPL-2.0 · https://www.drupal.org

Website & formsFrameworks & runtimes

Drupal self-hosted

Hosting: Self-hosted

GPL; self-host on PHP/MySQL or managed EU hosts.

Fair 4.7 Easy 2.7 Secure 3.7

Pillar	Criterion	Score	Evidence
Easy	Day-one UX Can non-technical staff use it without a project?	2	Typical onboarding for this product category. Source
Easy	Operate Admin burden, updates, backups and language coverage.	2	You handle updates, backups and scaling. Source
Easy	Integrate SSO, mail/CalDAV, APIs and common NGO connectors.	4	Integrations vary; check current APIs and connectors. Source
Fair	Lock-in / exit Can you leave with your data in open formats, at known cost?	4	Self-host keeps data and exit paths under your control. Source
Fair	Sovereignty EU legal entity, EU hosting, and exposure to extra-EU lawful access?	5	Non-EU or special jurisdiction — verify hosting and lawful-access exposure. Source
Fair	Openness Open source or open standards? Are independent implementations possible?	5	Open-source licence or self-host path available. Source
Secure	IT security Authentication, encryption, patch cadence and independent audit.	4	Security baseline depends on vendor posture and your configuration. Source
Secure	User security 2FA, roles, phishing resistance and safe defaults.	3	Account roles and MFA availability vary by plan. Source
Secure	Personal data GDPR fit: DPA, residency, sub-processors and Schrems II posture.	4	Review DPA, residency and subprocessors carefully. Source