Why organisations choose an open source CMS
An open source CMS ships with its source code and a licence to use, modify and redistribute it. Drupal is released under the GPL v2 or later, so there is no per-seat, per-site or per-environment licence fee, and no tier that gates a feature behind an enterprise contract.
Avoiding vendor lock-in is now the leading driver of open source adoption in Europe. The 2026 State of Open Source Report, published by the Open Source Initiative in April 2026 from more than 700 respondents, puts it at 55% overall, up 68% year on year, and 63% across the EU and UK against 51% in North America.
What you own is concrete: the codebase, the database, the content, the configuration, the deployment pipeline and the hosting relationship. Any competent Drupal team can take the platform over, which is what makes an exit path real rather than contractual.
What open source does not remove is cost. Implementation, hosting, maintenance and evolution are still paid work. What changes is where the money goes, into your platform rather than into a renewal, and that the bill does not scale with editor seats, page views or environments. Drupal itself is not a niche bet either: 500,000+ sites were reported running on it at the Drupal CMS 2.0 launch in January 2026, backed by a dedicated security team that publishes advisories on a fixed schedule.
Open source is also not automatically more secure, and the mechanism is what matters. The source is inspectable by anyone, vulnerabilities are disclosed publicly on a published cadence, and on a maintained platform applying them is a contractual commitment. The same 2026 report found that 55% of organisations which failed a compliance audit last year had end-of-life open source in their stack. Unmaintained open source is the risk, not open source.
Where this argument extends into data residency, infrastructure control and procurement, it is set out in full under digital sovereignty with open source.
They've Trusted Metadrop
From industrial manufacturing and chemicals to humanitarian organisations, international federations and public administrations, organisations publishing across 50+ countries and 30+ languages have relied on Metadrop for their content platforms.
What clients say about working with Metadrop
The quotes below are the client testimonials tagged for this solution.
Editorial experience: Drupal CMS 2.0 and Drupal Canvas
Drupal CMS 2.0 was released on 28 January 2026, built on Drupal core 11.3. It ships site templates, recipe-based integrations that install in one step, and AI-assisted authoring.
Drupal Canvas is the visual page builder. It reached 1.0 in December 2025 and has been on the 1.9.x line since July 2026, requiring Drupal 11.3 or later. On a new Drupal install it is the default page-building experience. Canvas was developed under the working name Experience Builder and later renamed, which creates a naming collision worth clearing up: Canvas is the Drupal builder, and Canva is the external design tool it connects to. The link between them is a design-to-page workflow, not a merger of two products.
What an editor actually does in Canvas is drag components onto the page, watch the rendered result while editing, reorder sections and publish, without a developer in the loop for a routine page. What still needs engineering is the component library itself: the options each component exposes, the constraints that stop a page being broken, the media handling and the translations. That is the work Metadrop does, and it is what separates a page builder that holds up at scale from one that produces inconsistent pages within a quarter.
Paragraphs and Layout Builder remain supported. Most enterprise Drupal estates run one of them today and neither is deprecated. Canvas is where new builds are heading, and an existing estate can move component by component on its own schedule. The current component model is Single Directory Components (SDC): template, styles and behaviour in one directory, exposed to Canvas with a typed schema so an editor gets sensible options instead of a free-text field.
Metadrop maintains Artisan, an SDC-based Drupal theme published on drupal.org, and has written publicly on building with it.
A global B2B marketplace in the wind-energy sector was upgraded to Drupal 11 and moved off a legacy layout module onto Drupal Canvas, with its theme migrated to Artisan, Metadrop's Tailwind-based base theme. Metadrop built an 80-component Single Directory Component library on it, exposed to Canvas so editors compose pages from reusable parts. Canvas lacked asymmetric translation support at the time, so Metadrop implemented it and proposed the solution upstream, allowing page structure to differ per language.
Editorial workflow, roles and content governance
The real question behind "is it easy to use" is whether forty editors across twelve markets can work in the same platform without breaking each other's pages. Content moderation states, typically draft, review, published and archived, answer most of it: each transition is tied to the role allowed to make it, so a market editor submits and a brand owner approves.
Around that sit the mechanics editorial teams ask for by name. Scheduled and deferred publishing handles campaign launches, embargoed announcements and coordinated multi-market releases. Revisions and version history on every content item show what changed, who changed it and how to revert. Content locking during concurrent sessions stops two editors overwriting each other on a high-traffic page. A media library acts as the single home for images, video and documents, with reuse across sites and focal-point cropping instead of per-page uploads.
Two of the harder governance requirements are ones Metadrop maintains modules for on drupal.org. Editorial Access Manager assigns edit rights per language on specific content, so a local team owns its market without touching the source language. Entity Mesh maps how content entities link to each other, so broken relationships surface before a restructure or migration rather than after it.
Across client platforms this has meant unified component sets spanning article, landing and basic-page types, moderation workflows carrying archived and redirect states, and scheduling wired into moderation rather than sitting beside it.
One design system across every brand and market
A component library is the design system in executable form. Each component carries its own styles and typed options, so an editor picks from what the brand allows instead of styling a page by hand. Design tokens for colour, spacing and typography are defined once and consumed by every component, which is what turns a brand refresh into a token change rather than a page-by-page rework. Where marketing teams want to adjust those tokens without waiting for a deployment, Metadrop maintains CSS Variables Customizer for that purpose.
The design work sits inside the delivery team. Research, wireframes, the validated prototype and the handover package come from people who know what the theme layer and the component system can do, so the recommendations are implementable in Drupal. That practice is described under UX/UI design.
Accessibility is treated as an engineering requirement throughout delivery, and it is handled at component level: semantic markup, keyboard paths, focus handling and contrast checked inside the component instead of retro-fitted page by page. On one public institution's platform, a full redesign and rebuild covered sitemap, wireframes, responsive interface and styleguide alongside the migration and the multilingual setup, with design and build running as a single engagement.
Modular architecture, integrations and headless options
Drupal is API-first out of the box. JSON:API ships in core, GraphQL is available as a contributed module, and custom REST endpoints are routine. Coupled and headless are both supported, and the choice belongs to the project rather than to a trend: coupled keeps editorial preview and rendering in one place, while headless puts a JavaScript front end over the Drupal API, as described under headless CMS with Drupal.
Headless is not automatically the better answer. Metadrop has rebuilt a headless platform back to a coupled architecture specifically to simplify the content-management workflow for the editorial team, because the decision follows the team and the roadmap.
Integration patterns already delivered include CRM systems such as Salesforce and Microsoft Dynamics, ERP, marketing automation, SSO and identity providers, payment gateways, PIM and product-asset feeds, DAM, and legacy REST and SOAP back ends. That work is covered under module development and third-party integrations.
Commerce, intranet, e-learning and advanced search run on the same platform rather than as separate systems: Drupal Commerce, enterprise intranets, LMS and e-learning, and Solr and Elasticsearch search.
The default when something is missing is to extend rather than fork. Metadrop has contributed 120+ modules to drupal.org with 500+ issue credits, so the generic part of a solution stays maintained by the community instead of being billed to one client on every upgrade.
Multilingual, multisite and multi-market publishing
Translation is in core, covering interface, content and configuration, with right-to-left layouts and per-language editorial ownership. Multisite runs many sites on one codebase with a shared configuration base and per-site overrides, which is what keeps a thirty-site estate maintainable. The architecture is described under Drupal multisite.
Coming from another CMS is a supported starting point. WordPress, Contentful, WooCommerce, legacy proprietary platforms and older Drupal versions all have a migration path, set out under migrate to Drupal.
A gluten-free food manufacturer publishes across 35 country sites from one platform. A chemicals group runs 33 sites, the main corporate site plus country and brand sites, on a single architecture. A workplace-supplies distributor operates 19 country sites, and a property-media group runs three main sites with fourteen country subsites. An international authors' rights confederation consolidated 7 sites off a legacy proprietary CMS onto one platform, retiring the old licence entirely. A multinational home-appliance and HVAC manufacturer was taken over from its previous provider, stabilised, and moved from a single install to a multisite architecture so newly acquired brands launch as new sites on the same codebase.
Search, SEO and visibility in AI answers
SEO capability sits in the platform, not in a paid add-on: editable URL patterns, full metatag control including Open Graph and Twitter cards, redirect management, XML sitemaps, canonical handling and Schema.org structured data. Multilingual SEO covers per-language URLs, hreflang and per-market metadata, which is where most multi-country platforms lose organic traffic.
Site search that scales past the database means Apache Solr or Elasticsearch, with faceted filtering, multilingual indexing and federated search across a multisite estate.
Visibility inside AI answers is now a separate discipline from ranking, with its own checks: crawler access, structured data, and whether a page's content can be extracted as an answer at all. Metadrop runs it as a measured service under GEO and AEO audit. Migrations are where organic traffic is most exposed, which is why redirect mapping and indexation monitoring before and after cutover belong in the migration plan rather than in a follow-up ticket.
Security, compliance and where your platform lives
Metadrop holds ENS certification, Spain's Esquema Nacional de Seguridad, at Categoría Media under Royal Decree 311/2022. It is a risk-based framework validated by external audit across more than 64 distinct security measures, and in Spanish and EU public-sector procurement it is frequently an entry requirement rather than a differentiator. ISO 9001 and ISO 14001 certification means those security and quality controls run inside a documented, audited management system.
The whole Metadrop team is located in Spain, and therefore inside EU jurisdiction. Where a tender or a DPA asks about third-country transfers, the answer on our side is that there are none.
On GDPR, the work covers consent management, lawful-basis data flows, data-subject-rights tooling and care with what third-party scripts collect. On accessibility, WCAG 2.1 AA is the level European obligations reference today, and the European Accessibility Act has applied since June 2025. Metadrop builds to 2.2 AA as an engineering benchmark, while a whole-platform legal conformance statement is a separate assessment, described under accessibility audit and consultancy. Metadrop has also published on the legal obligations arriving for the public and private sector from 2025 onwards under that act.
Delivery is prepared for NIS2 requirements, with a secure development lifecycle, dependency and CVE scanning, and a defined vulnerability-response path. That reading of the directive is an interpretation rather than legal advice. Security patching then runs under a contractual SLA with proactive monitoring, as part of Drupal maintenance and support.
AI in the editorial workflow
Drupal CMS 2.0 ships AI-assisted authoring: page generation from a text prompt, an admin chatbot that understands site context, and AI-generated alt text for accessibility. The AI layer is pluggable, so the provider is a configuration decision rather than a rebuild, and the model can change as the field moves.
Where a model earns its cost today, in Metadrop's experience, is narrower than the marketing suggests: machine translation wired into the editorial workflow rather than bolted beside it, semantic and vector search alongside Solr, draft and metadata assistance, and categorising or evaluating submitted form data instead of having someone read all of it. AI runs inside permissions and workflow, so generated content enters the same draft, review and publish path as anything else.
Metadrop's default is to contribute an AI integration upstream as a module rather than bury it in custom code, so the client stops paying to maintain it alone. The Voiceflow integration module is one example, and Metadrop has published on combining Drupal with AI for content production and on implementing an AI customer-support agent in Drupal. Broader automation and model-integration work is covered under AI and automation.
How a Metadrop CMS project runs
Delivery runs in seven phases, each producing an artefact the client can read before the next one opens.
Discovery and content model
Audience, content types, taxonomy, integration map and migration inventory, settled before any build decision is fixed.Architecture and roadmap
Coupled or headless, single site or multisite, component strategy, hosting target and a prioritised backlog.Design system and component library
Wireframes, a validated prototype, then the SDC component set the editors will actually use.Build in two-week sprints
Demos, retrospectives and a backlog the client can read at any time.Migration and content load
Redirect mapping and indexation monitoring where an existing site is being replaced.uality, security and accessibility gates
Automated tests, static analysis and CVE scanning before each release. Metadrop's development toolchain, *Aljibe*, is published openly, so a client can install it and check what the quality gates enforce before signing.Launch and continuous evolution
Production rollout and ongoing work under a defined SLA, with monitoring and a roadmap rather than a handover and silence.
Engagement models and handover
Metadrop works through three engagement models that combine freely: a dedicated core team on a monthly retainer, strategic projects at fixed price, and agile evolution on prepaid hours. Many client relationships extend over multiple years, and training is part of the handover, with the aim of increasing the client's operational autonomy over time. Where a team wants to go further, the training programmes are the route.
Handover at project close covers source code, documentation, credentials and environment access, so the platform can be maintained elsewhere if the relationship ends.
Tell us what you run today, how many markets publish on it and what has to be integrated, and we will come back with an architecture direction and an engagement model that fits.
Why Metadrop for an open source CMS
15+ years building Drupal platforms, as a Drupal Association Silver Certified Partner renewed annually, an Acquia Bronze partner, and a partner of Upsun for managed Drupal platforms.
120+ contributed Drupal modules and 500+ issue credits on drupal.org, sustained year on year. By contributed-project count that places Metadrop among the roughly 25 most active Drupal companies worldwide, out of more than 5,000.
Editorial experience and site building is one of the four areas Metadrop goes deepest in, and the evidence is the modules it maintains: Artisan, Artisan Styleguide, Visual Layout Suite, Editorial Access Manager, Layout Kit, CSS Variables Customizer, Entity Mesh and Content First.
Delivery across 50+ countries and 30+ languages, for manufacturing, chemicals, humanitarian organisations, public administrations, universities, media and international federations. One partner covers the lifecycle, from strategy and UX/UI through build, migration, maintenance and SLA-backed support, with the same team across phases and independent technical governance where several providers are already involved, as described under Drupal consulting.
ENS, ISO 9001 and ISO 14001 certified, EU-based, and used to European procurement documentation.
Frequently asked questions
What is an open source CMS?
An open source CMS is a content management system distributed with its source code under a licence permitting use, modification and redistribution. Drupal is released under the GPL v2 or later. In practice that means no licence fee, freedom to host it wherever you choose, and the ability to have it maintained by any competent team rather than only by its vendor. The code being open does not make the platform free to run: implementation, hosting and maintenance are still paid work.
Is Drupal a good open source CMS for a large organisation?
Drupal suits organisations with multilingual, multi-site, integration-heavy or compliance-bound platforms, which are the requirements that make a simpler CMS expensive to bend. More than 500,000 sites were reported running on it at the Drupal CMS 2.0 launch in January 2026. The capabilities that matter at that scale are translation in core, multisite on one codebase, granular roles and permissions, revisioning and moderation, and an API-first content layer. It is a poor fit for a small brochure site with no integrations and no compliance obligation, where the platform is more machine than the job needs.
What is Drupal CMS 2.0 and how is it different from Drupal?
Drupal CMS 2.0, released on 28 January 2026, is a ready-to-use distribution built on Drupal core 11.3. The same Drupal sits underneath, packaged with site templates, one-step recipe integrations and AI-assisted authoring, so a working site exists on day one instead of after a build. Drupal core remains the framework, and an enterprise project usually starts from that packaging before diverging into its own content model and component library. Both carry the same open source licence, and moving between them is not a migration.
What is Drupal Canvas, and is it the same thing as Canva?
Drupal Canvas is Drupal's visual page builder, released as 1.0 in December 2025 and on the 1.9.x line as of July 2026, requiring Drupal 11.3 or later. It was developed under the working name Experience Builder. Canva is a separate, external design tool that Canvas connects to, so a design produced there can be brought into a Drupal page. The names are close and the products are not the same thing. Canvas is the default page-building experience on new Drupal installs, while Paragraphs and Layout Builder remain supported on existing estates.
Do we have to rebuild our site to move to Drupal Canvas?
Moving to Drupal Canvas does not require a rebuild. The path is to convert existing components, whether Paragraphs types or Layout Builder blocks, into Single Directory Components, then compose new pages in Canvas while existing pages keep rendering as they do. The prerequisite is Drupal 11.3 or later, so on an older core version the Drupal upgrade comes first. Metadrop has delivered this on a production platform: an 80-component SDC library on Canvas, replacing a legacy layout module, with asymmetric translation support contributed upstream.
What does an open source CMS actually cost?
An open source CMS carries no licence fee, so the budget covers implementation, hosting, maintenance and evolution, and none of those scale with editor seats, environments or page views. The cost drivers on a real project are the number of content types and components, the integration count, how many markets and languages publish, and how much content is being migrated. Metadrop quotes per project rather than publishing a rate card, and a 30-minute call is normally enough to produce a scoped estimate range.
How is an open source CMS kept secure?
Security on an open source CMS rests on disclosure and patching cadence, not on the code being hidden. Drupal's security team publishes advisories on a fixed schedule, and on a maintained platform applying them is an SLA commitment rather than an intention. The controls that matter alongside patching are role and permission design, dependency and CVE scanning in the build pipeline, secure deployment, backups and monitoring. The recurring risk is open source left unmaintained past its end of life: the 2026 State of Open Source Report found that 55% of organisations which failed a compliance audit last year had end-of-life open source in their stack.
Can we migrate our content from our current CMS?
Content migration onto Drupal is a supported path from WordPress, Contentful, WooCommerce, legacy proprietary platforms such as eZ Publish, and older Drupal versions. The migration is designed around a content inventory and mapping, test migrations before cutover, redirect mapping to preserve URLs, and indexation monitoring after launch, with the goal of preserving organic traffic and content integrity through the change. Metadrop has consolidated multi-site estates off legacy proprietary platforms, including a seven-site consolidation for an international confederation.
Who owns the platform we pay for?
The client owns the source code, the repositories, the content and the intellectual property for the work Metadrop delivers, and an NDA can be signed before any technical detail is shared. At project close the handover covers source code, documentation, credentials and environment access. Because the platform is open source and the toolchain is documented, another team can take it over, which is what makes the exit path real rather than a clause in a contract.
Plan your open source CMS project
Tell us what you run today, whether that is a licensed platform coming up for renewal, an ageing Drupal install or several disconnected sites, and how many markets publish on it.
You talk to an engineer rather than a sales desk. Metadrop normally replies within one business day with a proposed next step, the first call is 30 minutes with no commitment, your data is handled under our privacy policy, and an NDA is available on request.