{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "payload", "name": "Payload", "vendor": "Payload CMS, Inc. (Figma)", "vendorUrl": "https://payloadcms.com", "kind": "http-api", "category": "cms", "summary": "Payload is an open-source, code-first headless CMS and application framework for Node.js and Next.js, now part of Figma. Agents manage content, drafts, versions and locales through generated REST and GraphQL APIs or an official MCP plugin.", "url": "https://www.anchorterminal.com/tools/payload", "markdownUrl": "https://www.anchorterminal.com/tools/payload.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/payload.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/payload.json", "repo": "https://github.com/payloadcms/payload", "license": "MIT for the core and the official packages. Enterprise add-ons are sold separately through sales", "transports": [ "http", "streamable-http" ], "packages": [ { "registry": "npm", "name": "payload" }, { "registry": "npm", "name": "@payloadcms/plugin-mcp" }, { "registry": "npm", "name": "@payloadcms/sdk" } ], "auth": "api-key", "authNotes": "Self-serve keys on your own instance, with no app review or partner approval. REST and GraphQL take a per-user API key sent as `Authorization: {collection-slug} API-Key {key}` once `auth.useAPIKey` is set on an auth collection. The key signs requests in as that user under the collection's access control, doesn't expire, is shown once, and can be regenerated or revoked by an admin. The MCP plugin has its own keys, created in the admin panel under MCP API Keys with find, create, update and delete switches per collection, sent as `Authorization: Bearer {key}`. Changing `PAYLOAD_SECRET` invalidates every key.", "pricing": "free", "pricingNotes": "Free to self-host under the MIT licence, with no account at Payload and no card, so an agent can start without a contract. Enterprise (SSO, publishing workflows, visual editor, dedicated support) is sold through sales with no public price. Payload Cloud has paused deployment of new projects since Payload joined Figma (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the 3.x documentation, the get-started page or the MCP plugin source (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 45151, "npmWeekly": 1108564, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://payloadcms.com/docs", "llmsTxt": "https://payloadcms.com/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.localisation", "cms.assets", "cms.schema" ], "tags": [ "open-source", "self-hosted", "mcp", "llms-txt", "graphql", "rest", "typescript", "nextjs" ], "lastRelease": "2026-09-23", "graded": true, "anchor": { "graded": true, "score": 55.2, "grade": "C", "agentReady": false, "rank": 516, "ranked": true, "rankOf": 722, "categoryRank": 10, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 64, "maintenance": 78, "payments": 45, "reliability": 78, "schema": 70, "security": 57, "transparency": 62 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 78, "points": 15.6, "reason": "Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js 18.20.2 or 20.9.0 and later in `engines` and 20.9.0 in the docs (20). A public `ci` workflow runs on every push. On the 3.x branch the 7 October 2026 run passed and the 8 October run failed, and the three latest runs on main failed (17 of 25). 499 issues are open, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026 (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in canary (15)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` and `select` are JSON passed as strings (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Four MCP tools per enabled collection and two per global, so five collections give 20 tools, the 11 to 30 band (15). We added 7 because the owner enables collections and operations one by one, each key narrows the list again, and find tools default to 10 documents at depth 0 with `select` (22 of 25). Page-based pagination with `limit` and `page`, 17 `where` operators, `sort`, `select` and `populate` (20). REST errors come back in an `errors` array and MCP tools return a text line beginning `Error:`. Neither format is documented as a list an agent can match on (10 of 20). No idempotency keys, and no `readOnlyHint` or `destructiveHint` in the plugin source. An update by id is repeatable (4 of 20). Few required parameters and sensible defaults. The one official client, `@payloadcms/sdk` for TypeScript, is labelled beta (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 57, "points": 9.98, "reason": "REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address, and advisories are published on GitHub with affected versions, patches and workarounds. No security.txt, bug bounty or SOC 2 statement was found (9 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 45, "points": 5.63, "reason": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 78, "points": 6.83, "reason": "3.90.2 was published to npm on 23 September 2026, 15 days before this check (30). Eight stable releases between 10 July and 23 September 2026, plus 4.0.0 canaries up to 8 October (20). 225 issues opened against 116 closed since 10 July, 140 open issues awaiting triage and 763 open pull requests (12 of 25). `@payloadcms/sdk` is current at 3.90.2 but beta and TypeScript only, and the official MCP registry has no Payload entry, which fits a plugin that runs inside each install (8 of 15). CI runs on every push. The latest 3.x run failed on 8 October 2026 (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 62, "points": 5.43, "note": "editorial 74, provenance 50", "reason": "MIT for the core and official packages, with LICENSE.md in the repository (30). A self-hosted install keeps content on its owner's servers. The privacy policy dates from 28 March 2024, states no retention periods that we could find and doesn't mention Figma. The only published terms cover Payload Cloud, which is closed to new projects (15 of 30). A written versioning policy defines breaking changes and how they're announced, with a migration guide per major. No end-of-support date for 3.x was found (13 of 20). Telemetry is on by default, documented as anonymous and turned off with `telemetry: false`. The docs don't list the fields sent (16 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Four MCP tools per enabled collection and two per global, so five collections give 20 tools, the 11 to 30 band (15). We added 7 because the owner enables collections and operations one by one, each key narrows the list again, and find tools default to 10 documents at depth 0 with `select` (22 of 25). Page-based pagination with `limit` and `page`, 17 `where` operators, `sort`, `select` and `populate` (20). REST errors come back in an `errors` array and MCP tools return a text line beginning `Error:`. Neither format is documented as a list an agent can match on (10 of 20). No idempotency keys, and no `readOnlyHint` or `destructiveHint` in the plugin source. An update by id is repeatable (4 of 20). Few required parameters and sensible defaults. The one official client, `@payloadcms/sdk` for TypeScript, is labelled beta (8 of 15).", "maintenance": "3.90.2 was published to npm on 23 September 2026, 15 days before this check (30). Eight stable releases between 10 July and 23 September 2026, plus 4.0.0 canaries up to 8 October (20). 225 issues opened against 116 closed since 10 July, 140 open issues awaiting triage and 763 open pull requests (12 of 25). `@payloadcms/sdk` is current at 3.90.2 but beta and TypeScript only, and the official MCP registry has no Payload entry, which fits a plugin that runs inside each install (8 of 15). CI runs on every push. The latest 3.x run failed on 8 October 2026 (8 of 10).", "payments": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under MIT, which the get-started page states. The only paid option, Enterprise, is priced by sales, and Payload Cloud is closed to new projects, so 15 of 20. No card and no account at Payload are needed (20). `npx create-payload-app` installs it, but the docs create REST and MCP API keys in the admin panel, so half (10).", "reliability": "Read with the local-software lines, since the graded surface is software its owner hosts. Official npm packages, with Node.js 18.20.2 or 20.9.0 and later in `engines` and 20.9.0 in the docs (20). A public `ci` workflow runs on every push. On the 3.x branch the 7 October 2026 run passed and the 8 October run failed, and the three latest runs on main failed (17 of 25). 499 issues are open, 140 of them awaiting triage, with 225 opened and 116 closed since 10 July 2026 (12 of 25). A written semver policy marks breaking commits with `!` and lists them in release notes, but lets security fixes and experimental APIs change in minor releases (14 of 15). 3.x is the stable line, with 4.0 in canary (15).", "schema": "No OpenAPI file is published or generated by the core packages, because endpoints depend on each project's config. Every MCP tool carries a typed input schema built from the collection's fields, and the GraphQL schema is generated from the same config (20 of 25). llms.txt per major version, llms-full.txt and a Markdown copy of every docs page (10). Default MCP tool descriptions are one line, such as `Create a document in a collection.`, unless the owner writes one in the plugin config. The docs tell owners to do so (10 of 20). Field inputs are typed with bounds on `limit` and `depth`, but `where` and `select` are JSON passed as strings (10 of 15). REST operations show a request and a response each. No reference page for error responses or status codes was found (8 of 15). Semver, release notes on GitHub and separate docs per major version. REST paths carry no version (12 of 15).", "security": "REST keys are per user, revocable and regenerable, shown once, and limited by that user's access control down to field level. MCP keys carry per-collection, per-operation switches. Both travel only in the Authorization header. Neither expires, and there is no OAuth (24 of 30). A find-only MCP key is a config switch away and the collection's access control still runs under it. Nothing asks a person to approve a delete or a publish in the free edition (14 of 20). Documents hold text written by other people, and no prompt-injection guidance was found. `overrideResponse` can strip fields before they reach a model (3 of 15). Versions record each change, and `onEvent` and `verboseLogs` expose MCP calls to the owner's own logging. No built-in audit log (7 of 15). SECURITY.md gives a reporting address, and advisories are published on GitHub with affected versions, patches and workarounds. No security.txt, bug bounty or SOC 2 statement was found (9 of 20).", "transparency": "MIT for the core and official packages, with LICENSE.md in the repository (30). A self-hosted install keeps content on its owner's servers. The privacy policy dates from 28 March 2024, states no retention periods that we could find and doesn't mention Figma. The only published terms cover Payload Cloud, which is closed to new projects (15 of 30). A written versioning policy defines breaking changes and how they're announced, with a migration guide per major. No end-of-support date for 3.x was found (13 of 20). Telemetry is on by default, documented as anonymous and turned off with `telemetry: false`. The docs don't list the fields sent (16 of 20)." }, "sources": [ { "what": "3.x docs index for agents", "url": "https://payloadcms.com/docs/v3/llms.txt", "seen": "2026-10-08" }, { "what": "docs index by major version", "url": "https://payloadcms.com/llms.txt", "seen": "2026-10-08" }, { "what": "MCP plugin docs", "url": "https://payloadcms.com/docs/v3/plugins/mcp.md", "seen": "2026-10-08" }, { "what": "REST API docs", "url": "https://payloadcms.com/docs/v3/rest-api/overview.md", "seen": "2026-10-08" }, { "what": "API keys", "url": "https://payloadcms.com/docs/v3/authentication/api-keys.md", "seen": "2026-10-08" }, { "what": "drafts", "url": "https://payloadcms.com/docs/v3/versions/drafts.md", "seen": "2026-10-08" }, { "what": "versions and restore", "url": "https://payloadcms.com/docs/v3/versions/overview.md", "seen": "2026-10-08" }, { "what": "uploads", "url": "https://payloadcms.com/docs/v3/upload/overview.md", "seen": "2026-10-08" }, { "what": "config options and telemetry", "url": "https://payloadcms.com/docs/v3/configuration/overview.md", "seen": "2026-10-08" }, { "what": "repository at tag v3.90.2 and main (clone): docs, MCP plugin source, LICENSE.md, SECURITY.md, versioning policy", "url": "https://github.com/payloadcms/payload", "seen": "2026-10-08" }, { "what": "security advisories", "url": "https://github.com/payloadcms/payload/security/advisories", "seen": "2026-10-08" }, { "what": "advisories through the API", "url": "https://api.github.com/repos/payloadcms/payload/security-advisories?per_page=100", "seen": "2026-10-08" }, { "what": "CI runs on 3.x", "url": "https://api.github.com/repos/payloadcms/payload/actions/runs?branch=3.x\u0026event=push", "seen": "2026-10-08" }, { "what": "stars and repository metadata", "url": "https://api.github.com/repos/payloadcms/payload", "seen": "2026-10-08" }, { "what": "npm versions, dates and dist-tags", "url": "https://registry.npmjs.org/payload", "seen": "2026-10-08" }, { "what": "npm weekly downloads", "url": "https://api.npmjs.org/downloads/point/last-week/payload", "seen": "2026-10-08" }, { "what": "get-started page (linked as Pricing)", "url": "https://payloadcms.com/get-started", "seen": "2026-10-08" }, { "what": "Payload Cloud notice after joining Figma", "url": "https://payloadcms.com/payload-has-joined-figma", "seen": "2026-10-08" }, { "what": "Payload Cloud terms", "url": "https://payloadcms.com/cloud-terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://payloadcms.com/privacy", "seen": "2026-10-08" }, { "what": "security page", "url": "https://payloadcms.com/security", "seen": "2026-10-08" }, { "what": "enterprise page", "url": "https://payloadcms.com/enterprise", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=payload", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.org/domain/payloadcms.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead omitted the official MCP plugin and Payload Cloud's pause on new projects. Both are recorded.", "No `provenance.terms` is recorded. The only published terms cover Payload Cloud, which is closed to new projects, and the software is under MIT.", "unchecked: a status page. None is linked from the pages we read and status.payloadcms.com didn't resolve.", "unchecked: whether any of the 49 advisories was exploited before its fix. We found no report either way.", "unchecked: Enterprise prices and whether Enterprise adds an audit log. The enterprise page lists what is included without prices.", "unchecked: REST error bodies and status codes by live call. No instance was run.", "LICENSE.md names Payload CMS, LLC, while the terms and privacy policy name Payload CMS, Inc. Figma's legal role isn't stated on the pages we read.", "The versioning policy was read on the main branch (4.x docs). The 3.90.2 tag's docs folder doesn't contain it." ] }, "negative": -10, "negativeNotes": [ "18 September to 8 October 2026. Payload published 38 security advisories in three weeks, 49 in the 12 months to 8 October 2026 (8 critical, 23 high, 18 medium). They include remote code execution through the first-register operation (GHSA-97rh-rhh2-7vjv), SQL injection on Postgres and SQLite (GHSA-v49j-62m6-pgrr), unauthorised document updates on orderable collections (GHSA-f7hx-52q9-hcrf) and four in `@payloadcms/plugin-mcp`, one an account takeover through the experimental password recovery tool (GHSA-h5rh-4jwf-738p). All are fixed in 3.90.0 or earlier, each was published by the vendor with affected versions and a workaround, and we found no report of exploitation, so we deduct 10 of a possible 15. https://github.com/payloadcms/payload/security/advisories" ], "verdict": "Payload generates REST, GraphQL and MCP interfaces from one typed config, with drafts, restorable versions and per-key MCP permissions in the free MIT core. The security record is the limit. The vendor published 49 advisories in 12 months, 8 of them critical, so an install older than 3.90.0 is exposed. No OpenAPI file is published.", "bestFor": "Teams that build on Next.js and want the content model in TypeScript, with drafts, versions and localisation in the free core.", "strengths": [ "MIT core with drafts, version history and restore through `POST /api/{collection-slug}/versions/:id`, none of it behind a paid plan", "MCP API keys carry find, create, update and delete switches per collection, and the key's user still passes through the collection's access control", "New documents default to `_status: 'draft'`, so nothing is published unless the request sets `_status: 'published'`", "MCP find tools default to 10 documents and depth 0, cap at 100, and take `select` to return named fields only", "llms.txt per major version, llms-full.txt and a Markdown copy of every docs page" ], "weaknesses": [ "49 security advisories in the 12 months to 8 October 2026, 8 critical, 38 of them published since 18 September 2026", "No OpenAPI file is published or generated by the core packages, and REST error responses have no reference page", "REST and MCP API keys don't expire, and rate limiting is left to the owner's own hooks or proxy", "No idempotency keys, and the MCP tools set no `readOnlyHint` or `destructiveHint` annotations", "Payload Cloud is closed to new projects, Enterprise is priced by sales, and no status page or security.txt was found" ], "agentNotes": [ "Check the installed version first. Anything below 3.90.0 carries published critical advisories, so ask the owner to upgrade before writing", "Send REST keys as `Authorization: {collection-slug} API-Key {key}` and MCP keys as `Authorization: Bearer {key}`. The two key kinds are separate", "To publish, set `_status: 'published'` in the data. The `draft` parameter only relaxes validation and chooses where an update is written", "Upload files with multipart POST to the upload collection, with other fields as JSON in `_payload`. No MCP upload tool is documented", "Roll back with `POST /api/{collection-slug}/versions/:id` after listing versions. Versions exist only where the collection config enables them" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "C", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 55.2 } ], "editorialScores": { "ergonomics": 64, "maintenance": 78, "payments": 45, "reliability": 78, "schema": 70, "security": 57, "transparency": 74 }, "provenanceScore": 50 }, "connect": { "install": "npx create-payload-app", "http": "curl 'http://localhost:3000/api/pages' \\\n -H \"Authorization: users API-Key $PAYLOAD_API_KEY\"", "claudeCode": "claude mcp add --transport http Payload http://127.0.0.1:3000/api/mcp \\\n --header \"Authorization: Bearer MCP-USER-API-KEY\"", "config": { "mcpServers": { "Payload": { "headers": { "Authorization": "Bearer MCP-USER-API-KEY" }, "type": "http", "url": "http://localhost:3000/api/mcp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/payload" }, "notable": [ "The official MCP plugin `@payloadcms/plugin-mcp` (3.90.2) answers at `/api/mcp` over HTTP and generates find, create, update and delete tools per enabled collection, and find and update per global (https://payloadcms.com/docs/v3/plugins/mcp.md)", "Enabling a collection in the plugin config isn't enough. Each MCP API key must also have the capability switched on in the admin panel (https://payloadcms.com/docs/v3/plugins/mcp.md)", "Deployment of new Payload Cloud projects is paused since Payload joined Figma. Existing projects keep running, and Payload says a migration will follow (https://payloadcms.com/payload-has-joined-figma)", "GitHub lists 50 published advisories for the repository, 49 of them between 5 February and 8 October 2026, 8 rated critical (https://github.com/payloadcms/payload/security/advisories)", "The default branch now builds 4.0.0 canaries (canary.39 on 8 October 2026). 3.90.2 of 23 September 2026 is the `latest` tag on npm (https://registry.npmjs.org/payload)", "Collections keep up to 100 versions a document by default (`maxPerDoc`), and restore is a REST, GraphQL and Local API operation (https://payloadcms.com/docs/v3/versions/overview.md)" ], "area": "business", "details": [ { "label": "Graded surface", "value": "Self-hosted Payload 3.90.2 (MIT) through its generated REST API and the official MCP plugin. Payload Cloud is closed to new projects, so it isn't graded" }, { "label": "REST API", "value": "Generated per collection under `/api`. GET, POST, PATCH and DELETE on `/api/{collection-slug}` and `/api/{collection-slug}/{id}`, plus `/count`, `/versions` and `/api/globals/{global-slug}`, with `depth`, `locale`, `fallback-locale`, `select`, `populate`, `limit`, `page`, `sort`, `where` and `draft` parameters" }, { "label": "MCP server", "value": "`@payloadcms/plugin-mcp` 3.90.2, built on `@modelcontextprotocol/sdk` 1.30.0, POST to `/api/mcp`. Tools are named `findPosts`, `createPosts`, `updatePosts` and `deletePosts` for a `posts` collection. Custom tools, prompts and resources can be added in config" }, { "label": "GraphQL", "value": "`@payloadcms/graphql` generates queries and mutations from the same config, with `maxComplexity` to reject costly queries" }, { "label": "Credentials", "value": "REST and GraphQL take a per-user API key (`auth.useAPIKey`) that doesn't expire and can be regenerated or revoked, or a JWT from login. MCP takes its own keys from the MCP API Keys collection" }, { "label": "Drafts and versions", "value": "`versions.drafts` adds `_status` (draft or published). `GET /api/{collection-slug}/versions`, `GET /api/{collection-slug}/versions/:id` and `POST /api/{collection-slug}/versions/:id` to restore" }, { "label": "Runtime", "value": "Node.js 20.9.0 or later, Next.js, and MongoDB, Postgres or SQLite" }, { "label": "Telemetry", "value": "On by default and described as anonymous. `telemetry: false` in the Payload config turns it off" }, { "label": "Paid options", "value": "Enterprise (SSO, publishing workflows, visual editor, dedicated support) through sales, no public price" } ], "unitPrices": [ { "item": "Self-hosted Payload", "unit": "month", "usd": 0, "note": "MIT, you pay for your own hosting and database" } ], "provenance": { "legalEntity": "Payload CMS, Inc.", "domain": "payloadcms.com", "domainRegistered": "2018-04-02", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://payloadcms.com/privacy", "statusPage": "", "changelog": "https://github.com/payloadcms/payload/releases", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "No `terms` is recorded. The only terms on payloadcms.com are the Payload Cloud terms at https://payloadcms.com/cloud-terms, which govern a hosted service closed to new projects. The software an agent uses is under the MIT licence in LICENSE.md.", "The privacy policy (effective 28 March 2024) names Payload CMS, Inc. as controller. The Cloud terms call it a Delaware corporation with an address at 624 Stocking Ave. NW, Grand Rapids, Michigan 49504. LICENSE.md names Payload CMS, LLC.", "The site says Payload has joined Figma. The privacy policy and the Cloud terms don't mention Figma.", "A self-hosted install answers on its owner's domain.", "https://payloadcms.com/.well-known/security.txt and https://payloadcms.com/security.txt returned 404 on 8 October 2026. SECURITY.md gives security@payloadcms.com.", "No status page is linked from the site footer, the security page or the get-started page, and status.payloadcms.com didn't resolve.", "RDAP for payloadcms.com gives a registration date of 2018-04-02." ], "score": 50, "checks": [ { "check": "Legal entity named", "value": "Payload CMS, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "payloadcms.com, registered 2018-04-02 (8 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": " is not on payloadcms.com", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 6 of the 8 things a reader expects", "points": 8.5, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://payloadcms.com/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2024-03-28", "words": 4972, "points": 8.5, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective as of March 28, 2024.", "says": "Last updated 2024-03-28" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "(\"Payload,\" \"we\", “us” or \"our\") processes personal information that we collect through our digital or online properties or services that link to this Privacy Policy (including as applicable, our website, mobile application, social media pages, marketing activities, live events and other activities described in this P…" }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": false }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as:" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms." }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "You can contact EDPO regarding matters pertaining to the GDPR:" }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": false }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.", "says": "Data goes to the United States" } ], "toKnow": [ { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/payload.json" } }