This guide is written for CTOs, lead architects, and agency owners evaluating a content platform — not for a feature-list debate. Instead of comparing how the engines work, it compares what each platform lets your team do:

• What it costs to run (total cost of ownership)
• How fast you can ship (time-to-market)
• Whether you pass the security review (compliance readiness)
• What is included versus what is paid (free core vs. paid tiers)

We compare SveltyCMS with Payload CMS, Strapi, and Directus based on publicly available documentation and pricing pages as of July 2026, on a like-for-like basis: SveltyCMS’s free core is compared against each platform’s free/community edition, with paid-tier availability noted separately. Where a competitor offers something we include for free in paid tiers, we say so. Where a competitor is genuinely stronger — a bigger marketplace, a deeper React integration — the Verdict section says that too.

This page follows EU Directive 2006/114/EC and German UWG §6 requirements for comparative advertising: all claims are date-stamped, based on verifiable public sources, and written in neutral, descriptive language. See Sources and Methodology for details.

Decision snapshot (facts, not pitch)

What differs in public product packaging and our self-measured stack (not a ranking of which vendor is “best”):

Decision factor	SveltyCMS (self-hosted core)	Payload CMS	Strapi	Directus
SSO / SAML / OIDC	Documented in core	Plugin / Enterprise SAML (public docs)	Pro / Enterprise (public pricing)	Built-in (OIDC / LDAP / SAML)
SCIM 2.0	Documented in core	Enterprise (public docs)	Enterprise (public docs)	Enterprise module (public docs)
Audit logs	Crypto-chained logs in core (self-described)	Enterprise (public docs)	Plugin / Enterprise (public docs)	Activity log; audit module Enterprise
Multi-tenancy	Native tenantId isolation in core	Not documented as built-in (as of July 2026 public docs)	Not documented as built-in	Enterprise plan (public docs)
Cold start	< 1s progressive init (our measure, Bun/local)	~3–5s (figures from public write-ups; not same harness)	~4–8s (public write-ups)	~3–6s (public write-ups)
Admin UI runtime model	Svelte 5 compile (no React VDOM in admin)	React VDOM	React admin	Vue reactivity
i18n	Paraglide compile-time	i18next runtime	Plugin runtime	vue-i18n runtime
Out-of-the-box API	REST + GraphQL + OpenAPI 3.1	REST + GraphQL	REST + GraphQL	REST + GraphQL

Competitor cold-start numbers are not measured with our suite. Treat them as orientation only. Verify current tiers on each vendor’s pricing page.

Total Cost of Ownership: Free Core vs. Paid Tiers

A meaningful difference in this comparison is where enterprise-grade capabilities sit. In SveltyCMS they are part of the free core; in several alternatives they are offered only in paid tiers. The table below compares like for like — the capabilities themselves, and where each platform places them.

Capability	Typical placement in alternatives	In SveltyCMS
SSO / SAML / OIDC	Paid tiers (Strapi, Payload); built-in (Directus)	Included in core, free
SCIM 2.0 provisioning	Paid tiers / enterprise modules (Payload, Strapi, Directus)	Included in core, free
Compliance-grade audit logs	Enterprise tiers (Payload, Directus); plugin-based (Strapi)	Included in core, free
Multi-tenancy	Custom implementation or enterprise plans	Included in core, free
Secure media sharing	Plugin-based or separate tooling	Included in core, free
DAM analytics	Plugins / enterprise modules	Included in core, free

Whether a capability is “free core” vs “paid tier” is a packaging difference on public pricing pages — not proof of implementation quality. Always re-check each vendor’s current tier matrix.

Note on methodology: Tier information is based on public pricing pages and documentation as of July 2026. Vendor pricing and tiering change frequently — verify against current pricing pages before a final decision.

Performance & Architecture: What the Admin Costs You

Every CMS admin panel carries a cost: cold-start latency, server memory, and runtime shipped to visitors. The difference between platforms is where that cost is paid — and who pays it.

Capability	SveltyCMS	Payload CMS	Strapi	Directus
Stack	SvelteKit 2 + Svelte 5 (Runes)	Next.js + React	Koa + React admin	Vue 3 + Express
Admin UI model	Svelte 5 compile	React VDOM	React admin	Vue reactivity
Cold start	< 1s progressive (our measure)	~3–5s (public write-ups)	~4–8s	~3–6s
i18n	Paraglide (compile-time)	i18next (runtime)	Plugin (runtime)	vue-i18n (runtime)
Type safety	TypeScript + Valibot	Zod (common)	Partial	Partial
Production DBs	MongoDB, MariaDB, PostgreSQL, SQLite	MongoDB, PostgreSQL	SQLite, PostgreSQL, MySQL, MariaDB	PostgreSQL, MySQL, SQLite, MSSQL

Cold start and admin model affect your compute and UX; competitor cold-start numbers are not same-harness comparisons.

List / count product layer (self-measured, 2026-08-04)

Optional dual-query list paths (findMany + exact count) vs shared findPage / count modes. Numbers are adapter-layer averages on one machine — not HTTP E2E, not competitor benches.

Engine	LIST+COUNT (legacy)	findPage (hasMore)	vs legacy	Count estimate (unfiltered)	Count exact (filtered)	L1 count cache hit
SQLite	0.192 ms	0.086 ms	~2.2×	0.023 ms	0.120 ms	~0.024 ms
PostgreSQL	2.233 ms	1.008 ms	~2.2×	0.745 ms	2.197 ms	~0.024 ms
MariaDB	1.086 ms	0.664 ms	~1.6×	0.502 ms	0.936 ms	~0.029 ms
MongoDB	4.925 ms	0.867 ms	~5.7×	0.492 ms	3.817 ms	~0.025 ms

What this is not: “0.024 ms list responses.” That figure is repeat count L1 hits only. Full list rows still cost ~findPage (+ HTTP/compression). Networked raw CRUD remains ~0.5–2 ms RTT-bound.

Verified Head-to-Head Database Benchmarks (10,000 Documents, PostgreSQL 16)

Self-measured p50 latency and throughput (RPS) across SveltyCMS, Strapi v5, Directus 12, and Payload CMS 3.0 on identical hardware (PostgreSQL 16 native, 10,000 seeded documents, August 2026, byte-identical dataset):

Workload	Metric	SveltyCMS (v0.0.7)	Strapi v5	Directus 12	Payload CMS 3.0	Architectural Difference & Notes
Cached Read (findById L1)	Latency (p50) RPS	0.839 ms 893.0 req/s	1.868 ms 499.3 req/s	2.668 ms 361.3 req/s	2.766 ms 347.0 req/s	SveltyCMS L1 Turbo GET cache (enabled by default). Competitors ran with default un-cached settings.
Un-cached Read (findByIdRandom)	Latency (p50) RPS	2.635 ms 379.0 req/s	1.538 ms 635.8 req/s	2.668 ms 361.3 req/s	2.766 ms 347.0 req/s	Direct database queries bypassing L1 cache.
Filter & Sort (listFilterSort)	Latency (p50) RPS	1.372 ms 535.9 req/s	1.953 ms 480.4 req/s	8.029 ms 124.3 req/s	3.419 ms 288.7 req/s	Direct index mapping vs. dynamic query AST builders.
GraphQL Query (graphql)	Latency (p50) RPS	1.139 ms 645.6 req/s	2.597 ms 350.2 req/s	2.734 ms 348.8 req/s	2.552 ms 378.9 req/s	SveltyCMS zero-runtime Svelte 5 resolvers. Flat 5-field schema query.
Single Write Persistence (create)	Latency (p50) RPS	14.845 ms 67.0 req/s	1.599 ms 622.2 req/s	6.984 ms 141.0 req/s	3.526 ms 263.3 req/s	SveltyCMS includes synchronous crypto audit logging & versioning. Strapi v5 leads on raw un-audited write throughput.

Methodology & Transparency Note: Standardized sequential benchmark run using 10,000 documents seeded via platform APIs on native PostgreSQL 16. SveltyCMS ships with GET L1 cache active by default; findByIdRandom measures raw un-cached DB persistence parity. Strapi v5 leads on direct write throughput. All comparisons comply with EU Directive 2006/114/EC and German UWG §6 standards.

Reproduce: BENCHMARK_RECORD=1 bun test tests/benchmarks/database-performance.test.ts · methodology: benchmarks · detail: Performance Architecture.

Media & Digital Asset Management

For agencies and media teams, the DAM is where hours disappear. These are the operations that typically cost time and money — and who supports them out of the box.

Capability	SveltyCMS	Payload CMS	Strapi	Directus
Large-file uploads	Byte-level streaming with backpressure	Buffer-based	Buffer-based	Buffer-based
Duplicate storage costs	SHA-256 content-addressable deduplication	Not documented as built-in	Plugin-based	Not documented as built-in
Secure external sharing	HMAC-signed, password-protected share links	Standard auth only	Plugin-based	Standard auth only
Per-file version history	Diff / compare / restore per file	Not documented as built-in	Not documented as built-in	Content revisions only
Safe deletion (reference protection)	Reverse-index + publish-state gate (409 Conflict)	Not documented as built-in	Not documented as built-in	Not documented as built-in
DAM analytics	Built-in usage, folder, and quota insights	Not documented as built-in	Plugin-based	Insights module
Bulk operations	Selection toolbar, 4× concurrency, publish-state gate	Not documented as built-in	Plugin-based	Built-in
Signed URLs	HMAC-SHA256, timing-safe, tenant-scoped	Not documented as built-in	Plugin-based	Not documented as built-in
Pre-upload optimization	WebGPU client-side compression	Not documented as built-in	Not documented as built-in	Not documented as built-in
Storage backends	Local, S3, R2, Cloudinary (pluggable adapters)	S3 plugin	Upload providers	Storage adapters
Media type safety	Discriminated unions + exhaustive type guards	Basic discrimination	Media library plugin	File library

Why this matters: content-addressable deduplication and client-side compression can reduce storage and bandwidth costs; signed, password-protected links let editors share assets with clients and partners without standing up a separate file-drop service.

Security & Compliance: The Audit-Ready Checklist

SOC 2, HIPAA, and GDPR reviews ask the same handful of questions: Who accessed what? How are sessions protected? Can logs be tampered with? How do users authenticate and deprovision? Every row below is a question your auditor will ask — and what each platform answers out of the box.

Compliance question	SveltyCMS	Payload CMS	Strapi	Directus
Who changed what? (audit logs)	Built-in & tamper-evident — SHA-256 chained (Core, free)	Enterprise tier	Plugin-based / Enterprise tier	Native activity log; audit module in Enterprise tier
How do users sign in? (SSO/SAML/OIDC)	Built-in — all 3 logout flows (RP-initiated, front-channel, back-channel)	Plugin-based; SAML in Enterprise tier	Paid Pro / Enterprise tier	Built-in SSO
How are users provisioned? (SCIM 2.0)	Native endpoints (RFC 7644), Core, free	Enterprise tier	Enterprise tier	Enterprise module
Are permission changes instant? (RBAC)	Instant invalidation (< 1ms)	TTL-based caching	TTL-based caching	TTL-based caching
Where are secrets stored?	Bootstrap secrets in config/private.ts; other secrets DB-driven Settings UI	Environment variables (common)	Environment variables	Environment variables
Session & CSRF hardening	__Host- cookie prefix + per-origin tokens	Built-in	Built-in	Built-in
Rate limiting	Built-in, hardware-aware (CPU / event-loop adjusted)	Not documented as built-in	Rate limit plugin	Rate limit plugin
Path traversal protection	Dual guard: string check + path.resolve() prefix	Not documented as built-in	Partial	Partial
SVG sanitization	Iterative XML scrubbing + attribute validation	Not documented as built-in	Not documented as built-in	Not documented as built-in
API key security	HMAC-SHA-256 with server secret (v2 format)	SHA-256 hashing	SHA-256 hashing	SHA-256 hashing
CORS policy	Origin allowlist — no reflection with credentials	Configurable	Configurable	Configurable
MIME enforcement	Strict allowlist (image/video/audio/pdf/archive)	Default-only coverage	Default-only coverage	Default-only coverage
GraphQL hardening	Introspection blocked unconditionally in production	Configurable	Configurable	Configurable
Secret scanning in CI	6-rule static analysis + 5 architecture rules	Not documented as built-in	Not documented as built-in	Not documented as built-in
Clickjacking protection	X-Frame-Options: DENY + CSP frame-ancestors: none	X-Frame-Options only	X-Frame-Options only	X-Frame-Options only
Session performance at scale	10,000 hot sessions (LRU + TTL)	Default	Default	Default

Compliance takeaway: SveltyCMS documents audit trails, SSO, and RBAC as core features. That can reduce paid add-ons versus some vendors’ public tier maps — it is not a SOC 2 / HIPAA certification claim. Always map controls to your auditor’s checklist.

Developer Experience: Time-to-Market

Time-to-market depends on the platform your team can ship with today. This is how each option gets you from content model to production API.

Capability	SveltyCMS	Payload CMS	Strapi	Directus
Schema definition	Hybrid — code + GUI with bi-directional sync	Code-first	GUI-first	GUI-first + code extensions
Local development	Zero-latency LocalCMS (bypasses HTTP)	Local API	Not documented as built-in	Not documented as built-in
API surface	REST + GraphQL + OpenAPI 3.1.0	REST + GraphQL	REST + GraphQL	REST + GraphQL
Real-time & collaboration	SSE + WebSocket (Yjs collaboration)	Not documented as built-in	WebSocket plugin	WebSocket + SSE
Extensibility	Built-in theme/plugin catalog	Plugin directory	Plugin marketplace — one of the largest of the four, to our knowledge	Marketplace

A note on Strapi’s marketplace: Strapi’s plugin marketplace is one of the largest of the four, to our knowledge — a real strength if you need a mature off-the-shelf integration, and a reason Strapi remains a strong default for teams that assemble integrations.

Accessibility: Compliance for Every User

Accessibility is a procurement requirement in public-sector and enterprise deals. WCAG conformance should be designed in, not retrofitted.

Capability	SveltyCMS	Payload CMS	Strapi	Directus
Accessibility target	WCAG 2.2 AA / ATAG 2.0 / WCAG 3.0-ready	No published conformance target	No published conformance target	No published conformance target
RTL support	Tailwind v4 logical properties	Partial	Partial	Partial
Keyboard navigation	Full keyboard support + ARIA-live regions	Partial	Partial	Partial

Common Scenarios

Scenario A — The Edge-Deployed Global App

The problem. You are shipping a customer-facing site to users on three continents. Latency on customer-facing pages can measurably affect conversions, and serverless cold starts can interrupt the experience.

What you need. Edge-friendly deployment, i18n that doesn’t add runtime to pages, sub-second cold starts, and media delivered from object storage close to users.

Why SveltyCMS. The admin compiles away to zero runtime, Paraglide i18n compiles to a zero-runtime bundle, cold starts stay under a second, and the R2/S3 storage adapters plus signed URLs support global media delivery. The stack deploys to edge runtimes as SvelteKit.

How the alternatives compare. React-based alternatives include runtime admin overhead and runtime i18n on pages; published benchmarks place their cold starts in the seconds range on edge/serverless runtimes.

Scenario B — The B2B SaaS Provider

The problem. You sell software to enterprises that run a security review before closing. SSO, SCIM, and audit logs are on the checklist — and so is the vendor’s price tag.

What you need. SAML/OIDC SSO, SCIM provisioning, tamper-evident audit logs, and multi-tenancy so each customer’s data stays isolated.

Why SveltyCMS may fit. Public docs place SSO, SCIM, chained audit logs, and multi-tenancy in core. That can reduce paid-tier dependencies versus some alternatives — still map controls to your auditor; not a certification claim.

How the alternatives compare. In Strapi and Payload, SSO, SCIM, and audit logs are offered in paid enterprise tiers; in Directus, compliance-grade audit logs and SCIM are enterprise modules. Custom implementation is possible but represents additional engineering effort.

Scenario C — The Media-Heavy Agency

The problem. You run client sites with large media libraries. Uploads can time out, duplicates inflate storage bills, and sharing assets with clients often means standing up a separate service.

What you need. Streaming uploads, deduplication, secure client sharing, per-file version history, and usage analytics.

Why SveltyCMS may fit. Documented streaming uploads, content-hash dedup, signed share links, per-file history, and DAM analytics in core (verify current docs for your release).

How the alternatives compare. Alternatives typically rely on buffer-based uploads and plugin-based workflows for sharing, deduplication, and analytics, or on separate file-sharing tooling.

Verdict

No CMS wins every evaluation — and claiming otherwise is how trust gets lost. Here is our honest read:

• Choose SveltyCMS when you need enterprise-grade security and compliance (SSO, SCIM, tamper-evident audit logs) without enterprise pricing; you’re building performance-sensitive or edge-deployed products; you run multi-tenant SaaS; your team is already SvelteKit or wants a single coherent stack rather than a separate admin framework layered on the front end; or your workloads are media-heavy.
• Choose Payload CMS when your team is React/Next.js and wants to share components between the admin and the front end, or when a code-first model deeply integrated with Next.js outweighs the cost of composing plugins for SSO, audit, and rate limiting.
• Choose Strapi when the plugin marketplace is your priority — one of the largest ecosystems of the four, to our knowledge, suited to teams that ship by assembling integrations — and your security requirements fit within its free tier; SSO, SCIM, and audit logs are offered in paid tiers.
• Choose Directus when you want to manage an existing SQL database with a powerful admin UI, you’re data-first rather than content-first, or you need MSSQL support. Budget for enterprise modules if compliance-grade audit logging or SCIM are on your checklist.

---

Sources and Methodology

• Date of assessment: July 2026 (list/count adapter numbers refreshed 2026-08-04). Vendor docs and pricing change; re-check before purchase decisions.
• Like-for-like basis: SveltyCMS free core vs each platform’s free/community edition where applicable; paid tiers noted separately. Self-hosted deployments.
• Performance figures: SveltyCMS numbers are self-measured (tests/benchmarks/, Intel i7-13700H class host, Bun 1.3.x). Competitor cold starts are public write-ups, not our harness. No third-party audit of our benches.
• What we avoid: Absolute speed rankings, “only platform,” or “0.024 ms list responses” without defining the exact operation (count L1 vs full list vs HTTP).
• Primary sources:
  • Payload CMS — documentation · pricing
  • Strapi — documentation · pricing
  • Directus — documentation · pricing
  • SveltyCMS benchmark reports and reproduction commands (local)
• Legal basis: This comparison is prepared in accordance with EU Directive 2006/114/EC on misleading and comparative advertising (EUR-Lex) and German UWG §6 (Unfair Competition Act). Feature-tier claims are verifiable against the vendor documentation and pricing pages listed above.

Related

• Technical Evaluation 2026
• Benchmark Reports
• Media System Architecture