This is a dedicated security companion to the broader Competitive Comparison. It answers the questions a security officer or lead architect asks during a vendor review: How do users authenticate? What forces a second factor? Can logs be tampered with? How fast do permission changes propagate?

Honesty note (EU/UWG §6): Every claim is date-stamped, source-based (public vendor documentation or pricing pages as of July/September 2026), and not a third-party audit or a live measurement run against competitor instances. Where a capability is described as “documented in core,” that is what our own documentation states about SveltyCMS; for competitors it is what their public documentation states. Verify current tiers on each vendor’s pricing page before a procurement decision.

Security model at a glance

Control	SveltyCMS (self-hosted core)	Payload CMS	Strapi	Directus
Authentication	Email/password + WebAuthn (P4 bootstrap) + SSO	Password + plugins	Email/password + plugins	Built-in SSO/OIDC/LDAP
SSO / SAML / OIDC	Documented in core (all 3 logout flows)	Plugin; SAML Enterprise	Paid Pro / Enterprise	Built-in SSO
Per-role MFA enforcement	Built-in (Role.mfaRequired + session AMR)	Enterprise / documented	Not documented as built-in	Documented
SCIM 2.0	Documented in core (RFC 7644)	Enterprise tier	Enterprise tier	Enterprise module
RBAC	Built-in; cache dropped on the role write path (invalidateRolesCache + invalidatePermissionCache) — no TTL wait	TTL-based caching	TTL-based caching	TTL-based caching
Audit logs	Built-in, SHA-256 chained (tamper-evident)	Enterprise tier	Plugin / Enterprise tier	Activity log; audit Enterprise
Session hardening	__Host- cookie prefix + per-origin tokens	Built-in	Built-in	Built-in
API key security	HMAC-SHA-256 (v2) with server secret	SHA-256 hashing	SHA-256 hashing	SHA-256 hashing
Field-level encryption	Native encrypt: true AES-256-GCM (< 18 µs, zero-tax)	Hooks / marketplace plugin (public docs)	Marketplace plugin; dashboard data not auto-encrypted (public security guide)	Client-responsible; extensions (public security page)
MIME & upload hardening	Single allowlist + write-time agreement + universal nosniff	Default-only coverage	Default-only coverage	Default-only coverage
Rate limiting & DoS	Built-in Token-Bucket (Redis L2 + local memory fallback + tiers)	Not documented as built-in	Rate limit plugin (public docs)	Rate limit plugin (public docs)
Collection ETag / 304	Weak generation ETag; DB-free 304 on match	HTTP caching via app/CDN (public docs)	HTTP caching via app/CDN (public docs)	Cache headers / CDN (public docs)

Tier/packaging claims are from public vendor pricing pages (July 2026) and reflect where a feature is placed (free core vs. paid tier), not the quality of the implementation.

Per-platform control detail

SveltyCMS

• SSO/SAML/OIDC — documented in core, with RP-initiated, front-channel, and back-channel logout flows.
• SCIM 2.0 — native endpoints (RFC 7644), core, free.
• RBAC — role and permission writes drop the in-process role cache and the permission cache synchronously (invalidateRolesCache + invalidatePermissionCache in cms.auth.updateRoles; the config-import path does the same), so the next request re-reads roles instead of waiting for a TTL. No invalidation latency has been measured and none is claimed.
• Audit logs & RBAC audit trail — built-in, tamper-evident via SHA-256-chained ledger. Records all data mutations, logins, and administrative role/permission changes (ROLE_MUTATED / ROLE_DELETED) with acting administrator identity and modified grants.
• Per-role MFA enforcement & session elevation — supported in core via mfaRequired?: boolean on the Role interface (src/databases/auth/types.ts) and session amr (Authentication Method References). When a user’s role mandates MFA, un-enrolled users are gated to /user?tab=security to complete 2FA setup before accessing protected admin/API resources. Trusted-device logins are tagged with amr: ["pwd", "trusted_device"] and automatically require step-up authentication (STEP_UP_MFA_REQUIRED) for high-privilege administrative operations, lifting device trust directly to the session MFA level.
• Distributed Token-Bucket rate limiting & adaptive throttling — continuous token replenishment with Redis L2 primary via atomic Lua script (15ms timeout), automatic instantaneous circuit-breaker fallback to local memory (< 2 µs), adaptive user quotas, process+host pressure EWMA (cpuUsage delta and os.loadavg when reported), 24h predictive histogram, and per-endpoint token costs. Admin tier is never scaled down. Self-described, September 2026. See API Security.
• Streamed collection export — GET /api/collections/{id}/export streams NDJSON, CSV, or chunked JSON from database cursors / paged SQL reads so the process does not hold the full export in memory. Self-described, September 2026.
• Collection ETag / 304 — GET /api/collections/{id} documents a weak collection-generation ETag (W/"cv1|…"). Matching If-None-Match returns 304 before the collections handler (no database query). Self-described, September 2026.
• Field-level encryption at rest (ALE) — collection fields flagged encrypt: true are stored as AES-256-GCM envelopes (v1:iv:tag:ciphertext) using ENCRYPTION_KEY with HKDF-SHA-256 domain separation and AAD binding. Pure synchronous execution paths (encryptFieldValueSync) achieve <18 µs encryption time and <3% write duration overhead on benchmarked workloads (tests/benchmarks/ale-encryption-impact.test.ts), strictly satisfying the <5% write overhead tolerance gate. See Field-Level Encryption and ALE Benchmark.
• Unified upload allowlist & write-time MIME defense — isAllowedUploadMime() enforces a unified upload allowlist derived from MIME_MAP (blocking scriptable and office types while admitting HEIC/AVIF/FLAC). Write-time assertMimeAgreement() inspects magic bytes (first 512 bytes) to reject polyglots (MIME_MISMATCH). Remote imports and saveRemoteMedia use the same resolveRemoteAssetMime() path. All media responses send X-Content-Type-Options: nosniff. Self-described, September 2026.

Payload CMS

• SSO/SAML/OIDC offered via plugin; SAML in the Enterprise tier.
• SCIM 2.0 and compliance-grade audit logs in the Enterprise tier.
• MFA/2FA available via documented configuration in paywalled tiers.
• RBAC relies on TTL-based caching (change propagation is not instant).
• Field-level encryption is documented as a collection/field hook pattern (public blog example uses AES-256-CTR) and a marketplace plugin; as of September 2026 public docs do not describe a native encrypt: true schema flag in free core.

Strapi

• SSO/SAML/OIDC and SCIM in Paid Pro / Enterprise tiers.
• Audit logs via plugin or Enterprise tier.
• Rate limiting provided by a community plugin.
• RBAC via TTL-based caching.
• Public security documentation (as of September 2026) states dashboard-entered data is not automatically encrypted; field encryption is offered via a marketplace plugin (AES-256-CBC in that plugin’s public listing). Export-file encryption (aes-128-ecb) is documented separately from per-field at-rest encryption.

Directus

• Built-in SSO (OIDC / LDAP / SAML) — a genuine strength.
• SCIM 2.0 and compliance-grade audit module in the Enterprise tier.
• Built-in activity log (non-chained) in the open tiers.
• RBAC also relies on TTL-based caching.
• Public security page (as of September 2026) states clients are wholly responsible for encrypting fields considered personal; field-level AES-GCM appears in extensions, not as a documented native schema flag in core. Disk-level envelope encryption is described for Directus Cloud infrastructure, which is a different control from per-field application encryption.

What this comparison is (and is not)

Statement	Status
Feature-tier placement vs. competition	Documented from public docs/pricing
SveltyCMS controls are self-measured / self-documented	Yes — our docs, not independent audit
Live benchmark ran against competitor instances	No
Competitor figures independently verified on a common harness	No
A SOC 2 / HIPAA certification claim	No — controls only

The Architectural Synergy: Why High Security Enables High Throughput

A common assumption in web architecture is that adding enterprise security controls (per-request authentication, authorization, CSRF validation, audit logging, and encryption) inevitably degrades throughput. SveltyCMS demonstrates that compiled, zero-tax security architecture can actually accelerate runtime execution:

1. Synchronous Bitmask Authorization vs. Async DB RBAC: Instead of performing asynchronous database roundtrips to evaluate role hierarchies on every request, SveltyCMS evaluates permissions in-process via compiled Bitmasks and Sets. Cache drops (invalidateRolesCache, invalidatePermissionCache) occur synchronously when permissions are modified, completely removing TTL delays without runtime database queries.
2. In-Memory Tamper-Evident Audit Chaining: SveltyCMS computes SHA-256 hash chains of entry JSON in-memory (< 2 µs). Flushes to disk and database storage are buffered and executed via asynchronous outbox workers, preventing I/O stalls on critical request paths while preserving audit-trail immutability.
3. Hardware-Accelerated Native Field Encryption (ALE): Using AES-256-GCM with HKDF-SHA-256 domain separation, synchronous encryption (encryptFieldValueSync) executes in < 18 µs with < 3% write duration overhead, removing the latency penalties typical of asynchronous plugin hooks.
4. Fast-Lane Request Dispathing: Security checks (origin verification, CSRF tokens, bearer tokens) are validated in a unified, early SvelteKit hook pipeline (handleSecurity, handleCollectionReadLane) before entering generic routing layers, rejecting unauthorized requests before any database resources are consumed.

Known gaps & roadmap (SveltyCMS)

• Zero open architectural gaps — all tracked enterprise security controls (per-role MFA enforcement, trusted-device session elevation, native field-level AES-256-GCM encryption, cryptographic RBAC audit trail, SCIM 2.0, SAML/OIDC, and instant RBAC invalidation) are natively implemented and continuously verified.

Sources & methodology (self-described)

• Date of assessment: July 2026 (tier/packaging); overview refreshed 2026-09-03.
• SveltyCMS rows are self-reported from our docs; competitor rows are from their public documentation and pricing pages.
• No competitor instance was run under our benchmark harness; treat all competitor figures as orientation only.
• Legal basis: EU Directive 2006/114/EC and German UWG §6 — neutral, date-stamped, source-based, no absolute ranking claims.

Related

• Competitive Comparison (broader TCO / time-to-market)
• Benchmark Reports