See How Sitefinity Cloud Works

Sitefinity Cloud is a fully managed, AI-powered cloud-native CMS designed for modern digital teams. Built on Microsoft Azure, it leverages native services for auto-scaling, load balancing and global availability. It provides scalable enterprise infrastructure optimally configured for security, scalability and performance.

Sitefinity Cloud CMS offers enterprise-grade SLA (99.95% uptime), DDoS protection and continuous security patching. With a strong compliance posture, it includes certifications like ISO 27001, SOC 2 and features such as global CDN, WAF, monitoring and audit logs. The infrastructure maturity of Sitefinity CMS is above average compared to competitors who rely on less integrated hosting stacks or DIY Azure/AWS setups. 

How does Progress® Sitefinity® Cloud reduce total cost of ownership compared to self hosting? 

Operations, security hardening, observability, autoscaling and platform upgrades are managed for you—so budgets shift from undifferentiated infrastructure to content and experience delivery. 

The service offers fully managed CI/CD pipelines and deployment automation tools for rapid deployment, streamlined upgrades, rollback and environment parity. Customers choose their level of control, from fully managed options to more hands-on configurations. 

Learn more or download Sitefinity Cloud Solution Overview

Sitefinity Cloud CMS is designed with flexible and composable pricing to meet your unique consumption needs.

Starting with the Cloud Base package, you can begin small and scale up as your requirements grow. With the help of add-ons and pay-as-you-go options, you can adjust your package to align perfectly with your usage.

For those seeking additional advanced features, enterprise-level setups or enhanced support, Sitefinity Cloud CMS offers value features/packages and enterprise-level support options. This means you can grow without the fear of outgrowing your initial setup or making an immense upfront investment, providing a scalable and adaptable solution tailored to your business. 

Yes, Sitefinity Cloud has a dynamically scaling infrastructure alongside a consumption-based pricing model to swiftly adapt to capacity requirements and traffic demands, enhancing cost-efficiency and overall performance. 

Sitefinity Cloud is built on a containerized architecture using Azure Kubernetes Service (AKS), which enables scalable, secure and efficient deployment of digital experiences. 

Yes - Moving your on-premises, or third party hosted site to Sitefinity Cloud is easy. Check out the Sitefinity Cloud requirements and the How To Move Your CMS to the Cloud guide.  

You can also purchase Sitefinity Cloud via Microsoft Azure Marketplace. Your Account Manager will assess environments, migration path and subscription setup in Azure Marketplace.

Reach out to our technical team that can provide you with a technical assessment and assist with planning your migration to the cloud. 

Sitefinity Cloud has a permission that allows only specified users to promote content to the Production environment. Additional permissions are included in Sitefinity CMS.

Visit SupportLink to log the case and select Sitefinity Cloud as the product.

In case of downtime or security incidents, an On-Duty engineer from Progress will acknowledge the issue within 15 minutes and start troubleshooting. Progress will open a ticket on behalf of the customer where detailed information will be provided every 20 minutes until the issue is resolved. If the downtime issue is caused by custom code deployed by the customer, Progress will assist with identifying the issue and provide suggestions for the fix.

Deployment runs on Microsoft Azure with integrated SIEM, Cloudflare CDN/WAF at the edge and managed observability for application and infrastructure events. 

Sitefinity Cloud is SOC2-certified and HIPAA-compliant. The platform provides built-in tools and workflows that enable organizations to address GDPR and HIPAA requirements and other data privacy laws.  

SOC2 and HIPAA-compliance reports can be downloaded from the Progress Security Center.

Sitefinity helps safeguard Personally Identifiable Information (PII) and Protected Health Information (PHI) by utilizing field mapping, PII/PHI removal workflows and data obfuscation during database restore to a non-production environment to help organizations maintain compliance and ensure personal and data privacy.

The Sitefinity Cloud documentation summarizes the regulatory certifications that Progress Software has been awarded as a company and the ones that Progress Sitefinity Cloud complies with as a product.

What is SOC2?

SOC 2 is an independent audit report that provides detailed information and assurance of the security, availability, integrity, confidentiality and privacy controls an organization has implemented in its products and internal workflows.

What is HIPAA

HIPAA is a federal law that requires the creation of standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.

The locations where Sitefinity Cloud can be provisioned are listed here.

Progress employees don't have any access to the services included in the customer's Sitefinity Cloud account. In cases of emergency that require troubleshooting, the customer can provide Progress explicit consent to access particular services of their tenant.

Progress Software is committed to providing 99.95% uptime of production websites on Sitefinity Cloud.

A 99.95% SLA translates to a maximum downtime of approximately 21 minutes per month, excluding scheduled maintenance and conditions defined in the SLA terms.

What support and SLAs do I get with Sitefinity Cloud purchased via Azure Marketplace? 

Support and SLA entitlements are identical to direct purchase. They are tied to your Sitefinity Cloud subscription tier, not the checkout channel.

This SLA applies to the availability of the production environment hosted in Sitefinity Cloud.

All of the Azure services that Sitefinity Cloud leverages are within an Azure subscription which is owned and managed by Progress.

The Sitefinity Cloud Base package includes options for pre-committed page views and API calls, along with consumption-based add-ons and pay-as-you-go solutions for surpassing limits.

Refer to the Sitefinity Cloud Packages page for up-to-date information on the current usage guidelines.

Sitefinity Cloud is provided as a service by default and is always running on the latest version without the need for any customer involvement. 

For the ASP.NET Core renderer application which is customizable and under customer control, an automated process runs daily checks for updates and executes a step-by-step upgrade routine. You're duly notified via email and have full control over when to merge and promote the upgrade.

Page views are counted as HTTP requests that match the following criteria: 

• Host: must be a Production domain 
• Method: GET 
• Response code: 200 (OK) 
• Bot filter: Likely human (requests that are determined to be from bots are not counted) 
• Content type: html 
• User agent does not contain "AppInsights" (excludes uptime health checks) 
• URL path is not part of Sitefinity Admin UI or media documents 

API calls are counted as HTTP requests that match the following criteria:

• Host: must be a Production domain 
• Content type: xml OR json 
• User agent does not contain "AppInsights" (excludes uptime health checks) 
• URL path is not part of Sitefinity system APIs used for Admin UI 

Page views and annual quotas are assessed yearly, allowing customers to offset their peak usage in one or more months and spread it across the entire billing cycle.   

Instead of calculating the overages every month based on the predefined quota, usage is also assessed annually. The result is a consumption-based model that offers flexibility and enables our customers to handle peaks in traffic for certain months and settle their balance at the end of the billing cycle.

To illustrate this, if your website exceeds the quota in March by 200,000 page views but due to seasonality, you do not reach your quota in August, your peak usage will be offset by the lower resource utilization in the summer. If you regularly exceed tier quota for page views or API calls, by 200,000 units each month, you will be asked to either prepay the difference or settle the balance at the end of the billing cycle. Alternatively, you can also upgrade your service to a higher bundle package by contacting your Account Manager.

You can track usage and resource utilization in the Sitefinity Cloud dashboard. Monthly usage reports contain a summary of your Sitefinity Cloud usage including the number of page views and API calls.

Customers with increased consumption needs can upgrade their quota for pre-committed page views by contacting their account manager. This can be done at any time or at the end of the designated period, in line with the renewal. 

Direct access to Cloudflare is not allowed. However, the Sitefinity Cloud team can apply custom configurations upon request. Sitefinity Cloud customers who have purchased the Advanced Security Add-on have access to all HTTP and WAF logs from Cloudflare in Azure.

 Sitefinity Cloud leverages a custom-developed Cloudflare worker function that supports customizable edge rules.

 Custom rules meeting the following criteria can be added directly to the CDN edge:

• URL or URL component (e.g., pathname, query) matches a regex
• IP is part of a safelist or blocklist
• Request header value matches a regex
• Response status code matches a regex
  

These rules can be used to configure the following actions:

• Redirect
• Rewrite
• Transform the URL (e.g., replace all occurrences of '+' with '-')
• Set custom response headers
• Set custom response cookies
• Customize CDN cache (e.g., bypass the cache or set mandatory cache duration)
• Use custom origin

Page view discrepancies between Sitefinity Cloud and Google Analytics are expected. The two systems collect and filter data using different methods and criteria.

How Sitefinity Cloud counts page views

In Sitefinity Cloud, page views are based on server-side HTTP requests that meet strict production criteria.

A request is counted as a page view when it:

• Targets a Production domain
• Uses the GET method
• Returns a 200 (OK) response
• Has content type html
• Is identified as likely human traffic
• Does not originate from uptime health checks
• Is not part of the Sitefinity Admin UI or media documents

Traffic identified as AI agents or automated bots is excluded. In addition, Sitefinity Cloud includes WAF and bot protection that may block suspicious traffic before it reaches the application layer.

This means Sitefinity Cloud reflects validated server-side traffic, after filtering and protection mechanisms are applied.

For full technical criteria, refer to the Page Views and API Calls documentation in the Management Portal.

How Google Analytics counts page views

Google Analytics collects data client-side through JavaScript tracking tags embedded in each page.

When a visitor loads a page:

• A JavaScript tag runs in the browser
• Data is sent to Google’s collection servers
• Cookies are used to track sessions and users

Google Analytics 4 automatically excludes known bots and spiders. However:

• Users who block JavaScript are not tracked
• Users who reject cookies may not be fully tracked
• Ad blockers or privacy tools can prevent tracking entirely
• Traffic blocked by WAF before page load may never trigger the tag

Google Analytics measures browser activity. Sitefinity Cloud measures validated server requests.

Why numbers differ

Common causes of variance include:

• Server-side filtering vs client-side tracking
• Bot protection and WAF blocking
• Cookie consent rejection
• Ad blockers and browser privacy settings
• JavaScript disabled in the browser
• Differences in bot detection logic

Because the two systems operate at different layers of the stack, deviations in reported page views are normal.

If reconciliation is required, review:

• Host filtering
• HTTP status codes
• Production vs non-production domains
• Bot filtering settings in both systems
• Time zone and date range alignment

Differences do not indicate data loss. They reflect fundamentally different measurement approaches.

Each customer environment is logically isolated using Kubernetes namespaces, dedicated databases and secure ingress paths. Network-level isolation and integrated security features help protect against external threats. 

How is PII handled in lower environments? 

When restoring production data to staging or development, PII is automatically obfuscated to help prevent exposure during non‑production use.