Pimcore (Digital Asset Management)

Positioning

• Platform, not point DAM. Pimcore markets a "Data & Experience Management Platform" and treats DAM as one of six domains on a shared data model S95 S1. All three element types live in one system, so updating an image updates every product record, page or feed that uses it S26. This suits organisations that manage product data and product media together: retail, CPG, manufacturing and wholesale are the industries Pimcore highlights S20. See DAM vs PIM, MAM and CMS.
• Developer-centric. Projects are built on PHP/Symfony. Asset metadata models, thumbnail pipelines, workflows and Datahub endpoints are configured in Studio and extended in code S27 S53 S61. Partners or in-house teams usually do the implementation (170+ solution partners claimed) S20.
• Packaged DAM features sit mostly in Enterprise. The free core covers storage, metadata, versioning, thumbnails, search, workflows, WebDAV and GraphQL. Brand/asset portals, local editing (Direct Edit), class-based asset metadata, webhooks, the read-only REST API, AI Copilot and OIDC SSO need the Enterprise edition S2.
• Analyst view. Pimcore's Gartner coverage is for PIM, MDM and DXP, not DAM (see below) S24. No Forrester or Gartner DAM evaluation including Pimcore was found.
• Competitors in Gartner's PIM and MDM quadrants are not named by Pimcore. DAM competitors as perceived by the market: Unknown (no DAM-specific analyst comparison found).

Pricing & licensing

Editions (each one includes everything in the editions below it) S2:

• Price drivers: no seat limits ("onboard as many users as you like"). More than 4 independent production instances need the Pimcore Unlimited Edition (price not published). PaaS cost depends on a "right-sized base commit" with per-minute "Boost Mode" scaling S14.
• Licence history: Pimcore was GPLv3 open source up to Platform Version 2024.4. Commercial modules were under a separate licence that the release notes call "PCL" S6. With 2025.1 (2025-04-30) all modules moved to the single POCL S5 S6 S13. Under POCL S4:
  • the source of open-core modules stays public on GitHub, and customers may modify it without publishing their changes;
  • free production use only applies under the revenue threshold (whole company group), is self-certified and can be audited; Pimcore may charge fees retroactively once the threshold is passed;
  • running Pimcore as a hosted or managed service for third parties, or forking it into a competing product, is prohibited without a separate agreement;
  • proprietary (Enterprise) software is "never free of charge".
• GPLv3 versions (≤ 2024.4) and POCL code cannot be mixed in one deployment S5. A community fork, OpenDXP, continues the last GPLv3 code base (Pimcore CE 11.5) without any affiliation to Pimcore GmbH S92 S19.
• Product registration: since 2025.1 every instance needs a product key, without which installation fails and the application container cannot be built S88 S6.
• Admin UI Classic fee: Community users who kept the ExtJS-based Admin UI Classic on 2025.x had to buy a perpetual licence at EUR 1,480 because of ExtJS licensing S6. The classic UI was removed in 2026.1 S9.
• Trial: free Community Edition, a public demo and guided product tours S14 S87.

Security & compliance

• Certifications: no ISO 27001 or SOC 2 report for Pimcore GmbH or its software was found. The PaaS page names SOC 2, PCI DSS and HIPAA and shows GDPR/CCPA logos for the managed platform S15 Unverified (these appear to describe the Upsun hosting stack; Pimcore does not state the scope).
• Hosting security (PaaS): automatic TLS, encryption at rest and in transit, optional DDoS protection add-on, Fastly CDN S15.
• SSO / identity: local users with TOTP two-factor authentication (Google Authenticator), which admins can make mandatory S38. OpenID Connect SSO for Studio, with several providers in parallel and claim-to-role mapping, is an Enterprise bundle S78. Portals can also use OIDC S44. SAML: Not public (not documented). SCIM provisioning: Unknown.
• Permissions: users and roles. System permissions (e.g. assets tree, thumbnails, metadata) plus permissions on data elements, set per folder S37.
• Default asset exposure: asset files are publicly reachable by URL by default for performance reasons. Confidential files must sit in protected folders blocked at web-server level or routed through a permission-checking controller S30.
• Audit: versions of every save (unlimited unless configured) S34. Notes & Events log per element S39. The DAM page says backend actions are logged with timestamp, user and action S1.
• Vulnerability handling: central GitHub security advisories in the platform-version repository S91. Each Platform Version ships a CycloneDX SBOM since 2026.2 S10 S94. Example: 2026.3 fixed a stored-XSS vector through uploaded HTML/JS asset files S11.
• Data residency: self-hosted customers choose it themselves. PaaS: region choice is advertised, list Not public S15.

Analyst & market recognition

None of these evaluations covers DAM specifically.

History