On June 16, 2026, Magnolia DXP achieved ENS certification (Esquema Nacional de Seguridad) at the highest level, Alta — the strictest tier of Spain's national security framework. ENS Alta is the de facto security standard for providing technology services to the Spanish public administration and highly regulated organizations.
At first glance, this sounds like a regional compliance topic. It is much more than that.
What happened — and what is behind it technically?
The Esquema Nacional de Seguridad is the binding information security standard for Spain's public sector and all private organizations that provide technology services to the public sector. The Alta level is reserved exclusively for systems in which a security incident would have catastrophic consequences — disruption of critical services, serious harm to people or compromise of sensitive national information. The requirements at this level are comprehensive: a security operations center, penetration testing, full redundancy, advanced identity management, end-to-end encryption and annual independent audits by ENAC-accredited certification bodies.
This certification independently confirms that Magnolia DXP's security controls meet the strictest requirements of Royal Decree 311/2022. This is not a one-time process: ENS Alta — like the ISO 27001:2022 and SOC 2 Type 2 certificates held in parallel — is not achieved once and ticked off, but requires continuous investment in controls and monitoring as well as an annual independent reassessment.
Talal Waseem, Information Security Officer at Magnolia, puts it unmistakably in the official blog post: “At Magnolia DXP, security is not a feature — it is a foundation.”
Why is this strategically significant — far beyond Spain?
On the surface, ENS Alta addresses a geographically limited market. The strategic logic behind it reaches further. This certificate means that Spanish authorities, financial institutions, healthcare providers and all companies subject to Spanish regulatory requirements can now deploy Magnolia DXP with full confidence in its independently verified security standards.
Magnolia thus simultaneously holds three of the world's most demanding security frameworks: ISO 27001:2022 as the international standard for information security management systems, SOC 2 Type 2 — independently audited by A-LIGN — which confirms the effective operation of security and data protection controls over an audit period, and ENS Alta as Spain's highest national security certification under Royal Decree 311/2022. Together, these certificates cover the full spectrum of what global enterprises, regulated industries and government bodies need from a DXP vendor.
This is a combination that cannot be taken for granted in the composable DXP market. Contentful, Contentstack or Storyblok have considerably thinner evidence to show in the BYOK area and in national compliance certifications at a European level.
Concrete implications for companies and projects
From a project perspective — especially in the German-speaking and European region — a clear picture emerges: every enterprise tender in the public sector, healthcare or financial industry that requires regulatory evidence now has, with Magnolia, a DXP vendor that can present three tier-1 certificates held simultaneously. This considerably shortens vendor assessment cycles and reduces the risk for the responsible decision-makers on the customer side.
Magnolia's Swiss origins and strong certification landscape — SOC 2, ISO 27001, ENS — make the platform a credible choice for regulated European companies. For SI partners such as Portalworks, this means a clearly differentiating argument in the pre-sales phase that is technically substantiated and verifiable — not a marketing claim, but audited evidence.
This step fits precisely into Magnolia's broader security and AI strategy. While the vision is an intelligent, agentic platform, security remains the top priority for every CIO. A core question with public AI models is data privacy and data sovereignty — and the most effective answer is to enable companies to use their own, privately hosted models. Sebastian Geschke, AI Lead Architect at Magnolia, sums up the technical consequence: “We support the actual feature to bring your own deployed model. So you can go and host your own inference API for an LLM, and that brings the ultimate security.”
ENS Alta certification and the BYOM principle (Bring Your Own Model) thus mesh together: if you want to run AI workloads in highly regulated environments, you need both — certified infrastructure and data sovereignty at the model level. Magnolia is currently one of the few DXP vendors to deliver both at the same time, and verifiably so.
For ongoing projects, this results in a concrete recommendation: compliance-relevant requirements should be anchored in the evaluation matrix of tenders and RFPs from the outset. Magnolia has measurably set itself apart from competitors here in recent weeks — and shortly before the NEXT 2026 conference in Basel, where live demos of agentic AI and the new Visual Editor have been announced. The timing of the certification announcement is no coincidence.
