Sanity: The Headless CMS with Content Lake, GROQ and Real-Time Collaboration

A CMS is supposed to manage content. For many SMEs, though, it mainly manages work: updates for the CMS, for plugins, for the PHP version and for the server. And when a critical security vulnerability becomes public, the question is who actually responds.

For websites with a lot of content, or complex content, I therefore rely on headless CMSs that run entirely in the cloud. One of them is Sanity. In this post, I show you how Sanity works, what sets it apart from other systems, and why it is a secure, maintenance-free alternative to a self-hosted CMS for many projects.

In short: with Sanity, the entire content database lives in the Sanity cloud. Sanity takes care of scaling, backups and security patches in the background. All you do is maintain your content.

What is Sanity?

Sanity is a headless CMS with roots in Oslo. “Headless” means that Sanity manages content only. Presentation is handled by a separate front end. Depending on the requirements, I use Webstudio or another front end.

Sanity consists of two parts that work together:

• Content Lake: the cloud database where all content is stored as structured documents. It is operated by Sanity and cannot be self-hosted.
• Sanity Studio: the editing interface where your team creates and edits content. The Studio is open source and built on React.

Why I use Sanity: security and zero maintenance

WordPress, TYPO3, Drupal and Craft CMS have one thing in common: they are written in PHP and run on a server that someone has to operate. Running them means regular updates for the CMS, for extensions, for PHP and for the server. If any of these is left behind, it creates an attack surface.

The PHP vulnerability of October 2026

Update October 2026: PHP2Shell is a case in point. On October 21, 2026, the PHP project closed two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They allowed attackers to run their own code on vulnerable servers without authentication. According to Kaspersky, essentially every unpatched PHP installation handling web requests was at risk, and the first exploitation attempts came before the patches were published.

According to Recorded Future, most of the internet-facing PHP services with an identifiable version were also running versions that no longer receive official updates. That is exactly the situation with many SME websites: the site runs, but nobody knows which version it is on.

You can read what this means for your website in my post “Who Actually Takes Care of Your Website's Security?”.

What is different with Sanity

With Sanity, there is no server for you to run and no PHP installation that needs patching. The content lives in the Content Lake, and Sanity handles scaling, backups and security patches. Your website fetches the content through an API. The Studio itself is a static application that needs neither its own database nor an application server.

According to Sanity, security and compliance are included on all plans, including SOC 2 and GDPR compliance. By default, content is stored in the EU, in a Google Cloud data center in Belgium. For Swiss SMEs with European customers, that is a comfortable starting point.

What makes Sanity stand out

Sanity Studio: the interface adapts to your team

Sanity's greatest strength is how customizable it is. You define the content model, meaning which content types and fields exist, in code. The Studio is a React application and can be customized down to the last detail: custom input fields, previews, validations and workflows. That way, your team gets exactly the interface it needs, and nothing more.

GROQ: queries that deliver exactly what is needed

For queries, Sanity uses GROQ, its own open query language for JSON data. It lets you filter, sort and join content precisely and retrieve it in exactly the shape the front end needs. If you prefer GraphQL, you can deploy a GraphQL API as well. In Webstudio, I connect the content through a resource, which is a request to the API.

Real-time collaboration

In Sanity Studio, several people can work on the same document at the same time. You can see who is working on what, and changes appear in real time. Comments, tasks and version history help with coordination. For teams that publish content regularly, that is a noticeable advantage.

Structured rich text for every channel

Sanity also stores body text in a structured way, as so-called Portable Text. Paragraphs, headings, lists and references are kept as data instead of finished HTML. This means content can be reused on the website, in an app, in a newsletter or in AI applications. And because the content is cleanly structured, it can be prepared specifically for SEO, AEO and GEO: visibility in Google and in AI chatbots like ChatGPT, Claude and Gemini.

Pricing: what does Sanity cost?

Sanity offers a free plan that is enough for many smaller websites. According to Sanity, it includes up to 20 seats and 10,000 documents, among other things. The Growth plan costs USD 15 per seat per month, and enterprise solutions are quoted individually. You can find the current terms on Sanity's pricing page.

Which plan you need depends on the number of documents, requests and people. I estimate this with you before the project starts.

Sanity and Contentful

A well-known example of a headless CMS as software as a service is Contentful. Contentful is considered the pioneer among SaaS headless CMSs: completely maintenance-free, with enterprise-grade security, and connected purely through APIs.

Sanity shares this basic principle but goes further in terms of customization. While Contentful's editing interface is largely predefined, Sanity Studio is built in code and can be tailored completely to a project. For SMEs, the generous free plan is another argument.

On request, I also work with Contentful, for example if you already use it. You can read more in my post Contentful: the pioneer among headless CMSs.

Sanity or Hygraph?

Alongside Sanity, I also use Hygraph, a headless CMS from Berlin. Both run entirely in the cloud, and both take operations and security off your hands. The differences:

• Sanity is a good fit when the editing interface should be tailored to your team, when several people work at the same time, or when content is reused across many channels.
• Hygraph is a good fit when GraphQL is at the center, when data from several sources comes together through content federation, or when you want an interface that is ready to use without custom development.

Sanity with Webstudio: my setup

Depending on the requirements, I combine Sanity with Webstudio. Webstudio queries the content, renders the pages on the server and caches them at the edge. To visitors and search engines, the website feels like a static one, even though the content can be changed in the Studio at any time. Hosting for Webstudio websites is available from me from CHF 120 per year.

One point belongs in an honest assessment: this combination is more demanding than a system with a built-in CMS. Portable Text has to be translated cleanly into HTML in the front end, and the content model needs careful planning. For a small company website, an integrated system like Webflow is often the simpler choice. I compare which systems suit which requirements in my posts Craft CMS vs. Drupal, TYPO3 and WordPress and WordPress or Webflow?.

When Sanity is right for you

• You no longer want to run and secure a CMS yourself.
• Your team publishes regularly and works on content together.
• The editing interface should match your workflows exactly.
• Your content should appear on the website and in other channels.
• Storing data in the EU matters to you.

Conclusion

Sanity combines two things that rarely come together in classic CMSs: maximum flexibility for content and zero effort for servers and security. The content database lives entirely in the Sanity cloud, and scaling, backups and security patches run in the background. You and your team can focus on the content.

Do you want to move away from a self-hosted CMS, or are you planning a website with lots of content? Get in touch. Websites for SMEs start at CHF 3,000, and I quote projects with a headless CMS individually, with an itemized quote that lists every item separately.