A legally-locked non-profit that charges flat hosting fees and takes zero cut of creator revenue, with ownership documents that prevent it from being sold, acquired, or pressured by investors. The structural alignment here isn't a mission statement, it's a corporate constitution.
Time for a different kind of report.
So far The Rake has brought to light the negative sides of tech companies. Balanced, cited, honest, and ideally giving us a better sense of how a company's behaviors and decisions relate to our interests as users and customers.
Now, diving into Ghost, the result has changed.
In my opinion, the company set up, the record of its founders, and what seems to be the general company philosophy, deserves more attention. Especially for anyone of us exploring different ways to run a tech company.
At its core, the structure of the company really sets it apart. In its legal constitution, it states the company cannot be sold, cannot take investment, and the founders hold no equity. These factors make user alignment more written in stone than just "the founders seem nice" and it has a "good culture".
Alignment of incentives is a key aspect of The Rake. For most companies, incentives shift over time, and often not for the better. Pressure from investors, leadership changes, anxiety about competition, survival instincts. With Ghost, the forces of pressure to change those incentives don't seem to be as present, and the structure of the company ensures it stays that way.
Ghost makes money with a flat monthly fee paid by customers. They don't take a cut of earnings. Ghost has no mechanism to benefit from user failure, engagement extraction, or content lock-in.
It's clear. Simple. But what makes it good is when Ghost set a public goal to have publishers earn more via Ghost than Ghost earns from all its publishers. They achieved this goal in 2025 when launching Ghost 6.0. Publishers earned over $100m, while Ghost took in $8.5m in annual revenue.
One caveat is a double-edged sword. Ghost customers who choose to self-host are in charge of their own maintenance. In early 2026 a vulnerability in their API was exploited against 700+ sites. Ghost patched it in February, but self-hosted sites that didn't update were left vulnerable.
To be honest, I wasn't sure what kind of company would achieve this "Principled" label, but Ghost did it. Highest score on every dimension, and no negative flags.
The Rake doesn't endorse any particular company, but it does endorse good practices. And Ghost has them all.
Scorecard
How this company scores across seven dimensions of user alignment, each rated 1–3. Learn more about our scoring methodology.
Revenue clarity Can a user immediately understand how this company makes money?
Ghost's revenue model is stated plainly on its homepage, pricing page, and in founder interviews: flat monthly tiers scaled by member count and staff seats, zero transaction fees on creator earnings, no advertising revenue, no data sales, and live company financials published in real time. The Tinybird analytics partnership — the only material third-party commercial relationship — is disclosed on a dedicated integrations page and in the platform changelog. One minor complexity exists: the Terms of Service grant Ghost a perpetual, irrevocable, sublicensable licence to user content despite "you own your content" marketing, but this is a legal rather than a revenue-stream disclosure gap and does not constitute a hidden revenue stream.
Incentive alignment Does the company make more money when users succeed, or when they stay longer, spend more, or remain confused?
Ghost charges flat monthly hosting fees and takes zero percentage of creator subscription revenue; the platform's revenue does not increase when users stay confused, fail to convert paid subscribers, or remain dependent on Ghost. The company's own stated goal — articulated in a 2021 Indie Hackers interview and corroborated by Nieman Lab's reporting on Ghost 6.0 — was to have publishers earn more via Ghost than Ghost earns from publishers, a target it has met (publisher earnings now exceed $100M versus Ghost's ~$8.5M ARR). The self-hosting option means users can exit to zero cost if Ghost's managed service no longer serves them, removing residual dependency on the platform's continued goodwill.
Captivity How easy is it to leave? Is data portable? Is cancellation straightforward?
Ghost provides self-serve content export (JSON) and member export (CSV) from within Ghost Admin, free migration assistance for Business/Custom plans, and — uniquely in this category — an open-source self-hosting path that lets users run an identical installation entirely outside Ghost(Pro) at zero platform cost, so there is no meaningful penalty for leaving. Cancellation is self-serve via the admin billing area. Two minor caveats exist but do not constitute deliberate lock-in: post comments are excluded from the standard content export (recoverable via a full database dump), and the Terms of Service state a default "no refunds" position that Ghost's own referral payouts page shows is applied more flexibly in practice (discretionary refunds within three days, or pro-rata for annual plans). The export formats are open, the data is complete on the dimensions that matter for migration, and the exit path is the most comprehensive available among comparable platforms.
Engagement extraction Does the product use engagement mechanics that serve the user, or that serve the platform at the user's expense?
Ghost's ActivityPub implementation is explicitly framed as a rejection of engagement-maximising algorithmic feeds; the changelog and project documentation describe federation as a tool for reaching readers without relying on attention-extraction mechanisms. The platform's native analytics are cookie-free, first-party, and described as being for publisher insight rather than for optimising reader dwell time. Ghost has no social feed, no notification-escalation system, and no streak or gamification mechanics in its core product; the "Retention Offers" feature surfaces incentives when a subscriber attempts to cancel a creator's subscription, but this is a publisher-facing tool that does not operate on the Ghost platform user.
Multi-sided tension When advertiser or third-party interests conflict with user interests, which side does the company take?
Ghost's primary commercial relationships are with its publisher-users, who pay directly for hosting; there is no advertiser or third-party data-buyer relationship that could create structural tension with user interests. The Tinybird analytics partnership is disclosed, cookie-free, and scoped to first-party publisher data with no third-party sharing confirmed in the official documentation. Ghost's native analytics page states explicitly that data is never shared with third parties. The Recommendations feature was deliberately built to work across the open web rather than only within Ghost's ecosystem — a design choice that foregoes platform lock-in at the cost of network-effect growth.
Algorithmic accountability Does the company take documented responsibility for what its systems surface and promote?
Ghost discloses the primary ranking signals for its Explore discovery engine (Ahrefs-based search/AI discoverability data) and builds its Recommendations feature on the open Webmention standard with cross-platform scope, rather than operating a proprietary attention-optimising feed. For the third-party content it hosts on Ghost(Pro), Ghost publishes a moderation policy enumerating eleven prohibited categories with a multi-reviewer complaint process, and the CEO made a public, on-record commitment to remove pro-Nazi content when Platformer migrated from Substack — a documented intervention made at a point when signalling openness would have been the commercially easier choice. Ghost operates no engagement-amplifying feed, so the harmful-amplification risk this dimension targets is structurally minimal; content on self-hosted installs running the open-source code falls outside Ghost's infrastructure and is not a surface Ghost controls, amplifies, or earns from, so it is not treated as a Ghost accountability gap.
Ownership pressure What structural pressures does the ownership model create, and do they push toward or against user interests?
Ghost Foundation is a Singapore Public Company Limited by Guarantee with no share capital, no external investors, and a legal constitution confirmed by corporate registry records that prevents the company from being bought or sold in whole or in part. Revenue is required to be reinvested; founders hold no equity and have confirmed they gain nothing personally from the structure. The company is profitable and growing (from ~$4M ARR at Ghost 5.0 to over $8.5M at Ghost 6.0) with no disclosed debt, no PE involvement, and no parent company — the ownership structure produces no mechanism by which external financial pressure could be applied to the product.
Flags
Specific documented incidents, commitments, or signals that affected how dimensions were scored. Learn more about flags.
Self-serve export, migration concierge, and self-hosting path provide full portability
Ghost provides self-serve JSON content export, CSV member export, and a free migration concierge service for Business and Custom plan users; the open-source codebase means users can run an identical installation on their own infrastructure at zero platform cost. This constitutes portability substantially beyond regulatory minimum and makes Ghost one of the few platforms from which you can genuinely exit with everything.
Ghost Help — Exports · Retrieved 16 June 2026 · Assessed
Critical SQL injection vulnerability exploited against 700+ sites in 2026
CVE-2026-26980, a critical (CVSS 9.4) unauthenticated SQL injection in Ghost's Content API affecting versions 3.24.0–6.19.0, was patched in February 2026 (v6.19.1) but was actively exploited from early May 2026 against 700+ sites including Harvard, Oxford, and DuckDuckGo; attackers extracted Admin API keys and injected malicious JavaScript. A second 2026 vulnerability (CVE-2026-29053, RCE via theme file processing) was also disclosed. The vulnerability was disclosed via Ghost's established responsible disclosure process and the patch was available before exploitation began; the primary risk fell on unpatched self-hosted installations rather than Ghost(Pro).
GitHub Security Advisory · 16 February 2026 · Assessed
CEO made public commitment to remove pro-Nazi content before migration completed
Ghost CEO John O'Nolan made an on-record public commitment to remove pro-Nazi content from Ghost(Pro) when Platformer announced its migration from Substack in January 2024 — a commitment made before the migration completed, creating reputational and operational obligations at a point when Ghost stood to gain commercially from signalling openness rather than constraint.
Platformer / Casey Newton · 11 January 2024 · Inferred
Live company financials published in real time since 2015
Ghost has published live, real-time company revenue figures via a public Baremetrics/ChartMogul dashboard since at least April 2015, going materially beyond legal disclosure requirements and including ARR, customer count, and growth trajectory. This represents proactive transparency at a level no competitor in this category matches.
Ghost Changelog · April 2015 · Assessed
Sources
Evidence base for this report. Learn more about how we assess sources.
Assessed (34)
- Ghost — Pricing Retrieved 16 June 2026
- Ghost — About Retrieved 16 June 2026
- Ghost — Privacy Policy Retrieved 16 June 2026
- Ghost — For Creators Retrieved 16 June 2026
- Ghost — Tinybird integration Retrieved 16 June 2026
- Ghost Changelog — April 2015 update (live financials launch) April 2015
- Ghost 6.0 launch page Retrieved 16 June 2026
- Ghost Help — Native analytics 6 August 2025
- Nieman Lab — Ghost makes it easier to publish to the social web 5 August 2025
- Ghost Docs — Introduction Retrieved 16 June 2026
- John O'Nolan — Democratising publishing 30 October 2024
- Ghost — Ghost vs Substack Retrieved 16 June 2026
- Ghost Help — Exports Retrieved 16 June 2026
- Ghost Help — Imports Retrieved 16 June 2026
- Ghost — Move to Ghost Retrieved 16 June 2026
- Ghost Docs — Migration from Ghost Retrieved 16 June 2026
- Ghost — Terms of Service Retrieved 16 June 2026
- Ghost Help — Manage your subscription 3 June 2024
- Ghost — Referral payouts 9 July 2025
- Ghost Help — GDPR compliance 1 May 2023
- Ghost ActivityPub Retrieved 16 June 2026
- Ghost Changelog — Recommendations 2 November 2023
- Ghost Changelog — Ghost Explore 26 November 2025
- Ghost — Abuse policy Retrieved 16 June 2026
- Ghost Docs — Recommendations Retrieved 16 June 2026
- Ghost Changelog — Native comments 15 August 2022
- Ghost Changelog — 5 years of Ghost Retrieved 16 June 2026
- Ghost Help — Funding Retrieved 16 June 2026
- Ghost Changelog — Moving to Singapore 11 January 2021
- SGP Business — Ghost Foundation Limited company record Retrieved 16 June 2026
- Charity Commission — Ghost Foundation governance record Retrieved 16 June 2026
- GitHub Security Advisory — GHSA-w52v-v783-gw97 (CVE-2026-26980) 16 February 2026
- The Hacker News — Ghost CMS CVE-2026-26980 exploited Late May 2026
- SonicWall — Ghost CMS Content API blind SQL injection 23 April 2026
Inferred (29)
- Wikipedia — Ghost (blogging platform) Retrieved 16 June 2026
- Email Software Insights — Ghost pricing review Retrieved 16 June 2026
- Creator Stack Club — Ghost Retrieved 16 June 2026
- Adweek — Newsletter platform Ghost generates $3.3M, doubling its revenue 1 April 2021
- ChartMogul — Ghost ChartMogul dashboard 6 August 2024
- Indie Hackers — John O'Nolan of Ghost ($3.3M/year) talks creators, decentralization 24 March 2021
- Listen Up IH — Ghost post 4 February 2022
- Use Better Products — Ghost CMS review 19 November 2025
- Noise Amplifier — Exporting Ghost CMS data for migration or backup 1 May 2025
- Ghost Forum — How to migrate with Ghost(Pro) to self-hosting 1 April 2022
- G2 — Ghost pricing Retrieved 16 June 2026
- Trustpilot — Ghost.org reviews Retrieved 16 June 2026
- Product Hunt — Ghost Retrieved 16 June 2026
- Subscribed.fyi — How to cancel Ghost 14 February 2024
- Nix Sanctuary — Ghost CMS: a big-time nasty lock-in publishing platform 17 July 2025
- TechCrunch — Substack rival Ghost is now connected to the fediverse 19 March 2025
- WebProNews — Ghost 6 launches fediverse integration via ActivityPub 5 August 2025
- Content Creators — Ghost review 21 March 2026
- Tinybird — Tinybird is the analytics platform for Ghost 6.0 15 January 2026
- Noise Amplifier — Ghost v6 review: built-in analytics and ActivityPub integration 14 August 2025
- Platformer — Why Platformer is leaving Substack 11 January 2024
- Rolling Stone — Substack, Platformer, leaving Nazi content 12 January 2024
- TechCrunch — Substack rival Ghost federates its first newsletter 8 July 2024
- The Week — Substack's moderation crisis: the revolt over Nazi newsletters 16 January 2024
- Birch Tree — I'm always happy I use Ghost and not Substack, but I'm extra happy today 22 December 2023
- Crunchbase — Ghost Retrieved 16 June 2026
- RecordOwl — Ghost Foundation Limited Retrieved 16 June 2026
- Tracxn — Ghost company profile 4 March 2026
- SecurityWeek — Ghost CMS vulnerability exploited to hack over 700 websites May 2026