87/100 Principled This product actively prioritises your interests, sometimes at cost to itself — the way it's built reflects values, not just incentives.
High confidence 70%+ assessed — Well-supported. Suitable for citation.

A legally-locked non-profit that charges flat hosting fees and takes zero cut of creator revenue, with ownership documents that prevent it from being sold, acquired, or pressured by investors. The structural alignment here isn't a mission statement, it's a corporate constitution.

Adversarial This product is designed to work against you — it makes more money when you fail, stay confused, or can't leave. Extractive This product takes more value from you than it delivers — engagement, data, or money are harvested in ways that don't serve your interests. Compromised This product has genuine value but isn't fully on your side — trade-offs exist between what's good for you and what's good for the business. Aligned This product makes money when you get value — its incentives and your interests point in the same direction. Principled This product actively prioritises your interests, sometimes at cost to itself — the way it's built reflects values, not just incentives.

Time for a different kind of report.

So far The Rake has brought to light the negative sides of tech companies. Balanced, cited, honest, and ideally giving us a better sense of how a company's behaviors and decisions relate to our interests as users and customers.

Now, diving into Ghost, the result has changed.

In my opinion, the company set up, the record of its founders, and what seems to be the general company philosophy, deserves more attention. Especially for anyone of us exploring different ways to run a tech company.

At its core, the structure of the company really sets it apart. In its legal constitution, it states the company cannot be sold, cannot take investment, and the founders hold no equity. These factors make user alignment more written in stone than just "the founders seem nice" and it has a "good culture".

Alignment of incentives is a key aspect of The Rake. For most companies, incentives shift over time, and often not for the better. Pressure from investors, leadership changes, anxiety about competition, survival instincts. With Ghost, the forces of pressure to change those incentives don't seem to be as present, and the structure of the company ensures it stays that way.

Ghost makes money with a flat monthly fee paid by customers. They don't take a cut of earnings. Ghost has no mechanism to benefit from user failure, engagement extraction, or content lock-in.

It's clear. Simple. But what makes it good is when Ghost set a public goal to have publishers earn more via Ghost than Ghost earns from all its publishers. They achieved this goal in 2025 when launching Ghost 6.0. Publishers earned over $100m, while Ghost took in $8.5m in annual revenue.

One caveat is a double-edged sword. Ghost customers who choose to self-host are in charge of their own maintenance. In early 2026 a vulnerability in their API was exploited against 700+ sites. Ghost patched it in February, but self-hosted sites that didn't update were left vulnerable.

To be honest, I wasn't sure what kind of company would achieve this "Principled" label, but Ghost did it. Highest score on every dimension, and no negative flags.

The Rake doesn't endorse any particular company, but it does endorse good practices. And Ghost has them all.


Scorecard

How this company scores across seven dimensions of user alignment, each rated 1–3. Learn more about our scoring methodology.


Revenue clarity Can a user immediately understand how this company makes money?

Clear Clear. Revenue model stated plainly, including any secondary streams. A user can understand the full picture without research.

14 sources (64% assessed) · Medium confidence

Ghost's revenue model is stated plainly on its homepage, pricing page, and in founder interviews: flat monthly tiers scaled by member count and staff seats, zero transaction fees on creator earnings, no advertising revenue, no data sales, and live company financials published in real time. The Tinybird analytics partnership — the only material third-party commercial relationship — is disclosed on a dedicated integrations page and in the platform changelog. One minor complexity exists: the Terms of Service grant Ghost a perpetual, irrevocable, sublicensable licence to user content despite "you own your content" marketing, but this is a legal rather than a revenue-stream disclosure gap and does not constitute a hidden revenue stream.

Incentive alignment Does the company make more money when users succeed, or when they stay longer, spend more, or remain confused?

Aligned Aligned. The company makes more money when users achieve outcomes.

12 sources (58% assessed) · Medium confidence

Ghost charges flat monthly hosting fees and takes zero percentage of creator subscription revenue; the platform's revenue does not increase when users stay confused, fail to convert paid subscribers, or remain dependent on Ghost. The company's own stated goal — articulated in a 2021 Indie Hackers interview and corroborated by Nieman Lab's reporting on Ghost 6.0 — was to have publishers earn more via Ghost than Ghost earns from publishers, a target it has met (publisher earnings now exceed $100M versus Ghost's ~$8.5M ARR). The self-hosting option means users can exit to zero cost if Ghost's managed service no longer serves them, removing residual dependency on the platform's continued goodwill.

Captivity How easy is it to leave? Is data portable? Is cancellation straightforward?

Portable Portable. Data is exportable in usable formats; cancellation is self-serve and immediate; no meaningful penalty for leaving.

16 sources (56% assessed) · Medium confidence

Ghost provides self-serve content export (JSON) and member export (CSV) from within Ghost Admin, free migration assistance for Business/Custom plans, and — uniquely in this category — an open-source self-hosting path that lets users run an identical installation entirely outside Ghost(Pro) at zero platform cost, so there is no meaningful penalty for leaving. Cancellation is self-serve via the admin billing area. Two minor caveats exist but do not constitute deliberate lock-in: post comments are excluded from the standard content export (recoverable via a full database dump), and the Terms of Service state a default "no refunds" position that Ghost's own referral payouts page shows is applied more flexibly in practice (discretionary refunds within three days, or pro-rata for annual plans). The export formats are open, the data is complete on the dimensions that matter for migration, and the exit path is the most comprehensive available among comparable platforms.

Engagement extraction Does the product use engagement mechanics that serve the user, or that serve the platform at the user's expense?

Value-driven Value-driven. Engagement reflects genuine user value. The product is used when it is useful.

7 sources (43% assessed) · Medium confidence

Ghost's ActivityPub implementation is explicitly framed as a rejection of engagement-maximising algorithmic feeds; the changelog and project documentation describe federation as a tool for reaching readers without relying on attention-extraction mechanisms. The platform's native analytics are cookie-free, first-party, and described as being for publisher insight rather than for optimising reader dwell time. Ghost has no social feed, no notification-escalation system, and no streak or gamification mechanics in its core product; the "Retention Offers" feature surfaces incentives when a subscriber attempts to cancel a creator's subscription, but this is a publisher-facing tool that does not operate on the Ghost platform user.

Multi-sided tension When advertiser or third-party interests conflict with user interests, which side does the company take?

Users defended Users defended. The company has a documented track record of siding with users when interests conflict, including at commercial cost.

9 sources (67% assessed) · Medium confidence

Ghost's primary commercial relationships are with its publisher-users, who pay directly for hosting; there is no advertiser or third-party data-buyer relationship that could create structural tension with user interests. The Tinybird analytics partnership is disclosed, cookie-free, and scoped to first-party publisher data with no third-party sharing confirmed in the official documentation. Ghost's native analytics page states explicitly that data is never shared with third parties. The Recommendations feature was deliberately built to work across the open web rather than only within Ghost's ecosystem — a design choice that foregoes platform lock-in at the cost of network-effect growth.

Algorithmic accountability Does the company take documented responsibility for what its systems surface and promote?

Accountable Accountable. Clear and documented responsibility for what its systems surface; ranking signals disclosed; moderation consistently applied.

11 sources (55% assessed) · Medium confidence

Ghost discloses the primary ranking signals for its Explore discovery engine (Ahrefs-based search/AI discoverability data) and builds its Recommendations feature on the open Webmention standard with cross-platform scope, rather than operating a proprietary attention-optimising feed. For the third-party content it hosts on Ghost(Pro), Ghost publishes a moderation policy enumerating eleven prohibited categories with a multi-reviewer complaint process, and the CEO made a public, on-record commitment to remove pro-Nazi content when Platformer migrated from Substack — a documented intervention made at a point when signalling openness would have been the commercially easier choice. Ghost operates no engagement-amplifying feed, so the harmful-amplification risk this dimension targets is structurally minimal; content on self-hosted installs running the open-source code falls outside Ghost's infrastructure and is not a surface Ghost controls, amplifies, or earns from, so it is not treated as a Ghost accountability gap.

Ownership pressure What structural pressures does the ownership model create, and do they push toward or against user interests?

Low pressure Low pressure. Bootstrapped and profitable; co-op or employee-owned; nonprofit or mission-locked structure.

13 sources (69% assessed) · Medium confidence

Ghost Foundation is a Singapore Public Company Limited by Guarantee with no share capital, no external investors, and a legal constitution confirmed by corporate registry records that prevents the company from being bought or sold in whole or in part. Revenue is required to be reinvested; founders hold no equity and have confirmed they gain nothing personally from the structure. The company is profitable and growing (from ~$4M ARR at Ghost 5.0 to over $8.5M at Ghost 6.0) with no disclosed debt, no PE involvement, and no parent company — the ownership structure produces no mechanism by which external financial pressure could be applied to the product.


Flags

Specific documented incidents, commitments, or signals that affected how dimensions were scored. Learn more about flags.

Positive · Captivity

Self-serve export, migration concierge, and self-hosting path provide full portability

Ghost provides self-serve JSON content export, CSV member export, and a free migration concierge service for Business and Custom plan users; the open-source codebase means users can run an identical installation on their own infrastructure at zero platform cost. This constitutes portability substantially beyond regulatory minimum and makes Ghost one of the few platforms from which you can genuinely exit with everything.

Ghost Help — Exports · Retrieved 16 June 2026 · Assessed

Trajectory

Critical SQL injection vulnerability exploited against 700+ sites in 2026

CVE-2026-26980, a critical (CVSS 9.4) unauthenticated SQL injection in Ghost's Content API affecting versions 3.24.0–6.19.0, was patched in February 2026 (v6.19.1) but was actively exploited from early May 2026 against 700+ sites including Harvard, Oxford, and DuckDuckGo; attackers extracted Admin API keys and injected malicious JavaScript. A second 2026 vulnerability (CVE-2026-29053, RCE via theme file processing) was also disclosed. The vulnerability was disclosed via Ghost's established responsible disclosure process and the patch was available before exploitation began; the primary risk fell on unpatched self-hosted installations rather than Ghost(Pro).

GitHub Security Advisory · 16 February 2026 · Assessed

CEO made public commitment to remove pro-Nazi content before migration completed

Ghost CEO John O'Nolan made an on-record public commitment to remove pro-Nazi content from Ghost(Pro) when Platformer announced its migration from Substack in January 2024 — a commitment made before the migration completed, creating reputational and operational obligations at a point when Ghost stood to gain commercially from signalling openness rather than constraint.

Platformer / Casey Newton · 11 January 2024 · Inferred

Positive · Revenue clarity

Live company financials published in real time since 2015

Ghost has published live, real-time company revenue figures via a public Baremetrics/ChartMogul dashboard since at least April 2015, going materially beyond legal disclosure requirements and including ARR, customer count, and growth trajectory. This represents proactive transparency at a level no competitor in this category matches.

Ghost Changelog · April 2015 · Assessed


Sources

Evidence base for this report. Learn more about how we assess sources.

Assessed (34)

  1. Ghost — Pricing Retrieved 16 June 2026
  2. Ghost — About Retrieved 16 June 2026
  3. Ghost — Privacy Policy Retrieved 16 June 2026
  4. Ghost — For Creators Retrieved 16 June 2026
  5. Ghost — Tinybird integration Retrieved 16 June 2026
  6. Ghost Changelog — April 2015 update (live financials launch) April 2015
  7. Ghost 6.0 launch page Retrieved 16 June 2026
  8. Ghost Help — Native analytics 6 August 2025
  9. Nieman Lab — Ghost makes it easier to publish to the social web 5 August 2025
  10. Ghost Docs — Introduction Retrieved 16 June 2026
  11. John O'Nolan — Democratising publishing 30 October 2024
  12. Ghost — Ghost vs Substack Retrieved 16 June 2026
  13. Ghost Help — Exports Retrieved 16 June 2026
  14. Ghost Help — Imports Retrieved 16 June 2026
  15. Ghost — Move to Ghost Retrieved 16 June 2026
  16. Ghost Docs — Migration from Ghost Retrieved 16 June 2026
  17. Ghost — Terms of Service Retrieved 16 June 2026
  18. Ghost Help — Manage your subscription 3 June 2024
  19. Ghost — Referral payouts 9 July 2025
  20. Ghost Help — GDPR compliance 1 May 2023
  21. Ghost ActivityPub Retrieved 16 June 2026
  22. Ghost Changelog — Recommendations 2 November 2023
  23. Ghost Changelog — Ghost Explore 26 November 2025
  24. Ghost — Abuse policy Retrieved 16 June 2026
  25. Ghost Docs — Recommendations Retrieved 16 June 2026
  26. Ghost Changelog — Native comments 15 August 2022
  27. Ghost Changelog — 5 years of Ghost Retrieved 16 June 2026
  28. Ghost Help — Funding Retrieved 16 June 2026
  29. Ghost Changelog — Moving to Singapore 11 January 2021
  30. SGP Business — Ghost Foundation Limited company record Retrieved 16 June 2026
  31. Charity Commission — Ghost Foundation governance record Retrieved 16 June 2026
  32. GitHub Security Advisory — GHSA-w52v-v783-gw97 (CVE-2026-26980) 16 February 2026
  33. The Hacker News — Ghost CMS CVE-2026-26980 exploited Late May 2026
  34. SonicWall — Ghost CMS Content API blind SQL injection 23 April 2026

Inferred (29)

  1. Wikipedia — Ghost (blogging platform) Retrieved 16 June 2026
  2. Email Software Insights — Ghost pricing review Retrieved 16 June 2026
  3. Creator Stack Club — Ghost Retrieved 16 June 2026
  4. Adweek — Newsletter platform Ghost generates $3.3M, doubling its revenue 1 April 2021
  5. ChartMogul — Ghost ChartMogul dashboard 6 August 2024
  6. Indie Hackers — John O'Nolan of Ghost ($3.3M/year) talks creators, decentralization 24 March 2021
  7. Listen Up IH — Ghost post 4 February 2022
  8. Use Better Products — Ghost CMS review 19 November 2025
  9. Noise Amplifier — Exporting Ghost CMS data for migration or backup 1 May 2025
  10. Ghost Forum — How to migrate with Ghost(Pro) to self-hosting 1 April 2022
  11. G2 — Ghost pricing Retrieved 16 June 2026
  12. Trustpilot — Ghost.org reviews Retrieved 16 June 2026
  13. Product Hunt — Ghost Retrieved 16 June 2026
  14. Subscribed.fyi — How to cancel Ghost 14 February 2024
  15. Nix Sanctuary — Ghost CMS: a big-time nasty lock-in publishing platform 17 July 2025
  16. TechCrunch — Substack rival Ghost is now connected to the fediverse 19 March 2025
  17. WebProNews — Ghost 6 launches fediverse integration via ActivityPub 5 August 2025
  18. Content Creators — Ghost review 21 March 2026
  19. Tinybird — Tinybird is the analytics platform for Ghost 6.0 15 January 2026
  20. Noise Amplifier — Ghost v6 review: built-in analytics and ActivityPub integration 14 August 2025
  21. Platformer — Why Platformer is leaving Substack 11 January 2024
  22. Rolling Stone — Substack, Platformer, leaving Nazi content 12 January 2024
  23. TechCrunch — Substack rival Ghost federates its first newsletter 8 July 2024
  24. The Week — Substack's moderation crisis: the revolt over Nazi newsletters 16 January 2024
  25. Birch Tree — I'm always happy I use Ghost and not Substack, but I'm extra happy today 22 December 2023
  26. Crunchbase — Ghost Retrieved 16 June 2026
  27. RecordOwl — Ghost Foundation Limited Retrieved 16 June 2026
  28. Tracxn — Ghost company profile 4 March 2026
  29. SecurityWeek — Ghost CMS vulnerability exploited to hack over 700 websites May 2026