Security without databases – why R24 uses Kirby

Security without databases – or why R24 uses Kirby

When people think about running a website today, they automatically think of databases, complex setups, and concerns about downtime, hacks and data leaks. When designing R24, we deliberately chose a different path. One of our core technologies is Kirby – a flat-file CMS from Germany that operates without a database and is therefore extremely secure.

At first glance, that may not sound remarkable. But it is:

Security: No database, no database problem

Most traditional content management systems store content in a database. This means additional attack surfaces, potential corruption, complex backups and, in the worst case, a complete failure if the database is compromised.

Kirby works differently. Content is stored as structured files directly in the file system. No database, no SQL injection risk, no broken tables, no late-night recovery efforts. Backups are as simple as copying a folder. For us, this means maximum stability with minimal complexity.

Simplicity: Not a single line of unnecessary code

Kirby is not an overloaded system with thousands of questionable plugins. It is lean, focused and clearly structured.

For every Relaunch24 website, Kirby allows us to implement a content management setup tailored precisely to specific requirements. No generic backend clutter with buttons nobody needs, but a streamlined dashboard that reflects exactly the content that should be managed.

This simplicity also extends to data handling: thanks to Kirby, Relaunch24 is one of the few solutions that can deliver the entire website content in a single folder, if required. No scattered database dumps, no proprietary export formats, no dependencies on third-party platforms. Content is stored in a structured file system – transparent, traceable and future-proof.

Speed: Flat-file technology with a performance edge

Without database queries, many traditional bottlenecks disappear. Kirby reads content directly from the file system – efficiently, quickly and with minimal server load. Combined with modern server infrastructure, this consistently results in high-performance websites with exceptionally low load times, especially within Europe.

For context, here is a typical performance comparison between an optimised Kirby setup (flat-file) and a traditional database-driven CMS on comparable infrastructure (PHP 8.x, Nginx, EU servers, no exotic tuning):

Of course, actual performance depends on hosting, caching, theme quality and external scripts. What matters most is the architecture: without a database, an entire system layer is removed. Fewer processes mean fewer potential bottlenecks – resulting in consistently low response times.

For our subscribers, this means fast websites, measurably better Core Web Vitals, satisfied users – and a technical foundation that remains stable under load and across all devices.

Perfect for our modular block approach

Another reason Kirby fits us so well is its flexibility in content modelling. Content is not predefined but can be structured freely. This is exactly where our R24 x Kirby x Edition comes in.

Our modular blocks are clearly defined, designed and technically optimised building units. Kirby allows us to model these blocks precisely – with simple input fields in the backend and a clean structure in the code.

After years of experimentation, we found that people of all ages, backgrounds and skill levels work best with straightforward input fields. Kirby enables us to break these down into modular blocks and model them precisely. This makes it possible for anyone to edit and rearrange content without external help.

EU and Germany focus: privacy by design

Kirby is developed in Germany – by an independent team with a clear technical stance: no telemetry and no vendor lock-in. The entire system consists purely of PHP and a clean Vue-based interface – and runs exactly where we deploy it. If the instance is hosted on an EU server, all data remains there. Network traffic only occurs when explicitly configured.

For our EU-hosting-only approach, this reduction is crucial. Fewer external dependencies mean fewer attack vectors, clearly traceable data flows and an architecture that can be audited end to end. Privacy is not achieved through add-ons, but through the underlying system design.

Conclusion

From a developer’s perspective, Kirby reduces the system to the essentials: files, clearly defined templates and transparent data structures. No hidden abstraction layers, no black-box database, no plugin ecosystem that requires constant maintenance. You always understand what is happening – and why.

In the end, it’s a straightforward technical decision: fewer moving parts, fewer external dependencies, less complexity. In return, you gain more transparency, maintainability and an architecture that will still make sense in five or even ten years.