Heretto alternative: when the Microsoft-native architecture is the better fit

Heretto is the most visible cloud-native DITA CCMS in the market. Strong product. Strong SEO presence (1,485 ranking keywords on the same vocabulary DitaExchange ranks for 11, as of the May 2026 SEO audit). Strong customer references in software documentation, developer documentation, and tech-startup content programs. Patrick Bosek’s LinkedIn presence carries a substantial share of the industry conversation.

Heretto is a good product, and the reference profile above makes that plain. The question that remains is whether a cloud-native architecture is the right shape for your organization.

For organizations standardized on Microsoft 365 (which is most regulated-industries customers and a substantial share of enterprise customers more broadly), the answer is usually no, and the reasons are structural rather than featural.

What Heretto is, in one paragraph

Heretto is a cloud-native, SaaS DITA CCMS. Authoring happens in a browser-based editor. Content is stored in Heretto’s own multi-tenant platform with role-based access, branching, content references, translation workflow, and publishing through DITA Open Toolkit to a range of output formats. The product is mature, the UI is among the strongest in the category, and the customer base skews towards software and developer documentation where the cloud-native architecture is the natural fit.

For the organizations Heretto is designed for, it works well. The product is not the question.

The structural comparison

The question is whether your organization is one of those organizations. For organizations already running Microsoft 365, three structural facts come into play.

You already operate a content platform. SharePoint is the content platform IT has approved, security-reviewed, integrated with Entra ID, set up data residency for, configured audit logging on, and built a DR plan for. Adding a CCMS layer on top of SharePoint uses that platform. Adding a separate cloud-native CCMS preserves the platform you already operate and adds a second one alongside it.

You already have an identity system. Entra ID is the identity system. Heretto can do SSO against Entra ID, most credible enterprise SaaS platforms can. SSO is not the same thing as native identity. With SSO, Heretto still has its own user model, its own role mapping, its own joiner-mover-leaver process, and its own access review cycle. With native identity, the access control is Entra ID and SharePoint permissions directly; there is no separate user model.

You already have an audit framework. The Microsoft Purview / SharePoint audit log feeds your SIEM. Adding a CCMS that produces its own audit log adds a second SIEM ingestion source, a second retention policy, and a second set of correlation rules. The CCMS as a SharePoint application produces audit events into the same log; the SIEM team sees one source.

These three facts compound. The combined effect is that a cloud-native CCMS asks the IT department to onboard a parallel content platform with the full discovery, due-diligence, integration, and operating cost of a new platform. A SharePoint-native CCMS asks the IT department to onboard an application that runs on top of an existing platform.

For regulated-industries customers (pharma, medical devices, defense, financial services) the difference typically lands as six to twelve months on the implementation timeline and a permanently simpler IT posture.

Where Heretto is genuinely the stronger choice

We have argued the SharePoint case at length. The reverse case matters too. Heretto is the better choice in three scenarios.

You are not standardized on Microsoft 365. The SharePoint-native architecture forces a Microsoft commitment that does not exist today. If your organization runs on Google Workspace, on a pure cloud-native stack with no Microsoft estate, or on a sovereign content platform that is not SharePoint, the SharePoint-native architecture is a worse fit than a cloud-native one.

You are actively leaving SharePoint. A small number of organizations are migrating away from SharePoint for strategic reasons. For those organizations, layering a CCMS on top of SharePoint is the wrong direction.

You want vendor-operated everything. Some customers prefer a posture where the CCMS vendor takes operational responsibility for the platform as well as the application. The SharePoint-native architecture deliberately puts the substrate in the customer’s hands. For customers who would rather not own the substrate, a cloud-native vendor is a cleaner fit.

For everyone else (organizations on Microsoft 365, with no active plan to move off, who would rather operate one content platform than two) the SharePoint-native architecture is the structurally cleaner answer.

What to ask in an evaluation

A useful evaluation puts both architectures side by side on the questions that actually decide operating cost. Five we have seen separate the two cleanly.

• Where does the content live? Vendor cloud (integration architecture) or your SharePoint tenant (native architecture). The answer is decisive for data residency, identity, audit, and DR.
• What does the SSO posture look like? Authentication via Entra ID is table stakes. The question is whether authorization is also Entra ID and SharePoint permissions directly, or whether it is the vendor’s own user model with SSO bolted on.
• Where does the audit log live? SharePoint / Microsoft Purview (one SIEM source) or the vendor’s own audit log (two SIEM sources).
• What is the DR posture? Inherit SharePoint’s, or the vendor’s separate DR plan.
• What does the compliance review look like? SharePoint application (much shorter) or new enterprise content platform (full discovery and due diligence).

For a more rigorous treatment of the same five points in a vendor-neutral framing, see Choosing a CCMS, six questions that decide the evaluation and the structural deep dive in Why your CCMS should be on SharePoint, not next to it.

Where DitaExchange sits

DitaExchange Dx5 is the Microsoft-native answer to the same problem space Heretto serves. Components stored as DITA XML inside the customer’s SharePoint tenant. Authoring in Microsoft Word, desktop or online, via the Dx5 ribbon. Access control by Entra ID and SharePoint permissions. Audit through the SharePoint audit log. Deployment options include SharePoint Online, SharePoint Server on-premise, national-cloud Microsoft 365, and air-gapped environments, a deployment matrix that cloud-native CCMS vendors cannot match.

Customers running Dx5 in production include EASA (since 2018), Lockheed Martin, LSEG, ICBC, Grundfos, MagVenture, Fokker / GKN. The substantial majority are organizations that evaluated cloud-native CCMS options and concluded the parallel-platform overhead was the wrong trade for their IT posture.

For the wider architectural treatment, see DITA on SharePoint, a complete architectural guide. For the category-level treatment of CCMS independent of any specific vendor, the CCMS pillar page. For the Dx5 product surface, Dx5 Overview.