Giving autonomy to the marketing team of a SOC 2 certified ed-tech platform
In partnership with
Client
Skillsetter
Year
2026
Industry
Education / SaaS
Services
Content Architecture, Frontend Engineering, CMS
Visit
skillsetter.com
Skillsetter, built with Storyblok and Astro
The marketing site was stuck in the product's release queue
Skillsetter trains counseling, social work and nursing students for the conversations they can't afford to get wrong. Their marketing site lived inside the product's Rails app. Changing a headline meant waiting for an engineer and the next product release, so most edits never shipped.
We moved the site to Storyblok and Astro. Marketing now builds and publishes pages themselves from a library of pre-designed blocks.
The product didn't move. It still runs on www.skillsetter.com, and our pages sit on the same domain without getting in its way.
Instant
Time to publish a copy change, down from up to a week
4 weeks
From kickoff to launch
100
Lighthouse score at launch for accessibility, best practices and SEO
Every section on this page is a block marketing can reorder
Before
Every edit waited for an engineer
The marketing site and the product shipped together. A headline change went out in the same release as a product feature, so the team saved edits up, waited for a slot and shipped a fraction of what they wrote. The site fell behind the product it was selling.
The product had to stay on its domain
Universities connect their course systems to www.skillsetter.com, and students and faculty log in there. Moving the product to a new address would break every one of those connections. So the new site had to share the domain and stay well clear of the login.
Everything had to pass a SOC 2 review
Skillsetter is SOC 2 Type II certified, and universities buy on that. Marketing sites usually stay out of security reviews. This one would share a domain with the login page, which put it right in the middle of one.
01 — Authoring
A page builder with guardrails
Marketing builds every page from a set of blocks we designed in Storyblok. Each block only accepts what the design allows, so the team can move fast without breaking anything. Blocks sit in a short menu, share the same display settings and preview live before anything goes out.
The SEO team edit titles, descriptions, social cards and structured data on each page, and manage redirects in the CMS. A typo in a redirect gets skipped with a warning, so it never blocks a publish.
Each page is a stack of blocks, each with its own fields and display settings
Write, save, preview, publish. No deploy, no ticket, no waiting
Built with
02 — The architecture
Workshopping the solution with their teams
We workshopped the solution with Skillsetter's developer and marketing teams. Their developers own the Rails app and the student login. Marketing needed to publish without waiting on anyone. Together we landed on an approach that works for both: Rails hands any page it doesn't recognise to our site, so the product runs exactly as before and marketing publishes on its own schedule.
We validated it with a working prototype before frontend development started. It caught a default Rails setting that would have quietly broken the site at launch.
04 — Compliance
Staying inside SOC 2
Our pages sit inside Skillsetter's certified environment, so they had to pass the same review as the rest of the platform. Nothing we built runs code on a server or stores data, which answers most of the security questions straight away.
We chose Storyblok partly because it's SOC 2 certified, and so is the hosting. Every vendor a website adds is one more company the client has to vouch for in an audit. Replacing a CMS later because it fails a review is an expensive project.
The product keeps every one of its routes. Nothing we run sits in front of the login page.
Only four parts of the site are interactive. Everything else is plain HTML
Results
Marketing owns the website now. They write, preview and publish, and it's live.
Marketing publishes on their own
A copy change used to wait for a release. Now it goes live when they hit publish. The SEO team manage redirects and metadata without a ticket.
Every page stays on brand
Blocks only fit together the way the design allows. The team moves quickly because there's very little they can get wrong.
Engineering got their releases back
Product releases are for product work again. The whole integration is one route in their codebase, so undoing it means deleting one line. If our CDN disappears, the login page doesn't notice.
Fast, whoever builds the page
The site is static with very little JavaScript, and accessibility is built into every block. It scores 98 for performance in production and 100 for everything else.
Marketing waiting on engineering to publish?
We build CMS setups marketing teams actually want to use, even inside apps we don't own. Tell us what you're working with.