Tech Stack & Security

Inside the Tech Stack Powering Under Armour's $5.2B Revenue — SFCC, Fastly, Algolia & More

We mapped Under Armour's entire marketing and infrastructure stack through DNS records, HTTP headers, and technology fingerprinting — revealing a headless Salesforce Commerce Cloud frontend, Fastly CDN, and a security header score that trails the competition.

Data as of March 20, 2026 20+ tools mapped $5.2B annual revenue
Listen to this article
0:00 / 0:00
20+
Tools detected
$500K+
Est. annual SaaS
1/6
Security headers
F
Security grade

First: Why Should You Care About Another Brand's Tech Stack?

Hard data on what a $5.2B athletic brand actually runs under the hood — and what it means for your stack

Because reverse-engineering what winning brands build on is the highest-ROI competitive research you can do. Under Armour is a publicly traded, $5.2B revenue athletic brand (SEC filing, FY2025) that recently overhauled its entire digital infrastructure. Their choices reveal exactly which platform bets matter at enterprise scale.

35

Under Armour runs 35 global storefronts on a single headless Salesforce Commerce Cloud instance. — Their 2023 headless migration, documented in Merkle's published case study, delivered a 10% improvement in mobile conversion and sub-three-second page loads. This is what enterprise ecommerce architecture looks like when done right.

35%

Algolia search drove a 35% higher conversion rate for Under Armour customers who used site search — compared to those who browsed without it. This is a real, published case study result, not an estimate. When you know which search tool a competitor uses and what results they got, you can make the same investment with confidence.

1/6

Under Armour scores just 1 out of 6 on security headers — a grade F. Only HSTS is present. No Content-Security-Policy, no X-Frame-Options, no Referrer-Policy, no Permissions-Policy. For a $5.2B public company, this is a significant gap. Monitoring competitor security headers reveals engineering priorities and potential vulnerabilities — intelligence that press releases and ad libraries cannot provide.

How We Got This Data

Technology fingerprints reveal everything.

Unlike brands with verbose CSP headers (which act as a public inventory of tools), Under Armour's headers are minimal. So we used a combination of DNS record analysis, HTTP header inspection, and technology detection tools like BuiltWith and SecurityHeaders.com to reconstruct their stack.

We also cross-referenced findings with published vendor case studies — Merkle, Algolia, and AWS all have public documentation confirming their partnerships with Under Armour. This gives us higher confidence than header analysis alone.

Method

All data comes from publicly accessible HTTP response headers, DNS records, and technology detection tools. No private data, no account access, no proprietary code. Just reading what the server tells every browser on every page load.

This is exactly the kind of analysis LeadMaxxing runs automatically on any brand you point it at — tech detection, DNS recon, security audit, cost estimates — all in under 60 seconds.

Tool Breakdown by Category

13 key tools across four major categories.

The Headless SFCC Architecture

Enterprise commerce powering a $5.2B brand across 35 global storefronts.

Under Armour doesn't run a standard Salesforce storefront. In 2023, they migrated to a headless architecture — decoupling the frontend experience from the SFCC commerce engine:

🌐 DNS Fastly CNAME CDN Fastly Edge STOREFRONT Headless Frontend 💳 COMMERCE Salesforce CC

This headless pattern lets Under Armour control every pixel of the storefront experience — page speed, personalization, layout testing — while SFCC handles the commerce logic: inventory, pricing, cart, checkout. The result: sub-three-second page loads across 35 storefronts, per Merkle's published case study.

Why this matters

Going headless gave Under Armour complete control over frontend performance independent of Salesforce's rendering engine. This enabled the 10% mobile conversion improvement and supports their rapid homepage iteration. It also positions them to adopt emerging frontend frameworks without re-platforming commerce.

Want This Analysis for Your Brand?

LeadMaxxing runs the same tech detection, DNS recon, and security audit automatically. Get your full report in 60 seconds when you create a free account.

Get Your Free Tech Stack Report → Free account — no credit card required

The Full Tech Stack

Every tool we identified, organized by category with pricing benchmarks.

Google Meta Salesforce Fastly Algolia AWS SAP Bootstrap jQuery Merkle

Advertising Platforms (4 tools)

Under Armour runs paid advertising across major platforms. Technology fingerprinting reveals scripts from these providers:

Google $$$
Search + Shopping + Display
GTM orchestrates all Google tracking. Running Search, Shopping, Display, and YouTube campaigns. Detected via BuiltWith technology profiling.
Google $$$
Programmatic
DoubleClick scripts detected via technology profiling. Programmatic display and video buying at enterprise scale.
Meta $$$
Social Ads
Expected for a brand of this scale running major social media campaigns. Facebook and Instagram are core channels for athletic apparel.
TikTok $$$
Short-form Video
Expected for Under Armour's athlete-focused demographic. TikTok is a core channel for sports apparel brands targeting Gen Z and millennial audiences.

Analytics & Optimization (3 tools)

Under Armour's analytics stack combines Google's free tier with enterprise-grade search optimization:

Google Free
Tag Management
Orchestrates all client-side tracking. Free tier but requires dedicated engineering at Under Armour's scale — coordinating tags across 35 global storefronts.
Google Free
Web Analytics
Detected via BuiltWith. Standard analytics for traffic, conversions, and user behavior across the global storefront network.
Algolia Enterprise
Site Search
Enterprise search platform with type-ahead autocomplete and custom ranking via Query Rules. Per Algolia's published case study: 35% higher conversion rate for search users. ~$20K-$50K/year.
Cost note

Algolia enterprise search alone likely costs Under Armour $20K-$50K per year (we estimate, based on published pricing tiers). The 35% conversion lift documented in their case study makes this one of the highest-ROI tools in their stack.

LeadMaxxing vs Under Armour's Analytics Stack

Under Armour uses GA4 + GTM + Algolia for analytics and search optimization. LeadMaxxing's tracking script captures every visitor interaction — page views, scroll depth, form submissions, click IDs — building behavioral profiles automatically. Our AI generates personalized landing pages and runs A/B tests without the enterprise price tag. Not the same scale as Algolia, but 80% of the growth playbook for $29/month.

See how it works →

Customer Engagement (2 tools)

Merkle Enterprise
Loyalty Program
Merkle LoyaltyPlus (UA Rewards)
Launched August 2023. Per Merkle's case study: 1M loyalty sign-ups in year one and 3x higher loyalty conversion rate. Powers the UA Rewards lifecycle program. ~$50K-$200K/year.
Salesforce Enterprise
CRM / Marketing
Expected with their SFCC deployment. Cross-channel messaging: email, push, SMS. The engine likely powering their lifecycle marketing alongside Merkle.

Infrastructure & Operations (4 tools)

Salesforce Enterprise
Commerce Platform
Enterprise ecommerce platform powering 35 global storefronts. Migrated in 2017, went headless in 2023. We estimate ~$200K-$500K/year based on enterprise SFCC pricing.
Fastly $$$
CDN / Edge Delivery
Global CDN confirmed by DNS CNAME pointing to n.sni.global.fastly.net. Edge delivery for all 35 storefronts — a key factor in their sub-three-second page loads. We estimate ~$50K-$200K/year at Under Armour's traffic volume.
AWS Enterprise
Cloud Infrastructure
Selected as preferred cloud provider for SAP environments in November 2021, per BusinessWire announcement. Entire SAP landscape migrated in under six months. We estimate ~$100K-$500K/year.
SAP Enterprise
ERP / Supply Chain
Enterprise ERP covering design, merchandising, planning, manufacturing, supply chain, and sales distribution. Runs on AWS infrastructure since 2021.

Security Headers: Grade F (1/6)

Only one of six recommended security headers is present — a significant gap for a public company.

Under Armour implements only 1 of 6 standard security headers. Verify at securityheaders.com.

Strict-Transport-Security
max-age=63072000 — forces HTTPS for ~2 years. Present but missing includeSubDomains and HSTS preload directives.
Content-Security-Policy
Missing. No CSP header means the browser allows scripts from any domain. This also means we cannot use CSP analysis to map third-party tools — the header that reveals tool inventories for other brands is simply absent here.
X-Frame-Options
Missing. Without this header, the site could potentially be embedded in iframes on other domains, opening the door to clickjacking attacks.
X-Content-Type-Options
Missing. Without nosniff, browsers may MIME-sniff responses, potentially executing uploaded files as scripts.
Referrer-Policy
Missing. The browser sends the full URL referrer to third parties by default, leaking page paths and query parameters to every external script.
Permissions-Policy
Missing. Third-party scripts can potentially access device APIs like camera, microphone, and geolocation without restriction.
What this means

A $5.2B public company scoring 1/6 on security headers signals that security hardening is not currently a priority for their web team. The missing CSP header is especially notable — it both weakens security and prevents the kind of tool-inventory analysis that competitors can do against brands with verbose CSPs. Ironically, having no CSP makes the stack harder to map but the site more vulnerable.

Curious how your own security headers stack up? LeadMaxxing's free report includes a full header audit with your score, missing headers, and fix-it instructions — no engineering background required.

The Cost Reality

What does a stack like this actually cost?

Under Armour's Estimated Annual SaaS Spend

These are estimates based on publicly listed pricing tiers. Actual costs depend on contract terms, volume discounts, and custom enterprise agreements.

Commerce Platform (SFCC) $200K-$500K
Enterprise tier
Cloud & ERP (AWS + SAP) $100K-$500K
At-scale pricing
CDN & Edge (Fastly) $50K-$200K
Traffic-based
Search + Loyalty + CRM (Algolia, Merkle, SFMC) $90K-$300K
Volume-based

This doesn't include significant ad spend across multiple platforms, engineering salaries for the headless frontend, or Merkle's implementation services. Total marketing technology investment: well into seven figures annually.

Automate the entire playbook with LeadMaxxing

LeadMaxxing scrapes competitor pages, generates landing pages from their styles, tracks every visitor interaction, runs autonomous A/B tests, and automates email campaigns from just $29. Or start with a free account today and get this analysis for your own brand as a free bonus.

Get Free Report + Account →

How Under Armour Compares to Industry Benchmarks

Where they rank across key operational metrics.

Security: Below Average

Under Armour scores 1/6 on security headers — a grade F. Most enterprise ecommerce sites score at least 2-3 out of 6.

Platform: Enterprise Grade

Salesforce Commerce Cloud with headless architecture places Under Armour in the top tier of ecommerce platform sophistication alongside brands like Puma and Adidas.

Search: Best-in-Class

Algolia is considered the gold standard in ecommerce search. With a 35% conversion lift, Under Armour's search investment is one of their strongest competitive advantages.

Global Reach: Exceptional

35 storefronts across 3 regions on a single SFCC instance is among the broadest global footprints in athletic apparel ecommerce.

Under Armour vs Industry Benchmarks
Security Score 1/6 Industry avg: ~2/6 Global Storefronts 35 Enterprise avg: ~5-10 Search Conv. Lift +35% Typical: +10-20% Headless Frontend Yes Low adoption

Source: Compiled from Merkle case study, Algolia case study, SecurityHeaders.com scan, and BuiltWith technology profiling (2026).

See how your brand compares

LeadMaxxing benchmarks your tech stack, security headers, and ad coverage against 100+ DTC brands automatically. Find out if you're top 3% or bottom 50% — and what to fix first.

Create a free account to benchmark your data →

What Even Under Armour Could Improve

No brand is perfect. Here are the gaps.

Security headers are critically weak

1/6 headers and a grade F is unacceptable for a public company processing millions of transactions. Adding CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy is a straightforward fix.

No visible Content-Security-Policy

Without CSP, the browser allows scripts from any domain — the single most impactful security header for preventing XSS attacks and controlling third-party script execution is absent.

HSTS configuration could be stronger

HSTS is present but with max-age only. Adding includeSubDomains and preload directives would ensure all subdomains use HTTPS and qualify for browser HSTS preload lists.

No visible CDP or advanced personalization

Unlike some competitors who run dedicated Customer Data Platforms, Under Armour's detectable stack lacks a visible CDP. At $5.2B revenue, enterprise personalization tools would likely deliver significant ROI.

Most of these gaps — security headers, missing personalization, limited analytics — can be addressed incrementally. LeadMaxxing takes a different approach: one lightweight script that handles visitor ID, tracking, personalization, and email — no enterprise complexity required.

Key Findings

  • → Under Armour runs on Salesforce Commerce Cloud with a headless frontend, powering 35 global storefronts across 3 regions — implemented by Merkle (dentsu) with a 10% mobile conversion improvement documented in their published case study.
  • → Under Armour scores 1 out of 6 on security headers (grade F), with only HSTS present. Missing CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — significantly below the enterprise ecommerce average of 2-3.
  • Algolia site search delivers a 35% higher conversion rate for Under Armour shoppers who use search, per Algolia's published customer case study — making it one of the highest-ROI tools in their stack at an estimated $20K-$50K/year.
  • → DNS records confirm Fastly CDN (CNAME: n.sni.global.fastly.net) as Under Armour's edge delivery network, enabling sub-three-second page loads at $5.2B revenue scale.
  • → We estimate Under Armour's core SaaS infrastructure costs $500K-$1M+ per year — dominated by Salesforce Commerce Cloud ($200K-$500K), AWS for SAP ($100K-$500K), and Fastly CDN ($50K-$200K), based on publicly listed pricing tiers.

What This Data Means for You

Turning Under Armour's tech stack into your competitive advantage

Understanding exactly which tools a $5.2B brand runs — and where they have gaps — lets you make smarter technology decisions. Under Armour's headless SFCC architecture is aspirational, but their security header score shows that even enterprise brands have blind spots. You can learn from their wins (Algolia's 35% search conversion lift, Fastly's edge delivery) while avoiding their gaps (weak security headers, lack of visible personalization). Cross-reference with their pricing strategy and SEO approach to build the full competitive picture.

5 Things You Can Implement Today

Actionable lessons from Under Armour's tech stack playbook

Check your own security headers right now

Paste your domain into securityheaders.com. If you score higher than Under Armour's 1/6, you're already ahead of a $5.2B brand. If not, fixing it takes 30 minutes of server config. LeadMaxxing's free report includes a full header audit with your score and fix-it instructions.

Invest in site search before personalization

Algolia gave Under Armour a 35% conversion lift from search users alone. If you're spending on personalization but your site search is basic, flip the priority. LeadMaxxing tracks which search terms visitors use and generates optimized landing pages for high-intent queries automatically.

Benchmark your tech stack against competitors

Under Armour uses SFCC + Fastly + Algolia — but most brands under $50M can achieve similar results with simpler tools. LeadMaxxing's free report scans any competitor's DNS and headers to tell you exactly what they use.

Consider headless architecture for conversion gains

Under Armour's 10% mobile conversion improvement from going headless shows the ROI is real at scale. If you're on Shopify, Shopify Hydrogen offers a similar headless approach. LeadMaxxing works with any frontend — one script, no architecture changes needed.

Supercharge Your Leads with LeadMaxxing

Get a free LeadMaxxing account and start supercharging your leads. Start free →

Free — No credit card required

Get This Analysis For Your Brand FREE
When You Create A Free LeadMaxxing Account

Create a free LeadMaxxing account and we'll generate a full competitive analysis for YOUR brand. The same intelligence you just read — comparison with competitors, actionable strategies, and AI-powered recommendations.

Auto-generated brand report Competitor comparison Strategy recommendations AI-powered insights Free LeadMaxxing account to supercharge your leads
Get Free Report + Account → Free plan includes visitor tracking, lead scoring, and AI chat. Paid plan $29/month for full access.

Sources & References

Merkle Case Study: Under Armour — Documents the Salesforce Commerce Cloud headless migration, 35 global storefronts, 10% mobile conversion improvement, UA Rewards loyalty launch (1M sign-ups, 3x loyalty conversion rate).
merkle.com
Algolia Customer Story: Under Armour — Documents the search platform migration, 35% higher conversion rate for search users, type-ahead autocomplete, and custom ranking via Query Rules.
algolia.com
BusinessWire: Under Armour Selects AWS — November 2021 announcement confirming AWS as preferred cloud provider for SAP environments, with full SAP landscape migration in under six months.
businesswire.com
SecurityHeaders.com — Automated security header scan confirming Under Armour's 1/6 score (grade F). Only HSTS present; CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy missing.
securityheaders.com
BuiltWith: underarmour.com — Technology lookup service detecting 115 technologies including GTM, Google Analytics, DoubleClick, jQuery, Bootstrap, and SFCC infrastructure markers.
builtwith.com
Under Armour Investor Relations — SEC filings confirming $5.16B FY2025 revenue (fiscal year ending March 2025). NYSE: UAA/UA.
about.underarmour.com
DNS & Header Analysis — We parsed underarmour.com's DNS records (CNAME: n.sni.global.fastly.net confirming Fastly CDN) and HTTP headers (HSTS: max-age=63072000) to identify infrastructure. Cost estimates are based on publicly listed pricing tiers for each identified tool.

Frequently Asked Questions

What ecommerce platform does Under Armour use?
Under Armour uses Salesforce Commerce Cloud (SFCC), migrated in 2017 with implementation by Merkle (now dentsu). In 2023, they transitioned to a headless frontend architecture on top of SFCC, decoupling the storefront from the commerce engine. This powers 35 global storefronts across 3 regions and achieved a 10% improvement in mobile conversion rates.
What CDN does Under Armour use?
Under Armour uses Fastly as their CDN. DNS CNAME records for underarmour.com point to n.sni.global.fastly.net, routing through Fastly's global edge network. At Under Armour's traffic volume ($5.2B annual revenue), Fastly CDN costs are estimated at $50K–$200K per year depending on bandwidth and edge compute usage.
What search technology powers underarmour.com?
Under Armour uses Algolia for site search, replacing an in-house open-source platform in 2017. Per Algolia's published case study, this resulted in a 35% higher conversion rate for customers using search. The implementation includes type-ahead autocomplete, custom ranking via Query Rules (product popularity, newness, availability), and is also deployed on their B2B website.
What is Under Armour's website security header grade?
Under Armour scores 1 out of 6 on critical security headers, receiving a grade F. The only header present is Strict-Transport-Security (HSTS) with max-age=63072000. Missing headers include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. This is below average for enterprise ecommerce. Verify at securityheaders.com.
Does Under Armour use AWS?
Yes. In November 2021, Under Armour selected AWS as its preferred cloud provider for SAP environments, per a BusinessWire announcement. They migrated their entire SAP landscape to AWS in under six months, covering design, merchandising, planning, manufacturing, supply chain, and sales distribution. This is separate from their ecommerce platform (SFCC) and CDN (Fastly).
How much does Under Armour spend on marketing technology?
We estimate Under Armour's annual SaaS spend on core marketing and infrastructure tools at $500K–$1M+, excluding ad spend and internal engineering. Major estimated line items: Salesforce Commerce Cloud ($200K–$500K/year), Fastly CDN ($50K–$200K/year), Algolia enterprise search ($20K–$50K/year), AWS infrastructure ($100K–$500K/year), and Merkle LoyaltyPlus ($50K–$200K/year). These are estimates based on publicly listed pricing tiers.
What loyalty program technology does Under Armour use?
Under Armour launched UA Rewards in August 2023, powered by Merkle LoyaltyPlus. Per Merkle's published case study, the program achieved 1 million loyalty sign-ups in its first year and a 3x higher loyalty conversion rate. The loyalty platform integrates with their Salesforce Commerce Cloud headless storefront across all 35 global storefronts.
How does Under Armour's tech stack compare to Nike's?
Both Under Armour and Nike operate enterprise-grade tech stacks, but with different platform choices. Under Armour uses Salesforce Commerce Cloud with a headless frontend and Fastly CDN, while Nike runs a fully custom stack. Under Armour's choice of SFCC gives them enterprise reliability without the engineering overhead of a fully custom build. Both companies use AWS for cloud infrastructure, and both have invested heavily in site search (Algolia for UA). The key difference is scale: Nike's estimated annual martech spend exceeds $10M/year.
Compiled by LeadMaxxing — we track how brands build, test, and optimize their marketing so you can learn from the best.