Self-hosted CRM in 2026: revisit Twenty, EspoCRM and SuiteCRM before you move another sales pipeline off Salesforce

A CRM looks simple from outside. It is a list of companies, contacts, deals and follow ups. Inside most organisations, though, the CRM slowly becomes the record of every customer conversation, every quote, every renewal date and every promise a sales person made. When that record lives in a hosted service such as Salesforce, HubSpot or Zoho, the cost grows per seat every year, and the data sits under someone else’s terms.

Self-hosted open source CRMs offer another path. You run the server, the customer data stays in your own database, and you decide when to upgrade. In 2026 three projects stand out for teams that want to try this seriously: Twenty, a young TypeScript CRM with a modern interface; EspoCRM, a PHP CRM that has been quietly maintained since 2014; and SuiteCRM, the long running fork of SugarCRM Community Edition, now on its version 8 line.

This post revisits all three calmly. We look at where each came from, how it is built, licences and paid editions, security record, operations, performance, data migration and when not to adopt each. We did not run a hands-on drill for this post, because each of these needs a database, a cache or a PHP stack and a meaningful data set before any test says something useful. Facts below come from official repositories, release notes, licence files, security advisories and documentation, read on 3 November 2026.

A scenario to keep us honest

To keep the discussion practical, we use an invented company. This company is illustrative only; any resemblance to a real firm is accidental.

Coimbatore Kovai Pump Works (invented) makes agricultural and domestic water pumps and sells through about 600 dealers in Tamil Nadu, Karnataka and Andhra Pradesh. It has about 350 employees, a sales team of 45 field officers and an IT team of five led by Revathi. Today:

• Dealer and lead data sit in a hosted CRM with 30 paid seats. Field officers without seats keep their own Excel sheets and WhatsApp groups.
• Quotes are prepared in Excel and emailed. Nobody can say quickly which dealer got which discount.
• Service complaints go to a separate helpdesk, so sales does not see when a dealer has an open complaint.
• The company already runs PostgreSQL and MariaDB for other systems, a Keycloak server for staff sign in, and Docker on two virtual machines.
• The hosted CRM renewal is due in March, with a price increase, and management wants all 45 officers plus 10 office staff on one system.

Revathi’s question is plain: can a self-hosted CRM carry the dealer pipeline for 55 users without a large team to run it, and which one?

The short version

• Twenty is the most modern of the three, with a fast interface, custom objects, a GraphQL and REST API and a growing app platform. It moves very quickly, with frequent releases and breaking changes, and features such as SSO, row-level permissions and audit logs need the paid Organization plan even when self-hosted.
• EspoCRM is a stable, light PHP application with a clean interface, entity customisation, LDAP and OpenID Connect sign in, and a predictable release rhythm. Some advanced features such as reports and business process workflows come as paid extensions from the vendor.
• SuiteCRM is the broadest in classic CRM modules (sales, marketing campaigns, cases, quotes, contracts, invoices) and has a large ecosystem from its SugarCRM roots. Version 8 adds an Angular front end on top of the older PHP core, which also means more moving parts to upgrade.
• For a dealer pipeline with 55 users, all three can work. The choice depends more on how much change your team can absorb, how much you will customise, and whether you need SSO and fine permissions without paying.

Where things stand on 3 November 2026

Twenty

• Repository twentyhq/twenty on GitHub, created December 2022, about 60,000 stars at the time of reading.
• Latest release twenty v2.54.0 on 30 October 2026 (UTC), a day after v2.53.1. Releases arrive roughly weekly.
• The v2.54.0 notes list three breaking changes, including replacing vetted apps with a marketplace listing, and changes around workflows round tripping through the application manifest. They also mention fair worker queue ordering behind a feature flag.
• Self-hosted through Docker Compose with a server container, a worker container, PostgreSQL 16 and Redis, according to the official compose file.

EspoCRM

• Repository espocrm/espocrm, created September 2014, about 3,500 stars.
• Major version 10.0.0 released on 2 July 2026. Current releases are 10.0.11 and 9.3.11, both on 23 October 2026, so the 9.3 line still receives fixes.
• Version 10.0 added multiple pipelines, cascading links, record locking, transactional save, PKCE support for OpenID Connect, TypeScript support in the framework, and removed older deprecated APIs.
• Requires PHP 8.3 to 8.5 according to composer.json and the server configuration docs, with MySQL 8.0, MariaDB 10.6 or PostgreSQL 15 listed as databases.

SuiteCRM

• Version 8 lives in SuiteCRM/SuiteCRM-Core, created March 2021. Version 7 lives in salesagility/SuiteCRM.
• Latest releases are 8.10.2 and 7.15.2, both on 31 July 2026. Before that came 8.10.0 on 30 April and 8.10.1 on 13 May 2026.
• The vendor publishes a migration guide from 7 to 8, and both lines still received releases this year.
• Release pace is slower than the other two, roughly one minor version per few months.

First questions before choosing

Before comparing features, answer these for your own team:

• How many users today, and in two years? Count field staff who only log a visit or two per week.
• Which objects do you really need? Leads, accounts, contacts and deals are standard. Quotes, invoices, contracts and campaigns are not in every product.
• Do you need sign in through your existing identity provider? If yes, check which edition gives it.
• How much will you customise? New fields are easy everywhere. New objects, relations and automation differ a lot.
• Who will upgrade the system every month, and what is the test process?
• What must integrate: email, telephony, WhatsApp Business, ERP, accounting?
• Where must data live for your customers and auditors?

How each one is built

Twenty

Twenty is a TypeScript monorepo. The server is a NestJS application on Node.js, the front end is React, data sits in PostgreSQL and background jobs run through a worker backed by Redis. Each workspace gets its own metadata, so custom objects and fields are created at runtime and exposed automatically through GraphQL and REST APIs. Recent releases add an application platform: apps with a manifest, logic functions, front components and an SDK, published through a marketplace.

The practical meaning: Twenty behaves like a modern product with a platform under it. That is attractive, but you are tracking a fast moving codebase.

EspoCRM

EspoCRM is a PHP application with its own framework and a single page front end. Metadata in JSON files describes entities, fields, layouts and relations, and an Entity Manager in the admin panel lets you create custom entities without code. It needs a web server with PHP, a database and a cron job for scheduled tasks and email fetching. There is also an optional WebSocket daemon for live updates.

The practical meaning: a classic LAMP style deployment that most Indian IT teams already know how to run.

SuiteCRM

SuiteCRM 7 is a PHP application inherited from SugarCRM Community Edition. SuiteCRM 8 keeps that legacy core for many modules and adds a Symfony based API layer and an Angular front end. Modules, fields and relations are defined in vardefs and managed through Studio and Module Builder. It also needs cron for schedulers and workflows.

The practical meaning: very mature modules, but two layers of technology to understand when you customise or debug.

Features that matter for a sales team

Pipelines and records

• Twenty: companies, people, opportunities, tasks, notes and custom objects, with table, kanban and calendar style views. Email and calendar sync connect through Google or Microsoft accounts, or IMAP and SMTP.
• EspoCRM: accounts, contacts, leads, opportunities, cases, meetings, calls, tasks, documents, campaigns and knowledge base. Version 10 allows multiple pipelines.
• SuiteCRM: accounts, contacts, leads, opportunities, cases, campaigns, quotes, products, contracts, invoices, projects and events, plus reports.

Automation

• Twenty: built in workflows with triggers and actions, which recent releases tie into the app manifest.
• EspoCRM: a Formula scripting language for field logic in the free core. Workflows and business process management come in the vendor’s paid Advanced Pack extension.
• SuiteCRM: workflows and reports included in the free product, inherited from the earlier AOS and AOW modules.

Mobile and field use

All three are web applications that work in a mobile browser. For field officers logging dealer visits, test on the actual phones they carry, with real network conditions in rural areas, before you promise anything.

Security, sign-in and permissions

Sign-in

• Twenty: email and password and Google or Microsoft sign in are available. According to Twenty’s pricing documentation, SAML and OIDC single sign-on, row-level permissions and audit logs are premium features of the Organization plan, on cloud and self-hosted. Custom roles with object and field permissions are included in self-hosted instances on every plan.
• EspoCRM: LDAP and OpenID Connect are part of the core, with two factor authentication. Version 10.0 added PKCE for OIDC.
• SuiteCRM: LDAP and SAML options exist in the admin settings; check the current 8.x documentation for the exact behaviour in your version.

For Kovai Pump Works, which already runs Keycloak, this point alone matters: EspoCRM gives OIDC without a subscription, while Twenty needs the Organization plan for SSO.

Permissions

• Twenty: roles with object and field permissions; row-level rules need the paid plan.
• EspoCRM: roles with scope, record level (own, team, all) and field level access, plus teams.
• SuiteCRM: roles and security groups, which can restrict records by group membership.

Test permissions with your real structure. For a dealer network, you usually want each officer to see only their own dealers, managers to see their region, and head office to see all.

Advisory record

All three publish security advisories on GitHub, and all three had recent ones.

• Twenty: several advisories in October 2026, including a high severity issue where pending workspace invitations could be taken over (listed as affecting 2.47.0 and earlier), unauthenticated execution of application logic functions through a webhook endpoint (fixed in 2.19.0), a field-level read permission bypass in timeline activity, and IMAP and SMTP connections that did not verify the mail server’s TLS certificate.
• EspoCRM: several advisories between late September and October 2026, including stored XSS in knowledge base articles (fixed in 10.0.9 and 9.3.11), an unauthenticated request that could load the CPU through a regex and deny service (fixed in 10.0.8 and 9.3.11), an SVG attachment issue and attachment access issues through import and PDF templates.
• SuiteCRM: an authenticated remote code execution through unsafe deserialisation and a record access check issue in March 2026, and a password reset account takeover in August 2026.

A healthy advisory list is not a bad sign by itself; it means people look and the project discloses. What matters is how fast you can apply fixes. Subscribe to each project’s GitHub security advisories and release feed before going live, and keep the CRM behind your VPN or a reverse proxy with sign in, not open to the internet, unless dealers must log in directly.

Performance and capacity

None of the three publishes a sizing guide with measured numbers that we could find for this post, so we will not invent any. Some practical notes instead:

• Twenty runs a Node.js server, a worker, PostgreSQL and Redis. That is four processes at minimum. Plan memory for all of them and watch the worker queue when email sync is on.
• EspoCRM and SuiteCRM are PHP applications. Their behaviour depends mostly on PHP-FPM worker count, OPcache and database indexes. Large list views with many joined fields are the usual slow spots.
• For about 55 users, the load from human clicks is small. Email sync, imports, scheduled jobs and integrations calling the API will create more load than users.
• Measure during your pilot: page response times for list views with your real data volume, the time of a 50,000 row import, and database size after importing history.

Licences and editions

Twenty

The LICENSE file says the project is mostly AGPL-3.0, with two qualifications. Files marked with a @license Enterprise comment are under the Twenty commercial licence and need a valid subscription for production use. Some packages, such as the SDK, CLI and UI library, are MIT. The file also adds a section 7 permission: applications built against Twenty’s published interfaces (APIs, webhooks, the app manifest, SDKs) are not covered by the AGPL just because they interact with Twenty. If you modify Twenty itself, the AGPL applies fully.

According to Twenty’s terms, commercial features need a licence key counted per user. When a subscription ends, the commercial features stop, but the instance and data keep working. A pull request on self-hosted billing describes a validity token refreshed from Twenty’s servers, with an option for air gapped installs. If your network blocks outbound traffic, confirm this path with the vendor before you pay.

EspoCRM

The core is AGPL-3.0. The vendor sells extensions such as the Advanced Pack (reports, workflows, BPM) and others, under their own commercial terms. Check the extension licences and prices directly on the vendor site.

SuiteCRM

SuiteCRM is AGPL-3.0, both 7 and 8. SalesAgility, the company behind it, sells support and hosting; the product itself has no separate paid edition with locked features as far as we found.

What AGPL means here

If you only run the CRM inside your company, AGPL places no extra duty on you beyond keeping the licence notices. If you modify it and let outside users such as dealers use it over the network, you must offer them the source of your modified version. Ask your legal team if you plan a dealer portal on a modified CRM.

Operations and day two

Install

• Twenty: Docker Compose with server, worker, PostgreSQL 16 and Redis. The compose file uses the latest tag by default; pin a version in production.
• EspoCRM: an official Docker image, an installer script, or a manual install on PHP with a web server. Add the cron entry the docs show.
• SuiteCRM: download the package, set up PHP and a web server, run the installer, add cron. Check the compatibility matrix for supported PHP and database versions for your release.

Upgrades

• Twenty: weekly releases and breaking changes. Plan for a staging copy, read every release note, and run upgrades through the documented upgrade command. Do not skip many versions at once without checking the upgrade guide.
• EspoCRM: upgrades through the CLI or admin UI (version 10 added config switches to turn UI upgrades and extension uploads on or off). Minor releases are frequent and mostly fixes. Major upgrades remove deprecated APIs, so test custom code.
• SuiteCRM: upgrades through the upgrade package process; moving from 7 to 8 is a migration with its own guide, not a simple upgrade.

Backups

• Twenty: back up PostgreSQL and the local storage volume (or your S3 bucket if configured). Redis holds queue state, not the main data.
• EspoCRM: back up the database and the data directory, which holds uploads and config.
• SuiteCRM: back up the database, the upload directory and config files.

For all three, schedule a restore test into a separate server every quarter. A backup that was never restored is only a hope.

Monitoring

Watch the cron or worker health, email fetch errors, disk growth of attachments and database size. Most CRM failures that users notice are silent email sync failures, not crashes.

Migration from a hosted CRM

• Export accounts, contacts, deals and activities to CSV from the current system. Keep the original IDs in a custom field so you can trace records later.
• Clean the data before import: duplicate dealers, phone numbers in many formats, old owners who left the company.
• All three products have CSV import with field mapping. Import in this order: users, accounts, contacts, deals, then activities and notes.
• Attachments and email history are the hard part. Decide whether old emails really need to move, or whether a read-only archive of the old export is enough.
• Run both systems in parallel for a short, fixed time, then make the old one read-only.

Side by side

Best fit

• Twenty: teams that want a modern interface and API-first platform, accept fast change, and either do not need SSO or are ready to pay for it.
• EspoCRM: small and medium teams that want a stable, light CRM with SSO in the free core, and are fine with paid extensions for advanced workflows.
• SuiteCRM: teams that need many classic modules (quotes, contracts, invoices, campaigns) in the free product and have PHP skills to maintain it.

Sign-in and permissions

• Twenty: SSO, row-level permissions and audit logs on the paid plan.
• EspoCRM: LDAP, OIDC and 2FA in core; record and field level roles.
• SuiteCRM: LDAP and SAML options; roles and security groups.

Operations

• Twenty: containers, Node.js, PostgreSQL, Redis; weekly upgrades.
• EspoCRM: PHP, one database, cron; steady minor releases.
• SuiteCRM: PHP, one database, cron; two code layers in version 8.

A worked plan for Kovai Pump Works

This plan is our own judgement for the invented company, not a vendor recommendation.

Month 1: prepare

• Export everything from the hosted CRM and count records: dealers, contacts, open deals, activities in the last two years.
• Write down five must-have workflows: new dealer onboarding, visit logging, quote follow up, regional reports, complaint visibility.
• Agree the permission model: officer sees own dealers, regional manager sees region, head office sees all.

Month 2: pilot two products

• Set up EspoCRM 10.0.11 on one VM with MariaDB, signed in through the existing Keycloak by OIDC.
• Set up Twenty v2.54.0 with Docker Compose on the second VM, pinned to that version, with email and password sign in for the pilot.
• Import one region (about 150 dealers) into both. Ask six field officers and one manager to use both for three weeks.
• SuiteCRM stays on the list only if the team asks for built-in quotes and invoices in the pilot.

Month 3: decide

• If officers prefer Twenty and management is willing to pay for the Organization plan for SSO and row-level permissions, choose Twenty, and set up a staging server for weekly upgrades.
• If not, choose EspoCRM, and decide whether the Advanced Pack is needed for workflows after listing real automation needs.

Months 4 and 5: roll out

• Import all regions, train officers region by region, keep the hosted CRM read-only for one month, then cancel before renewal.
• Set up backups, a restore test, advisory subscriptions and an upgrade calendar.

What we do not recommend

• Opening the CRM to the internet without a VPN or an authenticating proxy in front.
• Running Twenty on the latest tag in production.
• Customising code in the core of any of the three in the first year. Use the supported extension points.
• Migrating all old email history on day one.

When not to adopt each

• Twenty: when you cannot absorb weekly releases, or you need SSO and row-level rules but have no budget for the paid plan.
• EspoCRM: when you need complex workflows and approvals but cannot buy extensions, or need deep built-in invoicing.
• SuiteCRM: when you have no PHP skills in house, or want a small, simple system for a handful of users.

When not to self-host at all

If you have no one to own upgrades and security fixes, or your sales team depends on deep integrations that only the hosted vendor provides, a hosted CRM may still be the right answer. Self-hosting moves cost from licence fees to people time.

A short history

• SugarCRM released its Community Edition as open source in the mid 2000s. When SugarCRM moved away from the open edition, SalesAgility forked it as SuiteCRM in 2013. SuiteCRM 8 brought a new front end in 2021 and later.
• EspoCRM started in 2014 as a fresh PHP CRM with a single page interface, built by a small team, and has grown steadily without a big rewrite.
• Twenty started in late 2022 as an open source alternative with a modern stack, and gained a large following on GitHub in a short time.

Others we looked at

• Odoo CRM is part of a larger ERP; worth it if you also want Odoo for inventory and accounting.
• Krayin CRM is a Laravel based CRM, smaller in community.
• ERPNext includes a CRM module for teams already on Frappe.

We did not compare these in depth here.

Decision guide

• Need SSO free in the core: EspoCRM.
• Need many classic modules including quotes and invoices free: SuiteCRM.
• Want a modern API platform and can pay for premium features: Twenty.
• Have only one part-time admin: EspoCRM is usually the easiest to keep running.

Checklist before going live

• Version pinned and noted.
• Sign in through your identity provider, or strong passwords with 2FA.
• Roles tested with real officers and managers.
• Backups of database and files scheduled, and one restore done.
• Security advisory and release feeds subscribed.
• Cron or worker health monitored.
• Old system read-only date fixed.

Common mistakes

• Choosing by demo screens instead of a pilot with real data.
• Importing dirty data and blaming the new CRM.
• Forgetting the cron job, then wondering why emails do not arrive.
• Skipping upgrades for months, then facing a big jump with breaking changes.
• Giving everyone admin rights during the pilot and never removing them.

Hands-on check

We skipped a hands-on drill for this post. A useful check is to run each product on a test VM, import a sample of 1,000 accounts and contacts, and measure import time and list view speed, but that needs a full stack per product. Do this as part of your own pilot.

Unlearn and re-learn

• Unlearn: a CRM is a vendor product you rent per seat. Re-learn: it can be an application you run, like your ERP or mail server, with the same care for backups and upgrades.
• Unlearn: open source means every feature is free. Re-learn: read the licence file and the editions page; SSO and fine permissions are often where paid plans start.
• Unlearn: the newest product is the safest choice. Re-learn: choose the release pace your team can actually follow.

Sources

• Twenty repository and releases: https://github.com/twentyhq/twenty
• Twenty licence: https://github.com/twentyhq/twenty/blob/main/LICENSE
• Twenty Docker Compose file: https://github.com/twentyhq/twenty/blob/main/packages/twenty-docker/docker-compose.yml
• Twenty pricing plans documentation: https://docs.twenty.com/user-guide/billing/capabilities/pricing-plans
• Twenty SSO documentation: https://docs.twenty.com/user-guide/permissions-access/capabilities/sso-configuration
• Twenty terms of service: https://twenty.com/terms
• Twenty self-hosted billing pull request: https://github.com/twentyhq/twenty/pull/18075
• Twenty security advisories: https://github.com/twentyhq/twenty/security/advisories
• EspoCRM repository and releases: https://github.com/espocrm/espocrm
• EspoCRM 10.0.0 release notes: https://github.com/espocrm/espocrm/releases/tag/10.0.0
• EspoCRM server configuration: https://docs.espocrm.com/administration/server-configuration/
• EspoCRM security advisories: https://github.com/espocrm/espocrm/security/advisories
• SuiteCRM 8 repository and releases: https://github.com/SuiteCRM/SuiteCRM-Core
• SuiteCRM 7 repository: https://github.com/salesagility/SuiteCRM
• SuiteCRM 8.10 release notes: https://docs.suitecrm.com/8.x/admin/releases/8.10/
• SuiteCRM compatibility matrix: https://docs.suitecrm.com/8.x/admin/compatibility-matrix/
• SuiteCRM security advisories: https://github.com/SuiteCRM/SuiteCRM-Core/security/advisories

Related on Revisit.Tech

• Self-hosted helpdesk and ticketing in 2026
• Self-hosted e-signature in 2026
• No-code databases in 2026
• Self-hosted email in 2026
• Keycloak and its alternatives
• PostgreSQL backups in 2026
• Reverse proxies in 2026
• Self-hosted project tracking in 2026