Self-hosted document management in 2026: revisit Paperless-ngx, Mayan EDMS and Docspell before you scan another invoice into a shared drive

Every small business has a paper problem that slowly becomes a file problem. Purchase invoices, GST returns, rent agreements, salary slips, vendor KYC, insurance policies, bank statements. Someone scans them on the office printer, the PDFs land in a shared drive folder called “Scans 2024 new”, and six months later the accountant cannot find the March invoice from the transporter. Search does not help, because a scanned image has no text inside it.

Self-hosted document management systems try to fix this. They take in scans and emails, run OCR so the text becomes searchable, help you tag and classify documents, and keep the files on a server you control. In 2026 three open source projects are worth a calm look: Paperless-ngx, the popular community project written in Python; Mayan EDMS, the older and more enterprise styled system, also in Python and Django; and Docspell, a Scala based organiser aimed at households and small groups.

We checked whether any of these is dead before writing. None is. All three show recent activity, though at very different speeds, which we explain below. Facts here come from the official GitHub and GitLab repositories, release pages, PyPI and README files, read on 4 November 2026. Where we write from general knowledge, we say so.

A scenario to keep us honest

We use an invented business to keep the discussion practical. This business is illustrative only; any resemblance to a real one is accidental.

Rajkot Saffron Spices (invented) is a family run spice trading and packing firm in Gujarat with about 40 staff, one accounts team of three, and an outsourced IT vendor who visits twice a month. Today:

• Purchase invoices from farmers’ agents and transporters arrive on paper, by email and on WhatsApp.
• Scans go into a shared Google Drive folder with no consistent file names.
• Employee files hold PAN, Aadhaar copies, bank details and offer letters, kept in the same drive with broad sharing.
• The auditor asks every year for specific invoices and the team spends days searching.
• The owner’s son, Kunal, has some Linux experience and has offered to run a small server.

The firm wants searchable invoices, tighter access to employee papers, and less time lost during audit.

Where these tools came from

Paperless-ngx

Paperless-ngx has a family history. Its README calls it “the official successor to the original Paperless & Paperless-ng projects”. The original Paperless was a personal project; Paperless-ng was a fork that improved it; and when that fork’s maintainer became less active, the community moved the work into a new organisation so that responsibility is shared across a team. The current GitHub repository was created in February 2022. Since then it has become the most widely discussed self-hosted document tool in home lab circles (general knowledge). The latest release at the time of writing is v3.4.1, published on 31 October 2026, a few days after v3.4.0 on 29 October.

Mayan EDMS

Mayan EDMS is the oldest of the three. Its GitLab repository has a v0.5 tag dated April 2011 and a v1.0 tag dated August 2014, so the project has been around for more than fifteen years. It is maintained mainly by its original author and a small company around it (general knowledge). The latest version on PyPI is 4.12.2, uploaded on 16 September 2026. It describes itself as a “Free Open Source Electronic Document Management System”, and its README claims it is “the most advanced, scalable, and mature open source document management system”. That is the project’s own claim, not our measurement.

Docspell

Docspell was started by Eike Kettner; its GitHub repository was created in July 2019. The README describes it as “a personal document organizer” that is “targeted for home use, i.e. families, households and also for smaller groups/companies”. The latest tagged release is v0.43.0, published on 15 March 2025. Commits continue in 2026, but most recent ones are automated dependency updates. So Docspell is alive and maintained, but feature releases are slow. Keep that in mind if you need new features soon.

We considered newer options such as Papra and Teedy. Papra is a young AGPL project in TypeScript with active releases in 2026, and may be worth a future post. For this comparison we stayed with the three named tools because all three are still maintained.

Licences, in plain words

Paperless-ngx

GitHub reports the licence as GPL 3.0. You can run, change and share it freely. If you distribute a modified version, you must share your source under the same licence. Running it internally for your own firm does not trigger that duty.

Mayan EDMS

PyPI lists the licence as GPL 2.0 only. The practical meaning for an internal user is similar to Paperless-ngx: free to run and modify inside your business. The “only” wording means it is not automatically upgradable to GPL 3, which matters to lawyers combining code, not to most users.

Docspell

GitHub reports AGPL 3.0. AGPL adds one rule over GPL: if you modify the software and let people use it over a network, you must offer them your modified source. For a firm that runs the unmodified release for its own staff, nothing changes in practice.

None of the three has a separate paid enterprise edition folder in its main repository that we saw. Mayan offers paid support and books around the project (general knowledge from its README links).

How each is built

Paperless-ngx

• Python and Django on the backend, with an Angular web interface (general knowledge).
• A task queue with Redis and Celery workers for consumption and OCR (general knowledge).
• PostgreSQL, MariaDB or SQLite for the database (general knowledge; PostgreSQL is the common choice).
• OCR through OCRmyPDF and Tesseract (general knowledge).
• Official Docker Compose files are the usual way to install.

Mayan EDMS

• Python and Django, requiring Python 3.9 or newer according to PyPI.
• PostgreSQL, a message broker and workers for background jobs (general knowledge).
• Installation through the official Docker Compose file, which the README shows as a three command setup using a compose file and a .env file from GitLab.

Docspell

• Scala on the JVM for the server and joex (job executor) components, with an Elm web interface. GitHub lists Elm as the main language by line count.
• PostgreSQL, MariaDB or H2 as database, and optional full text search through Solr or PostgreSQL (general knowledge).
• Uses the Stanford CoreNLP library for its machine learning suggestions, as stated in the README.
• A Docker Compose setup from the docspell/docker repository.

Features that matter for an accounts team

Paperless-ngx

• OCR and search. Scans become searchable PDFs, and full text search covers the content.
• Tags, correspondents, document types and custom fields. These are the main ways to organise.
• Automatic matching. Paperless-ngx can learn from your existing documents and suggest tags and correspondents (general knowledge).
• Workflows. Rules run on consumption or update, for example assign a tag and an owner when a document comes from a certain email address. The v3.4.0 release notes add support for custom fields in workflow title templates.
• Mail and folder intake. It can watch a consume folder and fetch from email accounts (general knowledge; the v3.2.1 notes mention a mail fetch lock fix).
• Permissions. Owners and per user or per group permissions on documents.
• AI features. Recent 3.x release notes mention an LLM index and suggestion requests. Treat these as optional, and think carefully before sending financial documents to any external AI service.

Mayan EDMS

• OCR and full text search on documents and versions.
• Metadata types, cabinets and tags for flexible classification.
• Workflows with states and transitions, useful for approval flows like “received, checked, approved, paid” (general knowledge).
• Document versions, check in and check out, and detailed access control lists.
• Signatures and audit events that record who did what (general knowledge).

Mayan feels closer to a classic enterprise DMS. That gives more control, and also a steeper learning curve.

Docspell

• OCR and full text search, run only if needed according to the README.
• Tags, correspondents and custom metadata, with suggestions for correspondents, tags and dates using machine learning and NLP.
• Strong email integration. It can import mail and attachments.
• REST API, an Android upload app and a command line client, all listed in the README.
• Collectives, a way to separate groups of users and documents (general knowledge).

Operations

Installation

All three are easiest with Docker Compose on a single Linux VM. For a 40 person firm, a small VM with 4 vCPU, 8 GB RAM and enough disk for a few years of scans is a reasonable starting point (general knowledge; OCR is CPU heavy during bulk imports, light afterwards). Docspell runs a JVM, so give it a little more memory.

Upgrades

• Paperless-ngx releases often. In October 2026 alone there were releases 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.4.0 and 3.4.1. Version 3.3.2 fixed a security issue (GHSA-c8f3-pqr2-rr24), and 3.3.4 was a security maintenance release updating dependencies. Pin an exact image tag, read release notes, and plan small upgrades every few weeks instead of one big jump a year.
• Mayan EDMS releases less often but each upgrade can include database migrations. Read the release notes and back up first.
• Docspell changes slowly. Upgrades are rare, which is easy for operations, but also means fewer new features and slower fixes.

Monitoring

Watch disk space, the task queue, and failed consumption jobs. A stuck OCR worker quietly stops new scans from appearing, and users think the system has lost their documents.

Backups

A document system holds the only copy of many important papers, so backups are not optional.

• Back up both the database and the file storage. The database alone has metadata without files; files alone lose tags and permissions.
• Paperless-ngx ships a document exporter that writes documents and metadata into a folder you can back up and later import (general knowledge). Use it in addition to database dumps.
• Mayan EDMS and Docspell need regular PostgreSQL dumps plus a copy of the storage volume.
• Keep one copy off the server, encrypted, for example in object storage in an Indian region.
• Test a restore on a spare VM every quarter. Open five random invoices and check they are searchable.
• Keep the original paper for documents that have legal retention needs until your CA confirms digital copies are enough.

Security

Exposure

Do not put the admin interface directly on the public internet. Use a VPN or an access proxy for staff working from outside. If you must expose it, use HTTPS, strong passwords and two factor login where the tool supports it.

Accounts and access

Give each person their own account. Put employee files in a separate area with restricted permissions: in Paperless-ngx through owners and groups, in Mayan through access control lists, and in Docspell through separate collectives. Review access every six months.

Advisory record

Paperless-ngx publishes security advisories and fixes them quickly, as the October 2026 releases show. A fast patch rhythm is good, but only if you actually upgrade. For Mayan and Docspell, watch their release pages and repository activity.

Uploads

Documents from outside, especially email attachments, can carry malicious files. Keep the server patched, do not let the intake account receive mail from everyone, and avoid opening unknown macros in office files.

The Indian context: the DPDP Act

India’s Digital Personal Data Protection Act, 2023, together with the rules notified later, applies when you process digital personal data of individuals. The following points are from general knowledge, not legal advice.

• Employee files are personal data. PAN, Aadhaar copies, bank details and salary slips need clear purpose and limited access.
• Purpose limitation. Keep documents for the reason you collected them, and delete them when that reason and any legal retention period end.
• Security safeguards. The Act expects reasonable safeguards. Access control, encryption of backups and audit logs from a DMS help you show this.
• Breach response. Know who decides and who informs whom if a laptop or server is compromised.
• Retention is a balance. Tax and company law ask you to keep many financial records for several years. Write a simple retention note with your CA per document type.

A DMS does not make you compliant by itself. It gives you the tools: tags for retention class, permissions for sensitive files, and logs for who opened what.

When not to adopt each

Do not choose Paperless-ngx if

• You need formal multi step approval workflows with states, sign off and audit trails across departments.
• You cannot commit to frequent upgrades.

Do not choose Mayan EDMS if

• Your team wants something simple that works in an afternoon.
• Nobody has time to learn its many concepts: metadata types, cabinets, workflows, ACLs.

Do not choose Docspell if

• You need new features or quick fixes on a predictable schedule.
• Nobody on the team is comfortable running a JVM application.

Do not self-host at all if

• Nobody can own backups and upgrades.
• Your documents are few and a well structured cloud drive with good naming would solve the problem.

Back to Rajkot Saffron Spices

Here is a calm recommendation for our invented firm.

1. Inventory and clean up sharing first. Before any new software, remove broad sharing on the employee files folder in the existing drive. That one step lowers risk today.
2. Pilot Paperless-ngx for purchase invoices. It fits the main need: scan, OCR, search, tag by vendor and financial year. Kunal can run it with Docker Compose on one VM, pinned to an exact version, behind a VPN.
3. Use workflows for intake. Create a dedicated invoices mailbox and a consume folder for the office scanner. A workflow tags documents by sender and assigns them to the accounts group.
4. Keep employee files separate. Use a different owner and group with access only for the owner and HR, or keep them out of the pilot until permissions are well tested.
5. Keep Mayan EDMS as a later option. If the firm later wants formal approval of invoices before payment, with states and sign off, Mayan is worth a trial then. Do not run two systems now.
6. Skip Docspell for this firm. It is a capable tool, but the slower release pace and JVM stack add risk for a team with limited IT help.
7. Agree a backup and restore routine with the IT vendor. Nightly database dump, nightly exporter run, encrypted off server copy, and a quarterly restore test.
8. Write a one page retention note with the CA for invoices, GST papers and employee files.

The goal is not to remove the shared drive in a week. The goal is that the auditor’s next request takes minutes, not days.

Revisit checklist

• Paperless-ngx is the active, community driven choice for scanning and searching. Mayan EDMS is the mature, workflow heavy choice. Docspell is the quiet, home and small group organiser.
• Paperless-ngx is GPL 3.0, Mayan EDMS is GPL 2.0 only, Docspell is AGPL 3.0.
• Pin versions, read release notes, and upgrade on a schedule, especially for Paperless-ngx.
• Back up database and files together, and test restores.
• Keep sensitive employee papers in a restricted area, behind a VPN.
• Under the DPDP Act, purpose, access control and deletion matter more than which tool you pick.

Learn what each tool does well, unlearn the habit of dumping scans into a shared folder, re-learn simple tagging and retention, practise with one month of invoices, and apply it before the next audit.

Sources

• Paperless-ngx repository and releases: https://github.com/paperless-ngx/paperless-ngx
• Paperless-ngx documentation: https://docs.paperless-ngx.com
• Mayan EDMS repository: https://gitlab.com/mayan-edms/mayan-edms
• Mayan EDMS on PyPI: https://pypi.org/project/mayan-edms/
• Mayan EDMS documentation: https://docs.mayan-edms.com
• Docspell repository and releases: https://github.com/eikek/docspell
• Docspell website: https://docspell.org