Document360 vs BookStack: when each choice fits
BookStack fits teams that want to own their internal knowledge base outright, keep it on their own servers, and run a PHP and MySQL or MariaDB application. Document360 fits organizations that depend on a vendor-run customer portal, its AI and workflow features, and hosting handled for them. The decision turns on four questions: whether a customer-facing portal is a core need, which AI and workflow features your editors use every day, how many languages you publish in, and whether your identity provider signs in through OIDC, SAML2 or LDAP. A renewal or a quote-based price increase is a good moment to answer them in writing.
Start with the runtime. BookStack requires PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6 or later. Its installation documentation covers official install scripts for Ubuntu 26.04, 24.04 and 22.04. BookStack does not publish official Docker images and points to community setups such as LinuxServer.io, so a team that standardizes on containers should plan for that. Confirm that your team can patch PHP, the database and the operating system on a schedule and that someone owns backups. BookStack is MIT licensed, so there is no license fee, but hosting, patching and admin time are costs you carry. Paid support plans are available if you want a vendor on the hook for the application itself.
Document360 tends to be the better fit where the customer-facing side and vendor-platform features carry the most weight. If you run a public help center with approval flows, analytics or translation management that editors rely on, list each one and check how BookStack covers it. BookStack's role and permission system and per-role MFA enforcement suit internal access well, but confirm its public access settings and multilingual handling against your use case before you decide. Ask Document360 for a written quote that breaks out SSO, language count and AI usage, so you compare the same scope on both sides.
Which product fits which scenario
This table matches common Document360 scenarios to the better fit between Document360 and self-hosted BookStack, with the condition that decides each one. Read each row against your own content volume, audience and compliance constraints, since the conditions often matter more than the default choice.
| Scenario | Better fit | Condition that decides it |
|---|---|---|
| Internal runbook library for engineering and operations | BookStack | Your team is comfortable with a book, chapter and page structure and wants access control through your own SSO and roles. |
| Public customer help center | Document360 | You need a polished, vendor-run public portal with built-in analytics and feedback features, and you accept the subscription cost. |
| Public customer help center with light traffic and simple content | BookStack | Public pages can be shared with unauthenticated readers, and you are willing to build and maintain the public theme and hosting yourself. |
| Multilingual documentation across many languages | Document360 | Your translation workflow depends on Document360's built-in language management, so confirm how BookStack would handle your language count and translation tooling before deciding. |
| Strict data location rules | BookStack | Your data must stay in a named region or your own data center, and you can host the database and file storage there. |
| Heavy use of Document360's AI or workflow features | Document360 | Your content process relies on AI-assisted writing, review workflows or approval steps that BookStack does not provide natively, so confirm the gap and budget for a replacement process. |
| Small admin team with limited platform skills | Document360 | You lack capacity for patching PHP, MySQL or MariaDB, backups and upgrades, so a managed subscription may be less risky until you can staff that work. |
| Small admin team with a DevOps or platform function | BookStack | Someone can own installation, upgrades and backups on a schedule, and the content volume stays within what a single instance serves comfortably. |
Where the content and identity live under each option
With a hosted knowledge base, the vendor operates the application, the database and the storage that hold your articles, attachments and user records. Your team manages content and access settings, while the vendor controls the infrastructure underneath. Before you sign or renew, confirm in writing where the data is stored, which regions are used for backups and support access, and how long the vendor retains content after a contract ends.
- Data location: Confirm the hosting region for primary storage, backups and any AI processing, and whether those locations can be fixed in the contract.
- Backups: Ask how often backups run, how long they are kept, and whether you can restore a single article or only the whole site.
- Identity: Check which single sign-on protocols are included in your plan and whether the vendor's identity setup can be tied to your existing identity provider's groups.
- Subprocessors: Request the current list of subprocessors and the notice period for changes.
- Exit: Confirm the export formats and whether attachments, private notes and comments are included.
The compliance evidence for a hosted service is largely supplied by the vendor's own assurance reports, which you should request and review against your own risk assessment. Your team still owns the evidence for its configuration choices, such as access reviews and who holds administrator roles.
BookStack runs as a PHP application backed by MySQL 8.0 or MariaDB 10.6 or later, and it stores attachments on the server or in the storage you configure. Your organization decides where it runs: a cloud account you control, a data center, or a network with no internet access. Content, user records and audit history stay in the database you operate. The installation documentation describes official installation scripts for Ubuntu 26.04, 24.04 and 22.04, and it points to community Docker setups rather than publishing official images.
- Data location: The application, database and attachment storage sit in the environment you choose, so residency follows your own architecture decisions.
- Backups: You design the schedule, retention and restore tests for the database and the attachment store, and both must be backed up together to stay consistent.
- Identity: BookStack supports OIDC, SAML2 and LDAP sign-in, so it can be connected to your existing identity provider without a separate user directory.
- Authentication controls: Built-in multi-factor authentication can be enforced per role, and the role and permission system is available without a higher tier.
- Patching: Your team applies PHP, database and BookStack updates, so the upgrade calendar becomes an operational duty.
Your organization must produce its own evidence: configuration records, backup restore tests, access reviews and patch history. DeployOpen can prepare these controls and evidence for your assessment, but independent auditors issue any audit report. Confirm the exact requirements with your assessor before you start.
Identity decides who can read private spaces and who can edit public ones, so it is often the first integration question. A hosted tool connects through the vendor's supported protocols and may charge for some of them. A self-hosted BookStack instance connects to the identity provider you already run, which keeps group membership and offboarding in one place. The key point is that a user removed from the directory should also lose access to the wiki without a manual step.
- Protocol choice: Use OIDC or SAML2 for single sign-on and keep LDAP for directory-backed group lookups where your environment needs it.
- Group mapping: Confirm how directory groups map to BookStack roles, and test that a change in the directory changes access on the next sign-in.
- Fallback accounts: Define a small number of local administrator accounts with strong authentication, stored under your own break-glass process.
- Session and MFA policy: Set session lifetimes and enforce multi-factor authentication per role for administrators and editors of sensitive books.
- Offboarding: Test disabling a user in the directory and confirm the account can no longer reach private content.
For either option, the evidence that matters is your own access review records and sign-in logs. Ask the vendor for its identity documentation and compare it with the BookStack configuration your team documents.
Compliance readiness depends on who produces each piece of evidence. With a hosted product, the vendor supplies its own assurance material, but your configuration, access decisions and retention choices still need records. With self-hosted BookStack, your organization produces the evidence for the whole stack, from the operating system and database to the application settings. Neither option removes the need for an independent assessment, and DeployOpen does not issue audit reports, attestations or certifications.
- Control mapping: List which of your framework's controls cover access, change management, backup, encryption and logging, and name the system owner for each.
- Configuration records: Keep versioned copies of BookStack and server configuration, including authentication and permission settings.
- Restore evidence: Record regular restore tests with dates, scope and results, since backups without tests rarely satisfy an assessor.
- Access reviews: Schedule periodic reviews of books, shelves and role assignments, and retain the signed outcomes.
- Change history: Keep patch and upgrade records, including the BookStack release notes you reviewed.
Ask your auditor which evidence formats they accept and how long they expect records to be kept. DeployOpen can prepare the controls and evidence pack, which your independent auditor then reviews.
What self-hosting changes for data control and compliance
Moving a knowledge base from a hosted SaaS to BookStack changes who controls storage, identity, logs and recovery. The cards below cover the decisions that matter most for regulated teams, and each one names the condition under which it becomes a requirement rather than a preference.
Data location and residency
With Document360, page content, attachments and user records sit in the vendor's hosting environment, and you confirm the region and sub-processors through the contract and vendor documentation. With BookStack, the database and uploaded files live on servers you choose, whether in your data center, a private cloud account or an air-gapped network. This matters most when a residency rule or customer contract names where documentation may be stored. Ask Document360 for its hosting regions and sub-processor list in writing, and document where each BookStack component runs.
Hosting model and shared responsibility
A hosted service moves patching, availability and backup operations to the vendor, while a self-hosted BookStack instance moves them to your team or to a partner under a written scope. BookStack requires PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6 or later, so the stack must be kept current and supported. This matters when your team lacks capacity to run PHP, the database and the web server on a regular patch cycle. Decide who owns each layer before the cutover and record it in your responsibility matrix.
Identity and MFA enforcement
Document360 SSO and access controls depend on the plan and add-ons you buy, so confirm which identity features are included before you rely on them. BookStack supports OIDC, SAML2 and LDAP sign-in, and its built-in multi-factor authentication can be enforced per role, so you control the policy from your own identity provider. This matters when auditors ask whether privileged editors and administrators must use a second factor. Test enforcement with a non-admin account and an administrator account, and confirm that the chosen role mapping matches your identity groups.
Audit logging and access reviews
Access reviews need a record of who viewed, edited and shared content and when permissions changed. Confirm what audit events Document360 exposes, how long they are kept and whether you can export them to your SIEM. In a self-hosted BookStack instance, you decide where web server, database and application logs are written, how long they are retained and who can read them. This matters for quarterly access reviews and for any investigation of a data exposure on a customer-facing help center. Map each review question to a log source before go-live.
Backup and restore ownership
Document360 backup and restore behavior is defined by the vendor, and your ability to recover content outside the platform depends on the export options available to you. A self-hosted BookStack instance places backup, retention and restore testing under your control, including the database, the uploaded files and the configuration. This matters when a recovery objective or an incident response plan names a specific restore procedure that you must prove. Test a full restore into a separate environment and record the time it takes.
Controls an auditor will ask about
Auditors ask for evidence that access is authorized, changes are traceable, and the system is patched and backed up, regardless of where it runs. Self-hosting shifts the evidence burden onto your team, so you need configuration baselines, change records and access review outputs for BookStack. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors issue any audit report or certification. Ask your auditor which control frameworks apply and which evidence each one requires before you finalize the design.
How the license and editions differ
BookStack is MIT licensed, which lets your organization run, modify and redistribute the software without a per-seat license fee. Paid support plans and sponsorship are available from the project's maintainers, so you can buy operational help without buying the product itself. Document360 is a commercial hosted product priced by quote, where the price is shaped by team accounts, workspaces, languages, SSO and AI usage. Ask Document360 for a written quote that lists each of those drivers separately, so you can compare the recurring cost against the components you would carry yourself.
Open-source licensing does not remove the need to operate the platform. With BookStack, your team or a partner owns the PHP and Laravel runtime, the MySQL or MariaDB database, the web server, TLS, backups, restores, security patches and version upgrades. Plan who performs each of these tasks, how often, and what happens during an outage. Check the BookStack installation documentation for the supported PHP and database versions before you choose a host, because those requirements change between releases.
Before you decide, confirm which Document360 plan includes each feature your users rely on, such as SSO, private or restricted access, multilingual publishing, analytics and AI features. Plan tiers and add-ons change over time, so get this in writing from the vendor rather than from a comparison table. Map each confirmed feature to a BookStack capability or to a gap you will need to fill with configuration, custom development or a separate tool, and record the result in your migration decision file.
What drives the cost on each side
This table sets Document360's quote-based subscription against the components of running BookStack yourself, with no license fee. Read the rows as a checklist of who gets paid for what, which costs are one-time and which recur, and what to ask for before comparing totals.
| Cost component | Document360 (quote-based subscription) | BookStack (self-hosted, MIT) |
|---|---|---|
| License or subscription | Recurring fee set by the written quote, shaped by team accounts, workspaces, languages, SSO and AI usage. Ask which of these are priced separately. | No license fee. BookStack is MIT licensed, so the software itself is free to run. |
| Hosting and infrastructure | Included in the vendor's hosting. Confirm data residency and any add-on regions in the quote. | Recurring. Servers or cloud instances in your own accounts, sized for your users and attachment volume. |
| Database | Handled by the vendor. | Recurring operation of MySQL 8.0 or MariaDB 10.6 or later, including patching and storage growth. |
| Backups and recovery | Vendor-managed. Ask for backup frequency, restore testing and export rights in writing. | Recurring. You design, run and test backups of the database and uploaded files, and keep them off the host. |
| Monitoring and upgrades | Vendor-managed releases. Ask how feature changes and SSO updates are communicated. | Recurring. Someone tracks BookStack releases, PHP support and OS upgrades, and applies them. |
| Migration and content work | One-time. Export from Document360 and map structure, languages and access rules, with the export limits confirmed with the vendor. | One-time. Import, restructure into books and shelves, check links and permissions, then retire the old site. |
| Staff time | Lower admin load, but editor and admin time still applies for content governance. | Recurring. Editors and admins spend time on content upkeep and platform administration you would otherwise hand to the vendor. |
| Support | Included in the subscription at the tier the quote specifies. Confirm response targets in writing. | Optional. BookStack offers paid support plans, or you can rely on internal staff and community resources. |
| Quote checklist | Request each priced item separately, including AI usage, extra languages, SSO and workspace counts, plus renewal and overage terms. | Scope the one-time migration and the recurring hosting, backup and admin hours, then price them through a fixed written scope. |
What Document360's AI and workflow features leave behind
Before choosing BookStack, confirm which Document360 features your team actually uses day to day, because some of them have no direct BookStack equivalent. The most likely gaps are AI-assisted authoring, formal approval workflows that gate publication, portal analytics that report on how readers search and which articles fail to help, and vendor-run hosting that handles uptime, patching and scaling on your behalf. Pull the admin settings, workflow configurations, analytics dashboards and AI usage reports from your Document360 workspace and list each item with its owner and frequency. Ask the vendor to confirm in writing which of these are included in your plan and which are add-ons, since that determines what you must replace.
Each gap has a practical replacement, and each replacement has a cost. BookStack provides books, chapters, pages, roles and permissions, and its editor history, so a review step can be run as a documented process: drafts are kept in a dedicated shelf or draft book, a named reviewer signs off through a checklist, and an admin publishes. That process costs editor and reviewer time every week, which is often the largest hidden expense. For AI-assisted drafting, you can keep a separate, self-hosted writing assistant under your own data controls, or simply drop the feature, but either choice needs a policy on what source material may be sent to a model. Analytics usually require a separate tool, such as your web analytics stack pointed at the public pages, and search quality can be reviewed by exporting the BookStack search log or the web server access log if your administrators enable it. Confirm the exact logging options in the installation you deploy.
Hosting is the gap that changes the most work. With Document360, the vendor operates the service; with BookStack, your team or an implementation partner owns the server, database, backups, TLS certificates, upgrades and the PHP and database versions that BookStack requires. Plan for a named owner for these tasks and a tested restore procedure before cutover. If you need features that BookStack does not offer, such as a formal approval engine or analytics dashboards, compare the custom work against a different platform in this group, and ask for a written scope that lists each replacement, who builds it and how it is tested.
How a move from Document360 to BookStack proceeds
The sequence moves knowledge base content, books and access rules from Document360 into BookStack in an order that keeps public pages reachable and lets the team confirm each stage before the contract ends. Each step closes with a check the owner can sign off.
Inventory content and access rules
Before anything is exported, list every project, category, article and file, and record which pages are public, which are restricted to logged-in customers, which are internal, and which carry private notes or inline comments. Document360 users, roles and team accounts should be listed alongside the content, since BookStack will need its own role model. The content owner and the security lead sign off on this inventory. The output is a single register that maps each content area to its audience and owner.
Export content from Document360
Run the exports described in the Document360 export guide and check what each format leaves out, such as inline comments, attachments and private notes. Store the exports in a controlled location with access limited to the migration team. The migration lead compares the export against the inventory and records any gaps, so that missing items are either recovered or accepted as retired. The check is a reconciled list of exported articles against the register.
Map books, chapters and shelves
Translate the Document360 structure into BookStack's model of shelves, books, chapters and pages. Decide which categories become books, which become chapters, and how shelves group related books for customers and internal teams. Agree naming and slug conventions with the editors before any content is imported. The output is a written mapping document that the content owners approve.
Migrate attachments, images and permissions
Move files and images into BookStack and rebuild access using its role and permission system, so that each shelf and book carries the audience defined in the inventory. Test links to attachments and images on a sample of articles, since broken references are the most common defect after an import. Confirm that restricted content is not visible to unauthorized accounts by testing with accounts from each role. The check is a test log showing each role's visibility against the register.
Set up SSO and multi-factor authentication
Configure the identity provider with BookStack using one of its supported sign-in methods, which include OIDC, SAML2 and LDAP, and enable multi-factor authentication for the roles that require it. Confirm which account types can still sign in with local passwords and disable those that are not needed. The identity team and the security team test sign-in, role mapping and sign-out. The output is a tested login path for each audience.
Pilot with a group of editors
Import a representative subset of content and ask a small group of editors and admins to perform real tasks, such as updating an article, adding a diagram, and reviewing a permission change. Record problems with the editor, search results and formatting, and fix them in the mapping or import scripts before the full import. The pilot owner decides when the findings are resolved. The output is a pilot report with agreed fixes.
Cut over public pages with redirects
Import the full content set, publish the public pages, and create redirects from the old Document360 URLs to the new BookStack addresses so that existing links and search engine entries continue to resolve. Check a sample of high-traffic URLs and the most-linked articles after the switch. The web owner and the support lead confirm the redirect map. The output is a published site where legacy URLs land on the correct page.
Run the contract overlap and retire Document360
Keep Document360 available in read-only use while both platforms run in parallel, and ask the vendor to confirm the terms of that period in writing. During the overlap, compare traffic, support tickets and editor feedback against the pilot baseline, and resolve discrepancies. Retire Document360 only after the owners sign off that the content, access rules and redirects are complete and that a final export is archived. The output is a signed closure record.
Questions buyers ask before switching
What does switching from Document360 to BookStack cost?
BookStack is MIT licensed, so there is no license fee to pay. The cost sits in hosting, a database, backups, migration, administration and any outside help you choose to buy. Hosting, database capacity, backup storage and administrator time recur every year. Migration, content cleanup, access mapping and integration work are usually one-time costs. What drives the total is content volume, the number of access rules to recreate, how many identity providers you connect, and whether your team or a partner runs the platform. BookStack also offers paid support plans through its website, which are optional. Ask any implementation partner for a quote that lists each component separately, so you can compare it with your current Document360 renewal line by line.
How long does a Document360 to BookStack migration take?
No fixed duration applies to every migration. Time depends mainly on the number of pages, attachments and revisions you need to carry over, and on how many access rules must be rebuilt in BookStack's shelves, books and roles model. A typical sequence includes an inventory of content and access, an export from Document360, a mapping of the old structure to books and chapters, a test import into a non-production copy, a permissions check, and a cutover with a fallback plan. Confirm the export formats your Document360 account supports before you plan the work. Any partner should agree the scope, deliverables and timeline in writing before work begins.
Can our team run BookStack without outside help?
Yes, if your team is comfortable operating a PHP and Laravel application on Linux with a supported database. BookStack requires PHP 8.2 or later and either MySQL 8.0 or MariaDB 10.6 or later. Official installation scripts cover Ubuntu 26.04, 24.04 and 22.04. BookStack does not publish official Docker images and points to community Docker setups such as LinuxServer.io, so decide early which deployment method your security team will accept. Ongoing ownership includes applying upgrades, patching the operating system and PHP, testing backups, monitoring availability and reviewing authentication settings. The BookStack installation docs list the requirements. If no one on your team owns those tasks, a retainer for support and upgrades is an option.
What does BookStack need from admins and editors?
Admins and editors carry different work. Administrators must:
- Install and configure the platform, the database and backups
- Connect sign-in through OIDC, SAML2 or LDAP and enforce multi-factor authentication for the roles that need it
- Design roles and permissions so each team sees the right books and pages
Editors need time to learn the book, chapter and page structure, choose between the WYSIWYG editor and the optional Markdown editor, and build diagrams with the built-in diagrams.net integration. After a migration, editors also check internal links, images and page ownership, because automated imports rarely preserve every reference. Plan training and a review window for each content owner before you retire the Document360 workspace.
Does BookStack cover customer-facing documentation portals?
BookStack is designed primarily as a platform for internal team knowledge and documentation, so you should test it against your customer portal requirements before committing. Confirm how its public access settings work, whether you can publish selected books without an account, and how branding, custom domains and reader analytics would be handled. Compare these against what your customers use on Document360 today, including navigation, search behavior and feedback features. If your public documentation depends on features BookStack does not provide, you may need to keep a separate public site or evaluate other self-hosted options in this pillar. Ask for a written list of what the portal needs before any scope is agreed.
How does BookStack handle multilingual content?
The supplied information does not describe BookStack's translation features, so confirm them before planning. Check whether it offers language-specific books, whether translated pages can be linked to their source, how readers switch languages, and how translators and reviewers receive assignments. If there is no native translation workflow, a common approach is one book or shelf per language, with a consistent page naming scheme and a manual review process for each translated page. Document360 handles translations within its own workflow, so map out which steps your translators depend on today. Ask the vendor for documented behavior and test it on a sample set of pages in your own environment.
Will sign-in and access rules carry over from Document360?
Sign-in and access rules do not move automatically, so each one must be recreated and tested. BookStack supports OIDC, SAML2 and LDAP sign-in, built-in multi-factor authentication that can be enforced per role, and a full role and permission system. Because the license is MIT, connecting these identity methods does not add a per-feature fee. The work lies in mapping each Document360 group, space and visibility setting to BookStack roles, shelves and books, then testing that users see only what they should. Customers who need access to private content may require separate accounts or groups, which should be designed before the cutover. Confirm your identity provider's configuration with your security team.
How DeployOpen helps evaluate and migrate
DeployOpen plans, implements, integrates, hardens, backs up and supports self-hosted platforms inside your own cloud accounts, data centers or air-gapped networks, so a move from Document360 to BookStack keeps the wiki, its users and its content under your control. Most engagements are fixed-scope, with the scope, deliverables and timelines agreed in writing before work starts. For this comparison, that scope usually needs to settle which spaces move, which shelves and books map to which content, whether customer-facing content stays public, and which identity provider signs users in through OIDC, SAML2 or LDAP.
A quote follows from the written scope. DeployOpen does not publish a price list, so the useful preparation is to inventory your Document360 projects, languages, workspaces, user accounts and AI or workflow features, and to list which of them your team actually depends on. Ask for the quote to show separately the environment build, the content migration and the review of private and public access rules, the SSO and MFA configuration, the backup and restore testing, and any ongoing support or upgrade retainer. Confirm with the vendor what Document360 export you can obtain under your contract before the work is scoped.
Plan for the points that tend to slip during a migration: translated content that must be re-linked, search behavior that users will compare against Document360, and analytics that you may need to rebuild in another form. BookStack publishes official installation scripts for Ubuntu 26.04, 24.04 and 22.04 and points to community Docker setups rather than official images, so ask DeployOpen to state which deployment path it will use and how upgrades will be tested. Confirm the PHP and database versions required by the release you select against the BookStack installation documentation before you sign off the scope.
How DeployOpen works with knowledge base migrations
DeployOpen plans, implements, customizes, integrates, hardens, backs up and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a move from Document360 to BookStack, that means agreeing the scope of books, editors, access and content in writing before any content moves.
How we scope
- Inventory books, chapters, public and private pages, and the audiences each one serves
- Agree in writing which Document360 features, languages and workflows BookStack will replace
- Confirm SSO, MFA and role mapping requirements with your identity team before build starts
How we build
- Install BookStack on your infrastructure with PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later
- Configure OIDC, SAML2 or LDAP sign-in and role-based permissions to match the agreed scope
- Test exported content conversion and search results against a sample set of pages before full migration
How we hand over
- Document the installation, configuration, permission model and backup procedures for your admins
- Deliver a content migration log showing what moved, what was rebuilt by hand and what was left behind
- Train editors and administrators on the BookStack editors and the agreed publishing process
How we support
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts
- Ongoing support, upgrades and continuous testing are available as a retainer
- Ask for a written quote tied to the agreed scope, since DeployOpen does not publish a price list
