Mural or self-hosted Excalidraw: which fits your organization
If you are facing a Mural renewal, a per-member price change or a data residency requirement, the short answer is this: keep Mural if your teams depend on facilitation templates and want the vendor to run the service, and move to self-hosted Excalidraw if boards must sit on your own servers and you can operate a collaboration backend. Excalidraw is MIT licensed and its repository is actively maintained, but it is a drawing canvas first. Real-time sessions depend on the excalidraw-room server, which you would deploy, secure, back up and upgrade yourself. Confirm the current excalidraw-room setup steps and supported deployment patterns in its repository before you commit to a timeline.
Mural suits organizations that run structured workshops, need ready-made facilitation patterns such as voting, timers and sticky-note sorting, and prefer a managed service with vendor-run operations. Self-hosted Excalidraw suits teams whose main need is sketching, architecture diagrams and open drawings, where the open .excalidraw JSON format matters for portability and where the organization is willing to own uptime. Excalidraw's own end-to-end encryption model is a feature of its hosted app, so ask how your self-hosted deployment handles encryption, key handling and logging before you assume the same protections apply.
The decision turns on four things. First, facilitation needs: list the workshop formats your teams run each month and test whether Excalidraw can reproduce them without custom work. Second, residency rules: Mural offers regional residency only on its Enterprise plan, so compare that with a deployment inside your own data center or cloud account and check what your regulators require. Third, identity requirements: decide whether you need SSO and automated user provisioning, and confirm how each option integrates with your identity provider. Fourth, internal operating capacity: someone must own patching, backups, monitoring and availability. If that capacity does not exist, price a support retainer alongside the software.
Which option fits which scenario
This table matches common situations to the option that fits them better and names the condition that would reverse the choice. Read each row as a starting point, then check the condition against your own identity, residency and facilitation requirements before deciding.
| Scenario | Better fit and why | When the other option wins |
|---|---|---|
| Large paid-workshop facilitation | Mural, because its facilitation features such as templates, timers and presenter tools are built for running structured sessions with many participants. Confirm the exact facilitation features on your plan with Mural. | Excalidraw wins when the workshop is a sketching exercise without heavy facilitation needs, and the team is comfortable running the session with its own agenda and shared canvas. |
| Sovereignty-driven data residency | Self-hosted Excalidraw, because boards and the collaboration server run on servers you choose, so residency is set by your own infrastructure rather than a vendor's regional plan tier. | Mural wins only if its regional residency option on your plan meets your legal requirement and your assessor accepts vendor-held data. Confirm the region and the contract terms in writing. |
| Existing Nextcloud deployment | Nextcloud Whiteboard, which is built on Excalidraw and stores boards inside Nextcloud, so accounts, sharing and file storage already exist and need no second system. | Excalidraw standalone wins if Nextcloud is not already run and maintained, because adding it only for whiteboarding adds a platform to operate. |
| Small internal sketching teams | Excalidraw, because a small group can run one collaboration server and use the open .excalidraw format without per-member subscriptions for every participant. | Mural wins when the team needs a managed service, vendor support and no server administration, and the per-member cost is acceptable to the budget owner. |
| Regulated environments with audit evidence needs | Self-hosted Excalidraw, because your team controls logging, access, backup and retention, and can produce the evidence an assessor asks for from its own systems. | Mural wins if the regulator or assessor accepts the vendor's own compliance reports and you lack the capacity to operate and document a self-hosted service. |
| Teams needing SSO and centralized user management | Excalidraw with your own identity layer, which is workable but requires integration work, since SSO and provisioning are not built into the base project. | Mural wins when SSO and SCIM provisioning on your plan are required on day one and no internal team will build or maintain the integration. |
| Long-term archive of existing boards | Excalidraw, because drawings are saved in an open JSON format that you can read and keep without the vendor, which lowers lock-in on the content itself. | Mural wins for short-term reference work where static PDF or PNG exports are enough and no one needs to edit the original objects later. |
Where boards live and who controls access
Hosting location, encryption, identity and compliance evidence are the four places where a self-hosted whiteboard differs most from a hosted one. Each card below states what Mural provides on its own terms, what Excalidraw gives you when you run it, and what your team must verify. Start with data location, because the other controls depend on where the server sits.
Data location and hosting
Mural stores boards in its own cloud, and residency options depend on the plan you buy. Ask Mural in writing which region holds your boards by default, whether regional residency is included on your tier, and where backups and support access are located. Self-hosted Excalidraw, with excalidraw-room as its collaboration server, runs in the data center or cloud account you choose, so the location is your decision. Confirm the storage region and backup location before you size the rollout, and include your reverse proxy and log stores in that check.
End-to-end encryption in practice
Excalidraw describes its collaboration as end-to-end encrypted in the excalidraw.com app, and the open-source code is the basis for what your team runs. Under that design, the collaboration server should relay only ciphertext, but the packaging, reverse proxy and analytics settings of your deployment are yours to review. Ask Mural for its encryption at rest and in transit controls, and how it manages keys and who at Mural can access customer content. Test the encryption claim in your own environment with a traffic capture before you rely on it for confidential designs.
Identity and access control
Mural offers SSO on its Business plan and SCIM provisioning on Enterprise, so user accounts can follow your directory through joiners and leavers. Excalidraw's collaboration model is link-based, so access control sits in the layer you place in front of it, such as your identity provider through a reverse proxy, or Nextcloud login if you deploy Nextcloud Whiteboard. Confirm how the version you deploy handles room links, link expiry and removing a departing employee's access. Document who can create and share rooms before go-live.
Compliance evidence and audit reports
Excalidraw+ states SOC 2 Type 2 compliance for its own hosted service, with data encrypted at rest and in transit. That report covers the vendor's service, not your self-hosted deployment, so it cannot stand in as your evidence. Ask Mural for its current audit reports and the scope each one covers. DeployOpen prepares systems, controls and evidence for your assessment, but independent auditors and certification bodies issue the audit reports and attestations.
Admin logging and offboarding
Access reviews depend on records of who opened, shared and exported a board. Check what events Mural's admin controls log, how long those records are kept, and whether they can be exported to your SIEM. A self-hosted Excalidraw deployment has no admin console of its own, so logs from the reverse proxy, the identity provider and the host must be collected centrally and kept under your retention policy. Decide who reviews these logs and how often before the first board is shared.
How excalidraw-room carries live collaboration
Live collaboration in self-hosted Excalidraw runs on two parts: the Excalidraw front end that each participant loads in a browser, and excalidraw-room, the MIT-licensed collaboration server that relays changes between them. The room server does not need to understand the drawing to pass it along. Each participant's browser encrypts scene updates before they leave the device, and the room server forwards ciphertext to the other browsers in the same room. The room key travels in the link fragment, which browsers do not send to the server, so the server operator cannot read the board content. Confirm this behavior against the version you deploy, because the encryption model is the main reason many security teams accept the design.
The organization must run, secure and monitor the room server as a service of its own. That means hosting it in your network, putting it behind TLS, deciding who can reach it from inside and outside the perimeter, and keeping the Excalidraw front end and room server on versions you have tested together. Monitor uptime and connection errors, and plan log retention with care: the server sees room identifiers, connection metadata and timing even though it cannot read content. Ask your implementation partner or internal team to document the reverse proxy, WebSocket configuration and certificate renewal, since these are where most collaboration failures start. Ask the vendor or project which concurrency and room sizes they have tested before you assume any capacity figure.
When the room server is down, live sessions stop: participants can keep editing their local copy, but changes will not reach others until the connection returns. Work already saved in the browser or exported as an .excalidraw file is not lost, so the practical risk is an interrupted workshop rather than data loss. Plan for this with a second room endpoint or a documented fallback, a clear owner who can restart the service during a live session, and a check that facilitators know how to export and re-share a board. Note that the room server is separate from the storage of saved drawings. Nextcloud Whiteboard, covered in the sibling pages, handles storage and access differently, so compare the two before you decide where availability matters most.
Running Excalidraw for a whole organization
A single-team deployment runs the Excalidraw front end and the excalidraw-room collaboration server on one small host, usually behind a reverse proxy with TLS. It suits a workshop group or a product team that needs live boards without a platform project. The operator is effectively one or two people who own the server, updates and backups.
- Components: the Excalidraw web build, the excalidraw-room WebSocket server, a reverse proxy and a TLS certificate.
- Operator duties: patching the host and the container images, renewing certificates, monitoring uptime, and restoring boards if a host fails.
- Access control: there is no built-in member directory, so access depends on who holds the room link and on network controls you add.
- Mural equivalent: Mural's hosted service carries uptime, patching and backups, and its admin console carries member management.
- Backups: boards live in the browser unless you add a storage path, so decide early where
.excalidrawfiles are archived.
Before you pilot, confirm with the Excalidraw and excalidraw-room maintainers which versions are current and how their room server handles scaling, since a single node has no redundancy.
A company-wide deployment hosts Excalidraw and excalidraw-room as shared services, with access gated by your identity provider through a reverse proxy or an authentication layer. This is the model that replaces Mural's Business and Enterprise administration, so the work shifts from the vendor to your platform team. Expect a rollout plan, environment separation and a support rota.
- Components: the Excalidraw front end, excalidraw-room, an SSO gateway, persistent storage for scenes, and a monitoring stack.
- Operator duties: identity integration, role mapping for editors and viewers, high availability decisions, capacity planning and incident response.
- Lifecycle: track Excalidraw releases and test them in a staging copy before each production upgrade.
- Mural equivalent: SSO and SCIM provisioning are features Mural sells on higher plans, so deprovisioning becomes your job here.
- Logging: decide what is recorded about board access, since Excalidraw does not provide an audit trail comparable to Mural's admin reports.
Ask your security team which control evidence they need from this service and confirm with an independent auditor how they will assess it, because DeployOpen prepares the controls and evidence but does not issue audit reports.
Nextcloud Whiteboard is the official whiteboard app for Nextcloud, built on Excalidraw and licensed under AGPL-3.0. It stores boards inside Nextcloud, so your organization runs one platform for files, accounts and sharing instead of two. This model fits organizations that already operate Nextcloud, and it changes the operator's work mainly in the Nextcloud layer.
- Components: a Nextcloud server, the Whiteboard app, and the collaboration backend that the app requires for real-time editing.
- Operator duties: keeping Nextcloud and its apps current, database and file storage backups, and the collaboration backend service.
- Identity: users sign in through Nextcloud's own accounts or an LDAP or SSO integration you configure there.
- Mural equivalent: sharing rules and member management move into Nextcloud's share settings rather than Mural's workspace controls.
- Storage: boards are kept with the rest of your files, so Nextcloud backup and retention policies cover them.
Confirm the current Whiteboard setup steps and backend requirements in the project's repository before scoping, because the component list changes between releases.
Where networks are isolated or data must stay within a defined jurisdiction, Excalidraw can run with no external calls from the browser to hosted services. The operator controls every layer, including the container registry, the TLS authority and the time source used for logs. The work is mainly in supply chain control and offline update procedures.
- Components: an internal container registry or artifact mirror, the Excalidraw build, excalidraw-room, an internal certificate authority.
- Operator duties: verifying each release before import, maintaining offline update bundles, and documenting the build provenance.
- Data flow: confirm that no fonts, scripts or analytics are fetched from third-party hosts in your build.
- Mural equivalent: Mural's regional residency is an Enterprise feature, while here residency is a property of your own network.
- Recovery: rehearse restoring a full environment from offline backups, since no vendor can supply a copy.
Ask Excalidraw maintainers and your security architect which assets must be vendored, and treat any external dependency you find as an open item to close before go-live.
Cost components: licences, servers, setup and support
Mural is paid per member on a recurring basis, with SSO and SCIM tied to higher tiers. Self-hosted Excalidraw removes the license line but moves hosting, operation and integration work onto your budget. The cards below separate what recurs from what is paid once, and what moves each figure.
Mural per-member subscription
Mural is licensed per member, so the recurring cost scales with the number of people who need edit access, not with how many boards exist. Check which seats count as paid members, including guests and facilitators who only view. Confirm current tier prices on Mural's pricing page, since they change. Ask whether annual billing changes the per-seat rate and what happens to seats when staff leave mid-term.
Identity tiers for SSO and SCIM
SSO is available on Mural's Business plan and SCIM on Enterprise, so an identity requirement can push the whole organization into a higher tier. Confirm which tier your identity provider needs and whether provisioning and deprovisioning must be automated. For Excalidraw, the equivalent cost is integration work: placing a reverse proxy or authentication layer in front of the collaboration service, which you build and maintain.
Excalidraw licence and hosting
Excalidraw is MIT licensed, so there is no license fee for the editor or the collaboration server, excalidraw-room. Your recurring costs are the servers, bandwidth and storage that run it, which scale with concurrent boards and retained files. Ask your platform team to size compute for peak workshop sessions, not average load, and to price the hosting environment you already operate.
Storage, backup and reverse proxy
Board data in a self-hosted setup is your responsibility, so backup retention, restore testing and the reverse proxy with TLS certificates are recurring operational items. Mural hides these inside the subscription. Ask who owns backup schedules, how long snapshots are kept, and whether restores have been rehearsed. Storage cost grows with the number of retained scenes, so set an archive policy early.
Setup and migration effort
Setup is largely one-time: installing the collaboration server, configuring identity, and rebuilding the templates your facilitators use in workshops. Migration also carries one-time work to export murals and decide which boards are worth rebuilding. Ask for a written scope that lists each board class, the templates to recreate and the acceptance tests, since these drive the setup price more than the software does.
Ongoing support and upgrades
Upgrades, security patches and on-call support recur for as long as you run the service. Excalidraw's repository is actively maintained, but keeping your deployment current is still staff time or a support retainer. Ask whether support covers patching windows, incident response hours and who approves changes. Compare this recurring line directly with Mural's subscription over the same number of years, not against a single year's fee.
What moving from Mural to Excalidraw involves
The sequence turns Mural into a dated archive of static exports, a set of rebuilt working boards on your own Excalidraw and excalidraw-room stack, and a pilot-tested rollout to every team.
Inventory boards, templates and members
Someone who administers the Mural workspace lists every active board, every template used in workshops, and every member who owns or edits content. Tag each board by owner, last edit date, and whether it is still in use. Mark which boards are reference material, which are live workshops, and which templates are repeated often enough to justify rebuilding. The output is a single inventory sheet that the team signs off on before any export starts.
Export static archives from Mural
Board owners export each board they want to keep as PDF or PNG, following Mural's export options, and store the files in a dated archive folder with the board name and owner in the file name. Confirm the export with the vendor or in your own workspace, because Mural's bulk and emailed-link options can change. Check that a sample of files opens correctly. Expect that these exports are static images or pages: sticky notes, connectors, and editable objects will not carry over into Excalidraw. The closing check is an archive index that lists every board and its export file.
Decide which boards to rebuild
Workshop leads and the platform owner decide, board by board, whether the content is worth rebuilding as an Excalidraw scene, kept only as an archived export, or retired. Templates used in recurring facilitation are the usual candidates for rebuilding, because they are opened again and again. Reference murals with no future edits are usually archive-only. Record each decision in the inventory sheet with a named owner. The output is a rebuild list with a clear owner for each item, and an explicit archive-only list.
Stand up Excalidraw and excalidraw-room
The platform team deploys the Excalidraw web front end and the excalidraw-room collaboration server inside your infrastructure, with TLS, backups, and access logging in place. Both components are MIT licensed, so confirm the exact versions you pin and track the Excalidraw releases page for changes. Test real-time collaboration with several accounts across two networks and confirm that scenes are saved in the open .excalidraw JSON format to your chosen storage. Check that the end-to-end encryption behavior you rely on is what the project documents. The output is a tested stack with a documented runbook.
Connect identity and access controls
The identity team decides how users sign in and which groups can create, edit, or only view scenes. Confirm with the vendor and your own environment whether the deployment supports the single sign-on method you need, because Excalidraw's self-hosted setup is not the same as a managed workspace with built-in SCIM provisioning. Document where accounts are created and removed when someone leaves. Test that a removed user loses access to rooms and stored scenes. The output is an access matrix and a tested offboarding procedure.
Pilot with one workshop team
Choose one workshop team that runs facilitated sessions regularly, and have them rebuild their two or three most-used templates in Excalidraw. Run at least one live session with remote and in-room participants, and record what breaks, such as missing facilitation features, timer or voting habits, or unclear sharing. Keep a list of gaps against Mural's facilitation features and decide whether each gap needs a workaround, a process change, or a tool. The output is a signed-off pilot report with a gap list the wider rollout must address.
Roll out and retire Mural access
Roll out the rebuilt templates, the access model, and the usage guide to the remaining teams in waves, with a named contact in each team. Keep Mural read-only during the transition so people can still check old boards. When the archive is complete and each team has confirmed its working boards, the platform owner schedules the Mural subscription change and the removal of member seats, after checking the contract terms with procurement. The output is a closed Mural estate, a verified archive, and a support runbook for the internal team.
Questions buyers ask before switching from Mural
What does it cost to move off Mural to self-hosted Excalidraw?
Excalidraw itself is MIT licensed, so the software carries no license fee. The cost sits in the components around it: the servers or cloud accounts that run the collaboration room and storage, the time to set up identity and access, the work to rebuild or archive boards, and ongoing maintenance and support. Mural's cost is recurring and scales with members, so the comparison depends on how many people need edit access and how long you expect to run the platform. Ask any provider for a written quote that separates one-time setup from recurring hosting and support, and ask what changes if your member count grows.
How long does a Mural to Excalidraw migration take?
The timeline depends on the number of boards, how many are live workshop assets versus archive material, how much you rely on Mural templates, and how quickly your identity and hosting environment can be prepared. Boards that are only kept for reference can usually be exported and archived in a single pass, while active facilitation templates need to be rebuilt and tested with the people who run workshops. Ask for a phased plan with a written scope and timeline before work begins, and confirm which steps depend on your own change windows and approvals.
What does our internal team have to provide during the move?
Your team needs to name the business owners of the boards being kept, decide who may create and share boards, and supply the hosting environment and identity connection. Someone also has to own backups, upgrades and access reviews after go-live, because a self-hosted room is only as dependable as the people operating it. Workshop facilitators should review rebuilt templates before they replace Mural in live sessions. Confirm these responsibilities early, since they often matter more to the schedule than the technical installation.
Can our own team migrate from Mural without outside help?
Some teams can, particularly where a small platform group already runs container workloads and can manage a real-time collaboration server. The work that is easiest to underestimate is not the install but the ongoing operation: patching, certificates, backups, access control and monitoring. A fixed-scope engagement with DeployOpen can cover planning, implementation, hardening, backup setup and documentation, and retainers can cover upgrades and support afterward. Decide which of those tasks your team will own before you choose between a self-run and a supported path.
Will our boards stay usable in the open .excalidraw format?
Excalidraw saves drawings as open .excalidraw JSON and exports to PNG and SVG, so the drawing data does not depend on a proprietary file container. That keeps boards readable outside the tool, but it is not the same as keeping Mural's sticky notes, comments, reactions and version history intact. Mural's PDF and PNG exports are static images, and you should confirm what each export keeps before you rely on it for the archive. Test a representative board from each category in the target environment before you decide what to rebuild and what to archive as images.
How do templates and facilitation features get replaced?
Excalidraw supports shape libraries and real-time collaboration, but it does not provide Mural's facilitation layer out of the box, so templates and session tools need to be rebuilt or substituted. Start by inventory: list the templates your workshops use, the facilitation steps such as timers, voting or breakout flows, and the roles that run them. Then decide which can be recreated as Excalidraw scenes or libraries and which need a different tool. Confirm each Mural feature against Excalidraw's current documentation rather than assuming a match, since the supplied facts do not cover facilitation features in detail.
How do we confirm Mural features that Excalidraw may not cover?
Build a feature checklist from your actual workshop use, covering permissions, guest access, templates, comments, voting, presentation mode, integrations and audit logging. For each item, ask the vendor or project maintainers to confirm support in the version you will deploy, and test it in a pilot with real facilitators. Excalidraw+ is a separate hosted product with its own plan terms, so verify its features and certifications directly from its pricing page rather than assuming they apply to a self-hosted deployment. Record each gap and the chosen workaround before scheduling the cutover.
Does self-hosting Excalidraw keep whiteboard data inside our network?
Self-hosting places the collaboration server and any storage on infrastructure you control, which is the main reason many organizations choose it. Excalidraw describes its collaboration as end-to-end encrypted, but you still need to confirm how the room server, reverse proxy, logs and backups handle content in your environment. Check your data classification rules, retention settings and access logging before you move sensitive boards. Your security or compliance team should review the design, since DeployOpen prepares controls and evidence but does not issue audit reports or certifications.
What to confirm with Mural and in your environment
Start by confirming what you are actually paying for today. Check your current Mural tier and whether SSO or SCIM is included in it, because identity integration is the feature most often assumed to be available and then found to sit on a higher plan. Ask Mural for residency commitments in writing, covering where content and backups are stored and whether that applies to comments, exports and support access. A written commitment is what your data protection and sovereignty reviewers will ask for, and a verbal assurance from a sales call will not satisfy them.
Next, inventory the facilitation features your teams use. Mural workshops often depend on templates, voting, timers, private sticky notes and presenter views that Excalidraw does not provide out of the box. List the templates in active use, the workshops that run every month, and the facilitators who rely on specific controls. Decide which of these you will rebuild as Excalidraw library items, which you will drop, and which need a different tool. Treat this list as the scope of the migration, not an afterthought.
Then assess the operating model for excalidraw-room. Confirm who will track its releases, apply updates to the server and the Excalidraw front end, monitor availability, and handle backups of the scenes that live on your own servers. Ask whether your team has the skills to run a real-time WebSocket service and who covers it outside working hours. If that capacity does not exist, decide whether to use Nextcloud Whiteboard, which packages Excalidraw inside Nextcloud, or to buy support for the stack. Put that decision and its owner in writing before cutover.
How DeployOpen helps evaluate, implement or migrate
DeployOpen treats the Mural to Excalidraw decision as a question of who hosts the boards, how people collaborate on them, and what the organization must keep when a subscription ends. We plan and build the self-hosted setup inside your own infrastructure, then document and hand it over so your team can run it.
How we scope
- Inventory which murals, templates and facilitation workflows your teams depend on today
- Confirm whether real-time collaboration needs excalidraw-room hosted on your own servers
- Agree the written scope, deliverables and timeline before any implementation work starts
How we build
- Deploy Excalidraw and excalidraw-room in your cloud account, data center or air-gapped network
- Connect identity and access controls to your existing directory and single sign-on setup
- Build shared shape libraries and reusable templates to replace facilitation features Mural provides
How we hand over
- Test collaboration, export paths and access rules, then document the results for your team
- Provide runbooks covering backups, upgrades and the open .excalidraw file format for archives
- Train administrators and facilitators on running workshops in the new environment
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after handover
- Prepare system documentation and control evidence for your own compliance assessments
- Ask for a written quote based on your scope, since DeployOpen does not publish a price list
