When openDesk Community Edition is enough and when Enterprise Edition is needed
Choose openDesk Community Edition for evaluation, internal labs and teams that can carry their own second and third level support through openCode, with no SLA attached. ZenDiS's own position is that CE has no SLA and that Enterprise Edition is the recommended choice for production, because it includes SLA-backed 2nd and 3rd level support and patches from ZenDiS and the component suppliers. The CE build is a reasonable base for a proof of concept, a cyber range or a team that wants to learn the Helmfile and Helm deployment before committing budget. The same open-source core licenses apply in both editions, and Cryptpad, Jitsi, Notes, Nubus, OpenProject and XWiki run the same codebase and artifacts in each.
Treat CE as production-capable only if your organization can accept four conditions in writing: no contractual response commitment, patches that reach you when your own team applies them, no Enterprise-only modules, and an operations team that can absorb a Nextcloud security issue without a vendor patch. The Enterprise-only list matters most for public bodies. It includes Nextcloud Enterprise security patches and the Guard app, Element AdminBot, GroupSync and Admin Console, OX S3 storage, Collabora branding and automatic load scaling, and XWiki Pro apps. ZenDiS states that when patches ship only for Nextcloud Enterprise, openDesk delivers them only in EE. Confirm with ZenDiS which of these your identity, file and mail requirements depend on before you sign off on CE.
Because upgrading from CE to EE is currently not supported, the edition decision is effectively one-way for an existing deployment. The openDesk Enterprise Edition README names the main blocker as the move from Dovecot 2.x standard storage to Dovecot Pro 3.x on S3. Ask ZenDiS for the current migration position in writing, and plan the CE-to-EE path as a rebuild with a data migration unless that answer changes. Ask for the EE subscription scope, the included support tiers, the EE registry access and license file process, and whether SaaS or on-premises delivery fits your hosting model. Budget the subscription and the platform team's time together, because the subscription does not remove the need to run Kubernetes, PostgreSQL, Redis, object storage and the other external services openDesk expects in production.
Which openDesk features are Enterprise-only, component by component
This table lists the openDesk components where the documented split between Community Edition and Enterprise Edition differs, and notes the components that run identical code in both. Read each row as the documented split only, then confirm the exact contents of your edition with ZenDiS or your provider before you size a production deployment.
| Component | Community Edition | Enterprise Edition |
|---|---|---|
| Collabora | Web office without ZenDiS branding or automatic load scaling | Adds Collabora branding and automatic load scaling, using closed-source modules |
| Element | Chat without the AdminBot, GroupSync or Admin Console tooling | Adds Element AdminBot, GroupSync and Admin Console |
| Nextcloud | Open-source Nextcloud core under AGPL-3.0, patched through the community path | Adds Nextcloud Enterprise security patches and the closed-source Guard app |
| OX App Suite | Groupware with standard Dovecot 2.x storage and standard mailbox search | Adds OX S3 storage, advanced mailbox full-text search and Dovecot Pro, delivered from an EE-only registry |
| Cluster orchestration | Deployed without the EE cluster orchestration features | Adds cluster orchestration features; confirm which ones with ZenDiS before sizing |
| OpenProject | Community plan features under GPL-3.0 | Adds Corporate plan add-ons from the EE release |
| XWiki | Core XWiki under its open-source license | Adds XWiki Pro apps as Enterprise-only extensions |
| Cryptpad, Jitsi, Notes, Nubus, OpenProject, XWiki | Same codebase and artifacts as EE for the listed components | Same codebase and artifacts as CE for the listed components, so the split does not change these components' code |
How licensing, support and patches differ between the editions
Community Edition and Enterprise Edition share the same open-source core components, so the difference is less about the code and more about what you can patch, who supports you, and which modules you can run. Each card below covers one of the decisions that follows from that split.
Shared open-source core licenses
Most bundled components ship under the same licenses in both editions. Nextcloud and Nubus are AGPL-3.0, OpenProject is GPL-3.0 and Collabora is MPL-2.0, while the Helmfile and Helm deployment automation is Apache-2.0. Each component keeps its own license, so your legal review covers every bundled project, not only the suite as a whole. Confirm the license file for each component version you deploy.
Enterprise-only closed-source modules
EE adds closed-source modules for Collabora branding, Element admin tools, the Nextcloud Guard app, OX App Suite Pro and Dovecot Pro. These arrive from an EE-only registry and need a license file to pull. Treat them as a separate license obligation: ask ZenDiS which terms apply to each module and whether your audit or exit plan can work without them.
Community support with no SLA
Community Edition is supported by the community through openCode and carries no service level agreement. Fixes arrive when maintainers prioritize them. That can be acceptable for an evaluation or a non-critical pilot. For a production service with a defined availability target, confirm in writing who answers a critical incident and how quickly, because the community channel does not commit to either.
SLA-backed 2nd and 3rd level support
Enterprise Edition includes SLA-backed 2nd and 3rd level support from ZenDiS and the component suppliers, covered by included product subscriptions. It is sold as SaaS or for on-premises installation. Ask for the written SLA, the severity definitions, the response targets per severity and which components the subscription covers, since support scope can differ from the bundled list.
Nextcloud Enterprise patches reach EE first
When a patch is released only for Nextcloud Enterprise, openDesk ships it only in Enterprise Edition. Community Edition does not receive it through the standard path. openDesk also does not move to a new Nextcloud major release until the matching Nextcloud Enterprise release is available. For files, a security gap can therefore stay open longer on CE, so plan a risk acceptance or compensating control if you choose CE.
Patch cadence and supported lines
ZenDiS plans major releases annually in Q3, minor releases monthly and patch releases on demand, and supports only the latest minor version. Both editions follow this release process, but EE customers receive the patches that depend on Nextcloud Enterprise. Ask for the patch timeline for each edition, and confirm how far behind the latest minor release your environment may run before an upgrade is required.
What the free edition is missing for typical enterprise needs
The gap between openDesk Community Edition and Enterprise Edition is mostly operational. CE has no SLA-backed escalation path. Its support comes from the community through openCode with no SLA, while EE includes SLA-backed 2nd and 3rd level support. For a public body or a regulated operator, the question is not whether a fix exists but who is accountable for getting it to production within a time your change board can accept. If your continuity plan assumes a named escalation contact, CE does not provide one by default, and you should confirm with ZenDiS what, if anything, is available outside EE. Patch timing is the second gap, and it is the one most likely to surprise an operator. ZenDiS states that when patches are released only for Nextcloud Enterprise, openDesk ships them only in EE. It also states that openDesk does not move to a new Nextcloud major release until the matching Nextcloud Enterprise release is available. In practice, a CE deployment may receive a security fix later than an EE deployment, or not at all for that component. Ask ZenDiS in writing which Nextcloud security fixes reach CE, how long after the Nextcloud Enterprise release they arrive, and how the openDesk release cadence described in the openDesk release management docs applies to out-of-band patches. Finally, several administrative and access tools exist only in EE. The Enterprise-only list includes Element AdminBot, GroupSync and Admin Console, plus the Nextcloud Guard app. If your operations model relies on automated group synchronization from the directory, centralized Element administration or Guard-based controls on Nextcloud, CE leaves you to build or maintain those functions yourself. Map each of these to a named owner in your runbook, and confirm with ZenDiS which equivalent controls, if any, your CE version provides before you commit to the free edition for production.
Which edition fits each team situation
The vendor's documented position is that production deployments should run Enterprise Edition. ZenDiS recommends EE for production because support and patches come from ZenDiS and the component suppliers through included product subscriptions. Community Edition is supported by the community through openCode with no SLA, so a public body that answers to service levels has to weigh that gap before go-live. Read the openDesk Enterprise Edition README for the full list of EE-only components.
- Support model: EE includes SLA-backed 2nd and 3rd level support, while CE relies on community support with no SLA.
- Patch timing: When a patch is released only for Nextcloud Enterprise, openDesk ships it only in EE.
- Major upgrades: openDesk does not adopt a new Nextcloud major release before the matching Nextcloud Enterprise release is available, so the EE track sets the pace for that component.
- Commercial form: ZenDiS sells EE as SaaS or for on-premises installation, so the hosting model and the support contract are linked.
Before the procurement decision, get the written SLA terms, response levels and patch windows from ZenDiS, because the README does not state them.
Community Edition is the natural starting point for an evaluation because the core open-source components use the same licenses in CE and EE, and several components use the same codebase and artifacts in both editions. The documented evaluation floor is modest compared with production, but it still needs capable hardware and cannot run on ARM yet. The main decision is whether the proof of concept must exercise features that exist only in EE, since those features will not appear in a CE test.
- Hardware floor: The documented minimum for an evaluation deployment is 12 x64 CPU cores, 32 GB of RAM and more than 10 GB of disk, and ARM is not supported yet.
- Shared components: Cryptpad, Jitsi, Notes, Nubus, OpenProject and XWiki use the same codebase and artifacts in CE and EE, so tests of those components carry over.
- Edition-only gaps: Collabora branding, Element AdminBot, the Nextcloud Guard app, OX S3 storage and cluster orchestration are not part of CE, so a CE proof of concept will not test them.
- No upgrade path: Upgrading from CE to EE is currently not supported, so a CE evaluation is not a stepping stone to a production EE system.
If the pilot may become production, agree on the edition before the first deployment and plan the pilot as a rehearsal of the production design rather than a throwaway install.
A platform team that already runs Kubernetes can operate CE with its own support process, but the openDesk requirements reach well beyond the application itself. The deployment is Helmfile and Helm based, needs a CNCF-certified cluster and expects several production-grade external services. The documentation names kubespray as the tested cluster platform and does not list OpenShift as tested, which matters for any team already standardized on that distribution.
- Cluster baseline: A CNCF-certified Kubernetes cluster at v1.33 or later, with an ingress controller, cert-manager and an RWO volume provisioner.
- Tooling: Helm 3.17.3 or later below v4, Helmfile 1.0.0 or later, and deployment automation licensed under Apache-2.0.
- External services: Production expects PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server, which your team must provide and operate.
- EE-only orchestration: Cluster orchestration and automatic load scaling are Enterprise features, so a CE platform team owns that scaling work itself.
- Release cadence: Major releases are planned annually in Q3, minor releases monthly, and only the latest minor version is supported, so skipped minors may need intermediate steps.
Count how many of these services your organization already operates and supports, because that number determines how much of the operating load a CE platform team would absorb.
Audit evidence depends on what the assessor asks for, and the edition choice affects which records you can point to. DeployOpen prepares systems, controls and evidence for assessments, but independent auditors issue the reports. The vendor documents SLA-backed support and patches for EE and only community support with no SLA for CE, so the support path is itself part of the evidence package. The vendor documentation does not say which artifacts each edition produces for an assessment, so confirm that before you commit.
- Support records: EE provides SLA-backed 2nd and 3rd level support, which gives you a contractual support path to document, while CE has no documented SLA.
- Patch provenance: Ask ZenDiS how EE patches are delivered and dated, since patches that exist only in EE change the evidence trail for CE users.
- Closed-source review: EE adds closed-source modules for Collabora branding, Element admin tools, the Nextcloud Guard app, OX App Suite Pro and Dovecot Pro, which need license and third-party review in your assessment.
- Identity and admin controls: Element AdminBot, GroupSync and Admin Console are EE-only, so the access and identity-sync controls you describe depend on the edition you run.
- Fixed edition: CE to EE is not currently supported, so the edition is effectively fixed at design time.
Ask your assessor which control evidence they need, then ask ZenDiS to confirm in writing which artifacts each edition produces.
What drives the cost of CE and EE
This table separates what each edition charges for from the infrastructure and staffing both editions require, so you can see which costs are fixed by the edition and which follow your own footprint. Read the rows for CE and EE first, then the shared rows, which apply whichever edition you run. No DeployOpen or ZenDiS price is published, so EE pricing has to come from a vendor quote.
| Cost component | Community Edition | Enterprise Edition |
|---|---|---|
| Software license | Open-source licenses for the core components, with no subscription fee from ZenDiS for the CE software itself | Same open-source core licenses plus closed-source modules, bought as a subscription or SaaS from ZenDiS; EE pricing must come from the vendor quote |
| Support and patches | Community support through openCode with no SLA | SLA-backed 2nd and 3rd level support and patches from ZenDiS and component suppliers, included in the product subscription |
| Kubernetes cluster | Shared cost: a CNCF-certified cluster at v1.33 or later, sized by your own team or provider, recurring compute and operations | Same shared cost; the cluster is yours to run in either edition |
| Ingress, cert-manager and storage | Shared cost: ingress controller, cert-manager and an RWO volume provisioner, usually maintained by your platform team | Same shared cost; confirm with ZenDiS which versions the EE subscription covers |
| External production services | Shared cost: PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, SMTP relay, ClamAV over ICAP, object storage and a TURN server, each billed or run by you | Same shared cost, plus Enterprise-only S3 storage for OX and Dovecot Pro requirements; confirm the storage design in the quote |
| Staffing and operations | Recurring: platform engineers, security staff and application owners running upgrades, backups and monitoring without vendor SLA backstop | Recurring: same internal roles, with the subscription adding vendor-backed escalation rather than removing the need for in-house operators |
| Upgrades and migration | One-time and recurring: monthly minor releases and annual major releases; CE to EE upgrade is not currently supported, so a move is a rebuild | Recurring: monthly minor upgrades under the subscription; switching editions later is not a simple in-place step |
Why moving an existing CE deployment to EE is not currently supported
This sequence helps a CE team that may need Enterprise features later decide what to build now. It ends with a documented storage design, a written position from ZenDiS and a tested restore, so the decision rests on written facts.
Inventory the current mail storage
The platform or messaging engineer records how mail is stored today. Confirm whether mailboxes sit on Dovecot 2.x standard storage, which Dovecot version runs, where the data lives and where backups go. The output is a short storage inventory that names the Dovecot version, the storage path, the backup target and any custom mail settings. This step is done when another engineer can rebuild the mail layer from that document alone.
Record the documented upgrade blocker
The platform owner records the reason given in the openDesk Enterprise Edition README: moving from CE to EE currently requires migrating from Dovecot 2.x standard storage to Dovecot Pro 3.x on S3. This is a change to the mail storage backend, so it touches stored data as well as configuration. The output is a one-page decision note that cites the README. The step is done when the platform owner signs the note and it is filed with the architecture record.
Ask ZenDiS for a written position
The procurement or platform lead sends ZenDiS a written question. Ask whether a CE to EE upgrade path is planned, what it would require and what it would cost the customer. Also ask which component patches the team would receive under each option, since EE support and patches come through included subscriptions. The output is a dated written reply. The step is done when the reply is filed with the architecture record and states the position in clear terms.
Design mail storage for a possible move
The platform team keeps mail and file data in a form that can be exported and moved later. It also asks ZenDiS and its own operators whether S3-compatible object storage is workable in their environment. The openDesk requirements list object storage among the external services expected for production, so confirm the exact storage backend with ZenDiS before sizing. The output is a storage design with an exportable backup set. The step is done when a restore of that set succeeds on a staging copy.
Check the release and upgrade rules
The platform engineer reads the openDesk release management guidance and records the rules that would govern any future upgrade. Only the latest minor version is supported, in-place upgrades between majors are not guaranteed, and skipping several minor versions may need intermediate steps. Minor releases are planned monthly and patch releases come on demand. The output is a versioning rule in the runbook with a named owner for each constraint.
Decide the edition before go-live
Before the production build, the CISO and platform owner decide whether production runs on Enterprise Edition from the start. ZenDiS recommends EE for production, and EE is sold as SaaS or for on-premises installation, so this choice determines whether a later migration is needed. Record the license file, the EE-only registry access and the support scope in the decision record. The step is done when the signed record names the edition, the support model and the owner of the exit plan.
Test a restore before any change
Before any edition change, the operations team restores the backup set on an isolated copy of the CE deployment. It checks that mailboxes, search and user logins work after the restore, and it records the Dovecot version the restored system runs. The output is a restore report that lists the checks run and any gaps found. The step is done when the report shows a clean restore and every gap has a ticket with an owner.
How release timing affects both editions
Under the documented openDesk release model, both editions follow the same cadence, so the release calendar is a planning input for Community Edition and Enterprise Edition alike. ZenDiS plans major releases annually in Q3, minor releases monthly and patch releases on demand, and only the latest minor version is supported. The latest documented release at research time was v1.19.1, published on 2026-10-06, after v1.19.0 on 2026-10-01. Treat that date as a reference point for when your team last checked the release list, not as a schedule you can rely on. Confirm the current release and its support status on the openDesk releases page before each change window.
Because support covers only the latest minor version, a team that falls behind is running an unsupported stack. That risk applies to CE and EE. The difference is what happens next: CE receives community support through openCode with no SLA, so a team on an older minor has no contractual route to a fix. EE customers should confirm in writing which minor versions ZenDiS and the component suppliers will patch, and how long a version stays in support after its successor ships. Ask for that window in the quote, since it determines how often you must upgrade.
Plan each upgrade as a multi-step project. In-place upgrades between majors are not guaranteed, and skipping several minor versions may require intermediate steps. Build a staging environment that matches production Kubernetes, Helm and Helmfile versions, rehearse the upgrade path from your current minor to the target, and record each intermediate version you need. Schedule the annual major move in Q3 with the same rigor you apply to the first deployment. Whichever edition you run, the people who own the cluster, backups and identity integration need the calendar well before a release lands.
Questions buyers ask about openDesk editions and cost
Is openDesk Community Edition safe to run in production?
ZenDiS recommends openDesk Enterprise Edition for production, so CE is not the vendor's production recommendation. CE uses the same open-source core licenses as EE and is supported by the community through openCode with no SLA. The practical question is whether your organization can accept community-only support, a self-run patch cycle and the operating load of the platform on its own staff. If any of those are unacceptable for your risk profile, confirm the production position in writing with ZenDiS or your DeployOpen scope before you commit.
What does openDesk Enterprise Edition cost, and what drives the price?
DeployOpen does not publish prices, and openDesk EE pricing is not in the supplied facts, so ask ZenDiS for a quote. ZenDiS sells EE either as SaaS or for on-premises installation, and the included product subscriptions cover support and patches from ZenDiS and the component suppliers. The main cost drivers are the delivery model, the number of users and the components in scope, including EE-only modules such as the Nextcloud Guard app and OX S3 storage. Ask for a quote that separates the subscription from the infrastructure you pay for yourself and from any DeployOpen work.
How much effort does the Kubernetes platform need to run openDesk?
The platform needs a CNCF-certified Kubernetes cluster at v1.33 or later, an ingress controller, cert-manager, an RWO volume provisioner, Helm and Helmfile. The openDesk requirements list tested kubespray clusters and do not list OpenShift as tested. For production, openDesk expects external services such as PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. Effort rises with each of these you must build, secure, back up and monitor, so the operating load is the largest part of the ongoing cost.
Can an internal team run openDesk Community Edition without outside help?
A team with strong Kubernetes, Helm and identity skills can deploy CE, but the supplied facts give no effort estimate, so treat this as a skills question. Check whether your staff already run the required cluster version, the external production services and the release cycle. ZenDiS plans annual major releases, monthly minor releases and on-demand patches, and only the latest minor is supported, so someone must apply upgrades on that rhythm. Many buyers combine internal ownership with fixed-scope implementation help, and DeployOpen can plan, implement, harden and document such a deployment within a written scope.
What happens to security patches if we stay on Community Edition?
When patches are released only for Nextcloud Enterprise, openDesk ships them only in EE, so CE users do not receive those patches from openDesk. openDesk also does not move to a new Nextcloud major release until the matching Nextcloud Enterprise release is available. Your CE patch timing therefore depends on the community and on your own process. Ask ZenDiS which Nextcloud security fixes reach CE and how long they take to appear, and build a documented response plan for any gap.
Can we upgrade an existing openDesk CE deployment to Enterprise Edition?
No, upgrading from CE to EE is currently not supported according to the openDesk Enterprise Edition README. The main blocker is the required move from Dovecot 2.x standard storage to Dovecot Pro 3.x on S3. Because the change affects mail storage, plan the decision before go-live: choosing CE now may mean a rebuild or a migration project later. Confirm the current position with ZenDiS before you set a timeline for any future move.
What does DeployOpen need from our team to scope an openDesk engagement?
Engagements are fixed-scope, so the scope, deliverables and timeline are agreed in writing before work starts. To scope it well, give DeployOpen your intended edition, delivery model, user count, target Kubernetes platform, existing identity and mail systems, and which external production services you will provide. Also name your compliance obligations and who will operate the platform after handover. DeployOpen does not issue audit reports or certifications, so any compliance readiness work is prepared for assessment by independent auditors.
How DeployOpen scopes an openDesk deployment on either edition
The edition decision changes the scope of work before any installation starts. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted platforms inside the client's own cloud accounts, data centers or air-gapped networks. For openDesk, that means the written scope has to name the edition, because Community Edition and Enterprise Edition differ in which components are included, which closed-source modules are deployed, and whether an external registry and license file are part of the build. Most engagements are fixed-scope, so deliverables, environments and handover items are agreed in writing before work begins, and an edition change after signature will normally be a change request.
Ask for the scope to list each component with its edition: Nextcloud with or without the Guard app and Enterprise security patches, OX App Suite with or without OX S3 storage, Element with or without AdminBot, GroupSync and Admin Console, and Collabora with or without branding and automatic load scaling. Also record how the environment will receive patches, who holds the registry access, and how backups of the Dovecot storage layer will be handled. Because moving a CE deployment to EE is not currently supported, a CE start is a decision with a recurring cost, not a reversible trial. Illustratively, a team that plans to go to production on EE later should ask whether the first build should already use the EE pipeline.
DeployOpen is not a ZenDiS partner or reseller unless that status is stated in a supplied fact, and this page does not claim it. Confirm EE licensing terms, subscription scope, SaaS versus on-premises options and SLA-backed support levels directly with ZenDiS's openDesk Enterprise Edition README and in writing with the vendor, and ask DeployOpen to reflect those exact terms in the statement of work. Treat any support or patch commitment that is not in that written vendor documentation as unconfirmed until the vendor provides it.
How DeployOpen delivers and supports openDesk
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure. For openDesk, that means agreeing in writing which edition, components and environment are in scope before any work starts, so the Community Edition or Enterprise Edition decision is made on your requirements rather than on assumptions.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- We record which openDesk components are in scope and which edition each one requires, including any Enterprise-only features you need.
- We confirm the target Kubernetes environment, external services and support expectations, then issue a quote based on that written scope.
How we build
- We deploy openDesk into your cloud accounts, data centers or air-gapped networks, using the Helmfile and Helm automation the project provides.
- We integrate identity federation with your existing identity provider and configure the bundled components to your policies.
- We test the deployment, harden it and document the configuration, including any closed-source modules present in an Enterprise deployment.
How we hand over
- We deliver runbooks, configuration records and backup and restore procedures so your team can operate the platform.
- We prepare evidence and documentation for your compliance assessments, while independent auditors remain responsible for any audit outcome.
- We agree the upgrade path with you before handover, including any intermediate steps the release process requires.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the initial engagement.
- Support tiers, response expectations and the upgrade cadence are part of the written agreement, so you know what is covered.
- Before you commit to an edition, ask ZenDiS and us to confirm which support and patch commitments apply to your deployment.

