Which open-source CRM for small business fits your team
For a small team of a few to a few dozen sellers with a limited IT budget, the right open-source CRM depends less on features than on two things you already have: a hosting skill set and an identity provider. If your team runs PHP on MySQL or MariaDB, EspoCRM and Krayin are the lighter fits. If your team is comfortable with TypeScript, PostgreSQL and Redis, Twenty is the modern option. Start by writing down which stack your admins can patch at 2 a.m., then check which sign-in method your staff already use. EspoCRM suits a team that wants a lighter PHP stack and is willing to pay for add-ons. The core is AGPL-3.0 and free to self-host, and the install script in the EspoCRM docs deploys a Docker stack with Nginx and MariaDB on Ubuntu, Debian or Linux Mint. Reports and workflows come from the paid Advanced Pack, so budget for it if you need them. Krayin suits a team that values MIT-licensed simplicity. It runs on Laravel and needs at least 3 GB of RAM, but its README does not document SAML, OpenID Connect or LDAP for the core, so single sign-on means custom development or an extension. Twenty suits a team on PostgreSQL and Redis. The core is free to self-host, but SSO, row-level permissions and audit logs sit on paid plans, so confirm whether that tier fits your identity budget. Before you shortlist, check your identity provider against each option's sign-in support, and ask a partner or vendor to confirm exactly which methods the version you plan to run supports. Also ask who will patch the server, back up the database and apply upgrades after go-live, since that recurring work is usually the largest cost of a self-hosted CRM. A team with no PHP or PostgreSQL experience may find the stack choice matters more than the feature list.
Which small team fits which open-source CRM
This table matches common small team situations to the CRM that fits best, the reason, and the condition under which that choice stops making sense. Read each row against your own hosting skills, identity requirements and budget for paid tiers, then confirm the open items with the vendor before you commit.
| Team situation | Best fit and reason | When the choice stops making sense |
|---|---|---|
| Existing PHP and MySQL or MariaDB hosting | EspoCRM. Its server requirements are PHP 8.3 to 8.5 with MySQL 8.0 or MariaDB 10.6 or later, so existing skills and servers carry over. | When you need paid Sales Pack features like quotes and invoices on a tight budget, or when you need deeper module customization than Espo's entity model offers. |
| Team that wants MIT licensing | Krayin CRM. Its README states the project will always be free under the MIT License. | When you need built-in SSO or a paid extension ecosystem you can rely on, since Krayin does not document SAML, OIDC or LDAP for the core, and you should confirm the roadmap before committing. |
| SSO from day one without paying for a tier | EspoCRM. It supports OpenID Connect and LDAP, including Active Directory, in the open-source edition. | When your identity provider cannot offer OIDC or LDAP, or when you need SCIM provisioning, which Twenty lists only on its Enterprise plan. |
| Team with TypeScript and PostgreSQL background | Twenty. It runs on PostgreSQL and Redis with a NestJS backend and React frontend, and offers REST and GraphQL APIs. | When you lack Redis operations skills, or when you need row-level permissions and audit logs, which Twenty lists on its Organization and Enterprise plans rather than the free core. |
| Team that wants a managed cloud option | EspoCRM Cloud or Krayin cloud hosting, to be compared on price and data location. EspoCRM Cloud lists per-user plans with the Advanced Pack included. | When per-user pricing grows faster than your headcount, or when your data residency rules require hosting you control. Confirm current plans and regions on each vendor's pricing page. |
| Team with a small server and limited memory | EspoCRM, which runs on a standard LAMP or LEMP style stack with cron for background jobs. | When you can allocate memory generously, since Twenty asks for at least 2 GB of RAM and Krayin lists at least 3 GB, so both may suit a larger host better. |
| Frappe CRM or Vtiger as an option to confirm | Worth evaluating if your team already runs the Frappe Framework or Vtiger. Confirm licensing, edition limits and hosting fit with each vendor before shortlisting. | Treat as unverified for this page until you confirm license terms, edition features and support options directly with the vendor. |
What EspoCRM, Krayin and Twenty are built on and licensed under
Three lighter self-hosted CRMs share a small-team pitch but differ in license, runtime and what sits behind the paid line. Read each license against your open-source policy before you compare features, because the paid add-ons and enterprise files change what you actually run.
EspoCRM under AGPL-3.0
EspoCRM is a PHP application on MySQL, MariaDB or PostgreSQL, served by Apache, Nginx or IIS, with cron needed for background jobs. The core is AGPL-3.0 and free to self-host. The Advanced Pack (reports, BPM and workflows) and the Sales Pack (products, quotes, invoices and subscriptions) are paid add-ons, so confirm which of them your process needs before you budget. The current line is 10.0, with 10.0.10 released on October 14, 2026.
Krayin under MIT
Krayin is a Laravel and Vue.js CRM under the MIT License, which the project states will always be free. It runs on PHP 8.3 or higher with MySQL 8.0.32 or higher or MariaDB 11.4 LTS or higher, and the README asks for at least 3 GB of RAM. The paid extensions, including a Multi Tenant SaaS extension, a WhatsApp lead extension and a VoIP extension, are separate products. Its docs do not describe SAML, OpenID Connect or LDAP sign-in for the core, so plan for custom work or an extension if you need single sign-on.
Twenty under mixed licensing
Twenty is a NestJS and React application on PostgreSQL and Redis. Its core is mostly AGPL-3.0 with an additional application exception, and files marked with an Enterprise license header are under a commercial license. SDK and UI packages are MIT. Have your legal or open-source review team read the LICENSE file and confirm that the exception and the Enterprise-marked files fit your policy. Its Docker Compose guide runs a server, a worker, PostgreSQL and Redis, and asks for at least 2 GB of RAM. The latest release is v2.48.0, released on October 16, 2026.
Frappe CRM and Vtiger
Frappe CRM and Vtiger are also on many small-business shortlists, but this page does not verify their license terms, editions or system requirements. Before you compare them with the three options above, confirm the license, which features sit in the open-source edition and which sit in commercial editions, and the stack and hosting requirements, directly with each project and its documentation.
How EspoCRM, Krayin and Twenty compare on features, identity and requirements
This table sets EspoCRM, Krayin and Twenty side by side on license, stack, server requirements, identity options, extensibility and paid gating. Read each row against your own hosting skills and identity provider, and confirm any cell marked for vendor review before you commit, since current status can change between releases.
| Capability | EspoCRM | Krayin | Twenty |
|---|---|---|---|
| License | AGPL-3.0 core, free to download and self-host | MIT License, stated as always free in the README | Mostly AGPL-3.0 with an application exception; Enterprise-headed files are commercial |
| Core stack and database | PHP application on MySQL, MariaDB or PostgreSQL 15 | Laravel PHP with Vue.js front end on MySQL or MariaDB | TypeScript with NestJS, React, PostgreSQL and Redis |
| Minimum server requirements | PHP 8.3 to 8.5 on Apache, Nginx or IIS; confirm RAM with vendor | PHP 8.3 or higher, Composer 2.5 or higher, at least 3 GB RAM | Docker Compose guide asks for at least 2 GB RAM |
| Background jobs | Cron or scheduled task required | Confirm the scheduler and queue setup with vendor docs | Dedicated worker process plus Redis queues |
| Built-in workflows and reports | Reports, workflows and BPM need the paid Advanced Pack | Confirm workflow and reporting depth with vendor | Workflow automation included; confirm report features per plan |
| OIDC sign-in | Supported since version 7.3, with optional first-login user creation | Not documented in core; needs custom work or an extension | Included on Organization and Enterprise plans only |
| SAML sign-in | Not listed in the supplied EspoCRM documentation; confirm with vendor | Not documented in core; needs custom work or an extension | Included on Organization and Enterprise plans only |
| LDAP sign-in | Documented, including Active Directory and OpenLDAP | Not documented in core; needs custom work or an extension | Not listed in supplied plan details; confirm with vendor |
| API authentication | API key, HMAC (most secure) and basic authentication via API users | Confirm API authentication model with vendor | REST and GraphQL APIs with webhooks on all plans |
| Custom fields | Entity Manager configuration with Formula Script for logic | Unlimited custom fields listed on the website | Unlimited custom objects and fields, defined as code |
| Paid extension gating | Advanced Pack and Sales Pack are paid add-ons; included in all Cloud plans | Multi-tenant, WhatsApp and VoIP extensions are paid | SSO, row-level permissions and audit logs sit on paid plans |
Single sign-on and paid tiers that small teams hit first
The first trap is identity integration that sits behind a paid plan. Twenty's open-source core can be self-hosted for free, but its pricing page places SSO, row-level permissions and audit logs on the Organization and Enterprise plans, with SCIM provisioning and IP allow-listing reserved for Enterprise. Organization is listed at 19 US dollars per user per month. In an illustrative ten-seat team that needs SSO and audit trails from the first login, the paid tier applies from day one, not later. Before you choose the core, list the sign-in method, permission model and log retention you need immediately, then price those features against the seat count you expect within the next year. Current tier details are on Twenty pricing.
EspoCRM keeps identity in the core. OpenID Connect sign-in has been supported since version 7.3, and the settings can create users on first login, map identity provider groups to EspoCRM teams, support backchannel logout and keep a fallback login method so administrators are not locked out. LDAP, including Active Directory and OpenLDAP, is also documented. The catch is two-factor authentication: EspoCRM's own 2FA is not compatible with OIDC, so MFA has to be enforced by your identity provider. Test that enforcement end to end before you disable local passwords, confirm who holds the fallback login, and check that your group claims map cleanly to the team structure you plan to use. Feature add-ons are a separate cost. The Advanced Pack adds reports, business process management and workflows, and the Sales Pack adds products, quotes and invoices, so budget for them if your sales process depends on them. The OIDC setup steps are in the EspoCRM OIDC docs.
Krayin is the third case. Its README and website do not document SAML, OpenID Connect or LDAP sign-in for the core CRM, so single sign-on would need custom development or an extension, and neither path has a published price in the sources. Treat SSO as an open scope item until a vendor or implementer confirms it in writing. Before signing with any of these vendors, ask which sign-in protocols are included in the edition you will run, which features are paid add-ons, whether MFA is enforced by the identity provider or the application, who maintains any connector after upgrades, and how a version upgrade affects SSO and group mappings. Ask for the answers in the written scope, along with a test plan that covers a disabled account, a changed group membership and a failed identity provider login.
What each option costs to run, split by hosting model
EspoCRM, Krayin and Twenty all offer a free, self-hostable core. EspoCRM is AGPL-3.0, Krayin is MIT and Twenty's core is mostly AGPL-3.0. The EspoCRM pricing page confirms the open-source edition can be downloaded and self-hosted for free, and Twenty's pricing page says the same for its open source core. The license fee is zero, so the recurring cost is the infrastructure and staff time needed to keep the system running.
- Servers and storage: Recurring charges from your cloud account or data center. Twenty's Docker Compose guide asks for at least 2 GB of RAM, and the Krayin README lists at least 3 GB.
- Database and cache administration: Twenty needs PostgreSQL and Redis, Krayin needs MySQL 8.0.32 or higher or MariaDB 11.4 LTS or higher, and EspoCRM accepts MySQL, MariaDB or PostgreSQL 15.
- Backups, restores and upgrades: Ongoing staff time. EspoCRM's installation script includes a command.sh utility for these tasks, but someone must run and test them on a schedule.
- Initial setup: A one-time effort for installation, mail, scheduled jobs and access control. EspoCRM needs cron or a scheduled task for background jobs.
- Single sign-on: Often a one-time build. Krayin's README and website do not document SAML, OIDC or LDAP for the core CRM, so confirm before assuming SSO is available.
Before comparing these numbers with cloud prices, ask your internal team or implementation partner to write down the hosting bill, monthly administration hours and the backup and upgrade schedule.
Vendor-hosted plans move hosting and much of the patching to the vendor, and the price usually scales with users or a flat fee. The published figures are EspoCRM Cloud at 15, 25 and 69 US dollars per user per month on its Basic, Enterprise and Ultimate plans, with minimums of 3, 5 and 10 users, according to the EspoCRM pricing page. Krayin advertises cloud hosting at 20 US dollars a month with unlimited users, per the Krayin website. Twenty lists Pro at 9 US dollars and Organization at 19 US dollars per user per month, and Enterprise from 50,000 US dollars a year, per Twenty's pricing page.
- EspoCRM minimums: At the stated minimums, the monthly floor is 45, 125 and 690 US dollars respectively (arithmetic from the published rates). The Advanced Pack is included in all EspoCRM Cloud plans.
- Krayin flat fee: The 20 US dollar monthly figure is listed with unlimited users, but the website prices paid support, custom development, migration and integrations separately, with no published amounts.
- Twenty tiers: Pro and Organization are priced per user. Organization includes row-level permissions, SAML or OIDC SSO and audit logs. Enterprise adds single-tenant isolation, SCIM provisioning and an SLA.
- One-time and recurring costs: Subscriptions recur monthly or annually. Migration, onboarding and custom work are usually one-time, and their prices must come from a written quote.
- Questions for the quote: Ask what the subscription includes, how data is exported at exit, how extra users are billed and whether each plan is vendor-hosted or can run on your own infrastructure.
Compare the per-user floor with your actual headcount, because the per-user model costs more as the team grows while a flat fee does not.
Extensions add capability to a free core, and they are billed separately from hosting. EspoCRM's paid add-ons are the Advanced Pack, which adds reports, business process management and workflows, and the Sales Pack, which adds products, quotes, invoices, purchases, subscriptions, inventory and payments, per EspoCRM's features page. Krayin's README lists its own paid extensions, and Twenty gates some identity and security features behind its plans. Prices for the add-ons are not in the supplied sources, so confirm them with each vendor.
- EspoCRM Advanced Pack: Needed for reports and workflows on a self-hosted install, since the feature is bundled only in EspoCRM Cloud. Confirm whether the license is perpetual or a subscription.
- EspoCRM Sales Pack: Relevant if your team issues quotes or invoices from the CRM. Without it, quoting and billing must live in another system, which carries its own integration cost.
- Krayin extensions: The README lists a Multi Tenant SaaS extension, a WhatsApp lead extension and a VoIP extension. Check their license terms, whether they recur and whether they are supported on your Krayin version.
- Twenty plan upgrades: SSO, row-level permissions and audit logs sit in the Organization and Enterprise plans. For these features, the cost is a plan change rather than an add-on purchase.
- Integration and custom work: Connecting an identity provider or building a feature Krayin does not provide is a one-time project. DeployOpen scopes this kind of work in writing before it starts and quotes it from that scope.
Before you commit, list every feature your sales process needs and map each one to a core feature, an extension or a plan tier.
How to pilot a small business CRM before you commit
This sequence turns a shortlist of lightweight self-hosted CRMs into evidence the team can act on. Each step produces a written check on licensing, runtime requirements, identity, data movement, recovery and upgrades, so the final choice rests on tests in your own environment rather than on feature lists.
Confirm license and editions against the written requirement
The project owner and the compliance lead compare the written requirement list against each candidate's license and edition terms before any server is built. For EspoCRM, confirm that the AGPL-3.0 open-source edition covers the features you need, or whether reports, workflows, or sales modules sit in the paid Advanced Pack or Sales Pack. For Krayin, confirm the MIT license covers your use and that single sign-on, which its README does not document for the core CRM, will need custom work or an extension. For Twenty, confirm which SSO, row-level permission and audit log features sit only on paid plans. For Frappe CRM and Vtiger, record the same license and edition questions. The step is done when each gap is written down with a named source and an owner signs it off.
Build a test instance on your hosting platform
The infrastructure or platform engineer deploys each shortlisted CRM on the same cloud account, data center or virtual machine standard your team would use in production. Use the vendor's supported install path: the EspoCRM installation script for Ubuntu, Debian or Linux Mint, the Krayin Composer install with the krayin-crm:install command, or the Twenty Docker Compose stack. Record the exact commands, versions, and any manual changes, because these become your rebuild runbook. The step is complete when each instance loads a login page over HTTPS and the team can reproduce the build from its notes without help from the original installer.
Check RAM and database versions against the matrix
The platform engineer compares the running environment with each vendor's published requirements. EspoCRM's server configuration lists PHP 8.3 to 8.5, MySQL 8.0 or newer, MariaDB 10.6 or newer or PostgreSQL 15, plus cron or a scheduled task for background jobs. Krayin's README lists PHP 8.3 or higher, Composer 2.5 or higher, MySQL 8.0.32 or higher or MariaDB 11.4 LTS or higher, and at least 3 GB of RAM. Twenty's Docker Compose guide asks for at least 2 GB of RAM and runs a server, a worker, PostgreSQL and Redis. Confirm that cron jobs, the worker and the queue run after a reboot. The step is done when a memory and CPU baseline is recorded under normal test load, with the database version confirmed from the running server, not the installer.
Test identity integration with a test identity provider
The identity or security engineer connects each candidate to a test identity provider that matches your production setup. EspoCRM supports OpenID Connect sign-in with optional user creation on first login, group-to-team mapping and a fallback login method, and its docs also describe LDAP, including Active Directory and OpenLDAP. Note that EspoCRM's own two-factor authentication is not compatible with OIDC, so decide how the identity provider will handle MFA. For Twenty, test SSO only on the plan that includes it, and for Krayin, confirm whether the chosen approach is custom development or an extension. Test sign-in, first-login provisioning, group mapping and offboarding, where a disabled account must lose access. The step is complete when the security lead signs off on the results, including what does not work.
Load a sample of contacts and deals with the importer
The sales operations lead prepares a sample file of contacts, accounts and open deals, using anonymized or synthetic records if production data cannot leave the environment. Import it through each CRM's native importer, EspoCRM's import documentation being the starting point for that CRM, and check field mapping, duplicates, date formats, owners and character encoding. Measure how long the import takes and how many rows fail. Then repeat with a small set of custom fields and a relationship between contacts and deals, because this tests the data model you will rely on later. The step is done when a sales lead can find, edit and report on the imported records and the failure list is closed or accepted.
Run one backup and restore
The platform engineer performs a full backup of the database and the application files, then restores the backup to a separate host. For EspoCRM's installer-based stack, check whether the command.sh utility covers backups and restores, and record its exact options. For Krayin and Twenty, document the database dump, file storage and Redis or queue handling that your own runbook must cover. Log in to the restored instance, compare record counts and attachments with the source, and confirm that scheduled jobs resume. Time the restore and record the steps. The step is complete when the restored copy matches the source and the runbook has been used by someone other than its author.
Document the upgrade path
The platform owner reviews each vendor's release history and the upgrade route from the pilot version to the next release. For EspoCRM, the current line is 10.0, with 10.0.10 released on October 14, 2026, and the previous major version 9.0.0 was released on January 20, 2025. For Twenty, releases are frequent, with v2.48.0 released on October 16, 2026, so ask how breaking changes are announced. For Krayin, v2.2.7 was released on October 16, 2026, after v2.2.6 on September 10, 2026. Test one upgrade on the pilot instance, using a snapshot taken beforehand, and record any custom code or extensions that need rework. The step is done when the owner has a written upgrade procedure, a rollback plan and a decision on how often to patch.
Frappe CRM and Vtiger: what to confirm before they join the shortlist
Frappe CRM and Vtiger may belong on a small team's shortlist, but this page does not cover them in the same depth as EspoCRM, Krayin and Twenty. We have not verified their installation steps, edition boundaries, hosting terms or support tiers here, so this section sets out what to confirm before either product earns a place beside the others. Frappe CRM is an AGPL-3.0 sales CRM built on the Frappe Framework, and Vtiger's open source edition is licensed under the Vtiger Public License alongside its commercial cloud editions. Treat both descriptions as starting points for your own checks, not as settled facts.
Start with the license and the edition question. Ask each vendor which build is open source, whether the self-hosted version carries every feature the team needs, and whether the license on the current release matches the license in the repository you would download. Then ask for the server and database requirements in writing: the supported runtime versions, the supported database engines and versions, the memory and disk needed for your expected user count, and whether background jobs or scheduled tasks need their own process. Ask for a sample install on a machine sized like your production host, and record the exact versions the vendor tested.
Next, check single sign-on, hosting and support, and do not assume any answer from the other options on this page. Ask whether SAML, OpenID Connect or LDAP sign-in is in the free tier or only in a paid edition, and whether user provisioning is included. For hosting offers, ask for the recurring fee, the per-user basis, the minimum seats and what is excluded. Ask what support covers, the response windows, and who provides it. Get each answer in writing before the trial, and if a vendor cannot answer, remove that product from the shortlist.
What do small teams ask before they hire outside help with an open-source CRM?
How much more effort is self-hosting a CRM than using a vendor cloud?
Self-hosting moves hosting, patching, backups and upgrades onto your team or the partner you hire, while a vendor cloud carries those tasks in its subscription. The gap depends on the platform. EspoCRM's installation docs describe a script for Ubuntu, Debian and Linux Mint that deploys a Docker-based stack with Nginx and MariaDB, plus a command.sh utility for backups, restores and upgrades. Krayin's README lists at least 3 GB of RAM, and Twenty's Docker Compose guide asks for at least 2 GB. Ask the vendor cloud price for the same user count, then compare it with your hosting, staff time and outside support over the same period.
What drives the cost of setting up a self-hosted CRM?
Setup cost comes from five areas: hosting, database, identity integration, data import and customization. Hosting depends on the RAM and servers the platform needs. The database depends on your current stack, since SuiteCRM and EspoCRM run on MySQL or MariaDB, while Twenty runs on PostgreSQL and Redis. Identity integration varies widely, because EspoCRM supports OpenID Connect and LDAP, Twenty puts SSO on its Organization and Enterprise plans, and Krayin's README and website do not document SAML, OpenID Connect or LDAP for the core. Data import and custom fields add work in proportion to the records and rules you carry over. Ask for each area as a separate line item in the written quote.
How long does a CRM pilot usually take, and what sets its length?
No supplied figure gives a typical pilot duration, so ask the provider for a timeline in the written scope rather than relying on a general estimate. The length is set by the number of integrations, the volume of data to migrate, how many roles and permission rules you need, whether SSO must work before go-live, and how quickly your staff can review and sign off each stage. A pilot with one team and a clean data set is shorter than one that connects email, telephone and a directory. Agree on acceptance criteria before work starts, so the pilot ends with a decision.
What does a self-hosted CRM need from our IT staff?
Your IT staff will usually own the server or cloud account, DNS and certificates, network rules, backups, identity provider configuration and the on-call path for outages. For EspoCRM, the server configuration docs require a web server (Apache, Nginx or IIS), PHP 8.3 to 8.5, a supported database and cron or a scheduled task for background jobs. Check these against your change process and patch windows. Ask the provider which of these tasks it will perform, which your staff will perform, and who approves production changes.
Can a team with little technical staff run a self-hosted CRM alone?
A team with one part-time technical person can run a small CRM only if that person can handle backups, upgrades and restores on a fixed schedule, and only if the platform's install path matches your skills. EspoCRM's script and command.sh tooling lower the routine work on Debian-family systems, but it still needs a server owner. Plan for a named owner, a tested restore and a written upgrade routine before go-live. Many small teams split the work: an outside partner sets up and documents the system, and internal staff handle daily administration under a retainer.
What should a written scope from a CRM provider include?
A written scope should name the platform and version, the hosting environment, the database and identity provider, the data to import with record counts you have confirmed, each integration, the customization list, the testing you expect, documentation and training, backup and restore tests, and the support period after go-live. DeployOpen's engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support, upgrades and testing are available as retainers. Ask what is excluded, who signs off each deliverable, and how changes after sign-off are priced. DeployOpen does not publish a price list, so a quote follows from the written scope.
How DeployOpen scopes and supports a small business CRM rollout
DeployOpen plans, implements, customizes, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own cloud account, data center or air-gapped network. For a small business CRM, that means the team agrees on the platform, data and integrations in writing before any installation begins, so the choice between EspoCRM, Krayin, Twenty, Frappe CRM or Vtiger rests on your requirements and not on the installer.
How we scope
- Written scope listing the CRM edition, users, modules and data sources to be migrated or connected.
- Confirmation of your hosting target, including whether the stack is PHP with MariaDB or TypeScript with PostgreSQL and Redis.
- Named decisions on single sign-on, paid extensions and backups, with the open items each one leaves for your quote.
How we build
- Installation and configuration in your environment, following the vendor's documented requirements for the chosen release.
- Setup of roles, permissions, custom fields, pipelines and any agreed integrations with email, calendar or telephony tools.
- Security hardening, backup and restore checks, and testing of the workflows your sales team will use each day.
How we hand over
- Documentation of the configuration, admin procedures, backup routine and upgrade steps for your own staff.
- Walkthrough sessions with the administrators and sales leads who will run the CRM after handover.
- A clear list of what remains open, such as data cleanup, user training or extensions you chose to add later.
How we support
- Engagements are fixed-scope, so scope, deliverables and timelines are agreed in writing before work starts.
- Ongoing support, upgrades and continuous testing are available as a retainer if your team wants them after go-live.
- Ask for a written quote tied to the scope, and confirm how upgrades to the vendor's next release will be handled.
