When EspoCRM Cloud fits and when self-hosting fits
EspoCRM Cloud fits a team that wants a per-user subscription and does not want to run a PHP application, its database and its upgrades. Self-hosting the free AGPL-3.0 edition fits a team that already runs MySQL, MariaDB or PostgreSQL, has someone who will patch and back up the stack, and needs the data to stay inside infrastructure it controls. The pricing page lists Basic at 15 US dollars per user per month with a 3-user minimum, Enterprise at 25 dollars with a 5-user minimum and Ultimate at 69 dollars with a 10-user minimum, so the cloud bill grows with headcount while a self-hosted core carries no per-seat license fee. Team size alone rarely decides it. Hosting skills, the need for EU-hosted data (EspoCRM Cloud offers server locations in the United States and in Germany), and how often the team wants to take upgrades usually do.
Cloud subscriptions include the Advanced Pack, which provides reports, business process management and workflows, and the pricing page says every cloud plan includes the full feature set and all extensions. If you self-host, the core is free but paid extensions are not. Each extension licensed under the EspoCRM Extension License Agreement covers one instance on one server for a licensed period, plus two non-public development or staging instances, and must be renewed when it expires. Before you commit to self-hosting, list every extension your workflows depend on, price each one from the EspoCRM Extensions page, and confirm with EspoCRM how renewals and staging copies are counted in your setup.
Ask the same questions of both models. Who applies security patches and PHP or database upgrades, and on what schedule? Who restores from backup, and have you tested that restore? Does your data residency policy allow a US or German cloud location, or must the instance sit in your own data center? Can your identity provider handle OpenID Connect or LDAP for sign-in, and would you run EspoCRM's own two-factor login alongside it? Cloud plans shift most of the operating work to EspoCRM, while self-hosting keeps every control in your hands and in your budget for staff time. Write down the answers before comparing invoices, because the staff time to patch and restore is the cost most often left out.
How the two models compare on cost, limits and features
This table sets EspoCRM Cloud's published plan limits and inclusions against the free self-hosted AGPL edition and the license terms for paid extensions. Read each row as a question to answer for your own user count, storage needs and data location. The main takeaway is that the cloud price is per user and includes extensions, while a self-hosted deployment pays for the extension licenses separately and carries the operating work.
| Factor | EspoCRM Cloud | Self-hosted EspoCRM |
|---|---|---|
| License | Hosted service under EspoCRM's cloud terms. Core software is AGPL-3.0 per the GitHub repository. | Core is AGPL-3.0 and free to download and run. Paid extensions use the Extension License Agreement. |
| Price basis | Per user per month: 15 USD Basic (3-user minimum), 25 USD Enterprise (5-user minimum), 69 USD Ultimate (10-user minimum), per the EspoCRM pricing page. | No subscription for the core. Infrastructure, administration and any paid extension licenses are your costs. Ask for a quote from your own hosting provider. |
| Storage and records | Basic: 3 GB file storage per user and 100,000 records. Enterprise: 10 GB per user and 10,000,000 records. Ultimate: 400 GB and unlimited records, per the pricing page. | Limited by the disks, database and backups you provision. Size these against your own growth. |
| Included extensions | Advanced Pack included in all cloud plans. Every plan includes the full feature set and all extensions, per the pricing page. | Advanced Pack and Sales Pack are separately licensed. Check the Extensions page for current terms before you plan. |
| Paid extension licensing | Covered by the subscription while the plan is active. | Each paid extension license covers one instance on one server for the licensed period, plus two non-public development or staging instances. It must be renewed when it expires, and upgrades need a valid license. Uninstall is required on expiry. |
| Support | 12x5 support on every plan, per the pricing page. | Community resources, or a support arrangement you contract separately. Confirm what any partner provides in writing. |
| Server location | United States or Germany for EU hosting, per the pricing page. | Any location you control, including your own data center or air-gapped network. |
| Dedicated resources | Ultimate includes a dedicated IP address, private server and own domain name, per the pricing page. | Dedicated by design. Sizing and isolation are your decisions. |
| Trial | 30-day free trial, per the pricing page. | Install and evaluate the free core at no license cost. Paid extension trials depend on the vendor, so confirm before you start. |
What data location and control change for regulated teams
For regulated teams, the choice between EspoCRM Cloud and self-hosting is largely a choice about who controls the server, the data, the backups and the proof. The cards below cover the decisions that follow from that split, and what to confirm before signing anything.
Choosing a server location
EspoCRM Cloud offers server locations in the United States and in Germany for EU hosting. Confirm which location your data residency rules accept, whether the location applies to backups and file storage as well as the primary database, and whether any support access originates from outside that region. A self-hosted instance lets you choose the region, provider and data center directly, including a private network or air-gapped site.
Administrative access to the platform
On EspoCRM Cloud, the vendor operates the servers, so your administrators manage the application layer while someone else holds server-level access. Under self-hosting, your team holds root, database and web server access, which means you also own the access reviews, privileged account logging and offboarding. Ask the vendor who has operator access, how it is granted and whether that access is logged and reviewed.
Where backups and files live
Records, attachments and backups all carry the same regulatory weight. On a cloud plan, ask where backups are stored, how long they are kept, how restores are tested and whether file storage limits in your plan can be exceeded. Self-hosting with the install script includes backup and restore commands through command.sh, but the backup destination, encryption and off-site copy are your decisions and your responsibility.
Compliance evidence in your hands
A regulator or auditor will ask for logs, access records, change history and configuration evidence. Under self-hosting, most of that evidence sits in your own systems, which helps when you need to produce it quickly but means you must collect and retain it yourself. With a cloud plan, request the vendor's compliance documentation and confirm which artifacts it covers. DeployOpen can prepare systems and evidence for an assessment, but does not issue audit reports or certifications; independent auditors do.
Identity and sign-in control
Self-hosted EspoCRM can connect to your identity provider through OpenID Connect or LDAP, including Active Directory and OpenLDAP, so your existing controls on sign-in, group membership and logout apply. Confirm with the cloud vendor whether it supports the same identity integration on your plan, and note that EspoCRM's own 2FA is not compatible with OIDC.
Confirming obligations before choosing
Before choosing either model, map your data residency, administrative access, retention and evidence obligations to the controls each option provides. Ask the vendor for its current compliance documentation and check it against your own obligations rather than relying on a general statement. Treat both models as a design decision for your compliance and legal team, not a shortcut around it.
Which features each model gives you
EspoCRM Cloud is a hosted subscription priced per user. According to the EspoCRM pricing page, every cloud plan includes the full feature set, all extensions, external API access and 12x5 support, with a 30-day free trial. Server locations are in the United States and in Germany for EU hosting. The buyer does not install PHP, a database or a web server, and does not configure background jobs.
- Full feature set and extensions: Every cloud plan includes all extensions, so the Advanced Pack and the Sales Pack are not separate purchases on a cloud subscription.
- External API access: The pricing page lists external API access on all plans. Confirm the exact endpoints and authentication methods offered on the cloud tier with the vendor.
- Support window: Support is listed as 12x5. Ask what response targets, if any, apply to your plan before you rely on it for an incident.
- Hosting location: Choose the US or German location at signup. Confirm with the vendor whether SSO, LDAP or custom identity connectors are available on your plan.
- Trial: The 30-day free trial lets you test workflows with your own data model before committing.
Before you buy, confirm in writing which identity integrations, custom API scopes and data export paths the cloud plan supports.
The self-hosted EspoCRM core is AGPL-3.0 licensed and free to download and run. Your team owns the server, the database, the upgrades and the backups. The core includes Formula Script, which runs in before-save scripts set in the Entity Manager, in API before-save scripts, and in workflows and BPM. Reports, workflows and BPM are part of the paid Advanced Pack rather than the free core, so verify which of these you need before costing the self-hosted route.
- Formula Script: Used in before-save scripts, API before-save scripts, workflows and BPM, which lets you enforce field logic without custom PHP.
- Entity customization: Entity Manager changes are part of the core, so you can shape fields and layouts in-house.
- Runtime requirements: The team must maintain PHP, MySQL, MariaDB or PostgreSQL, a web server and cron for background jobs.
- Upgrades and backups: The installation script includes a
command.shutility for backups, restores and upgrades, but your team still schedules and tests them. - Paid extensions: Each paid extension is licensed per instance and time-limited, so the license renewal sits with you.
Check the extension list against your reporting and quoting requirements before assuming the free core covers them.
Sign-in is where self-hosting moves the most work onto your team. EspoCRM supports OpenID Connect sign-in since version 7.3, with optional user creation on first login, mapping of identity provider groups to EspoCRM teams, backchannel logout and a fallback login method. The documentation also describes LDAP authentication, including Active Directory and OpenLDAP. EspoCRM's own two-factor authentication is not compatible with OIDC, so your identity provider must carry the second factor.
- OIDC setup: Your team registers the client with the identity provider, sets redirect URIs and maps groups to teams.
- LDAP setup: Directory bind accounts, search bases and attribute mapping are configured on your server.
- Fallback login: Decide which fallback method you keep for when the identity provider is unavailable.
- Two-factor conflicts: Plan MFA at the identity provider, because EspoCRM's 2FA does not work with OIDC.
- Cloud comparison: On the cloud plans the identity configuration is not something the buyer hosts, so confirm which sign-in options the vendor enables for your tenant.
Test the full sign-in and logout path with your identity team before go-live.
The EspoCRM REST API supports API key, HMAC and basic authentication through dedicated API users with role-based permissions. The documentation describes HMAC as the most secure method and basic authentication as not recommended. On a self-hosted instance, your team creates the API users, assigns roles, selects the authentication method and manages the secrets. Integration design, rate limits at your reverse proxy and logging of API calls also fall to you.
- Dedicated API users: Create one per integration so permissions and audit trails stay separate.
- HMAC authentication: The documented preference for stronger integration security, which needs client-side signing support.
- Basic authentication: Documented as not recommended, so restrict it or avoid it.
- API key authentication: Simpler to deploy, but key rotation and storage become your responsibility.
- Cloud API access: Included on all cloud plans, but confirm the authentication options and any usage limits with the vendor.
Review which integrations you will run and pick the authentication method for each before you build them.
How per-instance extension licenses change the cost of self-hosting
The EspoCRM Extension License Agreement changes the cost model for self-hosting in a way that the free core does not. A paid extension such as the Advanced Pack or Sales Pack is licensed for one EspoCRM instance on one server for the licensed period, plus two non-public development or staging instances. A production team that runs a live instance, a test copy and a staging copy should count each of those against the license terms before it buys anything. Extra production servers, load-balanced nodes or separate tenants for different business units each need their own license scope, so the per-server model can multiply the line items quickly.
The agreement also makes the license a recurring cost. The license must be renewed when it expires, and when the agreement ends or the license lapses, the extension must be uninstalled. Upgrades can only be downloaded with a valid license, so a lapsed renewal can block the patches you need. The software may report the domain, license key and version to verify installations, which means your network egress rules, change records and data-handling notes for the CRM should reflect that call-home behavior. Confirm the exact reporting behavior with EspoCRM before you rely on it in a regulated environment.
Ask counsel to review the full EspoCRM Extension License Agreement before you buy, especially the renewal, termination and uninstall clauses and how they apply to your staging and disaster recovery copies. Build the renewal date, the uninstall runbook and the staging inventory into your operating calendar. Compare that recurring line with the per-user cost of EspoCRM Cloud, where the Advanced Pack is included in every cloud plan.
What your team runs in each model
This table sets out who provisions, patches, backs up and monitors EspoCRM in the cloud plan and in a self-hosted install. Read it as a staffing question: each row is work your team either hands to the vendor or keeps.
| Responsibility | EspoCRM Cloud | Self-hosted EspoCRM |
|---|---|---|
| Server provisioning and sizing | Vendor provisions the server in the US or Germany location you choose | Your team picks the host, sizes CPU, memory and storage, and sets up network access |
| Runtime stack (PHP 8.3 to 8.5, MySQL 8.0 or later, MariaDB 10.6 or later, or PostgreSQL 15, on Apache, Nginx or IIS) | Vendor selects and maintains the runtime | Your team installs and keeps the PHP version, database and web server compatible with the release you run |
| Background jobs (cron or scheduled task) | Vendor configures scheduled jobs | Your team must configure cron or a scheduled task, and confirm it runs after every server move |
| Install script stack (Docker with Nginx and MariaDB, Let's Encrypt option) | Not applicable to you | Installation script on Ubuntu, Debian or Linux Mint deploys this stack, but you still own the host it runs on |
| Backups, restores and upgrades (command.sh utility) | Vendor runs backups and upgrades; confirm restore testing and retention in writing | Your team schedules backups, tests restores and runs upgrades with the command.sh utility or your own procedure |
| Patching and security updates | Vendor patches the platform; confirm the notice period for changes | Your team applies core, OS, PHP and database patches and tracks each EspoCRM release |
| TLS certificates and domain | Vendor provides the domain option on higher plans; confirm certificate handling on your plan | Your team issues, renews and monitors certificates for your own domain |
| Monitoring and alerting | Confirm with the vendor which metrics and alerts you receive | Your team builds uptime, disk, database and error monitoring and owns on-call response |
| Support model | 12x5 support is included on every cloud plan, per the EspoCRM pricing page | No vendor support by default; ask a service provider for scoped support if you need it |
Moving from self-hosted EspoCRM to the cloud, or back
This sequence moves EspoCRM data, users and paid extensions between a self-hosted instance and EspoCRM Cloud without losing records or access, and ends with the old instance retired and its licenses closed out.
Inventory extensions, licenses and versions
Before any data moves, list every installed extension, its license period and the number of instances it covers, and record your current EspoCRM core version. Check the EspoCRM Extension License Agreement to confirm what your license allows, including the two non-public development or staging instances, and confirm with EspoCRM that the cloud plan you are buying supports your current extensions and version. Note that the Advanced Pack is included in all EspoCRM Cloud plans, so you may not need to carry it over separately. Done means you have a written list of extensions, license expiry dates and the target version, signed off by the person who owns the license.
Confirm the export and migration method with the vendor
The documented import and data tools cover moving records into an EspoCRM instance, but the exact export path from a self-hosted instance into EspoCRM Cloud is not something this page can confirm. Ask EspoCRM in writing which method applies to your data, whether attachments and custom entity definitions move with it, and whether the vendor or a partner performs the transfer. Ask for any cost or effort the vendor attaches to the move, since that is part of the cost of switching. Done means you have a written answer on method, scope and responsibility.
Export records and files from the source
Take a full database backup and a copy of the file storage directory before exporting anything, then export entity data using the import and export tooling described in the EspoCRM documentation. Keep the export in a location with restricted access, since it contains personal data from your CRM. Record record counts per entity type so you can compare them after the move. Done means you hold a verified backup and a per-entity count sheet that matches the live system at the time of export.
Rebuild and load into the target instance
Load the data into the target instance in the order defined by your entity relationships, starting with reference data such as users, teams and accounts, then related records. For a move back to self-hosting, this means a fresh install of EspoCRM on your own server and a new license setup for any paid extensions, since the cloud license does not transfer. Reapply custom entities, formulas, workflows and roles that the export does not carry over. Done means the target instance holds the same record counts as the source and every custom entity and workflow has been reviewed.
Validate records, workflows and permissions
Test a sample of records across each entity type, then run the workflows and business process rules that your team relies on, comparing results with the source. Check role-based permissions by signing in as a user from each team and confirming they see and edit only what they should. If you use OIDC or LDAP sign-in, confirm that group-to-team mapping and fallback login behave as they did before. Done means a named business owner has signed off on a written test list, and any gaps have been fixed or accepted.
Cut over DNS and move users
Schedule the cutover window with users, lower the DNS time-to-live ahead of time if your provider supports it, then point your CRM hostname to the new instance and reissue or reconfigure any certificates. Update identity provider redirect addresses, email integrations and API clients that call the old hostname. Set the old instance to read-only as soon as the switch happens so no records change after the export. Done means users can sign in at the new address, API integrations report success, and the old instance accepts no new edits.
Retire the old instance and close out licenses
Keep the old instance and its backup for a retention period set by your data policy, then remove it from service. Under the EspoCRM Extension License Agreement, uninstall any paid extension when its license expires or the agreement ends, and confirm with EspoCRM that the license record is closed. Revoke the API users and keys on the old instance and remove the old DNS entries. Done means the retention period has been recorded, the extensions are removed, and your asset register shows the old instance as decommissioned.
What buyers ask before choosing a hosting model
What drives the cost of self-hosting EspoCRM compared with per-user cloud pricing?
Per-user cloud pricing is a recurring charge that scales with headcount. EspoCRM Cloud Basic is listed at 15 US dollars per user per month with a 3-user minimum, Enterprise at 25 US dollars with a 5-user minimum, and Ultimate at 69 US dollars with a 10-user minimum, according to the EspoCRM pricing page. Self-hosting the AGPL-3.0 core has no license fee, so your costs are the infrastructure, the people who install, patch, back up and upgrade it, and any paid extensions you add. Those costs shift with user count, data volume, the number of environments you run and how many hours your staff or a partner spend on operations. Ask any partner for a quote built from a written scope that lists these components separately.
Can our team run EspoCRM without outside help?
A team with PHP, MySQL or MariaDB, and web server skills can run EspoCRM in-house, and the server configuration docs list PHP 8.3 to 8.5, MySQL 8.0 or newer, MariaDB 10.6 or newer, or PostgreSQL 15, with cron or a scheduled task needed for background jobs. The installation script for Ubuntu, Debian and Linux Mint deploys a Docker-based stack with Nginx and MariaDB and includes a command.sh utility for backups, restores and upgrades. The harder work is ongoing: patching, monitoring, restore testing, and handling upgrades across major lines. If your staff lacks that capacity, or you need a fixed-scope implementation, DeployOpen plans, implements, hardens, backs up and documents self-hosted platforms inside your own infrastructure, and ongoing support is available as a retainer.
How long does a migration to EspoCRM take, and what does it need from staff?
No migration duration is published in the sources for this comparison, so ask any vendor or partner for a written estimate tied to your data volume, number of entities, integrations and custom logic. The effort depends on how much data you move, how clean it is, and how much of your current workflow you rebuild with Formula Script, workflows or the Advanced Pack. The EspoCRM import documentation covers the mechanics, but field mapping, user and team setup, and testing with real users usually take the most staff time. Request a plan that names the data owner, the cutover window, the rollback approach and the sign-off criteria before work begins.
Does EU data have to stay in Germany if we choose EspoCRM Cloud?
EspoCRM Cloud offers server locations in the United States and in Germany for EU hosting, according to the EspoCRM pricing page. Choosing the German location is the setting that matches an EU hosting requirement, but whether it satisfies your obligations depends on your data classification, contracts, sub-processors and legal advice. Ask the vendor in writing which location your tenant uses, where backups are kept, which support staff can access data and how data is deleted at exit. If your policy requires control over the physical location or the operator, self-hosting in your own EU infrastructure gives you that control, at the cost of running the platform yourself.
How do paid extension renewals affect our budget?
Paid extensions such as the Advanced Pack and Sales Pack are licensed, not owned. The EspoCRM Extension License Agreement grants use on a single EspoCRM instance on a single server for the licensed period, plus two non-public development or staging instances, and the license must be renewed when it expires. Upgrades can only be downloaded with a valid license, and the extension must be uninstalled when the license expires or the agreement ends. For self-hosting, that means a recurring renewal line in your budget and a plan for what happens to workflows and reports if a renewal lapses. The Advanced Pack is included in all EspoCRM Cloud plans, so cloud pricing carries that cost inside the per-user rate. Confirm current renewal terms and prices with EspoCRM before you commit.
What does EspoCRM's 12x5 support cover on the cloud plans?
The EspoCRM pricing page says every Cloud plan includes external API access, the full feature set, all extensions and 12x5 support, which typically means support during business hours on weekdays. Ask the vendor to define those hours, the time zone, the severity levels, the response targets and whether support covers configuration questions, bugs, data recovery or only platform availability. For self-hosted EspoCRM, the AGPL core comes without a vendor support contract, so you need an internal on-call rota or a retainer with a partner. Write down who handles incidents outside those hours before you go live.
Which security settings should we check when self-hosting EspoCRM?
Check identity, API and access controls before go-live. EspoCRM supports OpenID Connect sign-in with optional user creation on first login and group-to-team mapping, but its own 2FA is not compatible with OIDC, so plan your MFA at the identity provider. LDAP authentication, including Active Directory and OpenLDAP, is also documented. For the REST API, the docs recommend HMAC over API key and describe basic authentication as not recommended. Review the EspoCRM security documentation, restrict API users to the roles they need, and test your backup restores.
What to confirm with the vendor and in your own environment
Before you commit to EspoCRM Cloud, get the current plan terms in writing. The published pricing lists per-user rates of 15, 25 and 69 US dollars per month with minimums of 3, 5 and 10 users, and storage limits of 3 GB, 10 GB and 400 GB per user or per account as listed on each tier. Confirm whether those limits are per user or pooled, how they are measured, what happens when a team exceeds them, and whether the Advanced Pack is included in the plan you choose. Ask for the exact server location, United States or Germany, that will host your data, and confirm that backups, support staff access and any sub-processors sit in the same jurisdiction if your residency rules require it. Your legal or privacy team should review that answer before purchase, not after.
Ask the vendor how you export all data at exit, not only at go-live. Request the export formats for records, attachments, custom entity definitions, workflows and audit history, and confirm whether an export can be run by your own administrator without a support ticket. Also ask how long data remains available after cancellation and how deletion is evidenced. For extensions, confirm which paid packs, such as the Sales Pack, VoIP or the Outlook and Google integrations, are included in each cloud plan, since the pricing page states the Advanced Pack is included in every plan but does not settle the status of every other extension. Check the Extensions page and the EspoCRM Extension License Agreement for any cloud-specific terms.
On the self-hosted path, the license question is only half the cost. Your team owns the server, the database (MySQL, MariaDB or PostgreSQL, per the server configuration documentation), PHP, web server, cron or scheduled tasks for background jobs, TLS certificates, backups, restore tests and upgrades. Decide who performs each task, how often backups are restored in a test environment, and where encrypted copies are kept. If you plan to buy paid extensions, note that each license covers one instance on one server for a fixed period, plus two non-public development or staging instances, and must be renewed, so budget for separate licenses for production and any extra environments. Confirm with EspoCRM how the license key and domain are verified and how renewals are handled in an air-gapped or restricted network.
How DeployOpen scopes and runs self-hosted EspoCRM
DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For EspoCRM, that means working through the hosting, licensing and extension decisions in this comparison before any installation begins, so the choice rests on your infrastructure and data rules.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope should name the EspoCRM edition, database, web server and any paid extensions in use.
- Scope should record which users, data types and identity sources the CRM must connect to, and where it will be hosted.
How we build
- Installation covers the server stack, database, background job scheduling and any chosen single sign-on or LDAP integration.
- Paid extension licenses are tracked per instance and renewal date, with non-public staging instances set up where your agreement allows.
- Testing covers access roles, API authentication method and backup restores before the system is handed to your team.
How we hand over
- Handover documentation covers the installed configuration, the backup and restore routine and the upgrade procedure.
- Your team receives a written record of licenses, instances and their expiry dates so renewals and removals are not missed.
- Ask for the handover list in your quote so you know exactly which artifacts you will own at the end of the engagement.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement ends.
- A retainer can cover planned upgrades between major EspoCRM lines, with testing before each change reaches production.
- Confirm response windows, included upgrade work and extension renewal handling in the retainer terms before you sign.
