Which lightweight CRM fits your team: EspoCRM, Twenty or Frappe CRM
Choose EspoCRM if your team already runs PHP on MySQL or MariaDB and wants a mature, self-hosted CRM with a free AGPL-3.0 core. Choose Twenty if your team is comfortable with TypeScript, PostgreSQL and Redis and wants a fast-moving CRM with a data model defined as code. Choose Frappe CRM if your team already runs, or plans to run, ERPNext or the Frappe Framework and wants sales records to sync with finance and inventory. All three are AGPL-3.0 at the core, so the license alone will not separate them. The stack your team already operates is usually the deciding factor, because it sets the hosting, patching, backup and troubleshooting work you will carry after go-live.
Before you decide, check what is free when you self-host. The EspoCRM core is free, but reports, workflows and business process management sit in the paid Advanced Pack, and quotes and invoices sit in the Sales Pack. Twenty's open-source core is free to self-host, but SSO, row-level permissions and audit logs are listed on its paid Organization and Enterprise plans, so confirm which identity features your security team requires before you build around the core. Frappe CRM is also free to self-host, and its product page describes per-site Frappe Cloud pricing as an alternative, not a requirement. Ask your identity team which sign-in method you need, then check the current EspoCRM OIDC documentation for the features that apply to your version.
Plan for the work after the pick. Twenty's Docker Compose guide runs a server, a worker, PostgreSQL and Redis and asks for at least 2 GB of RAM, so budget for four moving parts. EspoCRM needs a web server, PHP and cron for background jobs. Frappe CRM depends on the Frappe Framework, so a standalone install still means bench-level operations if you later extend it. Confirm the release cadence you will accept: Twenty and Frappe CRM ship frequent point releases, while EspoCRM 10.0 is the current line. Ask each vendor or your implementation partner for the upgrade path, the tested backup procedure and a written scope for any customization before you commit.
Which CRM fits which team situation
Each row names a team situation and the platform that fits it best, with the supplied fact behind the choice. Read the row that matches your team, then check the cell for the condition that would change the answer.
| Team situation | Best fit | Reason and condition |
|---|---|---|
| PHP and MySQL or MariaDB skills in house | EspoCRM | EspoCRM runs on PHP 8.3 to 8.5 with MySQL 8.0 or MariaDB 10.6 or later, so existing hosting skills carry over. The condition is cron or a scheduled task for background jobs, which your team must maintain. |
| PostgreSQL and Redis skills in house | Twenty | Twenty runs a server, a worker, PostgreSQL and Redis, with at least 2 GB of RAM in its Docker Compose guide. Choose it only if your team will also run the worker and Redis, not just the database. |
| Existing ERPNext deployment | Frappe CRM | Frappe CRM creates ERPNext quotations from deals and can create ERPNext customers when a deal is won. Most syncing works only when both apps run on the same site, so plan the shared site before choosing. |
| Need SSO without paying for a plan | EspoCRM | EspoCRM supports OpenID Connect and LDAP on the free self-hosted core. Twenty lists SSO only on its Organization and Enterprise plans. Confirm that your identity provider's group mapping meets your needs, since EspoCRM's own 2FA is not compatible with OIDC. |
| Need workflows and reports | EspoCRM | Reports, workflows and BPM sit in the paid Advanced Pack, which is included in all EspoCRM Cloud plans. Self-hosting means buying the pack's time-limited license per instance, so confirm the renewal terms before budgeting. |
| Phone-first sales team | Frappe CRM | Frappe CRM works in a phone browser, can be added to the home screen, and includes built-in Twilio and Exotel calling with recording. Confirm that your telephony provider is one of those two or plan an integration. |
| Team that wants to define custom objects in code | Twenty | Twenty supports custom objects and fields defined as code and exposes GraphQL and REST APIs. Test the workflow in a staging instance, since the release cadence is frequent (v2.48.0 on October 16, 2026). |
| Team that values a slower, stable release cadence | EspoCRM | EspoCRM 10.0.0 came out on July 2, 2026 and 10.0.10 on October 14, 2026, with 9.0.0 before that on January 20, 2025. Plan upgrades against those dates and read the release notes before each one. |
What is free and what is paid in each platform
EspoCRM's core is licensed under AGPL-3.0, and the open-source edition can be downloaded and self-hosted for free. The paid layer is a set of official extensions on top of that core. The Advanced Pack adds reports, Business Process Management and workflows, and the Sales Pack adds products, quotes, invoices, purchases, subscriptions, inventory and payments. EspoCRM Cloud is a separate, per-user option, and it includes the Advanced Pack in every cloud plan.
- Free core: The AGPL-3.0 edition runs on your own PHP and database stack at no license charge. Your costs are servers, backups, upgrades and staff time.
- Advanced Pack: Covers reports, BPM and workflows. Check whether your automation needs fall inside it before you assume the free core is enough.
- Sales Pack: Covers quotes, invoices and inventory. Teams that quote and invoice from the CRM will need it, and it is a separate purchase.
- Cloud per-user plans: Basic is listed at 15 US dollars per user per month (minimum 3 users), Enterprise at 25 dollars (minimum 5 users) and Ultimate at 69 dollars (minimum 10 users), with the Advanced Pack included.
- Extensions licensing: Confirm with EspoCRM whether paid extension licenses are per instance and time limited, and how renewals and upgrades are handled.
Before you budget, check the current EspoCRM pricing page and the extension terms, since both change over time.
Twenty's core is mostly licensed under AGPL-3.0 with an additional application exception. Files marked with an Enterprise license header are under a commercial license, and the SDK and UI packages are MIT. Twenty's pricing page says the open-source core can be self-hosted for free, and all plans include unlimited custom objects, fields, views and records plus REST and GraphQL APIs and webhooks. The paid tiers gate identity and governance features rather than core CRM data handling.
- Pro: Listed at 9 US dollars per user per month.
- Organization: Listed at 19 dollars per user per month, adding row-level permissions, SAML or OIDC SSO and audit logs.
- Enterprise: Listed from 50,000 dollars a year, adding single-tenant isolation, IP allow-listing, SCIM provisioning and an SLA.
- Enterprise-header files: Do not treat the whole repository as one license. Review which files you modify or redistribute and how the application exception applies to your use.
- Self-hosting costs: The free core still needs a server with at least 2 GB of RAM, plus PostgreSQL and Redis, and the costs of running them.
Confirm with Twenty which features each plan includes today and how the application exception and Enterprise-header files apply to your planned customizations.
Frappe CRM is licensed under AGPL-3.0, and you can self-host it for free using Frappe's easy-install script, the ghcr.io/frappe/crm image, or a bench setup. The alternative is Frappe Cloud, where the product page says plans start at 5 US dollars a month per site with unlimited users and no per-seat charges, billed by usage. Because pricing is per site rather than per seat, the cost driver shifts from headcount to usage and site count.
- Free self-hosting: No license fee applies under AGPL-3.0. You pay for servers, Frappe Framework operations, backups and upgrades.
- Frappe Cloud starting point: From 5 US dollars a month per site, billed by usage. Ask how usage is metered and what grows the bill.
- No per-seat charge: Cloud pricing does not scale with users, so compare it against your own user count and expected growth.
- Portability: The product page says customers are free to self-host or move to another provider, so confirm the export and migration steps with Frappe before relying on that.
- ERPNext integration: Deal-to-quotation and customer sync need both apps on the same site. If you run ERPNext, check whether that changes your hosting footprint and costs.
Confirm current Frappe Cloud plan details, usage billing and any support terms directly with Frappe, because the starting price and billing model may change.
How the architecture and stacks differ
The three CRMs run on different foundations, and that difference usually decides who on your team will own them. EspoCRM is a PHP application on MySQL, MariaDB or PostgreSQL. The EspoCRM server configuration documentation lists PHP 8.3 to 8.5 and MySQL 8.0 or later, MariaDB 10.6 or later and PostgreSQL 15 as supported, on Apache, Nginx or IIS. Background jobs need cron or a scheduled task, so your web and database administrators must plan for that scheduler alongside the web server. Confirm the exact PHP extensions and database engine you will run against the EspoCRM server configuration documentation before you build the host.
Twenty is a TypeScript application that needs PostgreSQL and Redis. Its backend uses NestJS with BullMQ, and its frontend uses React. The Docker Compose self-hosting guide runs a server, a worker, PostgreSQL and Redis, and asks for at least 2 GB of RAM because insufficient memory can crash processes. A team that runs PostgreSQL and Redis already has the backup, patching and monitoring habits this requires. A team that only runs PHP and MySQL will need to add those skills, and the worker and Redis are components that must stay healthy for background work to complete.
Frappe CRM runs on the Frappe Framework with Frappe UI, a Vue-based library. Its stable v1.x branch is compatible with Frappe and ERPNext versions 15 and 16, according to the frappe/crm README. Before you commit, confirm which Frappe bench version your environment will pin, because the CRM tracks the framework's release line rather than running independently. If you plan to use the ERPNext integration, most syncing works only when both apps share the same site, so that choice shapes the whole deployment and should be decided before installation.
Capability comparison across all three CRMs
This table compares EspoCRM, Twenty and Frappe CRM on license, release pace, identity sign-in, API access, customization, workflows and phone features. Read each row against your own requirements, and treat any cell marked as an item to confirm as a question for the vendor or a test in your own environment before you decide.
| Capability | EspoCRM | Twenty | Frappe CRM |
|---|---|---|---|
| License | AGPL-3.0 core, free to self-host; paid official extensions | Mostly AGPL-3.0 with an application exception; Enterprise-header files commercial | AGPL-3.0, free to self-host |
| Release line and recent releases | Version 10.0.10, released October 14, 2026 | Version v2.48.0, released October 16, 2026 | Version v1.88.0, released October 15, 2026 |
| Core stack | PHP on MySQL, MariaDB or PostgreSQL 15 | TypeScript with NestJS, PostgreSQL and Redis | Python Frappe Framework with Vue-based Frappe UI |
| SSO and identity options | OpenID Connect since version 7.3, with group-to-team mapping; 2FA not compatible with OIDC | SAML or OIDC SSO listed on the Organization and Enterprise plans, not the free core | Item to confirm: SSO options and whether they are free when self-hosted |
| LDAP | Documented, including Active Directory and OpenLDAP | Item to confirm for the self-hosted core | Item to confirm |
| API authentication | API key, HMAC (documented as most secure) and basic authentication via dedicated API users | REST and GraphQL APIs and webhooks on all plans | Item to confirm: API authentication methods and token scope |
| Customization model | Formula Script in Entity Manager, API before-save scripts, workflows and BPM | Custom objects and fields defined as code, plus unlimited custom objects on all plans | Frappe web forms, assignment rules and a sales hierarchy that limits record visibility |
| Workflows and reports | Reports, BPM and workflows require the paid Advanced Pack | Workflow automation included; reporting depth to confirm | Assignment rules and custom views; workflow and report depth to confirm |
| Phone and messaging | VoIP is a paid official extension | Item to confirm for calling and messaging | Built-in Twilio and Exotel calling with recording; WhatsApp through the Frappe WhatsApp app |
What drives the running cost of each CRM
Running any of these CRMs costs more than the license line. The cost splits between who runs the servers, who extends the product, who keeps up with releases and what each vendor charges per user or per site. Read each card as a question to put to your own team and to any partner quoting the work.
Hosting footprint and components
EspoCRM and SuiteCRM run as PHP applications on a web server with MySQL, MariaDB or PostgreSQL, plus cron for background jobs. Twenty runs a server, a worker, PostgreSQL and Redis, and its Docker Compose guide asks for at least 2 GB of RAM because insufficient memory can crash processes. Ask any quote to price each of these components, the backup target and the monitoring you expect to run.
Database and cache operations
Twenty adds Redis to the PostgreSQL database that every component depends on, so it has one more service to patch, monitor and back up. EspoCRM accepts MySQL, MariaDB or PostgreSQL, so the choice can follow the skills your database team already has. Confirm who owns patching, restores and failover for whichever database you pick.
Paid extensions and plan tiers
The free EspoCRM core excludes reports, workflows and BPM, which sit in the paid Advanced Pack, and quotes, invoices and inventory, which sit in the Sales Pack. Twenty's free core keeps unlimited custom objects and APIs, but SSO, row-level permissions and audit logs sit in paid plans. Frappe CRM is free to self-host with no per-seat charge. Ask which features your roles need, then price the extensions or plans that deliver them.
Frappe Cloud per-site billing versus self-hosting
Frappe Cloud bills by usage per site, starting at 5 US dollars a month, with unlimited users and no per-seat charges, and you can move to another provider. Self-hosting shifts that spend to your own cloud accounts, staff time and hardware. Compare the Frappe Cloud bill for your expected site count and usage with your full self-hosted cost before you decide.
Upgrade and release pace effort
EspoCRM 10.0.10 followed 10.0.0 on July 2, 2026, Twenty shipped v2.48.0 on October 16, 2026 one day after v2.47.0, and Frappe CRM released v1.88.0 a week after v1.87.0. Frequent releases mean recurring testing, staging and change windows for whoever operates the instance. Ask any partner how many upgrade cycles the quoted retainer covers and who tests extensions after each one.
Staff skills and ongoing ownership
Your team's existing skills often set the real cost. A PHP and MySQL team can run EspoCRM and SuiteCRM with familiar tooling, while a TypeScript, Redis and PostgreSQL team will find Twenty easier to operate. Frappe CRM depends on the Frappe Framework and bench for development. Ask for a written handover covering who on your staff owns the instance after the project ends.
How implementation effort differs by platform
This sequence shows where the work sits for each platform, from stack provisioning through identity, data import, customization, testing and upgrade planning, and what each step should leave behind before the next one starts.
Provision the stack and hosting baseline
Start by choosing the hosting model for each candidate. EspoCRM needs a PHP runtime on Apache, Nginx or IIS with MySQL 8.0 or later, MariaDB 10.6 or later, or PostgreSQL 15, plus cron or a scheduled task for background jobs. Twenty needs a server, a worker, PostgreSQL and Redis through its Docker Compose guide, with at least 2 GB of RAM. Frappe CRM runs on the Frappe Framework with bench for development, Frappe's easy-install script or the ghcr.io/frappe/crm image, or Frappe Cloud. Your platform or hosting team carries this work. It is done when each candidate starts, serves a login page and runs its background jobs on the target infrastructure, with the database and cache versions checked against the vendor's current matrix.
Configure identity integration for each platform
EspoCRM supports OpenID Connect sign-in with optional user creation on first login, mapping of identity provider groups to teams, backchannel logout and a fallback login method, and it also documents LDAP for Active Directory and OpenLDAP. Its own 2FA does not work alongside OIDC, so decide where multi-factor authentication lives before go-live. Twenty places SSO on its Organization and Enterprise plans, with SAML or OIDC on Organization and SCIM provisioning on Enterprise, so confirm the plan tier before design starts. Frappe CRM site setup handles user roles (Sales User, Manager and Admin) and the sales hierarchy, and you should confirm with Frappe which SSO options apply to your deployment. The identity team signs off when a test user from each group lands in the correct role on each platform.
Import and map existing customer data
Map your accounts, contacts, leads and deals to each platform's data model before loading anything. EspoCRM documents an import feature that you should test against a copy of your data set. Twenty supports custom objects and fields defined as code and includes unlimited custom objects, fields, views and records on all plans, which shifts more mapping work into the design phase. Frappe CRM's lead and deal model, assignment rules and web forms need to match your existing sales process before import. Your data owner and the implementation team complete this step. It is done when record counts and key fields match the source in a test load, and duplicate and ownership rules behave as the sales team expects.
Customize workflows, roles and automation
EspoCRM's reports, business process management and workflows sit in the Advanced Pack, so budget for that paid extension if you need them, and its Formula Script drives before-save scripts, workflows and BPM. Twenty provides workflow automation, role-based permissions and row-level permissions on the Organization plan. Frappe CRM provides assignment rules, email templates and lead syncing from Meta ads, and its ERPNext integration only syncs fully when both apps share a site. Your CRM administrator or the implementation partner builds these rules. It is done when each sales scenario runs end to end in a staging instance and the permission model matches the written access policy.
Test security, access and integrations
Test each platform against the access policy you wrote in the identity step. For EspoCRM, confirm that API users with role-based permissions use HMAC rather than basic authentication, since the docs call HMAC the most secure method and basic authentication not recommended. For Twenty, confirm that row-level permissions and audit logs behave as described on your chosen plan. For Frappe CRM, test the sales hierarchy so users see only their allowed records. Run integration tests for email, calling or messaging you plan to use, including Twilio or Exotel for Frappe CRM. Your security team and the implementation team own this step. It is done when access tests, integration tests and any agreed security test results are recorded and the open findings are assigned.
Plan backups, upgrades and release tracking
Upgrade effort differs sharply. EspoCRM ships its installation script with a command.sh utility for backups, restores and upgrades when you use the Docker-based stack, while a manual install needs your own procedure. Twenty ships very frequent releases, so set a review cadence against its release notes. Frappe CRM releases move quickly too, and its stable v1.x branch targets Frappe and ERPNext versions 15 and 16, so tie upgrades to the Frappe Framework version you run. Your operations team owns this work and should ask each vendor, and DeployOpen if you engage us, for the upgrade path in writing. It is done when a restore has been tested on a copy of production and a written upgrade calendar exists for each platform.
Hand over runbooks and confirm support scope
Close the implementation with runbooks for each platform covering stack components, identity configuration, backup and restore steps, and the contacts for escalation. Record which features depend on paid extensions or plan tiers, including the EspoCRM Advanced Pack, Sales Pack and Twenty's Organization and Enterprise features, so the cost model stays accurate after go-live. Confirm with each vendor and with any implementation partner whether support, retainers or upgrades are included, and get the scope in writing. The handover is complete when the operations team can restore the system, rotate credentials and apply an upgrade from the runbook alone.
Questions buyers ask before choosing or hiring help
What does it cost to self-host EspoCRM, Twenty or Frappe CRM?
The core of all three can be self-hosted at no license fee: EspoCRM and Frappe CRM are AGPL-3.0, and Twenty's open-source core can be self-hosted for free. The recurring costs are the servers, the database, backups, your staff time and any paid extensions or plans you add. For EspoCRM, the Advanced Pack and Sales Pack are paid add-ons, while Twenty gates SSO and audit logs behind its Organization and Enterprise plans. Frappe Cloud starts at 5 US dollars a month per site if you prefer hosted operation. Ask any vendor or partner for a written quote that separates one-time setup from recurring hosting, support and extension licensing.
Can our team run a self-hosted CRM without outside help?
It depends on the stack you already run. EspoCRM and Frappe CRM rely on PHP and Python-based tooling with MySQL, MariaDB or PostgreSQL, while Twenty runs a TypeScript server, a worker, PostgreSQL and Redis and asks for at least 2 GB of RAM in its Docker Compose guide. A team that already operates PHP web servers and MariaDB can usually take on EspoCRM. A team without Redis, cron or container experience should plan for training or an implementation partner. Outside help is most useful for initial hardening, backup and restore testing, and upgrade runbooks, and it is commonly scoped as a fixed-scope engagement with written deliverables.
How much work do SSO and paid extensions add?
SSO effort depends on the platform and your identity provider. EspoCRM supports OpenID Connect sign-in since version 7.3, with optional user creation on first login, group-to-team mapping and backchannel logout, and it also documents LDAP for Active Directory and OpenLDAP. Its own 2FA does not work with OIDC, so plan your MFA at the identity provider. Twenty lists SAML or OIDC SSO on its Organization plan and SCIM provisioning on Enterprise. Extensions add their own work: EspoCRM's Advanced Pack covers reports, workflows and BPM, and its Sales Pack covers quotes, invoices and inventory, and the Advanced Pack is included in EspoCRM Cloud plans. Confirm the extension licensing model with the vendor before you design around it.
How does release pace affect upgrades for these CRMs?
Faster release pace means more upgrade events, so the work is driven by how many versions you skip and how much you customize. Twenty ships frequently, with v2.48.0 released on October 16, 2026, one day after v2.47.0. EspoCRM's current line is 10.0, with 10.0.10 released on October 14, 2026, and its previous major version 9.0.0 came out on January 20, 2025. Frappe CRM v1.88.0 followed v1.87.0 by a week. Each upgrade should be tested against a copy of your data, your custom entities, scripts and integrations, with a rollback plan. Ask any partner to document the upgrade runbook and the staging environment it will use before signing a fixed-scope quote.
When does ERPNext make Frappe CRM the better fit?
Frappe CRM is the better fit when you already run, or plan to run, ERPNext on the same site. Its ERPNext integration can create quotations from deals and a customer when a deal is marked Won, but most of that syncing works only when both apps run on the same site. If you need CRM alone, a separate site or a non-Frappe ERP makes that advantage smaller, and EspoCRM or Twenty may fit better. Frappe CRM also offers built-in Twilio and Exotel calling, WhatsApp messaging and Meta lead sync. Check whether your sales process needs the ERP link before choosing, because moving CRM data between separate sites later takes planning.
What should we ask a partner for in a fixed-scope quote?
Ask for a written scope that names the platform versions, the hosting target, the database and identity provider, and each integration. Deliverables should cover installation, hardening, SSO configuration, backup and restore tests, upgrade procedure, documentation and handover. Ask which extensions or paid plans the quote assumes and who holds those licenses. Confirm the timeline, the acceptance criteria and what is excluded, such as data migration from an older CRM or custom development. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms inside your own infrastructure, and most engagements are fixed-scope with agreed deliverables, so ask any partner for the same level of written detail.
Which security checks should we ask for before go-live?
Ask for a review of the authentication path, the database and cache exposure, the API authentication method and the backup handling. For EspoCRM, the REST API supports API key, HMAC and basic authentication through dedicated API users, and its docs describe HMAC as the most secure and basic authentication as not recommended. For Twenty, confirm which row-level permission and audit log features your plan includes. Ask the partner whether it will run application and API security testing against the live configuration, and what evidence it will hand over. Compliance frameworks need an independent auditor or certification body to issue any report, so treat the partner's work as readiness evidence, not a certification.
Official sources for each CRM
Before you shortlist any of these CRMs, check the license, release and pricing claims against the vendor's own pages, since those change faster than comparison articles get updated. For EspoCRM, start with the espocrm/espocrm GitHub repository to confirm the AGPL-3.0 license metadata, then the EspoCRM releases page to see how the 10.x line is moving, and the EspoCRM pricing page to confirm what the free self-hosted edition covers and what Cloud plans include. The EspoCRM server configuration documentation is the authority on supported PHP, MySQL, MariaDB and PostgreSQL versions and on the cron requirement for background jobs.
For Twenty, the Twenty LICENSE file is the place to confirm the AGPL-3.0 terms with the application exception and which files fall under the Enterprise header. The Twenty pricing page shows which plans gate SSO, row-level permissions, audit logs and SCIM provisioning, and those gates should be checked against the version you intend to deploy. The Docker Compose self-hosting guide lists the server, worker, PostgreSQL and Redis components and the memory requirement you will need to budget for. For Frappe CRM, the frappe/crm README covers installation options and ERPNext version compatibility, the Frappe CRM product page covers licensing and Frappe Cloud pricing, and the Frappe CRM documentation describes roles, web forms and assignment rules.
Ask each vendor, in writing, which edition and version your quote assumes, and confirm the SSO method and any paid feature you depend on against that version's documentation rather than a blog summary. Keep a dated record of the sources you checked, because release numbers in this category move weekly.
How DeployOpen helps choose and implement a CRM
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For EspoCRM vs Twenty vs Frappe CRM, we start from your stack, identity provider and hosting skills, then build the option your team can run.
How we scope
- Written scope fixes which CRM options, editions and hosting targets are in the engagement before work starts.
- Scope records your identity provider, SSO requirements and whether you need paid extensions or add-ons.
- Scope names the data to migrate, the users and roles to configure, and the integrations to build.
How we build
- We install the chosen CRM in your environment on the database and web server your team already operates.
- We configure SSO and role-based permissions, then test sign-in, access boundaries and API authentication.
- We run security testing on the deployed application and document findings with fixes for your review.
How we hand over
- Handover includes runbooks for backups, restores, upgrades and background job scheduling for your team.
- Documentation covers configuration, custom entities, workflows and the settings that depend on your identity provider.
- We walk your administrators through the running system so they can operate it without us.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover release tracking, so you can plan upgrades when a new version of your chosen CRM ships.
- Ask any provider for written support scope, response expectations and who handles upgrades before you sign.
