When the free Community edition is enough and when Docmost Business or Enterprise is needed
The Docmost Community edition is free to self-host under AGPL-3.0, and for many teams it is enough. The paid features that typically drive an upgrade are SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning, MFA, page-level permissions, the REST API with personal keys, and audit logs. Docmost's documentation lists SSO, LDAP and TOTP MFA among its authentication methods, but the paid-edition list places SSO with SAML or OIDC, LDAP, SCIM and MFA behind the paid tier, so confirm for your version which sign-in options your Community install actually exposes before you design around them. A small team with no central identity provider, a single space or a few spaces, and a shared understanding of who may edit what can usually stay on Community. Email and password sign-in, space-level access and page history cover the basic collaboration case, and the cost is limited to the infrastructure and staff time you already pay for.
Business or Enterprise becomes the better choice when access rules have to be enforced by a system rather than by convention. The usual triggers are an existing identity provider that must govern sign-in, joiners and leavers that must be provisioned and deprovisioned automatically (which points to SCIM, an Enterprise feature according to the pricing page), page-level permissions for restricted content, and an API that other systems call with personal keys. Business is listed at $6 per seat per month billed annually with a 10-seat minimum, which the pricing page states directly. Enterprise is priced on request and adds audit logs, SIEM integration and security controls. Ask for a written quote that separates the license from your own hosting, configuration and upgrade work, since any Docmost plan does not replace the effort of running the stack. Confirm on the Docmost pricing page which features each tier includes at the time you buy.
Which Docmost features are free and which are paid
This table places each documented Docmost feature across the Community, Business and Enterprise tiers. Docmost's documentation lists the items below as paid-edition features, and its pricing page lists Business at $6 per seat per month billed annually with a 10-seat minimum. Where the facts do not state a plan's exact coverage, confirm it in the documentation or with Docmost before you buy.
| Feature | Community | Business | Enterprise |
|---|---|---|---|
| SSO with SAML 2.0 or OIDC | Listed as paid; confirm before relying on it | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
| LDAP sign-in | Listed as paid; confirm before relying on it | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
| SCIM provisioning | Listed as paid; not in the free list | Not named on the pricing page; confirm | Listed on the pricing page |
| Multi-factor authentication | TOTP is documented as a sign-in method; confirm Community scope | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
| Page-level permissions | Spaces and permissions are documented; confirm page-level limits | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
| REST API with personal keys | Listed as paid; confirm whether any API access is free | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
| Audit logs and SIEM integration | Not listed as free; confirm | Not named on the pricing page; confirm | Listed on the pricing page |
| Page verification with approval | Listed as paid; confirm before relying on it | Listed as a paid-edition feature; confirm the plan | Verification workflow listed on the pricing page |
| PDF and DOCX search, Confluence, DOCX and PDF importers | Listed as paid; confirm which import paths are free | Paid-edition feature; confirm the plan includes it | Paid-edition feature; confirm it in the quote |
How SSO, LDAP and SCIM change who can sign in and how access is removed
Sign-in methods decide how a person proves who they are, while provisioning decides whether their account exists at all. Docmost's documentation lists email and password, LDAP, SAML or OIDC single sign-on, and TOTP multi-factor authentication as sign-in methods. Those are the paths a user takes at the login screen. SCIM is different: it is the mechanism by which your identity provider creates, updates and deactivates Docmost accounts automatically. Docmost's documentation places SCIM provisioning, along with SAML 2.0 or OIDC single sign-on, LDAP, MFA and page-level permissions, among the paid-edition features, and the pricing page ties SCIM to Enterprise. Confirm with Docmost which of these features are included in the plan you are quoting before you design around them.
The operational difference shows up when someone leaves. On the free Community edition, an administrator has to find the user's Docmost account and disable or remove it by hand, and that step is easy to miss when the same person also has accounts in other tools. With SSO and SCIM in place, the identity provider becomes the single place to revoke access: disabling the user there should stop new sign-ins and, if provisioning is configured, deactivate the Docmost account as well. Ask the vendor how deactivation behaves for existing sessions, whether the account keeps its page ownership, and how quickly a SCIM deprovisioning request is applied. These answers matter more than the feature list when you plan an offboarding procedure.
Before assuming the feature fits, your team must confirm several things about its own identity stack. Check which protocol your IdP supports for SAML 2.0 or OIDC, whether your directory is an LDAP service that Docmost can query directly, and whether your IdP can push SCIM requests to a Docmost endpoint from your network. Confirm how group membership maps to Docmost groups and spaces, because a mapping error can grant wider access than intended. Also confirm what happens to local email and password accounts that already exist, and whether a break-glass administrator can sign in if the IdP is unavailable. Test these paths in a non-production instance first, and record the results as part of your access control evidence.
Licensing, support and update terms for each Docmost edition
Docmost ships as one product with two licenses. The core is AGPL-3.0, while code in the ee directories sits under the Docmost Enterprise license, and the Business and Enterprise plans are sold on top of that split. Read each card with the question of what you can run, change and redistribute, and what support and updates you are actually buying.
AGPL-3.0 core edition
The core of Docmost is licensed under AGPL-3.0, which is the license that governs the free self-hosted Community edition. You can run it inside your own infrastructure and modify it, but if you offer a modified version to users over a network, the AGPL requires you to make your modified source available under the same terms. Confirm with your legal team how that obligation applies to internal-only use and to any custom connectors your engineers write.
Enterprise license for ee code
Code in apps/server/src/ee, apps/client/src/ee and packages/ee falls under the Docmost Enterprise license, not the AGPL. That means the features in those directories, which include the paid-edition functions, are governed by different terms on use, modification and redistribution. Before you fork the repository or patch paid functionality, read the Enterprise license text itself and ask Docmost in writing what you may change and share.
Business plan terms
The Business plan is a paid subscription sold per seat, and its published price is listed on the pricing page with a seat minimum. Paid features such as SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning, MFA and page-level permissions are part of the paid editions. Ask for the written subscription terms covering the support channel, response expectations, update delivery and what happens to paid features if you stop renewing.
Enterprise plan terms
Enterprise is priced on request and adds SCIM, audit logs, SIEM integration, security controls and a page verification workflow. Because it is custom priced, the support level, service commitments and any custom license grants are defined only in the signed agreement. Ask whether the Enterprise terms include source access or modification rights for the ee code, and whether the contract covers self-hosted upgrades.
Support and update terms in writing
Support and update commitments come from Docmost's plan documentation and your signed order, not from this page or from the open-source project. Request written answers on support hours, escalation paths, security patch timing for both the AGPL core and the ee code, and how upgrades are handled for a self-hosted deployment. Keep those answers with the contract so audit and procurement reviews can trace them.
Questions buyers ask before choosing a Docmost edition
How much does the Docmost Business plan cost per seat?
The Docmost pricing page lists the Business plan at $6 per seat per month when billed annually, with a 10-seat minimum. Your total is the seat count multiplied by that rate, with a floor of ten seats, so a team of four still pays for ten. Confirm the current rate, billing terms and any tax or currency handling on the Docmost pricing page before you budget, because published prices can change. Seat count is the main driver, followed by whether you need Business features at all, since the Community edition is free to self-host.
Does Docmost publish Enterprise pricing?
No. Enterprise pricing is custom and is not listed on the pricing page. The page says Enterprise adds SCIM, audit logs, SIEM integration, security controls and a page verification workflow on top of the Business feature set. Ask the vendor for a written quote that names each Enterprise feature you need, the seat count, the license term and whether support is included. Feature lists alone do not tell you what you will pay, so compare the quote against the specific controls your auditors or security team require.
How much effort does the Docker self-hosted install take?
The Docmost installation documentation recommends Docker, with a compose template that runs Docmost alongside PostgreSQL 18 and Redis 8 images. You must set an APP_SECRET of at least 32 characters, and any reverse proxy must have WebSockets enabled for the real-time editor. Files are stored locally by default, so you need backup and disk planning from day one. A single-host install is a small task for a team already running Docker. Effort rises with TLS termination, identity integration, S3-compatible or Azure Blob storage, backups and monitoring. Confirm the current steps against the Docmost installation documentation.
Can our team run Docmost without an implementation partner?
Often yes, if you have someone comfortable with Docker, PostgreSQL, reverse proxies and identity configuration. The compose template covers a basic deployment, so the open questions are operational: backups of the database and local file storage, upgrades between tagged releases, and who responds when the real-time editor fails behind a proxy. If you need SSO, SCIM or audit logging, those are Business or Enterprise features, so plan the identity work too. DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms in your own infrastructure, usually under a fixed-scope written agreement, and offers retainers for ongoing support. Whether you need that depends on your in-house capacity.
What work is needed to migrate from Confluence or Notion?
Docmost's import dialog accepts Markdown and HTML files, including ZIP archives, Word DOCX documents, a Notion export ZIP and a Confluence export. The Confluence, DOCX and PDF importers are listed as paid-edition features, so confirm which importers your plan includes before you start. Expect work in mapping spaces and permissions, checking internal links, re-uploading attachments that do not survive export, and validating page history expectations. A pilot space with a sample of pages, reviewed by real users, shows the gaps early. Ask for a migration plan that lists what moves, what is rebuilt and what is retired.
Which identity features change the cost of running Docmost?
Email and password, LDAP, SAML or OIDC single sign-on and TOTP multi-factor authentication are listed as authentication methods, but SAML 2.0 or OIDC SSO, LDAP, SCIM provisioning and MFA are listed as paid-edition features. That means the identity design affects which plan you need, not only how you configure the server. Map your directory, group structure and offboarding process before choosing a plan. Confirm with Docmost which exact identity features each plan includes, because the documentation and pricing page may differ in detail.
What should we ask for in a Docmost quote?
Ask for a written quote that states the edition, seat count, billing period and whether the rate is per seat per month or per year. Request the list of paid features included, a named Enterprise scope if needed, and the terms for upgrades between editions. For a self-hosted build, ask for the install scope (Docker host, database, storage, reverse proxy, TLS), identity integration, backup and restore testing, data import and the handover documentation. Include exclusions, acceptance criteria, support hours and what happens if the seat count grows during the term.
Moving from the Community edition to a paid plan and back
This sequence lets a team move from Docmost Community to Business or Enterprise, or drop back down, without losing pages, permissions or sign-in access. Each step ends with a check that confirms the change is safe to repeat in production.
Confirm which paid features you need
Start by listing the capabilities your team must have that the Community edition does not include. Docmost's documentation places SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning, MFA, page-level permissions, the REST API with personal keys, and the Confluence, DOCX and PDF importers in the paid editions. SCIM, audit logs and SIEM integration are listed on the Enterprise tier of the pricing page, so Business and Enterprise are not interchangeable. Ask Docmost in writing which tier includes each feature on your list, and confirm the answer against the current pricing page before you buy. The output is a short, signed-off feature list mapped to a plan.
Document the identity provider and directory setup
Record how users sign in today and how group membership is maintained. Note the identity provider in use, whether LDAP directory groups will drive Docmost spaces and permissions, and which attributes map to user roles. Confirm that the IdP supports the protocol you intend to use, SAML 2.0 or OIDC, and that you can export a current list of groups. Your identity team and the Docmost documentation should agree on the mapping before any configuration changes. The output is a written mapping table that a second engineer has reviewed.
Back up data and configuration before the change
Take a full backup of the PostgreSQL database and the file storage location before you change anything. Docmost's compose template uses PostgreSQL 18 and Redis 8 and stores files locally by default, so the backup must cover both the database and the attachment volume, or the S3-compatible or Azure Blob bucket if you use one. Save a copy of the environment file, including APP_SECRET, because a lost secret affects how the instance is restored. Test the restore on a separate host. The output is a restore test that completes and opens a sample of pages with their attachments and history.
Test SSO and SCIM in a staging instance
Deploy a staging copy of Docmost with the same version and a copy of the production data, then enable the paid features there first. Test SAML 2.0 or OIDC sign-in, LDAP sign-in, and MFA with a small set of test accounts. If you plan to use SCIM, confirm that provisioning creates, updates and deactivates users as expected, and that deprovisioned accounts lose access. Also confirm that WebSockets work through your reverse proxy, because the real-time editor depends on them. The output is a written test log showing each sign-in method and provisioning event passed.
Plan the seat count and billing
Count the users who will hold a seat, including contractors, service accounts you may need to exclude, and any users who will move between spaces. The Business plan is listed at $6 per seat per month billed annually with a 10-seat minimum, so confirm whether your count sits above that minimum and whether the billing period suits your procurement cycle. Enterprise pricing is custom and requires a direct quote. Ask the vendor how seats are counted when users are deactivated mid-cycle and how they are counted for SCIM-provisioned accounts. The output is a seat forecast and a quote that matches it.
Cut over users in a planned window
Apply the licence or plan change to production, switch the sign-in method for a pilot group, then move the remaining users in stages. Keep the Community sign-in path available until the pilot group has used the new path without issues. Notify users of any change to how they sign in and where they reset credentials. Watch the logs for failed authentications and provisioning errors during the first days. The output is a sign-off from the team that owns the wiki confirming that every group can reach its spaces through the new sign-in path.
Plan a return to the Community edition
Dropping a paid plan removes access to the paid-edition features listed in Docmost's documentation, including SSO, LDAP, SCIM, MFA, page-level permissions, the REST API, and the advanced importers. Before you downgrade, identify which spaces depend on page-level permissions, which users depend on SSO, and which integrations use API keys. Export pages and spaces as Markdown or HTML so you hold a readable copy that does not depend on a paid feature. Confirm with Docmost in writing what happens to existing configuration, audit data and seat assignments when the plan ends. The output is a written downgrade plan with a tested export.
Verify data and configuration after each change
After any plan change, check that pages, attachments, comments, page history, spaces and group memberships match the pre-change record. Confirm that permissions still apply as intended, that the Community edition does not expose settings that now sit behind a paid tier, and that the backup you took still restores. Record the Docmost version, the plan, and the date of the change in your configuration log. The output is a post-change checklist, signed by the owner of the wiki, stored with the backup record.
What the Docmost edition choice costs beyond the seat price
The Community edition carries no license fee, but it is not free to run. The team pays for the hosting, storage, backups, upgrades and admin time that a self-hosted Docmost instance needs. The documented Docker setup runs Docmost with PostgreSQL 18 and Redis 8 images, requires an APP_SECRET of at least 32 characters, and stores files locally by default, so someone owns the database, the file store, the reverse proxy with WebSockets enabled, and the backup and restore routine. Those costs recur every month, and they scale with the size of the wiki and the number of people who depend on it. Ask who in your organization carries that work, and whether it is already covered by existing platform staff or a retainer.
The Business plan adds the published price of $6 per seat per month, billed annually, with a 10-seat minimum, as stated on the Docmost pricing page. That means a team of 10 pays for 10 seats even if fewer people edit pages, and the figure recurs for each year of use. Enterprise is custom-priced and adds SCIM, audit logs, SIEM integration, security controls and the page verification workflow. Costs rise with seat count, identity integration effort, the number of spaces that need page-level permissions, storage growth, and any audit or SIEM work your security team requires. Before you sign, request a written quote that states the seat count and billing term, which edition each feature is licensed under, whether SCIM and SIEM integration are included, who performs the SSO and LDAP configuration, and the one-time versus recurring split.
Treat the quote as a comparison of two bills, not one. Ask your provider to separate the subscription from implementation, testing and hardening, and from ongoing support, since a self-hosted Community deployment still needs those services when a regulated team relies on it. Confirm the terms of any Docmost license and the Enterprise license scope with Docmost directly, because the README places enterprise-licensed code in specific paths. If you plan to import from Confluence or Notion, budget time for the migration work as well, since those importers are paid-edition features. Use this list to decide whether the seat price is the largest number on the page or only the smallest.
Which team profile fits which edition
Each profile starts from one constraint, such as identity, audit evidence, migration or page approval, and the edition choice follows from it. Check each requirement against the feature list for the version you plan to deploy before you request a quote, because some features appear in more than one place in the documentation.
Small team without central identity
A small team with no central identity provider can run the AGPL Community edition on its own infrastructure and manage accounts with email and password. This fits internal how-to pages and team knowledge rather than audited records. Before you commit, confirm which sign-in methods your installed version exposes in Community, because the documentation lists LDAP, SAML and OIDC alongside the paid features. Confirm what support, if any, applies to Community, and name the person who owns backups, upgrades and the reverse proxy.
Team with an IdP needing SSO and MFA
If your organization already runs an identity provider, the requirement is single sign-on through SAML 2.0 or OIDC plus multi-factor authentication, both listed among Docmost's paid-edition features. Ask your identity team which protocol they will issue and whether group membership must map to Docmost groups. Confirm in writing that the Business plan includes SSO and MFA in the version you deploy, then test sign-in with an account that has been disabled to confirm access is removed.
Regulated team needing audit logs and SIEM
A regulated team that must show who changed what, and forward those events to a monitoring platform, needs audit logs and SIEM integration, which Docmost lists under Enterprise with custom pricing. Ask for the log fields, the export format, retention controls and whether events arrive through the API or a push integration. Confirm that SCIM provisioning and security controls are in the same Enterprise quote, since each one changes the evidence you can produce for an assessor.
Team migrating from Confluence
A team leaving Confluence should start with the export. Docmost's import dialog accepts Markdown and HTML, including ZIP archives, DOCX files, Notion export ZIPs and Confluence exports, but the Confluence importer also appears in the paid-edition feature list. Test the import on one space that includes attachments, macros and permissions, and confirm in writing which importer your edition includes. Plan time for pages that need manual cleanup and for link repair after cutover.
Team needing page verification workflows
Teams that publish policies, runbooks or procedures often need a page reviewed and approved before readers treat it as current. Docmost lists page verification with approval among paid features, and its Enterprise plan adds a page verification workflow, so the tier that includes the approval flow depends on the version you buy. Ask the vendor to demonstrate the approval steps, who can approve, and how the verified state appears to readers. Confirm the tier against the pricing page before you assume Business includes it.
Whether to self-host Docmost or use the hosted cloud version
Choose between self-hosting and the hosted cloud version based on where your wiki content may live and who is accountable for running it. Docmost is available as a self-hosted install using the Docker method recommended in its installation documentation, and it also runs as a hosted cloud service at app.docmost.com. Self-hosting keeps the database, file storage and encryption keys under your control, whether that is your cloud account, a data center or a restricted network. The cost is operating effort: you own the PostgreSQL and Redis images, the APP_SECRET, file storage (local by default, or S3-compatible or Azure Blob storage), backups, upgrades and WebSocket settings on your reverse proxy for the real-time editor. A hosted instance moves most of that work to the provider, which suits teams that do not have platform staff to run another stateful service, but it means your pages and attachments sit in the provider's environment under its terms.
Before you pick the hosted option, confirm in writing what each hosted plan includes. Docmost's documentation lists SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning, MFA, page-level permissions and the REST API among paid-edition features, but it does not establish, in the facts this page relies on, which of those are switched on in the hosted service at each tier. Ask the provider whether SSO, SCIM, audit log export, retention, backup restoration, data residency and any SIEM integration are available, and where encryption keys are held. Also ask how a data export would work if you later move to self-hosting, because the import and export options described elsewhere on this page are the practical exit path. Compare those answers against your own assessment of who must be able to access, audit and delete content.
If the hosted service cannot meet a residency, key management or audit requirement, self-hosting is the path that gives you direct control, and you should price the platform team time it needs before committing. If your constraint is staffing rather than data rules, a hosted plan may be the lower-risk way to start, provided you verify the terms above. A practical check is to run a short pilot on both: deploy the Docker template in a non-production environment, import a representative space, test real-time editing through your proxy, and rehearse a restore. Illustratively, a team that cannot confirm audit logs on the hosted tier would still need to self-host or upgrade before the wiki holds regulated records.
How DeployOpen scopes and delivers Docmost on either edition
DeployOpen plans, implements, integrates, hardens, backs up, documents and supports self-hosted open-source platforms inside your own infrastructure, so the edition decision is made against your identity, audit and hosting requirements. The same method applies whether you run the AGPL Community edition or a licensed Business or Enterprise plan.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope lists which Community, Business or Enterprise features your team needs, such as SSO, SCIM, MFA or audit logs.
- Scope records where Docmost will run, including cloud account, data center or air-gapped network, and how files are stored.
How we build
- Deployment covers the Docker-based install, PostgreSQL and Redis configuration, and secret handling for the APP_SECRET value.
- Identity integration is configured against your directory and tested for LDAP, SAML 2.0 or OIDC sign-in, and MFA enforcement.
- Reverse proxy settings are checked so WebSockets work for the real-time editor, and migration from Confluence, Notion or DOCX is tested on sample content.
How we hand over
- Deliverables include configuration documentation, runbooks for upgrades, backups and restores, and a record of the edition chosen.
- Permission model and page-level access rules are documented so your administrators can review them after handover.
- Evidence for compliance assessments is prepared as operational records, while independent auditors and certification bodies issue any audit outcome.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, separate from the initial fixed-scope work.
- Before any plan change, we can review which paid features your requirements need and what a license change would alter in your setup.
- Ask any quote to separate one-time implementation work from recurring retainer and vendor subscription costs.
