What an EspoCRM implementation involves
EspoCRM is an open-source CRM written in PHP and licensed under the AGPL-3.0. It ships with accounts, contacts, leads, opportunities, cases, campaigns, email and calendar, a single-page web interface and a REST API. Its Entity Manager can add entity types, fields and relationships, so teams also use it as a platform for business applications beyond sales.
Most requirements can be met through the administration panel: entities, layouts, dynamic logic, formula scripts, roles and teams. Code is needed for hooks, custom services and integrations. An implementation decides which layer each requirement uses, designs the access model, connects email and other systems, and migrates data from the CRM or spreadsheets being replaced.
EspoCRM's core is free. Reports, workflows and BPM come from the Advanced Pack, and quoting, orders, invoicing and inventory from the Sales Pack, both sold separately by the EspoCRM team. Settle which packs are in scope during discovery, because they change what has to be built.
Customization layers
Customizations made in the administration panel are stored in the custom directory and can be copied to another instance. New entities, fields and relationships get a c prefix to avoid clashes with future versions.
| Layer | Use it for | Upgrade note |
|---|---|---|
| Entity Manager | New entity types (base, person, company, event) and new fields and relationships on existing ones. | UI-made changes are expected to survive upgrades. |
| Layout Manager and Dynamic Logic | Detail, list and filter layouts, plus fields shown, required or read-only based on conditions. | Stored as metadata. Review layouts after major upgrades. |
| Formula | Before-save scripts that calculate fields or create related records, and an API before-save script for validation and duplicate checks on saves made through the API, which includes the web interface. | Keep scripts short and documented. Test them after each upgrade. |
| Hooks and custom code | PHP hooks such as beforeSave and afterSave in custom/Espo/Custom or a module, plus custom services and API actions. | EspoCRM warns that code customizations may break on upgrade, so keep them in Git with tests. |
| Extensions | Packaged modules installed as zip files from the administration panel or the CLI. | Check each extension's support for the target version before upgrading. |
Core, packs and custom work
Core
CRM entities, email, calendar, portals, roles and teams, import, formula, webhooks, LDAP and OpenID Connect sign-in, and the REST API.
Advanced Pack
Reports, workflows and BPM with gateways, events and activities. Use it for approval flows, scheduled follow-ups and multi-step processes that would otherwise need code.
Sales Pack
Products, prices, quotes, sales and purchase orders, invoices, inventory, payments and taxes. Compare it with your ERP or billing system before deciding where those records live.
Custom modules
Code built as an EspoCRM module or extension for integrations or logic the packs do not cover. Package it so it can be installed, upgraded and removed cleanly.
How the implementation runs
Map lead intake, the sales pipeline, account management and service cases with the teams that run them. Record stages, required fields, assignment rules, mailboxes, reports and connected systems.
Define entities, fields, relationships and layouts, then roles and teams. Decide what formula, Advanced Pack workflows or code will handle, and write each rule down with its owner.
Configure on a development instance, keep the custom directory and any modules in Git, and promote changes to staging and production by deployment.
Test each role on migrated data: record access, email import, workflows, scheduled jobs and reports. Train team leads first, then users by role.
Freeze the old system, run the final import, switch mailboxes and integrations, and keep close support through the first weeks.
Integrations and the API
The REST API lives under api/v1 and covers CRUD, relationships and metadata. EspoCRM recommends a separate API user for each integration, with a role that grants only what it needs. API users authenticate with an API key in the X-Api-Key header or with HMAC signatures, which the documentation calls the most secure method. Basic authentication is not recommended.
Webhooks push record events to other systems, and lead capture forms bring website leads in. Personal and group email accounts connect over IMAP and SMTP and link messages to records. ERP and billing integrations usually run through middleware or a custom module that calls the API, with one system named as the owner of each shared record.
Migrate with the import tool
Common predecessors are SuiteCRM, Salesforce, HubSpot, other CRMs and spreadsheets. Export to UTF-8 CSV, clean the data, and import in dependency order: users and teams, accounts, contacts, leads, opportunities, cases, then activities.
| Import feature | What it does | Use in a migration |
|---|---|---|
| Create, Create & Update, Update Only | Creates records, or matches on chosen fields and updates them. | Use Create for the first load and Update Only for corrections. |
| Execute in idle | Processes the import through cron. | Use it for large files so the web request does not time out. |
| Silent mode | Skips most after-save scripts, stream notes and workflows. | Stops historical records from triggering notifications and automations. |
| Relate by name | Links records to related records by name when IDs are missing. | Load accounts first so contacts and opportunities attach to them. |
| Revert import | Removes all records created by an import. Updates made by the import are not reverted. | Undo a failed rehearsal, then remove the import log once data is accepted. |
Hosting, access and backups
The current server requirements list PHP 8.3 to 8.5 with MySQL 8.0 or later, MariaDB 10.6 or later, or PostgreSQL. Run scheduled jobs through cron every minute, and add the daemon and WebSocket server where parallel jobs and live updates are needed. Official Docker images are available.
OpenID Connect sign-in has been available since v7.3, with provider groups mapped to EspoCRM teams and optional user creation on first login. EspoCRM cannot act as an identity provider itself. LDAP covers Active Directory and OpenLDAP.
Built-in two-factor authentication supports TOTP, email and SMS. It does not apply to OIDC logins, so enforce 2FA at the identity provider and keep fallback login limited to administrators.
Roles set access per entity and action, at levels such as all, team or own records. Treat users with import access as privileged, since an import can change many records at once.
Back up the whole EspoCRM directory and a database dump together. data/config-internal.php holds the database credentials, so protect backups accordingly, and restore to a separate host to confirm records, attachments and cron work.
EspoCRM operating ownership
A small team can run EspoCRM, provided platform, configuration and data each have an owner.
Platform
- Run PHP, the web server, the database and cron.
- Upgrade with the CLI after staging tests.
- Monitor scheduled jobs, email fetching and logs.
CRM administrators
- Own entities, layouts, formula and workflows.
- Manage roles, teams and portal users.
- Record every rule and its owner.
Data owners
- Merge duplicates and archive stale records.
- Approve imports and mass updates.
- Keep field definitions consistent across teams.
Security
- Review administrators and API users.
- Rotate API keys and HMAC secrets.
- Check who can export or import data.
EspoCRM implementation questions
How do upgrades work?
Run php command.php upgrade from the CLI, which installs the next version and can be repeated until the instance is current; the documentation advises against upgrading through the web interface. Back up first and enable maintenance mode. Upgrade PHP first when the next version needs it.
Will customizations survive upgrades?
Changes made in the administration panel should. Code customizations and extensions may break, and EspoCRM says incompatibilities are very likely on major upgrades and possible on minor ones. Test on a staging copy and read the release notes.
EspoCRM or SuiteCRM?
EspoCRM is a single PHP application with a single-page interface, and its reports, workflows and BPM are sold separately in the Advanced Pack. SuiteCRM includes workflows and reports in its open-source core and runs its SuiteCRM 7 code as a legacy layer inside SuiteCRM 8. Compare both against your processes and team skills.
Can EspoCRM support SOC 2 or ISO 27001 readiness?
DeployOpen reviews roles, API users, hosting and change control, runs security testing and helps prepare evidence for SOC 2, ISO 27001, DORA or NIS2 readiness. DeployOpen does not issue audit reports or certifications.
Scope and handover
Effort depends on the number of teams and processes, custom entities, the packs in use, code and integrations, data volume and quality, and the number of users to train.
DeployOpen runs discovery, designs entities, layouts and the access model, builds formula, workflows and custom modules, integrates SSO, email and other systems, migrates data, deploys and hardens EspoCRM in your infrastructure and trains administrators and users. Handover includes the data model and role matrix, the rule register, the repository for custom code, integration specifications, import mappings and counts, restore test results and the upgrade procedure.
