Why EspoCRM for B2C businesses starts with the contact, not the account
Consumer businesses sell to individuals, so the first design decision is where the customer record lives. EspoCRM is configured for B2B by default, with the Account entity as the anchor for companies and their contacts. For a business whose customers are people, that default puts an unused layer between the team and every lead, order or conversation. Enabling B2C Mode in Settings, then removing the Account tab, Account fields and Account access from navigation, layouts and roles, moves the model so that the contact is the primary record. Before you change anything, list every place Account appears in your current setup, including layouts, filters, reports and roles, so nothing is left pointing at a hidden entity.
Once the contact is the anchor, the work shifts to pipelines, lead capture and mass email. Opportunities and leads should attach directly to contacts, and the stages you define should reflect how individuals buy, such as enquiry, quote, purchase and repeat order. Lead capture forms, imports and any web-to-lead flow should create contacts with the fields your marketing and service teams really use, so duplicates are caught at entry. Mass email target lists should be built from contact fields such as consent status and purchase history. Confirm with your email provider and your legal adviser how opt-in and unsubscribe handling will work for individuals before the first campaign runs.
B2C mode does not change how you host or license EspoCRM. The software remains self-hosted on infrastructure you control, it is licensed under AGPL-3.0, and the open-source edition can be downloaded for free. Your identity, backups, access controls and data location stay under your own governance. Confirm with your team which hosting and security settings apply to a contact-centric instance, and read the EspoCRM B2C documentation to check which settings your version supports before planning the change.
Which consumer-business requirements shape the EspoCRM build
This table maps the requirements typical of consumer-facing operations to the EspoCRM documentation that governs them and to what each one means for the build. Read each row as a design decision to settle before configuration starts, since several of them change the data model, the navigation and the access rules at once.
| Requirement | Documented EspoCRM behavior | What it means for the build |
|---|---|---|
| Individual customers without company records | B2C mode is enabled in Settings, and the Account tab, Account fields and Account access are removed from navigation, layouts and roles (B2C docs) | Contacts become the primary customer record, so pipelines, layouts and reports must be rebuilt around contacts rather than accounts |
| Lead capture from web forms | Leads are created through the API and inbound channels; the API supports API users with role-based permissions (API docs) | Form submissions need a dedicated API user with narrow permissions, and duplicate handling must be decided before forms go live |
| Bulk import of existing customer lists | CSV import offers Create Only, Create and Update, and Update Only modes, field mapping, duplicate matching and reverting imported records (import docs) | Confirm duplicate matching fields in a test run, and plan how to revert a bad import before loading the full contact base |
| Mass email to large contact lists | Mass email campaigns and target lists are part of the email feature set, and large imports run through cron (import docs, server configuration docs) | Background jobs must be scheduled and monitored, and sending volume and provider limits should be confirmed with the mail provider |
| Consent and personal data handling | Data handling depends on the fields, roles and deletion practices configured in the instance; EspoCRM documents security controls rather than legal compliance (security docs) | Consent fields, retention and erasure steps need to be designed by your legal and privacy team, then built and tested in EspoCRM |
| Admin access control for shared staff | The security docs recommend strong password policy, 2FA, avoiding admin accounts for daily work and IP restriction (security docs) | Customer service staff should get scoped roles, and admin rights should be limited to a small named group with logged activity |
| Customer identity sign-in | OpenID Connect sign-in is supported since version 7.3, with optional user creation on first login and team mapping (OIDC docs) | Staff sign-in can be centralized, but EspoCRM's own 2FA is not compatible with OIDC, so identity provider controls must replace it |
Which settings, modules and integrations matter for consumer businesses
A consumer business runs on people, not accounts, so most of the work is turning off B2B defaults and building the right contact flow. The cards below cover the settings that change the data model, the pipeline and follow-up, the import and email tools that handle large customer lists, and the sign-in setup for staff.
Enable B2C mode and remove accounts
B2C mode is set in Settings, but it does not finish the job on its own. The Account tab, Account fields and Account access still need to be removed from navigation, layouts and roles, or staff will keep creating company records for individual buyers. Check each layout and role after the change, not just the global setting. Walk through the result with a sales user and a service user before you load any data.
Contact-centric pipelines
Without accounts, the Contact becomes the anchor for every interaction, so opportunities and their stages need to hang off the person. Decide whether a sale starts as a Lead or directly as an Opportunity, and align the Opportunity layout with the stages your team actually uses. Test how a returning customer with two purchases appears in the pipeline. Ambiguous ownership at this stage makes later reporting unreliable.
Advanced Pack workflows for follow-up
Follow-up rules such as reminders after an enquiry, a post-purchase check-in or a lapsed-customer task depend on the Advanced Pack's Workflows and BPM engine. The Advanced Pack is included in all EspoCRM Cloud plans, so cloud customers do not need a separate purchase for it. Self-hosted instances must add it through the official route. Confirm the license and plan before you design the rules, since they shape what you build.
CSV import with duplicate matching
Consumer lists often arrive from point-of-sale exports, webshops and event sign-ups, with the same person appearing several times. Choose the matching fields before import, such as email address or phone number, and select a mode that creates, updates or skips records deliberately. Run a small test file first and keep the revert option in mind. Large files should run through cron so the browser does not time out.
Mass email and target lists
Target lists let marketing and service teams send campaigns to defined groups of contacts without exporting data to a separate tool. Define how consent and opt-out status are recorded before the first send, because a list built from an old import may contain people who never agreed to receive mail. Review bounce handling and sending limits with your mail provider. Confirm the mass email setup in your own environment before you rely on it for a launch.
OIDC sign-in for staff
Staff accounts are the one place where a consumer business still needs strong identity control. EspoCRM supports OpenID Connect sign-in with optional user creation on first login, group-to-team mapping and a fallback login method. EspoCRM's own two-factor authentication is not compatible with OIDC, so the identity provider must enforce MFA. Plan the fallback login carefully so that an identity provider outage does not lock out the whole team.
How a B2C EspoCRM rollout runs, phase by phase
The sequence moves from agreeing the contact model to a handed-over system, so that sales and service teams work from one contact-centric pipeline with clean navigation, controlled data and a tested routine for backups and admin work. Durations depend on data volume and scope, which are confirmed in the written scope before work starts.
Confirm the contact model and pipeline stages
Sales and service leads agree which records the business tracks (contacts, households, orders or service requests), which fields each team needs, and the stages each pipeline passes through from first enquiry to customer. DeployOpen documents these decisions as a short design record that names the entities, fields and stage definitions. The step is done when both leads sign off the record, because every later step depends on it. Ask your partner to confirm which of these choices are reversible after data is loaded.
Enable B2C mode and clean up navigation
The team checks B2C Mode in Settings, then removes the Account tab, Account fields and Account access from navigation, layouts and roles, as the EspoCRM B2C documentation describes. Contact layouts and list views are reworked so that the fields sales and service staff use appear first. The step is complete when a test user in each role sees no account references in menus, detail views or list filters. Check the effect on existing integrations and reports before this change reaches production.
Set up roles, teams and access
Roles are rebuilt around the teams identified in the first step, so that sales, service and administration each see only the scopes they need. Admin accounts are kept separate from daily-use accounts, in line with the EspoCRM security recommendations. The step closes when a permission matrix is reviewed with each team lead and a test user per role confirms what they can open, edit and export. Ask for this matrix as a written deliverable.
Migrate contacts with import and duplicate rules
Source data is cleaned and mapped to the contact fields agreed earlier. Records are loaded with the CSV import in a test instance first, using the matching mode that fits each file (Create Only, Create and Update or Update Only), with duplicate matching on chosen fields. Large files run through the cron-driven idle execution the import docs describe. The step is done when import counts reconcile with the source, duplicate rules have been reviewed by a business owner and the import can be reverted if a batch is wrong.
Configure lead capture and mass email
Lead capture forms and the mailboxes that send and receive contact email are configured, along with the mass email templates and target lists that the marketing or service team will use. Consent wording and opt-out handling are confirmed with the business owner before any campaign is sent. The step closes with a test submission that creates the expected contact and a test campaign delivered to internal addresses. Confirm the mail provider, sending limits and bounce handling in your own environment, since these are not fixed by EspoCRM itself.
Pilot with one team
One sales or service team works live in the new setup for a defined period agreed in the written scope. The team logs real enquiries, moves contacts through the agreed stages and sends a test campaign. DeployOpen collects defects and layout requests, and the change list is closed or deferred with the team lead. The pilot is done when the team confirms the pipeline matches how they work and that no open issue blocks the wider rollout.
Hand over admin and backup routines
Administrators are trained on role changes, imports, mass email and routine checks, and a written runbook covers backup, restore and upgrade steps. Backup schedules and restore tests are run and recorded, and the platform's security settings, such as password policy, two-factor authentication and admin account separation, are confirmed. The step is complete when the client's administrators perform a restore test and the runbook, access list and open-issue log are accepted in writing.
How the setup differs for direct sellers, service providers and subscription-style consumer brands
Direct sellers with high contact volume usually work a large number of individual leads and buyers, most of whom never need a relationship record beyond a purchase. The pipeline tends to be short and repetitive, so the configuration should favor speed of entry and clear stages over detailed opportunity fields. Once B2C mode removes account-level structure, contacts become the main record and the layouts should put purchase intent, source and consent in view at the top.
- Short pipeline stages: Define a few stages such as new inquiry, quote sent, order placed and follow-up, so staff can move contacts without filling in long forms.
- Lead source capture: Make the source of each contact a required field on the contact layout so campaign and channel reporting stays usable.
- Compact contact layouts: Show product interest, last purchase and preferred channel on the list view, and move rarely used fields to a detail panel.
- Mass email segments: Build target lists from contact fields such as product interest and opt-in status before any campaign goes out.
- Duplicate matching: Choose the fields used for duplicate matching during imports, typically email and phone, so repeat buyers are not created twice.
Before go-live, confirm with your team how consent is recorded and which contacts can receive mass email, since high volume increases the impact of an error.
Service providers such as clinics, salons, repair shops and home services work around bookings rather than sales cycles. The key record is the scheduled visit or the service request, and the contact often needs to be linked to a history of past appointments. The pipeline should reflect the booking path from first enquiry through confirmation, visit and follow-up, and the layouts should show the next appointment prominently.
- Booking-led stages: Use stages for enquiry, appointment requested, confirmed, completed and review requested, so the pipeline reads as a service calendar.
- Service history on the contact: Add linked fields or related lists that show past services, so staff see context before the next visit.
- Reminder steps: Plan reminder emails or tasks before each appointment, and confirm with your team whether those messages need a separate mailbox.
- Team assignment: Assign contacts to teams or branches so each location sees only its own follow-up work.
- Access limits for staff: Restrict who can view full contact histories, especially where health or personal details are recorded.
Check whether any scheduling you need is covered by a core feature or an official module, and confirm that before the layouts are designed around it.
Subscription-style consumer brands, such as meal kits, memberships, clubs and recurring delivery services, care most about retention and renewal. The contact is the unit of value, and the lifecycle runs from trial or sign-up through active membership, renewal and cancellation. The configuration should therefore emphasize status fields, renewal dates and churn reasons, with pipelines that handle win-back as a separate path.
- Lifecycle status fields: Model membership status as a controlled list (trial, active, paused, cancelled) that the pipeline and reports both use.
- Renewal date fields: Store the next renewal date on the contact so scheduled reports and follow-up tasks can rely on it.
- Cancellation reasons: Require a reason when status moves to cancelled, which gives the retention team usable data.
- Win-back pipeline: Keep a separate pipeline for former members, so reactivation efforts do not clutter the sales view.
- Billing boundaries: Decide whether payment data stays in the billing system or in EspoCRM, and confirm which payment integrations are in scope before storing any card-related information.
Confirm which workflow and reporting features your plan needs before designing renewal automation, because the setup depends on them.
What buyers ask before hiring a partner for a B2C EspoCRM setup
What drives the cost of a B2C EspoCRM setup?
The main cost driver is how much of the CRM you change. Switching off the Account tab, account fields and account access in B2C mode is a configuration task, while contact-centric pipelines, custom entities, lead capture forms and mass email templates add design and build time. Other cost components are the hosting you run, the official extensions you choose, and any data migration from spreadsheets or another CRM. The software itself is free to self-host under AGPL-3.0, so the quote covers people's time, not licenses. Ask for a written scope that lists each pipeline, form, template and integration separately, with what is one-time and what recurs, such as hosting and ongoing support.
How long does a B2C EspoCRM implementation take?
Duration depends on the number of pipelines, lead sources, integrations and the state of the contact data you migrate. A single contact-centric pipeline with a web form and one mass email list is a much smaller job than several pipelines fed by ads, marketplaces and point-of-sale exports. Testing with real users and a rehearsed import also takes time, especially when duplicate matching rules need tuning. DeployOpen does not publish timelines. Ask the partner for a phased plan with milestones and the assumptions behind each phase, and confirm which items are fixed in the written scope.
What does the business need to provide before the build starts?
The build depends on decisions the business must make first. Prepare a clean export of existing contacts with the fields you actually use, a list of the stages each pipeline needs, and the lead sources you will capture. Consent rules are essential for consumer contacts: record which marketing opt-ins you hold, how they were obtained, and how people withdraw consent, so mass email and lead capture can reflect that. The CSV import supports field mapping and duplicate matching on chosen fields, so agree those keys early. Confirm with your legal or compliance lead which consent and retention rules apply in your markets.
Can an internal administrator set up B2C mode without a partner?
Yes, an experienced administrator can enable B2C Mode in Settings and remove the Account tab, account fields and account access from navigation, layouts and roles, because the EspoCRM B2C documentation describes those steps. The harder part is the surrounding design: pipeline stages, duplicate rules, roles that limit who sees which contacts, and mass email governance. A partner is most useful when the team lacks time for testing or when integrations and migration are in scope. Before deciding, check whether your administrator can also run upgrades, backups and access reviews over time.
Do we need the Advanced Pack for a B2C setup, and what does it cost?
Not for the core B2C configuration. The B2C changes described in the EspoCRM documentation work in the open-source edition. The Advanced Pack, an official add-on, provides reports, Business Process Management and workflows, so you need it for automated follow-up sequences, scheduled reports or approval steps. Per the EspoCRM pricing page, EspoCRM Cloud costs 15 US dollars per user per month on the Basic plan (minimum 3 users), 25 dollars on Enterprise (minimum 5 users) and 69 dollars on Ultimate (minimum 10 users), and the Advanced Pack is included in all cloud plans. Self-hosted use would need its own licensing check on the official pages before you rely on it.
How do EspoCRM upgrades affect a B2C setup?
Upgrades can touch your customizations, so a B2C setup should be tested after each one. Changes to the Account tab, layouts, roles and custom entities must still behave as intended, and any extensions must be compatible with the target version. The EspoCRM server requirements list PHP 8.3 to 8.5 and MySQL 8.0 or newer, MariaDB 10.6 or newer or PostgreSQL 15, so check your hosting stack against the target release. As of version 10.0, upgrading through the UI is disabled by default, so plan for the CLI process. Ask the partner for an upgrade procedure that includes a backup, a staging test and a rollback plan.
Does a B2C setup need single sign-on or extra security controls?
Staff access to consumer data is a security question even without business accounts. EspoCRM supports OpenID Connect sign-in since version 7.3, and its own two-factor authentication is not compatible with OIDC, so plan the identity model before you enable it. The EspoCRM security documentation recommends a strong password policy, two-factor authentication where it applies, avoiding admin accounts for daily work and restricting access by IP address. Confirm which controls your security team requires and document them in the scope.
What should a quote for B2C EspoCRM include?
A useful quote lists the work by area: B2C configuration, pipelines and layouts, lead capture, mass email setup, migration, integrations, testing, training and handover. It should separate one-time build effort from recurring costs such as hosting, extensions and support or upgrade retainers. Ask who performs each task, what the partner needs from your team, and which assumptions could change the price, such as data quality or the number of lead sources. Fixed-scope engagements agree scope, deliverables and timelines in writing before work starts, so request that format.
What consent and personal data handling means for consumer contact records
Consumer contact records are personal data, and an EspoCRM B2C setup holds a lot of it. Without accounts to group people under, every lead, customer and prospect is a contact with its own email address, phone number, purchase history and marketing preferences. Before you configure anything, list which fields you collect, who can see them, how long you keep them and which lawful basis or consent record supports each marketing use. Those decisions belong to your legal and privacy team, and you should confirm the obligations that apply to your markets with counsel. A partner can build the technical controls around those decisions, but cannot decide what the law requires for your customers.
On the platform side, the EspoCRM security documentation gives a clear baseline. It recommends enforcing a password policy, requiring two-factor authentication, avoiding admin accounts for daily work, limiting authentication token lifetime, disabling password recovery for admins and restricting access by IP address. For a consumer business, the admin role and the roles that export or mass-email contacts matter most. Check that marketing staff do not hold admin rights, that exports are limited to the roles that need them, and that your identity provider enforces sign-in controls if you use the OIDC setup. Note that EspoCRM's own two-factor authentication is not compatible with OIDC, so confirm which second factor your identity provider provides.
Evidence is the part teams underestimate. A partner can document role matrices, configuration baselines, import and export procedures and access reviews, and prepare them for an assessment. Independent auditors and certification bodies issue any audit report or certification, and regulators decide whether your handling of consent and personal data complies. Ask your implementation partner to deliver a written control list mapped to your own requirements, and ask your counsel to review the consent wording, retention periods and opt-out handling before the first mass email campaign runs.
Controls to plan before consumer contact data enters EspoCRM
Consumer contact records are personal data from the first import, so access, sign-in, session and recovery settings need decisions before anyone loads a list. The cards below cover the EspoCRM features that control who sees those records, how people sign in, how long sessions last, and how you get back in or restore data when something goes wrong.
Roles, teams and API users
Roles in EspoCRM define what each user can read, create, edit and delete, and teams limit which records they see. For B2C work, decide who may view full contact details, who may export lists, and whose accounts may use the API. Create dedicated API users with narrow roles instead of reusing a person's login. Check that portal roles, if you use a portal, cannot reach contact data they should not see. Test each role with a sample user before go-live.
Single sign-on with OpenID Connect
EspoCRM supports OpenID Connect sign-in, with optional user creation on first login and mapping of identity provider groups to teams. Decide whether accounts are created automatically or pre-provisioned by an administrator, and who removes access when a staff member leaves. Keep a fallback login method for the case where the identity provider is unavailable, and confirm who holds it. Note that EspoCRM's own two-factor authentication is not compatible with OIDC, so second factor enforcement moves to your identity provider.
Session and token lifetime
The security guidance recommends limiting auth token lifetime and enforcing a password policy, and restricting admin access by IP address. Set token and session lengths that suit staff who handle customer calls on shared or mobile devices. Decide whether to allow IP restrictions for the admin area and the API. Review these settings after each change to sign-in methods, since OIDC and local passwords behave differently.
Admin separation and recovery
Keep administrator accounts out of daily sales and service work, and disable password recovery for admins as the security guidance recommends. Decide who holds admin access, how a locked-out administrator regains control, and where the recovery steps are written down. Test the recovery path on a staging instance. Without a tested path, a lost admin login can stall the whole deployment during a customer data incident.
Backups before and after import
Take a full backup before loading consumer contacts, because CSV imports can create and update many records at once. EspoCRM's import tool can revert imported records, but confirm that this covers the scope you expect and that a full database restore is still tested. Keep an import log that records the file, the operator, the matching fields and the mode used (Create Only, Create and Update, or Update Only). Store backups where access is restricted to the same people who may see contact data.
Upgrades and API exposure
Upgrading through the UI is disabled by default as of version 10.0, so plan upgrades through your own change process. Before any upgrade, confirm that API users and their permissions survive the change and that the access settings you tested still apply. Decide who may enable API access for integrations, and review API user activity after each upgrade. Record which upgrade path your team will follow so consumer data is never exposed through an untested configuration.
How DeployOpen scopes and delivers a B2C EspoCRM implementation
DeployOpen plans, implements, customizes, integrates, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For EspoCRM in a consumer-facing business, we start by agreeing on the contact-centric model, the lead sources and the data you must keep before any configuration begins.
How we scope
- The written scope lists which B2C settings, removed Account fields and tabs, and contact pipelines are included.
- We confirm your lead capture sources, mass email needs and roles that will see contact data.
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- Hosting location, identity provider and any extensions you plan to use are recorded in the scope.
How we build
- We enable B2C Mode and remove Account access from navigation, layouts and roles in a test instance first.
- Contact-centric pipelines, layouts and formula logic are built and reviewed with your sales and service leads.
- Lead capture, import mappings and mass email settings are tested with sample records before go-live.
- Role and access checks confirm that teams see only the contact data their work requires.
How we hand over
- You receive documentation of the configuration, roles, layouts, formulas and integration settings.
- Admin accounts are separated from daily-use accounts, and the security settings we apply are recorded.
- Staff walkthroughs cover how to create contacts, manage leads and run campaigns in the new setup.
- Backup and restore steps are documented so your team can run them without outside help.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Support can cover upgrade planning for future EspoCRM releases, including extensions and PHP requirements.
- Ask any partner to confirm how changes to B2C settings are tracked, reviewed and rolled back.
- Confirm response expectations and service levels in writing before you sign the retainer.
