What a SuiteCRM implementation involves
SuiteCRM is an open-source CRM licensed under the AGPL-3.0 and maintained by SuiteCRM Ltd. It covers accounts, contacts, leads, opportunities, cases, campaigns, quotes, contracts and invoices, with security groups for record-level access. Its code base started from the last open-source SugarCRM release, which still shows in its module structure.
SuiteCRM 8 adds an Angular front end and a Symfony application layer, and runs the SuiteCRM 7 code inside it as a legacy layer. Customizations can therefore live in two places: the SuiteCRM 8 extension framework, or the legacy Studio, Module Builder, workflows and logic hooks. Deciding which layer each change belongs to is one of the first design tasks.
An implementation maps your sales, service and marketing processes onto modules and fields, sets up roles and security groups, automates the routine steps, connects email and other systems, and migrates data from the CRM being replaced.
Versions and support windows
From SuiteCRM's supported versions page. Non-ESR releases have no security-only period, and so far each 8.x minor release has been supported until the next one arrived.
| Version | Support | What it means |
|---|---|---|
| 8.10 | Current release, first released in April 2026. | Target for new projects. Supports PHP 8.2 to 8.4, MariaDB 10.6 to 11.8, MySQL 8.0 and 8.4, on Apache 2.4. |
| 8.9 | Active support ended in April 2026. | Upgrade to 8.10. Plan to follow 8.x minor releases as they ship. |
| 7.15 ESR | Active support until December 2027, security fixes until March 2028. | A supported base for SuiteCRM 7 sites while the move to 8 is planned. |
| 7.14 ESR | Security support ended in March 2026. | Move to 7.15 or migrate to SuiteCRM 8. |
Where customizations live
Use configuration tools first and code where logic needs tests. Every code change is reviewed against each new 8.x release.
Studio
Edits labels, fields, relationships, layouts and subpanels for each module. Changes are written as metadata under the legacy custom directory, so keep them in version control.
Module Builder
Creates new modules from templates such as company, person or basic, packaged for deployment. Suited to simple record types such as a project register or asset list.
Workflows
Conditions and actions on any module, run on save or by the scheduler: create records, send emails, update fields. Formerly Advanced OpenWorkflow (AOW).
Logic hooks
PHP code fired on application, user and module events such as before and after save. Common for validation, calculated values and calls to external APIs.
SuiteCRM 8 extensions
Each extension is a folder under extensions/ with backend code autowired into Symfony (record validators, save handlers, process handlers) and an Angular front end loaded through module federation.
How the implementation runs
Map lead handling, the sales pipeline, quoting, case management and campaigns with the teams that run them. Record stages, required fields, assignment rules, reports, mailboxes and connected systems.
Decide which standard modules to use, rename or hide, which fields and relationships to add, and where a custom module is needed. Design roles and security groups early, since they control who sees which records.
Build workflows for assignment, follow-ups and notifications, and logic hooks or extensions for rules that need code. Keep a register of every automation with its trigger and owner.
Test each role's daily work on migrated data, including email import, workflows, scheduled jobs and reports. Train team leads first, then users by role with short guides.
Freeze the old CRM, run the final import, switch mailboxes and integrations, and keep close support through the first weeks.
Integrations and APIs
The SuiteCRM 8 front end talks to a GraphQL API at api/graphql. The V8 REST API, with OAuth2 bearer tokens and JSON:API-style payloads, comes from the SuiteCRM 7 code base and is reached through the legacy layer, so test the exact path on your installation.
| System | Approach | Design point |
|---|---|---|
| Personal and group mailboxes over IMAP and SMTP, linked to records and cases. | Check the authentication your mail provider requires and plan shared mailbox ownership. | |
| ERP and billing | V8 API calls from a middleware or the ERP, with a dedicated OAuth2 client. | Decide which system owns accounts, products and invoice status. |
| Website and forms | Web forms from the Campaigns module, or API calls from the website back end. | Validate input and add spam protection before records are created. |
| Reporting | Built-in reports, or reads from a database replica into a BI tool. | Respect security groups when data leaves the CRM. |
Migrate from SuiteCRM 7 or another CRM
SuiteCRM treats the move from 7 to 8 as a migration to a new SuiteCRM 8 installation, with the SuiteCRM 7 code and data running as its legacy layer. Each migration package names the minimum 7.x version it accepts, and the process may remove non-core files under public/legacy, so audit custom code, add-ons and themes first and rehearse on a staging copy with a full backup of files and database.
From SugarCRM Community Edition or older SuiteCRM releases, the data model is close and much of the work is cleaning and mapping custom fields. From other CRMs or spreadsheets, export to CSV, map fields and relationships, and load with the import tool or API scripts in dependency order: users, accounts, contacts, leads, opportunities, cases, then activities and notes.
Run at least one full rehearsal, compare record counts and spot-check relationships and assigned users with the data owners, then repeat the final import during a short freeze.
Hosting, access and upgrades
Point the document root at the public folder. SuiteCRM warns that a web root on the main folder can expose all files. Enable URL rewrites so api/graphql works, and install the PHP modules listed for your release.
A cron job runs the schedulers for workflows, email import and other tasks. From 8.10, asynchronous tasks run on a Symfony Messenger worker, which needs its own service and monitoring.
SuiteCRM 8 documents SAML (with a separate configuration reference for 8.7 and later) and LDAP authentication. Decide how users are provisioned and how roles and security groups are assigned, and keep a local administrator for recovery.
Configure trusted hosts, login throttling and session storage, keep secrets in Symfony secrets or the environment, and restrict admin users. Follow the SuiteCRM security policy and apply security releases promptly.
Back up files and database, upgrade a staging copy first, and review the documented metadata merge modes so Studio changes are kept. Retest extensions, logic hooks and workflows after each release.
SuiteCRM operating ownership
A CRM stays useful when someone owns the platform, the data and the rules that change it.
Platform
- Run PHP, the web server, the database, cron and the Messenger worker.
- Apply minor and security releases after staging tests.
- Monitor scheduler runs, email import and errors.
CRM administrators
- Own Studio changes, workflows and reports.
- Manage roles and security groups.
- Keep the automation register current.
Data owners
- Merge duplicates and archive stale records.
- Agree field definitions with sales and service.
- Approve bulk imports and updates.
Security
- Review admin accounts and OAuth2 clients.
- Check exports and API access to personal data.
- Track SuiteCRM security releases.
SuiteCRM implementation questions
Should we start new work on SuiteCRM 8 or 7?
On SuiteCRM 8. 7.15 ESR keeps existing sites supported until 2028, but new customizations built for 7 add work to the later migration.
Do our SuiteCRM 7 customizations survive the move to 8?
Many legacy customizations keep working inside the legacy layer, and some need rework or replacement with SuiteCRM 8 extensions. The audit and staging rehearsal show which ones.
Can SuiteCRM hold data for regulated teams?
Yes, with care over access and hosting. DeployOpen reviews roles, security groups and the deployment, runs security testing and helps prepare evidence for SOC 2, ISO 27001, DORA or NIS2 readiness. DeployOpen does not issue audit reports or certifications.
Scope and handover
Effort depends on the number of teams and processes, custom modules and code, legacy customizations to carry from SuiteCRM 7, integrations, data volume and quality, and the number of users to train.
DeployOpen runs discovery, designs the data model and security, builds Studio changes, workflows and extensions, integrates SSO, email and other systems, migrates data, deploys and hardens SuiteCRM in your infrastructure and trains administrators and users. Handover includes the data model and role matrix, the automation register, the code repository, integration specifications, migration scripts and counts, restore test results and the upgrade procedure.
