AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomsespocrm
EspoCRM is a free, open-source CRM platform built in PHP with a single-page application frontend and REST API backend. It supports lead, contact, sales, marketing, and support case management with full customization via extensions and custom entities.
Key facts
Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.
| Field | Value |
|---|---|
| Repository | espocrm/espocrm |
| Owner | espocrm |
| Primary language | PHP |
| License | AGPL-3.0 — OSI-approved |
| Stars | 3.1k |
| Forks | 895 |
| Open issues | 59 |
| Latest release | 10.0.1 (2026-07-07) |
| Last updated | 2026-07-07 |
| Source | https://github.com/espocrm/espocrm |
What espocrm is
PHP 8.3–8.5 backend (REST API) with MySQL 8.0+, MariaDB 10.3+, or PostgreSQL 15+ database support. Frontend is a custom SPA framework with TypeScript components and service-based dependency injection. Metadata-driven via JSON Schema; SOLID principles and static typing in backend.
Get the espocrm source
Clone the repository and explore it locally.
git clone https://github.com/espocrm/espocrm.gitcd espocrm# follow the project's README for install & configurationNeed it deployed, integrated, or customized instead? DEV.co ships production installs.
Best use cases
Implementation considerations
- PHP 8.3–8.5 and compatible database (MySQL 8.0+, MariaDB 10.3+, PostgreSQL 15+) must be provisioned and configured per official server guidance.
- AGPL-3.0 license requires careful review if modifying code or deploying as a service; document compliance strategy and source disclosure obligations.
- Custom entity and field creation, extension development, and form view customization assume developer proficiency with PHP, REST APIs, and the EspoCRM metadata/DI architecture.
- Data migration from legacy CRM and API integration testing should occur in staging; no mention of ETL tools or migration templates.
When to avoid it — and what to weigh
- AGPL copyleft incompatibility — If your stack or commercial products cannot accommodate AGPL-3.0 (derivative works must be open-sourced), EspoCRM is unsuitable without explicit license exception review.
- SaaS/hosted offering without legal review — AGPL-3.0 requires providing source code to end users in hosted deployments. Cloud SaaS providers must review AGPL terms carefully; commercial support may be necessary.
- Zero-touch, pre-built integrations — EspoCRM lacks documented native connectors to major marketing/ERP platforms out of the box. Integration effort required; consider Salesforce, HubSpot, or Pipedrive if native connectors are critical.
- Enterprise security certifications — No mention of SOC 2, ISO 27001, or penetration testing. Community-maintained project; security audit and hardening review required before handling sensitive compliance data.
License & commercial use
EspoCRM is licensed under GNU AGPLv3, a copyleft license requiring derivative works and hosted instances to be open-sourced and provide source code access to end users. This is a strong restriction on proprietary and SaaS use.
Commercial use is possible under AGPL-3.0, but with significant constraints: (1) On-premise deployments generally permissible if source is not modified or distributed; (2) SaaS/hosted offerings require providing full source code to end users, which may conflict with proprietary goals; (3) Custom extensions or modifications trigger copyleft; (4) Requires legal review before deployment in profit-generating contexts. Consider commercial support or licensing alternatives if AGPL is incompatible.
DEV.co evaluation signals
Editorial assessment — not user reviews. Directional, with an explicit confidence level.
| Signal | Assessment |
|---|---|
| Maintenance | Active |
| Documentation | Strong |
| License clarity | Clear |
| Deployment complexity | Moderate |
| DEV.co fit | Good |
| Assessment confidence | High |
No explicit security audit, penetration testing results, or security certifications mentioned. AGPL source transparency aids code review but does not guarantee secure defaults. Developers should: (1) perform code review before sensitive deployments; (2) harden PHP 8.x and database configurations per official guidance; (3) validate REST API authentication mechanisms (not detailed in README); (4) implement network and data-access controls in host environment; (5) keep PHP and dependencies patched.
Alternatives to consider
Salesforce
Enterprise-grade, multi-tenant SaaS with extensive native integrations, security certifications (SOC 2, ISO 27001), and professional support. Higher cost and less customization freedom; proprietary.
Odoo
Open-source (LGPL and commercial dual licensing) with broader ERP/business suite scope. Better positioned for SaaS and proprietary extensions; larger community. More complex architecture.
HubSpot
Freemium SaaS CRM with strong marketing automation, pre-built integrations, and customer support. Limited customization and on-premise options; cloud-only. Suitable for SMB sales and marketing focus.
Build on espocrm with DEV.co software developers
Review the official documentation, test the demo, and confirm AGPL-3.0 compliance with your legal team. Consider custom development support if extensions are required.
Talk to DEV.coRelated on DEV.co
Explore the category and the services that help you build with it.
espocrm FAQ
Can I use EspoCRM in a commercial SaaS product?
What databases are supported?
How do I integrate EspoCRM with external systems?
Is there commercial support available?
Senior engineers for your next build
espocrm rarely ships on its own. As a software development company, DEV.co handles the surrounding work — data modeling, service integration, deployment, and the open-source crm glue code that production actually requires.
Ready to evaluate EspoCRM for your team?
Review the official documentation, test the demo, and confirm AGPL-3.0 compliance with your legal team. Consider custom development support if extensions are required.