EspoCRM

EspoCRM is a free, open-source CRM platform that enables businesses to manage leads, contacts, sales opportunities, support cases, and marketing campaigns through a fast single-page application backed by a clean REST API. Built for startups, SMBs, and developers who want full control over their customer data without vendor lock-in.

The platform is built on PHP 8.3-8.5 with Slim 4 routing, Doctrine DBAL for database access, and supports MySQL, MariaDB, and PostgreSQL. Its metadata-driven architecture lets administrators define custom entities, fields, relationships, and UI layouts without writing code — all described by JSON schema with IDE autocompletion support.

EspoCRM ships with email sync and mass email campaigns, kanban boards, a formula scripting engine for calculated fields and automation, dynamic form logic, a customer portal for self-service case management, and a WebSocket-powered notification system. The module system lets developers extend or override core behavior without modifying core files, keeping customizations upgrade-safe.

Licensed under AGPLv3, EspoCRM is community-driven with over 22,000 commits, more than 290 releases since 2014, and an active developer documentation portal covering dependency injection, ORM, REST API, hooks, and custom module development.

What You Get

• Custom Entities & Fields - Define new data objects, custom field types, and relationships entirely from the administration UI, with changes reflected immediately in the interface and REST API.
• Full REST API - Every entity type and operation is accessible via a documented REST API with OAuth2, API key, and HMAC-based authentication, enabling integration with any external system.
• Email Sync & Mass Email Campaigns - Fetch incoming emails via IMAP (with ImapEngine), send bulk campaigns with templates and merge variables, and track all email activity linked to CRM records.
• Formula Scripting & Dynamic Logic - Write server-side formula scripts for calculated fields and automation, and configure dynamic form logic to show, hide, or require fields based on other field values — no code required.
• Kanban Boards & Calendar - Visualize pipelines with drag-and-drop kanban boards tied to status fields, and manage tasks, calls, and meetings through a unified calendar with reminders.
• Customer Self-Service Portal - Provide branded portal access for customers to submit and track support cases, browse a knowledge base, and view their account information without accessing the main CRM.
• Field-Level ACL & Role Management - Configure access control at the field level for each role — control who can read, edit, or see specific fields on any entity, not just entity-level actions.
• Module Extension System - Build upgrade-safe extensions by overriding or extending core behavior through the module system, with full access to DI bindings, hooks, and metadata overlays.

Common Use Cases

• Running a B2B sales pipeline - A mid-sized SaaS company uses EspoCRM to track leads, opportunities, and accounts with custom fields for contract renewal dates, configuring role-based access so sales reps only see their assigned records.
• Managing customer support operations - A support team uses cases, IMAP email sync, and the customer portal to manage ticket volume, linking incoming emails automatically to case records and tracking resolution time.
• Building a custom CRM for a niche industry - A real estate brokerage creates custom entities for properties and listings with relationship links to contacts, configuring web-to-lead forms to capture inquiries from their website.
• Automating marketing campaigns - A marketing team sets up mass email campaigns with dynamic templates, segments target lists by custom field criteria, and tracks open and click activity back to contact records.
• Integrating CRM data with other business systems - A development team uses the REST API to sync EspoCRM contacts and deals with an ERP system, triggering workflow actions in EspoCRM when order statuses change externally.
• Self-hosting CRM for data compliance - A healthcare or financial services firm deploys EspoCRM on-premises to keep all customer data within their own infrastructure, satisfying data residency requirements while retaining full customization freedom.

Under The Hood

Architecture EspoCRM follows a layered, module-driven architecture that cleanly separates an SPA frontend from a stateless REST API backend. The backend organizes execution through a container-based dependency injection system built around an InjectableFactory that resolves constructor dependencies via PHP reflection and type hints, following SOLID principles throughout. HTTP requests flow from Slim 4 routing through typed controllers into a Record Service layer that handles CRUD, search, and relationship operations per entity type. A hook system (beforeSave, afterSave, afterRelate, and others) decouples cross-cutting concerns like auditing and notifications from business logic. The metadata system — a deeply nested JSON configuration tree — drives entity definitions, field types, layouts, relationships, and ACL rules at runtime, making the application schema-driven and allowing administrators to extend the data model without touching PHP code.

Tech Stack The backend runs on PHP 8.3-8.5 with Slim 4 for HTTP routing and Symfony components handling HTTP foundation, process management, and SMTP email. Doctrine DBAL provides database abstraction over MySQL 8, MariaDB 10.3, and PostgreSQL 15. Real-time WebSocket notifications use Ratchet and ReactPHP, with process management via Symfony Process and spatie/async. The frontend is a custom SPA framework built on Backbone.js with Handlebars templating and Bootstrap, with core modules incrementally migrated to TypeScript. Build tooling uses Grunt and Rollup. PDF generation uses DomPDF, spreadsheet import/export uses OpenSpout, and IMAP email fetching uses DirectoryTree’s ImapEngine.

Code Quality The codebase maintains an extensive test suite of over 360 test files spanning unit tests for ACL, ORM, formula evaluation, and entity lifecycle operations, plus integration tests for API responses and data persistence. The backend enforces strict PHP 8+ type declarations throughout, and PHPStan runs at level 8 — one of the strictest static analysis configurations available for PHP — catching type errors before runtime. Error handling uses typed exception classes (Forbidden, NotFound, Conflict, BadRequest) that propagate meaningfully through the request lifecycle. Inline documentation is thorough across core classes, with docblocks describing PSR-11 DI patterns, generic type parameters, and link references to the developer documentation. Frontend code quality is incrementally improving via TypeScript migration of core modules.

What Makes It Unique EspoCRM’s core differentiator is its metadata-driven entity system that lets administrators create entirely new data models with custom entities, field types, and relationships directly from the administration interface, with changes instantly reflected in both the UI and the REST API — without writing a line of PHP. The built-in formula scripting language enables complex calculated fields, conditional automation, and data transformations without requiring extension development. Dynamic logic applies show/hide/required rules to form fields conditionally based on other field values, processing server-side to ensure consistency. The ACL system enforces permissions at the individual field level for each role — controlling read, write, and visibility independently per field — going further than most CRMs that stop at entity- or action-level access control. Together these capabilities make EspoCRM a genuinely customizable business application platform, not a fixed-feature CRM product.

Self-Hosting

EspoCRM is licensed under the GNU Affero General Public License v3.0 (AGPLv3), one of the strongest copyleft licenses available. For self-hosters using EspoCRM internally — running it as an internal tool for your own organization without distributing it to third parties — the AGPLv3 obligations are minimal in practice: you can use, modify, and deploy it freely. The key AGPLv3 implication is that if you make modifications and provide access to the modified software over a network (as a service to external users), you must make the source code of those modifications available. Organizations using EspoCRM as a standard internal CRM deployment are unaffected by this clause. A Contributor License Agreement is required for pull request contributions back to the project.

Running EspoCRM yourself means you are responsible for the full infrastructure stack: a PHP 8.3-8.5 web server (Apache or Nginx), a supported relational database (MySQL 8, MariaDB 10.3, or PostgreSQL 15), and optionally a cron runner for scheduled jobs and a WebSocket daemon for real-time notifications. Docker installation scripts and Traefik configurations are provided for containerized deployments. You handle uptime, database backups, SSL termination, PHP version compatibility across upgrades, and applying security patches by staying current with releases. The project releases updates frequently — multiple times per month — so operational discipline around upgrades is important for a production deployment.

The EspoCRM team offers paid commercial support, professional services, and an Advanced Pack extension that adds workflow automation, reports, PDF templates, recurring events, and other enterprise-oriented features not included in the core open-source release. A cloud-hosted option (EspoCRM Cloud) is available for organizations that prefer a managed deployment. Compared to the self-hosted path, the cloud tier provides managed upgrades, guaranteed uptime, hosted backups, and direct support access — removing the operational burden of maintaining the server stack. The open-source core is genuinely capable for most CRM workloads, but teams that need workflow automation or advanced reporting will likely find the Advanced Pack extension a practical consideration.