CRM
EspoCRM
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by EspoCRM (open source) · www.espocrm.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
No written verdict for this product
The panel scored EspoCRM, but the summary our synthesizer wrote did not survive our own contradiction check — twice. Rather than print a paragraph we cannot stand behind, we print none. Every score, rationale and source below is unaffected; read them and draw the conclusion yourself.
The scores
Contact & data model
Show reasoningHide reasoning
How this is scored
Depth and hygiene of the core records — contacts, companies, deals, custom fields, deduplication.
0 — A flat address book; no relations between people, companies and deals.
3 — The standard three objects exist but customization is cosmetic: few field types, no required fields, duplicates accumulate unchecked.
5 — Custom fields across objects, basic dedupe on create, activity history on the record; complex models still need workarounds.
8 — Rich field types with validation, merge and dedupe tooling, relationships beyond the standard model, permissioned field access.
10 — A genuinely modelable system: custom objects or equivalent, bulk hygiene tooling, field-level history — the data model bends to the business, not the reverse.
The Solo Seller
The entire registry never mentions a contact, company, deal, custom field, or dedupe once — for a CRM the evidence that is an indictment, not an oversight. I scored what's evidenced: nothing, so this sits just above a flat address book. 1 2
The Data Protection Officer
The data model is evidenced only through per-plan record ceilings and a consent-tracking tool; not a single fact covers field types, validation, dedupe, merge, or company/deal relations. Absence is information here — I cannot certify hygiene that isn't documented. 2
The Sales Ops Lead
The evidence never describes the data model — no custom fields, no required-field validation, no dedupe, no relationships — so for record hygiene this is a black box. I'm crediting only the standard objects a 'sales tool' CRM implies plus the per-plan record limits, nothing more. 1 2
The RevOps Integrator
The evidence evidences nothing about the data model itself — no custom fields, no dedupe or merge, no relationships between people, companies and deals — only a 'sales tool' label and per-plan record caps. Silence this deep caps it at the cosmetic-customization anchor. 1 2
The Migrator
Not one fact describes the data model — no custom fields, no dedupe, no merge, no relations, nothing beyond generic 'records' limits. I've cleaned up flat messes before, and if the vendor's own pages can't show me hygiene tooling, I budget for a flat mess. 1 2
The Skeptic
The evidence is entirely silent on the data model — no evidence of contact/company/deal relations, custom fields, dedupe or merge tooling anywhere. The only record-level facts are per-tier record-count caps (100,000 to 'unlimited') and a homepage calling it an 'open source sales tool', so contacts exist as rows but nothing here evidences a model richer than that. Silence this deep on the core object of a CRM is information, and it prices low. 1 2
Pipeline & forecasting
Show reasoningHide reasoning
How this is scored
Whether the pipeline enforces a process and produces reporting a finance department accepts.
0 — A kanban of deals with amounts; nothing is enforced, nothing rolls up.
3 — Multiple pipelines and stage probabilities exist, but no required fields per stage and only canned reports.
5 — Stage requirements, win/loss capture and standard forecast views; custom reporting is limited or an add-on.
8 — Enforceable process (required fields, stage gates, routing), custom report builder, forecast by team and period with quota tracking.
10 — Forecasting a CFO signs: weighted and commit-based views, historical snapshots, attainment tracking, and reporting composable enough to answer questions the vendor never anticipated.
The Solo Seller
The only pipeline-adjacent word on record is 'our open source sales tool' — no stages, no gates, no forecast, no win/loss capture, no reporting. Nothing here tells me a deal moves through anything enforced. 1
The Data Protection Officer
All I can confirm is an 'open source sales tool' with record-count limits; there is no evidence of stage requirements, win/loss capture, forecasting, or any report a finance department would accept. Scored low because the evidence is silent on everything this criterion needs. 1 2
The Sales Ops Lead
Nothing evidences stage gates, required fields per stage, win/loss capture, quota tracking or any forecast view. An 'Advanced Pack' is included in all plans but the evidence never says what it contains, and I don't score nameplates — my CFO would have nothing to sign. 2
The RevOps Integrator
No stage model, no required fields, no forecasting or reporting is evidenced anywhere; all I have is 'our open source sales tool' and record limits. That is barely above a deals-with-amounts board. 1 2
The Migrator
The registry is silent on pipelines, stages, forecasts and reporting; the Advanced Pack ships with every plan but its contents are unevidenced, and I don't buy a sealed box. One point only for it being an open source sales tool with records that exist. 1 2
The Skeptic
Not one word about pipelines, stages, probabilities, forecasting or reports in the entire sheet — no matter how generous I am, the anchors can't be climbed on zero evidence. The closest fact is 'our open source sales tool' plus record limits, which proves storage of deals at best, not any enforced process or rollup. This is the criterion the vendor most needed a feature page for and didn't provide. 1 2
Automation & workflows
Show reasoningHide reasoning
How this is scored
Triggers, sequences and routing that remove manual work without a consultant.
0 — No automation beyond email templates.
3 — Simple if-this-then-that on records; no multi-step sequences, no branching.
5 — Multi-step workflows with delays and branching, email sequences, basic lead routing — capped by tier or count.
8 — Full workflow builder across objects with webhooks as steps, round-robin routing, sequence analytics.
10 — Automation as infrastructure: versioned workflows, error handling, per-step logs, and limits generous enough that the feature is not its own upsell.
The Solo Seller
The single automation fact is that all plans bundle an 'Advanced Pack' extension, but the evidence never says what it does — no triggers, sequences, routing, or workflow builder evidenced. A name on an extension list is not a capability. 2
The Data Protection Officer
Native automation is unevidenced — the Advanced Pack is named but never described, so it proves nothing — and the only automation on record is routing records through Zapier or Make. As DPO I note that means your contacts' data flows through a third-party subprocessor the vendor has not documented. 2
The Sales Ops Lead
No trigger, sequence, routing or workflow capability is evidenced at all; the closest fact is the undescribed Advanced Pack extension. As this sheet shows it, a 40-seat team runs its follow-ups by hand. 2
The RevOps Integrator
The only automation-adjacent fact is that an 'Advanced Pack' extension is included in all plans, with its contents never described — no triggers, sequences, routing or webhook steps evidenced. A capability name without capabilities is worth almost nothing. 2
The Migrator
Zero evidence of a trigger, workflow, sequence or routing rule anywhere in the registry. Anchor zero: I score what's on the page, and on this the page is empty. 2
The Skeptic
The automation story is 'All the plans include the Advanced Pack extension' — an inclusion claim about a black box the evidence never defines; no triggers, workflows, sequences or branching are evidenced. The only concrete automation path is through Zapier and Make, which is third-party if-this-then-that as a crutch, not native capability. 2
Integrations & API
Show reasoningHide reasoning
How this is scored
Two-way email/calendar sync, native connections, and an API that treats external systems as first-class.
0 — No API, no sync; data enters by CSV and leaves never.
3 — One-way email logging (BCC), a handful of Zapier triggers, a read-mostly API.
5 — Two-way email and calendar sync for the major providers, a documented REST API with sane limits, a modest native directory.
8 — Deep native integrations for the revenue stack, webhooks, OAuth apps, API parity with the UI for core objects.
10 — An ecosystem: public API covering everything the UI does, event streams, a marketplace, and sync so reliable the CRM can be the system of record without being the only system.
The Solo Seller
A REST API with OpenAPI support is real and I respect it, but there is zero evidence of two-way email or calendar sync — the thing I actually run my pipeline on — and the '2000+ integrations' ride on Zapier and Make with an asterisk flagged not-included, not on native depth. 2
The Data Protection Officer
A documented REST API with OpenAPI support and Zapier/Make bridges are real, but the '2000+ integrations' claim is asterisked as not included in the subscription, and no native two-way email or calendar sync is evidenced anywhere on the evidence. 2
The Sales Ops Lead
A documented REST API with OpenAPI and Zapier/Make connectors is real and bidirectional by design. But there is zero evidence of two-way email or calendar sync — table stakes for a revenue CRM — and the '2000+ integrations' claim carries an asterisk and sits outside the subscription. 2
The RevOps Integrator
A documented REST API with OpenAPI support is the one real signal, but the evidence is completely silent on two-way email and calendar sync and webhooks — the exact things a revenue stack runs on — and the rest of the story is Zapier/Make glue plus an asterisked '2000+ integrations' count excluded from the subscription. That reads like marketplace arithmetic, not native connections. 2
The Migrator
A REST API with OpenAPI support plus Zapier and Make is a solid anchor-3 read, but '2000+ integrations' carries an asterisk and is explicitly not included in the subscription — metered add-on smell. No evidence anywhere of two-way email or calendar sync, which for a CRM is table stakes. 2
The Skeptic
'2000+ integrations *' with an unexplained asterisk, listed alongside a separate Zapier/Make line, is a borrowed marketplace dressed up as a native directory — the asterisk is the footnote I'm trained to find. The REST API with OpenAPI support is genuinely stated and anchors this above one-way logging territory, but there is zero evidence of two-way email/calendar sync, webhooks, or native integrations for the revenue stack, which rubric level 5 requires. 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where other people's personal data actually lives and under whose law — entity, hosting, subprocessors, DPA.
0 — US entity, US-default hosting, no public DPA or subprocessor list.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad and undocumented.
5 — EU hosting selectable at signup, published DPA and subprocessor list; core processing still touches US entities.
8 — EU entity or EU-default hosting with published subprocessors, consent-friendly fields, retention and deletion controls; residual US exposure named and narrow.
10 — European entity, EU-only processing including subprocessors, deletion that provably deletes — sovereignty a DPO can sign off without a caveat file.
The Solo Seller
A Germany hosting region plus GDPR consent and erasure workflows is more than most, but there is no DPA or subprocessor list on record, the governing entity is flagged unknown, and support answers on a +1 (408) phone — US fingerprints on an EU story. 1 2
The Data Protection Officer
A Germany region, GDPR erasure workflows, consent tracking, and a 'you own your database' clause earn real credit, but there is no published DPA, no subprocessor list, a parallel US hosting region, and the support line is a California number — under anchor terms this sits at 'DPA exists'-level or below, and I cannot verify whose law touches the personal data. 1 2
The Sales Ops Lead
A Germany region plus GDPR request, consent-tracking and erasure tooling is a genuine start, but no DPA, no subprocessor list, an unclear governing entity and a +1 (408) support line leave the accountability chain unevidenced. That's residency without transparency — no DPO signs it. 1 2
The RevOps Integrator
A selectable Germany region, GDPR request/consent/erasure tooling and an explicit 'you own your database' clause are genuine substance, but there is no published DPA, no subprocessor list, and the governing entity is on record as unclear — with a US support number. rubric level 5 requires the DPA and subprocessor list, so it cannot clear the bar. 2 1
The Migrator
A Germany region and GDPR erasure workflows are real, but the governing entity is unknown, support answers on a Silicon Valley phone number, and no DPA or subprocessor list is on record. I won't hand a DPO a region flag plus a +1 (408) number and call it EU processing. 1 2
The Skeptic
Germany-region hosting selectable for GDPR needs and claimed data-erasure workflows are a start, but a DPO cannot sign off on marketing: no DPA, no subprocessor list, a governing entity that is 'unclear' per provenance, and the only support phone is a US number, +1 (408), while a US hosting region is offered alongside. The data ownership statement helps, but undocumented subprocessor exposure plus an unidentified entity sits below the anchor that demands a published DPA. 1 2
Import, export & exit
Show reasoningHide reasoning
How this is scored
Getting in with history intact, and out with everything — the anti-lock-in criterion.
0 — Import is a support ticket; export is contacts-only CSV missing notes, activities and files.
3 — Self-serve CSV import with mapping; export covers main objects but drops activity history, attachments or relations.
5 — Guided migration from major competitors, full-object CSV export, API access sufficient to rebuild the database elsewhere with effort.
8 — Complete export (all objects, history, files) self-serve in open formats, import with dedupe and dry-run, no API metering that prices exit out of reach.
10 — Exit as a feature: documented full-fidelity export, migration tooling both directions, and contractual data-return terms — leaving is a weekend, which is exactly why you can stay.
The Solo Seller
Open source plus 'You own your database, data files and custom files... We can provide you with all copies by your request' is a genuinely strong exit posture, backed by the REST API. It only loses ground because no self-serve export, import, or migration tooling is evidenced in the product itself. 1 2
The Data Protection Officer
'You own your database, data files and custom files... we can provide you with all copies by your request' plus a free self-hostable open-source core makes exit structurally real — the software leaves with you. What's missing is any documented self-serve full export or migration tooling; today, exit is a support ticket rather than a self-service act. 1 2
The Sales Ops Lead
Open source plus 'you own your database... we can provide you with all copies by your request' plus the REST API makes exit plausible — the strongest anti-lock-in signal in the evidence. But export is by request rather than self-serve, and import, migration tooling and export fidelity are entirely unevidenced. 1 2
The RevOps Integrator
'We can provide you with all copies by your request' plus an open-source, self-hostable product makes lock-in structurally low — with self-hosting the exit is inherent. But nothing evidences self-serve full-fidelity export, import mapping or migration tooling, so it sits between anchors. 1 2
The Migrator
Open source changes the exit math: self-hosted, I own the database and no vendor gates my dump, and the cloud terms state 'You own your database, data files and custom files' with copies on request. But nothing evidences self-serve full-fidelity export, import with dedupe or migration tooling, and 'by your request' is one polite queue away from the support-ticket export I've been burned by — so it stops at the middle anchor. 1 2
The Skeptic
'You own your database, data files and custom files... We can provide you with all copies by your request' is a written data-return promise, and open source means the software and schema leave with you — self-hosting the same stack is the exit plan most SaaS vendors charge to deny you. Held below 8 because 'by your request' is not self-serve export, and the evidence evidences no export formats, import tooling or dedupe-on-import. 1 2
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per seat, per month, at renewal — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most buyers need are unpriced, or per-seat maths is obscured by bundles, minimums or mandatory onboarding fees.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability hides in an unpriced tier or usage-metered add-on.
8 — Every tier priced publicly including annual/monthly split; limits, seat minimums and overage rules stated; only genuine enterprise contracts are custom.
10 — Complete price computability: every tier, add-on, usage meter and renewal rule public, with a calculator or table that makes the invoice at 3 and 30 seats a two-minute exercise.
The Solo Seller
Prices are public and the per-seat maths is honest — €12.90/user, 3-user minimum, 6-or-12-month billing, limits stated — but as a one-seat buyer I literally cannot buy the smallest paid tier, no monthly billing exists, VAT treatment is unstated, and the 'free cloud' is a headline without a spec. 2 1
The Data Protection Officer
All three tiers carry public per-user euro prices with seat minimums, record caps, and storage limits — better than most — but billing is only 6 or 12 months with VAT treatment unstated, and the asterisked '2000+ integrations' flag signals a commonly needed capability sits outside the quoted price. 1 2
The Sales Ops Lead
Three tiers with real per-seat euros, published seat minimums and hard records/storage limits — I can compute a 40-seat Enterprise invoice in two minutes (40 × €22 × 12). Dings: no monthly billing, VAT treatment unstated, Ultimate's billing period unspecified, and the asterisked '2000+ integrations' hints at unpriced add-ons. 2
The RevOps Integrator
Three tiers with real per-user prices, seat minimums, record and storage limits are all public — better than most. But the Ultimate billing period is unstated, VAT treatment is absent, and the '2000+ integrations' asterisk is an exclusion with no price attached, which is exactly the hidden-cost pattern rubric level 5 warns about. 1 2
The Migrator
Three tiers with real per-user numbers, minimum seats and hard record/storage limits is a decent start, but billing is only 6-month or 1-year terms with no VAT treatment stated, and the integrations asterisk marks something the subscription doesn't cover at an unpublished price. I can compute most of the invoice at 3 seats, not all of it at 30. 1 2
The Skeptic
All three cloud tiers carry real per-seat numbers with seat minimums and hard limits (records, storage) published, and the free self-hosted tier is the cheapest invoice to compute in the industry — but the maths is dirty at the edges: no monthly billing exists at all ('billed for 6 months or 1 year'), VAT treatment is never stated, 'unlimited records' is capped by 400GB total storage, and the asterisk on '2000+ integrations' hides whatever the footnote says. 1 2
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in US | 0/3 pts | 3 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 15 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 product fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
- The panel’s written verdict is withheld: our own re-read found claims in it that the evidence does not carry, and a second synthesis did not fix them. The scores and the material below are unaffected. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.espocrm.com Checked 15 Sep 2026 Details →
- 2 Hosted cloud pricing www.espocrm.com Checked 15 Sep 2026 Details →
- 3 Terms of service www.espocrm.com Checked 21 Sep 2026 Details →
- 4 Subprocessor list www.espocrm.com Checked 30 Sep 2026 Details →
- 5 Privacy policy www.espocrm.com Checked 30 Sep 2026 Details →
- 6 Contact & data model — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 7 Contact & data model — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 8 Pipeline & forecasting — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 9 Pipeline & forecasting — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 10 Automation & workflows — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 11 Integrations & API — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 12 Integrations & API — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 13 Import, export & exit — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →
- 14 Import, export & exit — found from sitemap www.espocrm.com Checked 1 Oct 2026 Details →