What "free" means here

SuiteCRM has no price list in the usual sense. There is no per-seat fee, no user cap and no locked feature tier: the hosting page says the only limit on users "is the performance of your package". The code is published under AGPLv3, and you can download the whole platform, run it on your own server and never pay anyone.

That freedom has a history. When SugarCRM abandoned open source in 2013, its Community Edition was forked, and SuiteCRM 7 shipped in October of that year. The source files still carry the SugarCRM Inc. copyright header from 2004-2013. The project is maintained by SuiteCRM Ltd in Stirling, Scotland, the company formerly called SalesAgility, and the code now lives at github.com/SuiteCRM. SugarCRM itself went the other way: it now sells AI from $98 a seat, as our SugarCRM review covers.

The fastest way to judge it costs nothing. The vendor runs a public SuiteCRM 8 demo at suite8demo.suiteondemand.com with the login will / will, no signup and no card. It is shared and reset regularly, so treat anything you type there as public. This review covers 8.10.2 and 7.15.2, both released on 31 July 2026, with prices and documentation checked in November 2026.

Pricing: what running it actually costs

The licence is free. Running it is not, and the vendor's own pages do not agree on the entry price. The pricing page advertises fully managed hosting "From £50 / month" and adds that application support is required. The hosting page, where you actually pick a plan, starts at £130 a month. All figures below exclude VAT.

Support is sold in prepaid hours. Silver is £1,200 for 10 hours a year, which is £120 an hour, and it is 20% cheaper bought with hosting. Gold is £3,240 for 30 hours, Platinum £5,400 for 50 hours. The pricing page's worked examples come to £1,560 a year (£600 hosting plus £960 of discounted support) and £3,950 a year with SuiteASSURED, the separately maintained build that comes with warranties and indemnities. Notice that the £600 hosting figure matches no plan on the hosting page. Price it from the published plans instead: Starter billed annually is £1,560 on its own, so with Silver support a ten-user team pays about £2,520 a year. Spread over ten users, that is roughly £21 per user per month - and the per-user figure falls as headcount grows.

The extras add up quietly. On managed hosting, direct database access is a £450 one-off, phpMyAdmin another £450, Git access £300 (included on Premium), and Elasticsearch and a sandbox each start at £600 a year. The official Outlook plugin is $60 per user per year. There is no official native mobile app; the web UI is responsive, and the third-party QuickCRM app costs $7 per user per month. A 30-day hosted trial is free.

Try SuiteCRM

What you get in the box

The module list is long for a free product: accounts, contacts, leads, opportunities, quotes, products, contracts, invoices, cases, a knowledge base, projects, campaigns, calendar, calls, meetings and tasks. Studio lets an admin add fields, rearrange layouts and build entire new modules without writing code, and the workflow engine runs actions when conditions are met.

Reports query any module and show the result as a table, a chart or both. They can be saved, shared, pinned to a homepage dashlet, exported and emailed on a schedule.

Version 8.10, released in April 2026, is the vendor's own pick for one of its biggest releases: Documents and Notes finally moved into the SuiteCRM 8 interface, an image field arrived, email compose was rebuilt, campaigns now pause and resume on SMTP errors, and accounts and quotes print to PDF. The roadmap puts 8.11 in Q4 2026 with button-triggered workflows and a new calculated-field engine, and a drag-and-drop campaign email builder after that.

What is missing is AI. Nothing in the 8.9, 8.10 or 7.15 release notes or on the roadmap mentions it as of November 2026 - no summarising, no lead scoring, no drafting assistant. The interface is the other recurring complaint: G2 reviewers (about 4.2 out of 5 from roughly 100 reviews) repeatedly describe it as dated and less intuitive than the SaaS names, and point to slow third-party mobile apps and integration work that needs a developer. Capterra users rate it a little higher, around 4.4.

Self-hosting and the 7-to-8 upgrade

Self-hosting 8.10 means PHP 8.2, 8.3 or 8.4, Apache 2.4, and MariaDB 10.6 to 11.8 or MySQL 8.0/8.4. Node.js is not needed in production. The install is short: unzip the 117 MB package, set permissions, run the installer.

The step people miss comes afterwards. SuiteCRM needs a cron job for workflows, inbound email checks and scheduled reports, and from 8.10 it also needs a Symfony Messenger worker running as a service. Skip the worker and background tasks sit at "Pending" indefinitely.

Moving from 7.x to 8.x is a migration, not an update. You must first be on the latest 7.14.x, then copy the old instance into public/legacy of the 217 MB migration package and run three console commands. The docs warn that the process may remove non-core files under that folder, and that custom code has to meet the new minimum PHP version. Anyone with years of 7.x customisations should budget a project, not an afternoon. Staying put is allowed for now: 7.15 is an extended support release with security fixes until January 2028. No 8.x extended support release has been named yet; the vendor expects to pick one by Q3 2027. On managed hosting, upgrades are included, but if your custom code breaks one, fixing it comes out of your paid support hours.

Security: the patching bill

This section should decide the self-hosting question. The 7.x repository, whose code also ships inside every 8.x install as public/legacy, had 77 published GitHub security advisories when counted in November 2026, and 47 of them were published in 2026. SuiteCRM-Core, the 8.x layer, had 10, four of them this year.

Several are as bad as advisories get. CVE-2026-29103, a Module Loader scanner bypass leading to remote code execution, was fixed in 7.15.1 and 8.9.3 in March. CVE-2026-71550 (local file inclusion to RCE through the workflow module) and CVE-2026-100358 (an admin-level OS command execution via PHP injected through the dropdown editor) are both critical and both fixed in 8.10.2 and 7.15.2. CVE-2026-71549 allowed account takeover through password reset on 8.8.0 to 8.10.0. In practice, every 8.x before 8.10.2 and every 7.x before 7.15.2 now has publicly documented RCE or SQL-injection bugs, and the vendor's release post says to upgrade "without delay".

The fixes also change behaviour. 8.10.2 removed SOAP Portal support outright and switched off the legacy v4 API's query "where" clause by default. A customer portal or integration built on either stops working the day you patch. If nobody owns patching, the free licence is the most expensive thing about it.

Your data, and getting it out

Self-hosted, you own the MySQL or MariaDB database outright, which is the strongest exit story any CRM can offer. The in-app route is weaker than it looks: CSV export works from any module and includes record IDs, but dropdown fields export as their underlying database keys rather than the labels users see, so a "Lead source" column arrives as codes you have to map back by hand. On managed hosting, the full backup comes via SFTP on request (not during the trial), and direct database access is the £450 add-on mentioned above.

For integrations, the v8 API follows JSON:API 1.0 with OAuth2, and 8.x also exposes GraphQL.

Verdict

SuiteCRM is the right CRM for an organisation with its own PHP and database administrator, a reason to keep customer data on its own servers, and enough users that per-seat pricing hurts. At 50 users, the Business plan plus Silver support costs about £3,120 a year in total; self-hosted, it costs whatever your server and your admin's time cost. For that buyer, the module depth, Studio and the AGPL licence are hard to beat, as long as 8.10.2 or 7.15.2 goes on promptly and every later patch follows.

Buy the vendor's managed hosting if you want the licence freedom without running Linux yourself, but price it from the hosting page, not the "£50" headline, and remember that support hours are mandatory and also pay for upgrade breakage.

Skip it if nobody on your team will own patching or the cron and worker setup: a small sales team is better served by Less Annoying CRM or Zoho CRM, and a marketing-led one by HubSpot. Skip it too if you want AI built into the CRM; SuiteCRM has none on its roadmap, while its commercial ancestor in our SugarCRM review sells it by the seat. For a wider shortlist, see the best CRM software.

Try SuiteCRM