Five open-source tools for CRM, support, newsletters and analytics

What this guide covers

• What each of the five tools does, according to the project itself
• One small first project per tool, sized for a team of one to five people
• What you need to run each one: server, Docker, SMTP, approvals from social platforms
• A comparison table: purpose, requirements and licence
• What AGPL-3.0, MIT and the separate enterprise terms mean in plain words
• Which tool to try first, and a short checklist on personal data

Five tools side by side, and what their licences say

All five are developed in the open on GitHub and can run on your own server. Twenty, Chatwoot, Postiz and PostHog also have a hosted version from their makers.

Two licence families appear in the table. The GNU AGPL version 3 lets you run, change and redistribute the program under the same licence; its section 13 adds that if you modify the program and people use your version over a network, you must offer them its source code at no charge. The MIT licence permits using, copying, modifying, distributing and selling copies if the copyright and permission notice stays in, and supplies the software as is, without warranty.

Twenty, Chatwoot and PostHog keep part of their code under separate enterprise terms: production use only with a valid subscription or enterprise licence, while copying and modifying it for development and testing is permitted. Read each LICENSE file before commercial use. This summary is not legal advice.

Twenty: a CRM you shape yourself

Twenty is an open-source CRM built around objects, fields and views. It ships with Companies, People, Opportunities, Tasks and Notes, and lets you add your own objects, such as projects or contracts, and fields of 20+ types. Records show as a table, a kanban board or a calendar, and can be imported and exported as CSV.

First project: a sales pipeline with five stages. The kanban view groups cards by a select field, so give that field five options that match how you sell, for example New, Contacted, Proposal sent, Negotiation, Closed. Then add a date field named Next action to Companies and save a table view sorted by it. No company should sit in the list without a date.

You need Docker with Docker Compose and at least 2 GB of RAM. The docs give a one-line install script and recommend a reverse proxy with SSL. Backups are yours to arrange. The README addresses technical teams, so plan for someone at ease with a server. Licence: AGPL-3.0 for most of the code; the table lists the exception.

Chatwoot: one inbox for every channel

Chatwoot is a customer support platform. Its README lists website live chat, email, Facebook, Instagram, WhatsApp, Telegram, Line and SMS in one inbox, with private notes and mentions, labels, canned responses, auto-assignment, teams, business hours and a help centre portal.

First project: bring the website chat widget, the support mailbox and a Telegram bot into one account and make sure every conversation has an owner. Auto-assignment is on by default and shares new conversations among available agents in turn; when nobody is available, the conversation waits in Unassigned. Write five canned responses for your most frequent questions.

The self-hosting guide names 2 CPU cores, 4 GB of RAM and 20 GB of SSD as the minimum, plus PostgreSQL, Redis, a domain, an SSL certificate and an SMTP server for notifications. Channels depend on third parties: Telegram needs a bot token from BotFather, and WhatsApp is connected through Meta, which may ask for business verification. Licence: MIT, except the enterprise/ folder.

listmonk: a newsletter on your own server

listmonk is a self-hosted newsletter and mailing list manager shipped as a single binary with a PostgreSQL database. It handles subscribers, single and double opt-in lists, templates and campaigns, shows campaign analytics such as bounces and top links, and has an API. Segments are built with SQL expressions.

First project: three double opt-in lists by interest, for example News, How-to and Offers, and one useful letter a month to each. With double opt-in a subscriber gets campaigns only after clicking the link in the confirmation email.

You need the binary or the sample Docker Compose file, PostgreSQL 12 or newer and an SMTP server or provider. The docs warn that some hosts block outgoing SMTP ports. Delivery is the real limit: Google's sender guidelines ask every sender to set up SPF or DKIM for the sending domain, and those who send more than 5,000 messages a day to Gmail accounts to have both, plus DMARC and one-click unsubscribe. Licence: AGPL-3.0.

Postiz: a weekly publishing routine

Postiz is a social media management platform for scheduling, automating and analysing posts. Its README shows Instagram, YouTube, LinkedIn, TikTok, Facebook, Pinterest, Threads, X, Reddit, Mastodon and Bluesky among the networks. It also has team members with roles, a public API with webhooks and a custom n8n node.

First project: one weekly routine. Fix an hour on the same day each week, write the week's posts in the composer, save them as drafts, have a colleague read them, then add them to the calendar. Start with two channels, not ten.

Self-hosting runs on Docker Compose with PostgreSQL, Redis and Temporal. The docs name 2 GB of RAM as the tested floor and advise 4 GB or more for several users. The main limit sits outside the software: for most networks you register your own developer app and pass that platform's approval, which the README says can take weeks for Meta, YouTube and TikTok. A few, such as Bluesky, Medium and WordPress, connect with credentials typed into the dialog. Support for self-hosted installs comes from the community. Licence: AGPL-3.0.

PostHog: see where visitors stop

PostHog combines event-based product analytics, a web analytics dashboard, session replays, feature flags, experiments, surveys and error tracking. A funnel shows how many people pass each step of a flow and where they drop out.

First project: one funnel with three steps: opened the service page, opened the form, sent the form. Install the JavaScript snippet, with a consent banner where your law asks for one, wait until real visits accumulate, and see which step loses the most people before you redesign anything.

Read the self-hosting terms first. The docs call self-hosted deployments officially unsupported: no customer support, no help with recovering lost data, and paid-plan features only in the cloud. The docs ask for an Ubuntu server equal to 4 vCPU, 16 GB of RAM and over 30 GB of storage, and the README says such deployments should scale to roughly 100 thousand events a month. The README recommends PostHog Cloud, which has a free monthly tier. Licence: MIT, except the ee/ folder.

Which one first if you have one evening

Choose by the problem that costs you most right now, not by the feature list. An evening is about enough for a trial install and a first look; a production setup with a domain, backups and channel approvals takes longer.

• Deals get forgotten: Twenty. Run the Docker script on a small server and set up five stages.
• Messages arrive in five places: Chatwoot. Connect the website widget and email first.
• Addresses but no regular letter: listmonk. Two Docker commands start it on a laptop; real sending waits for SMTP and DNS records.
• No idea where visitors leave: PostHog Cloud. No server, one snippet, one funnel.
• Irregular posting: Postiz. Apply for the platform developer apps first; approval is the slow part.

Personal data: consent, unsubscribe and what you store

All five tools hold data about people: names, email addresses, chats, clicks, session recordings. On your own server you answer for that data, for security updates and for backups. The points below are practical caution, not legal advice. Rules differ by country; the GDPR applies to people in the EU.

• Mail only people who asked for it. Use double opt-in and keep the date and source of every subscription.
• Put a working unsubscribe link in every letter and act on it at once.
• Name the tools and their purpose in your privacy notice. PostHog's GDPR guide says to use a cookie banner when it runs with cookies on a website.
• Session replay masks input fields by default; other page text is recorded unless you mask it.
• Store less. No passport scans in CRM notes, no card numbers in chats. Delete what you no longer need.