Four of the five open source CRMs I checked are AGPL and nobody mentions it

I published something wrong. Let me start there, because the correction is the whole point.

For about three months my blog told people that Twenty, the open source CRM, was MIT licensed. "MIT licensed, so you can do whatever you want with it commercially." I wrote that. People read it. Some of them probably repeated it.

It isn't true.

Twenty's LICENSE file opens with this line. "This project is mostly licensed under the GNU Affero General Public License v3.0." There are carve-outs. The SDKs are MIT, the UI component library is MIT, and a set of files marked @license Enterprise sit under a commercial license instead. But the core, the part you'd actually fork and brand and sell, is AGPLv3.

I got it from a roundup. The roundup probably got it from another roundup. Nobody opened the file.

So I opened all of them.

The audit

Five open source CRMs and marketing platforms that agency owners actually consider when they get sick of paying rent. I pulled the license off each repository rather than the marketing page.

Twenty, AGPLv3 with MIT and commercial carve-outs. EspoCRM, AGPLv3, with a paid commercial license available. SuiteCRM, AGPLv3. Mautic, GPLv3. ERPNext, GPLv3.

Four AGPL. Well, three AGPL outright and one mixed. Two clean GPL.

Not one of the "best open source GoHighLevel alternative" articles I read while checking mentioned the license at all. They compared interfaces. They compared feature checklists. They listed "free and open source" as a bullet and moved on, as though free and open source were one idea instead of two.

Why AGPL is the one that matters

Most people who know a little about open source licenses know the rough shape of GPL. Copyleft. If you distribute modified software, you ship the source along with it. Fine. Reasonable. Doesn't affect me, I'm not distributing anything, I'm hosting it.

That last sentence is the trap.

The AGPL exists specifically to close the hosting gap. Section 13 says that if you run modified AGPL software and let users interact with it over a network, those users get the right to your modified source. Not your customers who bought a copy. Your users. The people logging into the thing.

Hosting counts as the trigger. That is the entire reason the license was written.

Now put the standard agency plan next to that. Fork an open source CRM. Rebrand it. Point a subdomain at it. Host it for fourteen clients at $200 a month each. Never distribute a single file to anyone.

Under AGPL, every one of those fourteen clients can ask you for the source code of your modified version. Your integrations. Your custom modules. The onboarding flow you spent two months on. You hand it over, and nothing stops them from taking it to a developer who will host it for $40.

GPL does not do this. Under GPLv3, hosting genuinely is not distribution. Run modified Mautic or modified ERPNext as a service for your clients and no source obligation triggers. Mail them a modified copy to install on their own box and it does.

Same family of licenses. Opposite answer to the only question a reseller cares about.

The part where I stop pretending this is simple

A few honest caveats, because license posts attract people who want to argue and they are sometimes right.

AGPL does not ban commercial use. It does not ban white-labeling. It does not ban charging money. You can build a real business on AGPL software and plenty of companies have. What it does is remove your ability to keep your modifications secret from the people using them. If your moat is your code, that is fatal. If your moat is your service, your onboarding, your industry knowledge, or just being the person who answers the phone, it might not matter to you at all.

EspoCRM handles this the cleanest way anyone does. They dual license. Take the AGPL version for free, or pay them for a commercial license that lifts the copyleft obligation entirely. You write a check and stop thinking about it. More projects should do this.

And I'm an agency owner who reads licenses, not a lawyer. Everything above is the shape of the thing, not legal advice. If you're about to build a company on one of these, pay someone qualified to read it properly. It's cheaper than the alternative.

What I actually do now

I check the LICENSE file. In the repository. Before anything else.

Not the README, which says "open source" and stops. Not the pricing page, which says "self-hosted" as though that answered the question. Not somebody's listicle, which is how I got it wrong in the first place. The file. It takes ninety seconds.

Then I ask one question. If I host a modified version of this for paying clients, do I owe them my source?

AGPL, yes. GPL, no. MIT or Apache, no, and go build whatever you want. Commercial, read the actual terms because they vary wildly.

That question decides more about a white-label business than any feature comparison will, and it's the one nobody puts in the table. I rewrote my own GoHighLevel alternatives comparison around it, license column first, because the feature list is genuinely the least important thing on the page.

The full AGPL text is on gnu.org and section 13 is four paragraphs. Read those four paragraphs before you name your SaaS.

I write about this stuff in longer form over on Medium too, mostly the agency economics side.

Anyway. I was wrong in public for three months, and the fix took ninety seconds of reading I should have done first. Go check yours.