Twenty is a CRM that developers can change as code
Twenty keeps the familiar CRM records, including people, companies, deals, activities, views, and workflows, but treats customization as application development. Its CLI scaffolds an app, and the SDK defines objects, fields, views, agents, and logic functions. A private app can then be published to a workspace. That approach suits a company whose sales process has already outgrown generic fields and a few no-code automations.
The product still has to work for sales and operations staff. The README shows configurable layouts, CRM tools, AI chat, workflows, and a marketplace rather than a developer-only database admin. Twenty offers a hosted cloud route for teams that do not want infrastructure, plus Docker Compose for self-hosters. The decision is less about feature availability than about whether you want to own the platform beneath those features.
A 4,822 MB install shows the size of the engineering surface
Our sandbox cloned commit 0393e1c and installed the yarn monorepo in 445 seconds. Yarn added 5,270 packages and used 4,822 MB on disk. Before installation, the checkout already contained 28,846 files, about 1,954,902 lines of source, and 291.3 MB. This is a full product, website, documentation set, server, worker, SDK, application system, and supporting packages in one repository.
That size changes contribution work. A developer should expect workspace-aware commands, Nx, TypeScript, NestJS, React, BullMQ, PostgreSQL, and Redis. Our scan found 46 CI workflow files and monorepo workspaces, but no root Dockerfile or tests directory. Docker assets live under packages/twenty-docker.
What happened when we ran it
Our clean 3-CPU, 8 GB Debian container completed dependency installation in 445 seconds. The resulting 5,270-package tree occupied 4,822 MB. Installation succeeded, so the package manager and lockfile were usable at commit 0393e1c. A contributor checkout needs several gigabytes before caches, databases, containers, uploads, or production backups are counted.
The harness found no build script or target, so it skipped the build. It also found no test script or target and skipped tests. A skipped step is not a failure, but it is not evidence that the code compiled or passed a suite. Twenty's 46 workflow files show that upstream automation exists. A buyer should identify the package-specific commands used by those workflows rather than assume one root command covers the monorepo.
No vulnerability count was supplied by our lab for this run, so this review does not assign one. Release v2.35.0 includes dependency and production-image security work, including package bumps and patched operating-system components. Those release notes show active maintenance; they do not substitute for an audit of the exact images and lockfiles a self-hoster deploys.
Self-hosting means protecting one irreplaceable encryption key
The Compose guide asks for Docker, current Compose, and at least 2 GB RAM. Its default stack brings up the application with PostgreSQL, Redis, a server, and a worker. Persistent volumes cover the database and local file storage. A public instance should set its real SERVER_URL and sit behind a reverse proxy with HTTPS, because generated links, OAuth callbacks, secure cookies, and some browser features depend on the correct public origin.
The ENCRYPTION_KEY deserves more attention than the one-line installer. Twenty uses it for OAuth tokens, application variables, signing-key material, TOTP secrets, and sensitive configuration. The docs state that losing it means losing access to every encrypted secret in the database. Keep the key outside the host, rehearse database restores, and follow the documented rotation procedure. A database dump without the matching key is an incomplete recovery plan.
Integrations add provider setup rather than checkbox magic
Gmail and Google Calendar require a Google Cloud project, enabled APIs, OAuth credentials, and exact redirect URLs. Microsoft mail and calendar support similarly needs Azure configuration, Microsoft Graph permissions, and a Microsoft 365 license for users who sync those services. The admin panel can store much of this configuration, while database URLs, server URLs, and encryption secrets remain environment settings.
Single-workspace mode is the simpler default. Multi-workspace mode changes signup and administration behavior, gives workspaces subdomains, and requires wildcard DNS. That makes sense for a service provider or a larger organization with isolated teams, but it adds a tenancy decision that an internal CRM rarely needs. Start with one workspace unless separate domains and independent administration are requirements you can name.
The license separates apps from modifications to Twenty
GitHub could not reduce the repository's license to one SPDX identifier because the file has layers. Most of Twenty is AGPLv3. Some files carry a commercial license, and named SDK, UI, and application packages use MIT. An additional permission says applications built through the published APIs, webhooks, manifests, function runtime, renderer, and SDKs can use other terms, including proprietary ones.
That exception makes the app system useful to commercial teams without erasing the AGPL around Twenty itself. If you modify the core and let users interact with it over a network, the AGPL terms still apply. Legal review is sensible before distributing a customized appliance or mixing enterprise-marked files into a fork. Ordinary private applications using the stated interfaces have a much clearer path.
Active releases make backups and pinned upgrades mandatory
GitHub recorded 55,615 stars, 179 combined issues and pull requests, and a last push on August 27, 2026. Release v2.35.0 was published on August 26 and lists 107 pull requests, including two breaking changes. It also changes workflows, widgets, the ORM path, video attachments, mail aliases, metrics, and an MCP progress-token response. This is active product work, not a maintenance-only branch.
The upgrade guide says v2.34 and newer need PostgreSQL 15 or later, while the official Compose file uses PostgreSQL 16. It supports direct cross-version upgrades from v1.23, runs migrations on startup, and tells operators to back up first. That is workable discipline for an experienced self-hoster. For a team without database ownership, the 445-second install is the smallest part of the commitment; hosted Twenty or a simpler CRM is the better buy.