# CRM Hosting Requirements and Deployment Checklist

- Link: https://offshorehosting.pk/crm-hosting-requirements-and-deployment-checklist/
- Published: 2026-10-25T10:35:00+00:00
- Author: admin

# CRM Hosting Requirements and Deployment Checklist

A CRM is not just another web application. It holds the names, contact details, 
conversations, deals and histories of every customer your business has — the data
that is hardest to reconstruct if it is lost, and the data whose exposure does the
most damage if it leaks. Hosting a CRM therefore deserves more care than hosting
a brochure site, and a deployment checklist is how that care becomes repeatable.

This guide uses SuiteCRM as the worked example, because it is a widely used self-
hosted, open-source CRM, but the requirements and the checklist apply to most self-
hosted CRMs. Always confirm the exact requirements for the CRM and version you deploy—
versions change, and this guide is a starting point, not a substitute for the vendor’s
documentation.

## Server requirements

SuiteCRM’s compatibility matrix, as reflected in current installation guides, calls
for:

 * **PHP:** 8.1, 8.2 or 8.3 for SuiteCRM 8.9.x; 8.1–8.4 for SuiteCRM 7.15.x. Check
   the matrix for your exact version before you install — PHP compatibility is version-
   specific.
 * **Web server:** Apache 2.4 with `mod_rewrite` enabled, or Nginx with an equivalent
   configuration.
 * **Database:** MariaDB 10.6, 10.11, 11.4 or 11.8, or MySQL 8.0/8.4. SuiteCRM is
   a PHP application backed by MySQL/MariaDB, and the database is where performance
   is usually won or lost.
 * **Operating system:** a current, supported Linux distribution, kept patched.

A practical minimum server for a small team is 2 vCPU cores, 4 GB of RAM (8 GB recommended
for production), and at least 20 GB of free disk — and that is a minimum, not a 
target. A CRM with several simultaneous users, email sync, workflows and reporting
needs headroom, particularly in RAM. Set the PHP memory limit to at least 512 MB
for larger deployments, and size uploads and post limits to the attachments your
team actually sends (a common starting point is 100 MB for both, adjusted to your
needs).

Shared hosting is generally not recommended for SuiteCRM: it needs more resources
than a shared plan reliably provides, and the background jobs a CRM depends on do
not run well there. A VPS or a dedicated server is the usual fit. See [Self Hosted CRM vs SaaS CRM](https://offshorehosting.pk/blog/self-hosted-crm-vs-saas-crm/)
if you are still deciding whether to self-host at all.

## The parts people forget

**Background jobs (cron/schedulers).** A CRM does work when nobody is looking: it
sends scheduled emails, runs workflows, updates campaigns, and processes inbound
mail. In SuiteCRM these are Schedulers, and they only run if the server’s cron is
configured to trigger them. A CRM installed without a working cron looks fine on
day one and silently stops doing its background work. Configure the cron during 
deployment and verify that a scheduled job actually runs.

**Email — inbound and outbound.** A CRM is only useful if its email works both ways:
outbound notifications and campaign mail through SMTP, and inbound mail for cases,
leads and replies. Configure SMTP with authentication and TLS, test sending to an
external address, and confirm SPF, DKIM and DMARC for the sending domain so CRM 
mail is not treated as spam. Test inbound mail as well — a mailbox that is configured
but never polled is a silent failure.

**File storage and attachments.** Documents, email attachments and imported files
accumulate. Size the disk with growth in mind, and include the CRM’s upload directory
in the backup — it is not in the database, so a database-only backup will not restore
it.

## Security requirements

A CRM is a high-value target, because it concentrates personal data. Treat its security
as a first-class requirement, not a post-launch task:

 * **HTTPS everywhere**, with a valid certificate and HSTS if your setup supports
   it. Never run a CRM over plain HTTP, even internally.
 * **Strong authentication**, unique accounts per user, and the strongest multi-
   factor authentication the CRM supports. Shared logins make auditing impossible.
 * **Role-based access.** Configure roles so each user sees only the records they
   need. Sales, support and management do not need the same access, and the default“
   everyone sees everything” is rarely right.
 * **Least-privilege database access.** The CRM’s database user should have only
   the privileges the CRM needs, from localhost only where possible.
 * **Firewall and SSH hardening.** Only the web ports (80/443) and SSH from trusted
   sources should be reachable. Use SSH keys, disable password-only root login, 
   and keep the server patched.
 * **Keep the CRM, its modules and the server updated.** An unpatched CRM with known
   vulnerabilities is an easy target, and the data it holds makes the payoff high.
 * **Audit logging.** Enable and review the CRM’s audit and access logs, and retain
   them. If a record changes unexpectedly, you need to know who changed it and when.
 * **Data protection law.** A CRM stores personal data, so confirm what your jurisdiction
   requires — consent, retention, access and deletion rights, and breach notification.
   This article is not legal advice; confirm with a qualified adviser.

## Backup and recovery

Back up the database _and_ the application data. A SuiteCRM backup that covers only
the database will not restore uploaded documents, custom modules, or configuration
files. A practical routine is:

 * Daily automated backup of the database and the application data volume, stored
   off the server.
 * A second copy off-site, on the 3-2-1 pattern — see [Server Snapshots vs Backups](https://offshorehosting.pk/blog/server-snapshots-vs-backups/)
   and [How to Plan Backups for an Online Store](https://offshorehosting.pk/blog/how-to-plan-backups-for-an-online-store/)
   for the principles.
 * A restore test to a staging server, at least quarterly, timed and documented.

Decide your RPO and RTO before you deploy: how many hours of CRM activity can you
afford to lose, and how long can the sales team be without the CRM? Those answers
set the backup frequency.

## Deployment checklist

Use this checklist for every deployment, and do not skip the staging step.

**Planning**
 – [ ] CRM and version chosen, requirements checked against the vendor’s
compatibility matrix. – [ ] Server sized for the team and the data volume, with 
headroom for growth. – [ ] Data-protection and retention requirements confirmed.–[]
RPO and RTO agreed, and the backup plan written down.

**Server setup**
 – [ ] Current, patched Linux; firewall allowing only required 
ports. – [ ] PHP version matching the CRM’s matrix, with required extensions installed.–[]
MySQL/MariaDB installed, with a dedicated database and a least-privilege user. –[]
Web server configured with `mod_rewrite` (Apache) or the equivalent, and HTTPS with
a valid certificate. – [ ] PHP memory, upload and post limits set to the planned
values.

**Installation**
 – [ ] CRM installed on staging first, from the official release.–[]
Admin account created with a strong, unique password; no default credentials left
in place. – [ ] Company information, currencies, and system settings configured.–[]
SMTP configured and tested (send and receive); SPF, DKIM and DMARC checked. – [ ]
Cron/schedulers configured and verified running. – [ ] Roles and user accounts created;
access reviewed per role.

**Data**
 – [ ] Data import tested on staging with a sample file first — check for
duplicates, encoding issues, and field mapping errors. – [ ] Full import run on 
staging, verified, then repeated on production only after staging is approved. –[]
Duplicate-detection rules configured before the full import, not after.

**Testing**
 – [ ] Core journeys tested on staging: create a contact, log a call,
create a deal, send an email, run a workflow, generate a report. – [ ] Backup taken
and a restore tested on staging, timed. – [ ] Performance checked with a realistic
number of simultaneous users.

**Go-live**
 – [ ] DNS and SSL confirmed on the production domain. – [ ] Monitoring
and backup-failure alerts in place. – [ ] Team trained on the basics: login, contacts,
deals, and how to ask for help. – [ ] A named owner for patching, backups and user
management, with a weekly check on the calendar.

## After go-live

A CRM deployment is not finished at launch. Put these on a recurring schedule: weekly
patch checks and backup verification; monthly user and role reviews (remove access
when people leave); quarterly restore tests and performance reviews; and a review
of storage growth and database size every quarter. A CRM that is deployed and then
ignored slowly becomes slow, insecure, and full of duplicate data — all of which
are preventable with a small, regular routine.

## The bottom line

Hosting a CRM well means getting the server, the database, the cron jobs and the
email right, securing the personal data it holds, backing up both the database and
the files, and testing the whole thing on staging before anyone’s real customer 
data goes in. The checklist above is the difference between a CRM the team trusts
and one they work around.

For a VPS sized for a CRM, see our [VPS hosting](https://offshorehosting.pk/vps-hosting/)
plans. [TO BE CONFIRMED: Offshore Hosting VPS specifications suitable for SuiteCRM,
including RAM, storage and backup options.]

## Sources

 * SelfHostedWorld — SuiteCRM (self-hosted software, requirements summary): https://
   selfhostedworld.com/software/suitecrm/
 * idroot — How To Install SuiteCRM on Fedora 43 (compatibility matrix): https://
   idroot.us/install-suitecrm-fedora-43/
 * Dev.to — Self-Hosting SuiteCRM with Docker Compose: https://dev.to/selfhostingsh/
   self-hosting-suitecrm-with-docker-compose-4aj8
 * OSS Software — Open Source CRM Self Hosted Solutions: https://osssoftware.org/
   blog/open-source-crm-self-hosted-solutions/
 * MonoVM — How to Backup a Server or VPS: The Ultimate 2026 Guide: https://monovm.
   com/blog/how-to-backup-a-server-or-vps/

## Sources

 * https://selfhostedworld.com/software/suitecrm/
 * https://idroot.us/install-suitecrm-fedora-43/
 * https://dev.to/selfhostingsh/self-hosting-suitecrm-with-docker-compose-4aj8
 * https://osssoftware.org/blog/open-source-crm-self-hosted-solutions/
 * https://monovm.com/blog/how-to-backup-a-server-or-vps/