OSS vs Enterprise Edition
What the open-source Tempest server gives you, what Enterprise Edition adds, and how to tell which one you are running.
Tempest Server comes in two editions:
Open source
Self-hosting for yourself — one person, one vault, your own infrastructure
Enterprise Edition
Self-hosting for an organization — shared vaults, stronger authentication, access control and audit
The open-source image is published on Docker Hub as tempestterm/tempest-web-services-oss; see Deploy the Tempest Server with Docker Compose. Enterprise Edition is distributed to customers under licence — contact support.
The one-sentence difference
The open-source edition gives every user one personal vault. Enterprise Edition is what makes a vault something more than one person can hold.
Almost everything else follows from that. Shared vaults need membership, membership needs invitations, shared access needs policies and groups, shared responsibility needs audit and recordings, and an organization that shares secrets needs single sign-on and a stronger second factor than a password.
What the open-source edition already does
This is not a demo build. It carries the whole single-user product:
Encrypted vault sync. The full end-to-end encrypted personal vault — hosts, keys, snippets, settings — replicating to your own CouchDB. The E2EE design is identical in both editions; the server only ever sees ciphertext.
Accounts and sign-in. Registration, email confirmation, password reset, sessions.
A complete OAuth 2.0 and OpenID Connect provider. Authorization code with PKCE, the device grant, discovery, JWKS and UserInfo. This is how the desktop, mobile and CLI clients sign in — with an account held on your own instance.
The Console — the web admin UI, account settings, device list.
Web Mode, SSH multiplexing, and the scheduled-snippet runner.
Instance administration, including the background-job dashboard.
Master-password self-service reset for the personal vault.
A single-person homelab install is not missing anything it needs.
What Enterprise Edition adds
Shared Teams and shared vaults
The headline feature, and the one the rest hangs off. The open-source edition gives each account a single Personal Team and refuses to create any other; vault sharing has nowhere to happen. Enterprise Edition adds shared Teams, shared vaults, per-vault membership and per-vault access policies, vault member management and pending grants — with seat-based licensing, where a Team administrator assigns seats explicitly rather than membership granting one automatically.
Invitations
Inviting colleagues — to a Team, to a vault, or to a notification channel — is Enterprise Edition. The open-source edition has no invitation flow, because there is nothing to invite anyone into.
Single sign-on
Signing in with an existing identity — Google, GitHub, Apple — is Enterprise Edition. The open-source edition authenticates against accounts on your own instance only: email and password, plus the device grant for clients. That is enough for one person, and not enough for an organization that already has an identity provider.
Two-factor authentication
TOTP and WebAuthn passkeys or security keys as a second factor, with the matching challenge step at sign-in. There is no way to turn two-factor on in an open-source build.
Hosts, groups and access control
Everything that expresses who may reach what: cloud Hosts and Host Groups, User Groups, access bindings, policies, and team SSH CA rotation.
Relays
Relay registration, heartbeat, token rotation and per-connection credential issuance.
Session recordings and Tempest Drive
Session recording upload, listing and retention, plus Drive attachments — client-side-encrypted attachments for snippets.
Real-time collaboration
Shared terminal sessions: participants, link viewers, and the session lifecycle around them.
The AI assistant
The Tempest AI Assistant — the model catalog, conversations and usage accounting — is Enterprise Edition. It is not present in an open-source build.
Push notifications
Tempest Push delivery to APNs and FCM is Enterprise Edition. An open-source instance still registers your devices, but it has no delivery transport wired, so notifications are not sent — security alerts such as a new-device sign-in reach you by email instead.
Notification channels
Webhook, Pushover and SMTP notification channels, and inviting colleagues to them.
The administration console
Both editions ship instance administration and the background-job dashboard. Enterprise Edition adds the full administration console: CRUD over users, teams, vaults, hosts, policies, relays and instance settings, user impersonation, and the operational actions that go with them.
In an open-source deployment, that console returning 404 to a signed-in instance administrator is correct behavior, not a misconfiguration.
Bot challenge
An optional Cloudflare Turnstile challenge on the sign-up, sign-in and password-reset forms. It ships with Enterprise Edition and stays off until an operator configures a Turnstile key pair.
Licensing
Enterprise Edition is licensed per instance, with a plan and a seat count, and activated by an administrator after installation. The open-source edition has no licence, no expiry and no activation step.
Quick reference
Personal vault, end-to-end encrypted sync
●
●
OAuth 2.0 / OpenID Connect provider, device grant
●
●
Console, Web Mode, SSH multiplexing
●
●
Scheduled snippets
●
●
Instance admin + background-job dashboard
●
●
Shared Teams and shared vaults
—
●
Invitations
—
●
Single sign-on (Google, GitHub, Apple)
—
●
TOTP + WebAuthn two-factor
—
●
Hosts, Host Groups, User Groups, policies
—
●
Relays
—
●
Session recordings, Drive attachments
—
●
Real-time collaboration / shared terminals
—
●
AI assistant
—
●
Push delivery (APNs / FCM)
—
●
Notification channels (webhook, Pushover, SMTP)
—
●
Full administration console
—
●
Bot challenge
—
●
Licence required
—
●
Telling which edition you are running
The Console sidebar footer shows the server version and edition, so a screenshot or a support ticket always carries the build it came from.
Enterprise-only endpoints are not present at all in an open-source build, which is why they answer 404 rather than 403. A 404 on an enterprise feature means you are on the open-source edition, not that something is broken.
Moving to Enterprise Edition
Both editions run against the same Postgres and the same CouchDB, and Enterprise Edition layers its migrations on top. In practice the move is: switch to the Enterprise image, run db:migrate, activate the licence, and create your first shared Team. Existing accounts, personal vaults and client sign-ins carry over untouched.
Contact support for the Enterprise image and a licence.
See also
Deploy the Tempest Server with Docker Compose — the open-source stack, end to end
End-to-End Encryption — identical in both editions
Last updated