> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/self-hosting-and-web-mode/oss-vs-enterprise-edition.md).

# OSS vs Enterprise Edition

What the open-source Tempest server gives you, what Enterprise Edition adds, and how to tell which one you are running.

Tempest Server comes in two editions:

| Edition                | For                                                                                                 |
| ---------------------- | --------------------------------------------------------------------------------------------------- |
| **Open source**        | Self-hosting for yourself — one person, one vault, your own infrastructure                          |
| **Enterprise Edition** | Self-hosting for an organization — shared vaults, stronger authentication, access control and audit |

The open-source image is published on Docker Hub as `tempestterm/tempest-web-services-oss`; see [Deploy the Tempest Server with Docker Compose](/self-hosting-and-web-mode/self-host-tempest-server-docker-compose.md). Enterprise Edition is distributed to customers under licence — contact support.

## The one-sentence difference

**The open-source edition gives every user one personal vault. Enterprise Edition is what makes a vault something more than one person can hold.**

Almost everything else follows from that. Shared vaults need membership, membership needs invitations, shared access needs policies and groups, shared responsibility needs audit and recordings, and an organization that shares secrets needs single sign-on and a stronger second factor than a password.

## What the open-source edition already does

This is not a demo build. It carries the whole single-user product:

* **Encrypted vault sync.** The full end-to-end encrypted personal vault — hosts, keys, snippets, settings — replicating to your own CouchDB. The [E2EE design](/accounts-vaults-and-privacy/end-to-end-encryption.md) is identical in both editions; the server only ever sees ciphertext.
* **Accounts and sign-in.** Registration, email confirmation, password reset, sessions.
* **A complete OAuth 2.0 and OpenID Connect provider.** Authorization code with PKCE, the device grant, discovery, JWKS and UserInfo. This is how the desktop, mobile and CLI clients sign in — with an account held on your own instance.
* **The Console** — the web admin UI, account settings, device list.
* **Web Mode**, SSH multiplexing, and the scheduled-snippet runner.
* **Instance administration**, including the background-job dashboard.
* **Master-password self-service reset** for the personal vault.

A single-person homelab install is not missing anything it needs.

## What Enterprise Edition adds

### Shared Teams and shared vaults

The headline feature, and the one the rest hangs off. The open-source edition gives each account a single Personal Team and refuses to create any other; vault sharing has nowhere to happen. Enterprise Edition adds shared Teams, shared vaults, per-vault membership and per-vault access policies, vault member management and pending grants — with seat-based licensing, where a Team administrator assigns seats explicitly rather than membership granting one automatically.

### Invitations

Inviting colleagues — to a Team, to a vault, or to a notification channel — is Enterprise Edition. The open-source edition has no invitation flow, because there is nothing to invite anyone into.

### Single sign-on

Signing in with an existing identity — Google, GitHub, Apple — is Enterprise Edition. The open-source edition authenticates against accounts on your own instance only: email and password, plus the device grant for clients. That is enough for one person, and not enough for an organization that already has an identity provider.

### Two-factor authentication

TOTP and WebAuthn passkeys or security keys as a second factor, with the matching challenge step at sign-in. There is no way to turn two-factor on in an open-source build.

### Hosts, groups and access control

Everything that expresses *who may reach what*: cloud Hosts and Host Groups, User Groups, access bindings, policies, and team SSH CA rotation.

### Relays

Relay registration, heartbeat, token rotation and per-connection credential issuance.

### Session recordings and Tempest Drive

Session recording upload, listing and retention, plus Drive attachments — client-side-encrypted attachments for snippets.

### Real-time collaboration

Shared terminal sessions: participants, link viewers, and the session lifecycle around them.

### The AI assistant

The [Storm AI](/ai-and-automation/tempest-ai-assistant.md) — the model catalog, conversations and usage accounting — is Enterprise Edition. It is not present in an open-source build.

### Push notifications

[Tempest Push](/terminal-and-operations/tempest-push-notifications.md) delivery to APNs and FCM is Enterprise Edition. An open-source instance still registers your devices, but it has no delivery transport wired, so notifications are not sent — security alerts such as a new-device sign-in reach you by email instead.

### Notification channels

Webhook, Pushover and SMTP notification channels, and inviting colleagues to them.

### The administration console

Both editions ship instance administration and the background-job dashboard. Enterprise Edition adds the full administration console: CRUD over users, teams, vaults, hosts, policies, relays and instance settings, user impersonation, and the operational actions that go with them.

In an open-source deployment, that console returning 404 to a signed-in instance administrator is correct behavior, not a misconfiguration.

### Bot challenge

An optional Cloudflare Turnstile challenge on the sign-up, sign-in and password-reset forms. It ships with Enterprise Edition and stays off until an operator configures a Turnstile key pair.

### Licensing

Enterprise Edition is licensed per instance, with a plan and a seat count, and activated by an administrator after installation. The open-source edition has no licence, no expiry and no activation step.

## Quick reference

| Capability                                        | Open source | Enterprise Edition |
| ------------------------------------------------- | :---------: | :----------------: |
| Personal vault, end-to-end encrypted sync         |      ●      |          ●         |
| OAuth 2.0 / OpenID Connect provider, device grant |      ●      |          ●         |
| Console, Web Mode, SSH multiplexing               |      ●      |          ●         |
| Scheduled snippets                                |      ●      |          ●         |
| Instance admin + background-job dashboard         |      ●      |          ●         |
| Shared Teams and shared vaults                    |      —      |          ●         |
| Invitations                                       |      —      |          ●         |
| Single sign-on (Google, GitHub, Apple)            |      —      |          ●         |
| TOTP + WebAuthn two-factor                        |      —      |          ●         |
| Hosts, Host Groups, User Groups, policies         |      —      |          ●         |
| Relays                                            |      —      |          ●         |
| Session recordings, Drive attachments             |      —      |          ●         |
| Real-time collaboration / shared terminals        |      —      |          ●         |
| AI assistant                                      |      —      |          ●         |
| Push delivery (APNs / FCM)                        |      —      |          ●         |
| Notification channels (webhook, Pushover, SMTP)   |      —      |          ●         |
| Full administration console                       |      —      |          ●         |
| Bot challenge                                     |      —      |          ●         |
| Licence required                                  |      —      |          ●         |

## Telling which edition you are running

The Console sidebar footer shows the server version and edition, so a screenshot or a support ticket always carries the build it came from.

Enterprise-only endpoints are not present at all in an open-source build, which is why they answer 404 rather than 403. A 404 on an enterprise feature means you are on the open-source edition, not that something is broken.

## Moving to Enterprise Edition

Both editions run against the same Postgres and the same CouchDB, and Enterprise Edition layers its migrations on top. In practice the move is: switch to the Enterprise image, run `db:migrate`, activate the licence, and create your first shared Team. Existing accounts, personal vaults and client sign-ins carry over untouched.

Contact support for the Enterprise image and a licence.

## See also

* [Deploy the Tempest Server with Docker Compose](/self-hosting-and-web-mode/self-host-tempest-server-docker-compose.md) — the open-source stack, end to end
* [Self-Hosted Tempest Server & Web Mode](/self-hosting-and-web-mode/self-hosted-tempest-server.md)
* [End-to-End Encryption](/accounts-vaults-and-privacy/end-to-end-encryption.md) — identical in both editions
* [How Tempest Protects Your Privacy](/accounts-vaults-and-privacy/how-tempest-protect-your-privacy.md)