Spot on about the billing page screenshot request. That's saved me before - it's where they sneak in the "platform fee" or mandatory "success onboarding" package for teams over 10 seats.
> the API call limits per user can throttle your entire integration
Absolutely. We learned this the hard way with a previous tool. The overall org API pool seemed fine, but heavy users would hit their individual cap and fail, while light users had capacity sitting idle. Had to build a queuing system just to smooth it out.
Your compliance point on self-hosted is huge. Beyond audit logs, think about encrypted backups and intrusion detection. That's a whole part-time job right there.
spreadsheet ninja
Your shortlist is a pragmatic start, but I'd suggest a methodological pivot based on your API requirement. Instead of evaluating the CRM first, begin by examining the API documentation and changelog for each candidate. A dated or sparse API often indicates where the vendor's engineering priorities lie, which directly impacts your integration's longevity.
Regarding real pricing for 20 seats, the listed per-user monthly rate is rarely the final number. You must factor in the cost of the integration layer itself. For instance, with a self-hosted option like EspoCRM, the true cost includes the engineering time to build and maintain the API gateway that secures and monitors its endpoints. With a SaaS option, it's the potential overage costs from webhook traffic or batch operations that exceed the included limits, a line item you won't see until the second invoice.
I'd add Copper (formerly ProsperWorks) to your list for consideration. Its API is straightforward and it's built for Gmail/Workspace environments, which simplifies certain integrations. Their pricing is per-user and they've historically avoided mandatory contracts, but confirm that's still the case. For 20 users, you're likely looking at their Professional tier.
APIs are not magic.
I totally get where you're coming from on the billing data point. We ran into something similar with a team of 18 last year. The per-user quote for Freshsales looked perfect, but after six months, our actual bill was 40% higher because of API call overages from our custom webhook integrations. The pricing page called them "advanced workflows," but they were just basic lead routing.
That said, I think the grenade analogy can be a bit fatalistic. You're absolutely right about needing that real-world data, but you can pressure-test it before signing. My rule now is to get a written commitment on the specific limits that would trigger overages - especially on API concurrent calls and historical data export. If they won't put that in an email, it's a hard pass.
Has anyone actually gotten a vendor to agree to a capped egress fee for data extraction? That's the real lock-in test.
Happy testing!
That's such a smart rule about getting the overage triggers in writing before signing. We had a terrible time with that exact "advanced workflows" label on another platform - it turned out to include any automation with more than two conditions.
> Has anyone actually gotten a vendor to agree to a capped egress fee for data extraction?
Once, but it was a fight. We only got a soft cap on a per-gigabyte basis after threatening to walk, and even then, they defined "extraction" so narrowly it only covered manual CSV exports, not API calls for archiving. The real lock-in test we use now is to ask for a formal, itemized quote to extract 100% of our data, including all custom fields and activity logs, via their API at the end of a hypothetical contract. If they balk at providing that number, you know the answer.
Your lock-in test is the most practical vendor assessment I've seen. We formalized it into a security questionnaire item for our procurement process. The pushback you'll get is predictable: they claim it's impossible to estimate without knowing future data volume.
That's a red flag. Any competent vendor can provide a formula based on current record counts and a standard growth multiplier. We've had success framing it as a business continuity requirement, not a negotiation point. If they can't model the cost of a full exit, how can they claim to be a partner?
One caveat: even with a written quote, you must verify the extraction method's integrity. We once received a "full" data dump that omitted timestamps on activity logs, rendering the audit trail useless.
—at