Open-Source Customer Data Platforms Compared: Licences, Capabilities, Production Readiness

No open source project in 2026 combines a permissive licence with a complete customer data platform (CDP) feature set out of the box. Apache Unomi (Apache 2.0) comes closest as a profile-centric CDP. RudderStack, Snowplow and Tracardi are source-available with commercial limits, while Jitsu, PostHog and Dittofeed are an event pipeline, an analytics suite and a messaging tool. We read each licence file on 17 October 2026.

Who this is for: architects and marketing-operations leads deciding whether a self-hosted open source route is realistic. You will get a licence and capability matrix, maturity signals, a line between pipelines and platforms, and a list of what you must build or buy to reach production. Part of the guides hub.

How we compared the projects

Every licence below was read from the LICENSE file in the project's GitHub repository on 17 October 2026, not from marketing pages. Licences change: Snowplow moved its core pipeline to a limited-use licence in 2024 11, and RudderStack's server is no longer under the licence its own 2021 post describes 78. Re-check before you commit.

For each project we asked four questions. Licence: can you run and modify it in production inside your own business? What it is: event pipeline, profile store with identity, or messaging tool? Hosting: which datastores must you operate? Maturity: latest release, activity and who stands behind it. Stars and push dates come from the GitHub repository pages and API on the same day 37. They show activity, not quality.

The master matrix: licence and capability

Table 1. Licence and capability (licences read 17 October 2026)

Checked 18 October 2026. These are licence-file observations, not legal advice. A project’s ingestion, identity, consent and activation features require a separate current-version test.

Sources for the table: 1, 4, 5, 7, 9, 11, 13–19. Where a cell says "not described", we read the README or docs page and found nothing; that is not proof the capability is absent.

Maturity signals

Table 2. Stack, releases and backing (GitHub data queried 17 October 2026)

| RudderStack | Go, React, PostgreSQL only | v1.90.1, 15 Oct 2026 | 4.5k / 17 Oct 2026 | RudderStack (vendor) | | Jitsu | TypeScript and Go; Postgres, Kafka or Redpanda, ClickHouse, MongoDB | 2.14.0, 9 Jul 2026; betas to 2.15.0-beta.85 | 5.1k / 16 Oct 2026 | Jitsu Labs, Inc.; Jitsu Cloud | | Snowplow | Scala; Collector 3.8.0 (25 Sep 2026), Enrich 6.13.1 (21 Aug 2026) | See components | Enrich 30, collector 39; umbrella repo 7.0k, last release 22.01 | Snowplow (commercial licence, managed clouds) | | OpenSnowcat | Scala; same pipeline components | Collector 1.2.1, Enrich 1.3.1 (21 May 2026) | Collector 78 / 15 Oct 2026 | SnowcatCloud (hosted) | | Dittofeed | TypeScript; Postgres, ClickHouse, optional Kafka | v0.23.0, 1 Dec 2025; alphas to v0.24.0-alpha.21 (4 Oct 2026) | 3.0k / 12 Oct 2026 | Idea Market inc.; Dittofeed Cloud | | LEO CDP | Java 11, Python, ArangoDB 3.11, Redis, Dagster | No releases listed | Framework 15 / 2 Oct 2026; free edition 53 / 13 Oct 2025 | Individual maintainer, USPA | | PostHog | Docker Compose hobby deploy, 4 GB memory recommended | Continuous from master | 40.3k / 17 Oct 2026 | PostHog Inc. |

| Krenalis | Go, React, PostgreSQL; Snowflake supported | v0.44.0, 6 Oct 2026 | 5 / 17 Oct 2026 | Copyright Open2b; pre-1.0 |

Sources: 1–5, 7, 9–19, 37.

Project by project

Apache Unomi

Unomi is a top-level Apache project that calls itself a Java open source customer data platform and the reference implementation of the upcoming OASIS CDP standard 2. Version 3.0 needs Java 17 and Elasticsearch 9; the "latest" manual says OpenSearch 3 arrives with 3.1 4. Profile merging fires on login events and a configured property, with the oldest profile as master by default; merged profiles are deleted and aliased 4. The manual also tells you to change the default karaf:karaf credentials. Jahia sells jCustomer on top of Unomi 3. Expect to write your own connectors and to run Elasticsearch yourself.

Tracardi

Tracardi describes itself as a headless, API-first CDP engine, shipped as Docker containers 5. The licence is MIT plus Commons Clause: you may use and modify it, but you may not sell a product or service whose value comes substantially from it, including hosting or support 5. The vendor's own comparison says automatic profile merging on identification points, processing of historical data, time-based events and extra collectors exist only in the commercial edition 6. That puts automatic identity merging behind the paid licence.

RudderStack (rudder-server)

RudderStack’s current rudder-server licence is Elastic License 2.0: source-available, rather than OSI open source. Confirm the licence and paid feature boundaries for the version you evaluate. The exact date of the historical licence change and the current open/paid replay split are not established here. Project repository.

Jitsu

Jitsu’s newjitsu branch carries an MIT licence from Jitsu Labs, Inc. That licence does not establish which components are required in a production deployment. Confirm the supported installation and whether functions, profile building and connector syncs require Kubernetes in the release you evaluate. Licence; self-hosting documentation.

Snowplow and the OpenSnowcat fork

Snowplow Enrich’s licence file is SLULA 1.1. It permits only the defined non-production or non-commercial uses and excludes competing use; do not infer that a production deployment is free because code is visible. Individual trackers and pipeline components can have different licences. Check each exact component and version before treating a fork or a paid edition as equivalent. Enrich licence.

Dittofeed

Dittofeed is MIT licensed (copyright Idea Market inc.), but its README says multi-tenancy, embedding and white-labelling belong to a licensed closed-source codebase 14. It is a customer engagement tool: journeys, broadcasts and templates across email, push, SMS and more 14. The architecture needs Postgres, ClickHouse, an API and a worker, with Kafka optional 15. The newest stable tag is v0.23.0 (December 2025); October 2026 builds are alphas 37. See self-hosted email marketing platforms compared.

LEO CDP

PostHog

PostHog is an analytics platform whose data pipelines module acts as a customer data platform for its own event stream 17. Code is MIT Expat except ee/ 17. Self-hosting is deliberately limited: the README says open source deployments should scale to roughly 100k events per month, the docs offer no support for self-hosted instances, publish no tagged releases or CVEs for them, and steer most users to Cloud 17. Treat it as an analytics tool, not a regulated-industry CDP.

Mautic (not a CDP)

Mautic describes itself as open source marketing automation software under GPL-3.0 or later; its own site never calls it a customer data platform 18. It runs on PHP with MySQL or MariaDB 18. It appears in "open source CDP" lists because it is self-hostable and holds customer records, but as marketing automation software it is built to send messages and run campaigns, not to unify identities.

Newer projects and building blocks

• Krenalis: Go, single executable plus PostgreSQL, warehouse-native identity resolution; Elastic License 2.0 core, MIT connectors; five stars, v0.44.0, the README warns that breaking changes may occur until version 1.0.0 19.
• Multiwoven: AGPL-3.0 reverse ETL, 1.7k stars, v0.134.0 on 15 October 2026 20.
• Zingg: AGPL-3.0 entity resolution, v0.7.0 on 10 August 2026 21.
• Splink: MIT probabilistic record linkage, v5.0.0 on 18 September 2026 (GitHub licence detection) 23.
• Airbyte: Elastic License 2.0 root LICENSE 22.
• Grouparoo: MIT, archived since April 2022 23.

Apache Unomi vs RudderStack

They are not substitutes. Unomi keeps persistent profiles and answers real-time context requests; RudderStack moves events.

Open source Segment alternatives: what you replace

If you are leaving Twilio Segment on price (see Twilio Segment pricing and alternatives), you are replacing collection and routing, which RudderStack, Jitsu, OpenSnowcat and Krenalis cover. You are not automatically replacing Segment's identity graph, consent enforcement, audiences or its destination catalogue. Our 90-day migration plan lists those gaps phase by phase.

Event pipelines are not CDPs

A pipeline collects, validates, routes and loads events. A customer data platform adds a persistent identity graph and profile store, consent and suppression state, audience computation, governed activation and an audit trail. Five questions separate them:

1. Does it keep a persistent profile per person, not just a stream of events?
2. Can it merge anonymous and known identities with rules you can explain to an auditor?
3. Does it hold consent state per purpose and enforce it at activation?
4. Does it compute audiences incrementally and expose them to channels?
5. Does it log every activation with who, what, when, and under which consent?

Snowplow, OpenSnowcat, RudderStack and Jitsu answer "no" to most of these in their open versions. Unomi and Tracardi answer "partly". See what a customer data platform is, identity resolution explained and customer data platform architecture.

Open source composable CDP: assembling from parts

A composable build uses the warehouse as the profile store and assembles the rest. See composable vs packaged vs private CDP.

AGPL-3.0 extends copyleft to software users reach over a network; have counsel review before you modify and expose it. This article is not legal advice.

What practitioners say on Hacker News

• Price triggers builds. In a 2019 Segment pricing thread, commenters reported bills near $30,000 per six months and in-house replacements built in about a week, at roughly $500 a month in extra cloud cost 24.
• Stateless means no replay unless you provide storage. A 2020 commenter noted that a pipeline storing no data cannot replay history; RudderStack's founder replied that replay works if you supply a bucket 25.
• Licence changes feel like rug pulls. Snowplow's January 2024 notice, as quoted in the thread, said "You cannot run this software in production in a highly available manner" 28. The OpenSnowcat Show HN drew 77 points and 18 comments, and several readers said the site did not explain what the product does 29.
• Deployment ergonomics matter. Jitsu's launch (265 points) drew requests for Helm charts over Docker Compose, consent configuration, and questions on scaling and event ordering 26. Dittofeed's launch pitched self-hosting so finance and healthcare teams keep PII on their network, and one commenter objected to Docker Compose 27.
• "Self-hosted" is not "self-sufficient." An Ask HN poster with a high budget and a breach-sensitive customer base found that many data vendors did not offer self-hosting, and replies pointed to assembling ClickHouse and Airbyte 30. The evefan founders said self-hosted alternatives failed at their scale of over 60 million accounts 32.

The path from open source to a supported private deployment

Open source gives you code. It does not give you a service. Table 3 lists what you must build or buy.

Table 3. Gaps between open source code and a production customer data platform

A private-deployment shortlist can include commercial products alongside open-source projects. The supplied fact check identifies Meiro’s hosting choices, Tealium Private Cloud and PrivyCDP’s customer-managed options. Confirm the current deployment contract and BAA scope directly; these descriptions do not establish on-premises availability for every vendor or plan. See the deployment guide and three-year TCO model.

Operations checklist

Before an open source customer data platform carries production traffic, confirm:

• The licence permits your use: internal production, modification, and any resale or hosting for subsidiaries or clients. Counsel has read it.
• A licence-change plan exists: a fork or exit path if terms change, as happened with Snowplow and RudderStack.
• Datastores (Elasticsearch, ClickHouse, PostgreSQL, Kafka) are sized, replicated across zones and backed up.
• A restore from backup has been tested within your recovery time target.
• Default credentials are replaced and admin ports are not exposed.
• Identity merge and unmerge rules are written down and tested with real edge cases.
• Consent and suppression changes propagate to every destination within a stated time. See consent withdrawal across channels.
• Every activation is logged with consent basis, and logs are tamper-evident.
• Upgrades are rehearsed in staging, and a CVE feed covers every component.
• Connector failures alert a person, with retries and a dead-letter queue.
• Load is tested at twice peak, including replay and backfill.
• Someone owns on-call, and a vendor or partner can be paged at 02:00.
• The total cost of engineering, infrastructure and risk has been compared with a supported option (use the RFP template).

Licences were read from the LICENSE file in each repository on 17 October 2026. Stars, releases and push dates come from the GitHub REST API on the same day.