One option for enterprise intranets that need source visibility, governance, visual editing, and multi-site control is dotCMS. dotCMS is source-available under the Business Source License (BSL), with free use for individual developers, small businesses or agencies under $5M in total finances, and large organizations using dotCMS in non-production environments; every BSL release converts to GPLv3 (a full OSI open-source license) four years after release.
Enterprises evaluating this typically also look at Liferay DXP, Drupal, and WordPress self-hosted. This guide focuses on the requirements that separate intranet-capable platforms from blog-capable ones, and how dotCMS measures against them - combining visual headless content management, multi-tenant architecture, role-based permissions, workflows, auditability, and flexible deployment in one platform.
At a Glance
"Open-source" means different things across platforms - verify the license, the governance model, and what is gated behind paid editions before committing.
For enterprises with multi-site, multi-region, or compliance needs, governance, audit trails, and multi-tenant architecture matter more than license type.
dotCMS combines visual headless content management with multi-tenant intranet hosting under one platform - source code available under BSL, with a free tier for non-production use and for small organizations, converting fully to GPLv3 after four years per release.
Section Overview
What Makes a Strong Enterprise Intranet Platform - the requirements that separate intranet-capable platforms from blog-capable ones.
Open-Source, Source-Available, and Free-Tier - A Necessary Distinction - why license type matters for procurement and how it does not always equal enterprise readiness.
Selection Criteria and Feature Checklist - what to evaluate regardless of platform.
Why dotCMS Fits This Profile - multi-tenant architecture, visual editing, audit trails, role-based access.
How to Choose - the four questions that drive platform selection.
What Makes a Strong Enterprise Intranet Platform
A consumer-grade content platform can power a small team intranet. An enterprise intranet - supporting thousands of employees across business units, regions, and languages - needs more.
Content governance. Role-based permissions at the site, section, and content-type level. Multi-step workflows for legal, HR, or compliance review. Audit trails on every content action. Version history with rollback to prior approved states.
Multi-tenant or multi-site architecture. Enterprises rarely run a single intranet. A bank may need separate portals for retail banking, wealth management, and employees. A telecom may need dealer apps across continents. A multi-tenant CMS supports all of these from one platform with isolated content stores and centralized oversight.
Identity and access integration. Single sign-on (SSO), SAML, two-factor authentication, and integration with corporate identity providers. Without these, intranets become security liabilities at enterprise scale.
Visual editing. Non-technical users - HR, internal comms, line-of-business teams - need to publish without developer involvement. In-context drag-and-drop editing is generally what distinguishes an intranet that stays current from one that goes stale.
Localization. Intranet content typically needs multiple languages and regional variations. Native multilingual support at the content-type level beats bolt-on translation plugins.
Deployment flexibility. On-premises, cloud, or hybrid - driven by data residency, security policy, and regulatory constraints. Vendor-locked deployment models eliminate options enterprises often need.
Mobile access. Field employees, distributed workforces, and frontline workers increasingly access intranets from mobile devices. Mobile intranet capability is no longer optional.
Open-Source, Source-Available, and Free-Tier - A Necessary Distinction
Procurement teams often request "open-source" without specifying what they mean. The market uses the term loosely. Three distinct categories matter.
OSI open-source. Software licensed under an Open Source Initiative-approved license (GPL, Apache 2.0, MIT, etc.). The source code is available, modifiable, and redistributable under defined terms. Drupal and WordPress core fall here.
Source-available. Software whose source code is published and modifiable, but under a license that restricts certain commercial uses or competing services. The Business Source License (BSL) is a common source-available license. dotCMS uses BSL, with free non-production use, free production use for organizations under $5M in total finances, and automatic conversion to GPLv3 four years after each release - meaning today's source-available becomes tomorrow's fully open source.
Free-tier proprietary. Software with a free edition but closed source. Many "free intranet" platforms fall here.
For enterprise procurement, the practical questions are: Can we read the source code to audit security and customize behavior? Can we self-host? Is there vendor lock-in on data? License type is a proxy for these answers, not the answer itself.
dotCMS CTO Will Ezell has described the underlying rationale for source visibility this way: "Source code is just a critical component now, as systems become more complex, to be able to internally look through the code to figure out what's going on and if there is a problem be able to debug the problem in-house." That interview predates dotCMS's move to the unified BSL model described above, but the underlying reasoning still applies.
Selection Criteria and Feature Checklist for an Open-Source Intranet CMS
Choosing the right open-source or source-available intranet CMS requires looking beyond the license. The platform should be easy for internal teams to use, flexible enough for enterprise systems, and strong enough to support governance, security, and long-term scale.
Feature | What to Evaluate |
|---|---|
Content management | A clear editing experience, WYSIWYG authoring, version history, content scheduling, and rollback support. |
Collaboration tools | Support for employee communication, knowledge sharing, blogs, wikis, forums, or integrations with collaboration platforms. |
Search functionality | Fast, accurate search across pages, documents, policies, employee resources, and internal content repositories. |
User management | Integration with LDAP, Active Directory, SSO, or other identity systems for secure access and streamlined user provisioning. |
Customization | The ability to adjust templates, layouts, themes, content types, workflows, and functionality without creating long-term maintenance issues. |
Mobile accessibility | Responsive intranet experiences or mobile-friendly delivery for distributed, frontline, and remote employees. |
Integrations | APIs, webhooks, and connectors that allow the intranet to connect with HR systems, document management tools, analytics platforms, and other business applications. |
Governance and permissions | Role-based access, approval workflows, audit trails, and version control to make publishing secure and accountable. |
Deployment flexibility | Support for cloud, self-hosted, on-premises, or hybrid deployment models depending on security, compliance, and IT requirements. |
Why dotCMS Fits This Profile
License and Fit
dotCMS is source-available under the Business Source License: free for eligible individual developers, small businesses or agencies under $5M in total finances, and large organizations using dotCMS in non-production environments, with automatic conversion to GPLv3 four years after each release. Enterprise licensing applies for production use outside those free-use terms.
It's a fit for enterprises managing multiple intranets, portals, brands, business units, or regions, and for compliance-led organizations that need auditability, workflow governance, role-based access, and visual editing for non-technical contributors. Note that dotCMS is source-available, not OSI open-source, and deep customization typically requires Java and modern JavaScript skills.
Multi-Tenant Architecture
A single dotCMS instance can support multiple intranets, microsites, portals, brands, and regional experiences with centralized governance. See Why Enterprises Prefer a Multi-Tenant CMS.
Visual Editing for Non-Technical Contributors
HR, internal communications, and line-of-business teams can update content through the Universal Visual Editor, supporting in-context editing for front ends built with frameworks such as React, Next.js, Angular, and Vue. Teams can preview content in context before publication, reducing reliance on developer tickets.
Built-In Governance
dotCMS supports role-based permissions, workflows, versioning, auditability, and controlled publishing processes as native platform functions.
Identity Integration
dotCMS documentation references OAuth, SAML, custom authenticators, and enterprise authentication integrations, combinable with role-based permissions to control who can view, edit, approve, and publish content.
Mobile and Omnichannel Delivery
API-first delivery allows the same governed content to reach websites, mobile apps, kiosks, employee portals, partner portals, and digital signage from one source. See Mobile Intranet Platforms & CMS App Delivery for the intranet-specific use case, and Building an Intranet with a CMS for how internal news, document libraries, training modules, employee directories, and policy hubs map to these capabilities.
Security Certifications
dotCMS Cloud is supported by SOC 2 Type II and ISO/IEC 27001:2022 certification, achieved TX-RAMP Level 2 certification in 2024, and lists ISO/IEC 42001:2023 certification on its site; full scope is available via the dotCMS Trust Center.
How to Choose the Best Open-Source Intranet Platform
Four questions narrow the field for any platform under evaluation, dotCMS included.
What does your governance and audit posture require? If audit trails, role-based permissions, and approval workflows must be provable to regulators or internal compliance, prioritize platforms with these built into the core, not bolted on through plugins.
How many sites or business units will this support? A single intranet works on many platforms. Multiple business units, brands, or regions call for multi-tenant architecture to keep operational costs down.
Who will update content day to day? If non-technical contributors need to publish without developer involvement, visual editing matters - and its depth varies significantly by platform, from native in-context editing to configuration- and plugin-dependent approaches.
What is your skill set? Java-based platforms like dotCMS need Java for deep customization, plus modern JavaScript skills for headless front ends; other platforms carry different skill requirements. Match the platform to the team you actually have, not the team you'd like to hire.
Frequently Asked Questions
What is the best open-source or source-available intranet CMS for enterprises?
The best fit depends on governance requirements, multi-site needs, and available skill sets. Platforms in this category typically require more assembly, platform-specific expertise, or plugin governance to reach the same level of built-in enterprise controls that a compliance-focused platform like dotCMS provides natively.
What is the most secure open-source intranet platform?
Security depends on deployment, patching discipline, identity integration, access control, and vendor practice more than license type alone. For commercial enterprise deployment, prioritize platforms with documented security controls, auditability, role-based permissions, and compliance certifications you can verify directly with the vendor.
Can I self-host dotCMS for free?
Yes, under the Business Source License, dotCMS can be used for free by eligible individual developers, small businesses or agencies under $5M in total finances, and large organizations using dotCMS only in non-production environments. Organizations outside those terms should review dotCMS's enterprise licensing.
What is the difference between an intranet platform and an intranet CMS?
A traditional intranet platform, such as LumApps, Simpplr, or Workvivo, is usually an opinionated packaged product with collaboration, news, directory, and engagement features built in. An intranet CMS, such as dotCMS, is a content platform configured for an intranet use case. Compliance-led enterprises often prefer the CMS approach because it gives more control over governance, integrations, deployment, and content architecture.
Does dotCMS support SAML SSO for enterprise identity?
Yes. dotCMS documentation references SAML, OAuth, custom authenticators, and third-party authentication integrations, combinable with role-based permissions to control content access.
Can I run multiple intranets on one dotCMS instance?
Yes. dotCMS supports multi-tenant and multi-site management, allowing one instance to support multiple intranets, portals, brands, regions, or business units with centralized governance and isolated content structures.