Start with what's free, because it's most of it

Strapi's open-source edition is MIT licensed and it is not a demo. Role-based access control is a free feature, and the docs say so plainly: custom roles, granular permissions across content types and plugins, and custom conditions like "is creator" all sit in the free tier with no Enterprise gate anywhere on the page. Internationalisation is free. The Media Library is free. The MCP server is free. Data transfer, API tokens, draft and publish, custom fields, the blocks editor, webhooks, cron jobs. All free, all unlimited on entries, API calls and locales.

That matters for the comparison, because it means the paid tiers are not selling you a working CMS. You already have one. They're selling you editorial workflow, identity integration, compliance evidence, and a phone number.

The things people get wrong first

Strapi Cloud and Strapi CMS are separate products, not two rungs of the same ladder. Cloud is a PaaS that deploys your CMS. A Cloud plan does not include premium CMS features: if you want Content History or SSO you buy a CMS Growth or Enterprise plan on top, or instead. If you self-host, you buy the CMS plan and no Cloud plan at all.

And seats are per environment, not a global pool. Buy five seats and you get five admin users in development, five in staging, and five in production. Adding an environment doesn't consume additional seats. I got this wrong once mid-RFP and had to correct myself in front of the customer, so I'm now slightly evangelical about it. API tokens don't consume seats either, which matters more than it used to now that agents and CI pipelines authenticate the same way.

What Growth buys you

Growth is $45/month and includes three seats, with additional seats at $15/month each. The interesting part is what unlocks:

  • Content History, capped at 14 days of retention.
  • Releases, unlimited.
  • Live Preview, the side-by-side editing experience on top of the free full-screen Preview.
  • Strapi AI, with 1,000 credits a month.
  • Basic Support, by email and the customer portal.

Read that last one carefully, because it is narrower than it sounds. The support policy scopes Basic Support to licence-related and billing-related issues. Bug troubleshooting and implementation guidance start at Standard, which means Enterprise. On Growth, if you hit a bug, your route is Discord and GitHub like everyone else.

SSO is not included. It's a $150/month add-on, plus $50/month per seat, so on Growth's three seats that's $300/month rather than $150.

Growth's seat limit is enforced. If you upgrade into Growth with more admin users than you have seats, the users beyond the limit are automatically deactivated. My understanding is that Enterprise behaves as a soft cap reconciled commercially at renewal, though I haven't found that written down publicly, so don't plan around it without asking. The Growth behaviour is documented, and it's worth knowing before you migrate a twelve-person editorial team.

The honest read on Growth: it's aimed at a single product team with a handful of editors who want version history and scheduled publishing without a procurement cycle. You pay by card. Nobody talks to you. For a lot of companies that is exactly right.

What Enterprise adds

Everything in Growth, plus SSO included, unlimited Review Workflows, Audit Logs, a SOC 2 report, Standard Support, extended Content History retention, and the option to buy Premium Support with Concierge Advisory or an offline licence. You pay by wire transfer, which is a feature if you've ever tried to put a $45 card charge through a Fortune 500 procurement team.

What follows is each feature, what it does, and where I think it sits.

Single sign-on

Admin panel users authenticate against your identity provider instead of a local password. Azure AD, Okta, Auth0, Keycloak, generic OAuth. You configure providers in config/admin and manage the rest under Global settings. Auto-registration creates admin accounts on first login against a default role you nominate, and you can lock specific roles out of password auth entirely so they can only ever come in through the IdP.

One warning the docs give and I'll repeat: don't lock the Super Admin role out of local auth. If the IdP breaks you have no way back in.

Available on Enterprise, or as an add-on to Growth at $150/month plus $50/month per seat.

Audit logs

A searchable, filterable record of administrative actions: content created and changed, logins, role modifications, each with action type, timestamp, the user, and a detailed payload. Retention defaults to 90 days and is configurable in config/admin. Export caps at a million rows.

Since 5.52.0, agent-initiated changes through the MCP server land in audit logs alongside human edits. That is a bigger deal than it sounds. Once you let an AI client write to your content, "who changed this" stops being a question with a human answer, and audit logging is the only thing that makes the answer retrievable. Release actions are also Enterprise-only in the audit log.

Enterprise only. Requires 4.6.0 or later.

Review workflows

Custom multi-stage review pipelines. You define stages, assign entries to admin users as reviewers, and move content between stages. Transitions are permission-gated in both directions: a user needs permission to move content out of the current stage and into the target one, and the dropdown only shows what their role allows.

The limitation worth stating up front, because it surprises people: the documentation does not describe stages as blocking publication. Review Workflows track and route review, they don't hard-gate the publish button on their own. If you need "nothing ships without two approvals" enforced by the system rather than by the team, plan for that explicitly rather than assuming the stages do it.

Enterprise only, with unlimited workflows and stages. There is no reduced version on Community or Growth; the feature is simply absent.

Content history

Editors can browse and restore earlier versions of a document from the Content Manager. Versions are created automatically whenever content changes through the admin panel.

Retention is the whole story here. Growth gets 14 days and cannot extend it. Enterprise gets 30 days by default and up to 90 days maximum. The history.retentionDays config can only shorten retention, never extend it, and where the licence and the config disagree the lower value wins. The deletion job runs daily at midnight and versions it removes are gone.

The other thing to know: only Content Manager changes create versions. API calls, webhooks and scripts do not. If your editorial team writes through the admin panel you're covered. If a migration script mangles 4,000 entries overnight, Content History will not save you.

One caveat: the docs give the Enterprise default as 30 days and the maximum as 90, while the pricing page lists Enterprise retention as "Custom". Check what your contract actually says rather than the docs.

Releases

Group entries across content types and locales into one container and publish or unpublish them together, immediately or scheduled to a date, time and timezone. Content types need Draft & Publish enabled.

Releases store references, not snapshots. If someone edits a draft after you add it to a release, the release publishes whatever the latest saved version is at publish time. There's no version pinning. A published release also can't be updated or re-run; you create a new one.

Growth and Enterprise. Audit logging of release actions is Enterprise only.

Live Preview

Preview itself is free and shows content editors how changes will render on the front end inside the admin panel. Live Preview, on Growth and Enterprise, adds the side-by-side experience where you edit and see the result update next to you.

It's still flagged experimental. Setup is non-trivial: a preview object in config/admin with an activation flag, allowedOrigins and a handler, plus CLIENT_URL, optionally PREVIEW_SECRET, a preview route on the front end, and a frame-ancestors CSP directive so the iframe embeds. Changes to blocks fields and to fields inside dynamic zones aren't reflected in the preview, which for a lot of Strapi projects is most of the page.

Offline licensing

A self-hosted Enterprise add-on for infrastructure that can't reach Strapi's licensing endpoints. A standard licence checks in periodically against Strapi's licensing servers over the public internet; an offline licence validates without that call. It carries an additional fee.

If you're in defence, health, banking or anywhere with an air-gapped or heavily egress-filtered production network, ask about this at contract time rather than at go-live. It's a different licence type, not a config flag.

SOC 2 and compliance posture

Strapi states that it is SOC 2 certified and GDPR compliant. The Enterprise plan is what gets you the actual SOC 2 report to hand to your security reviewers; it's an Enterprise line item on the pricing page. If you have a vendor assessment questionnaire in your future, this line item is the one that closes it.

Support, and the Concierge Advisory programme

This is the part I'd argue is the real reason to buy Enterprise, so it gets more room.

Community edition gets Discord and GitHub Discussions, staffed by volunteers. Growth gets Basic Support by email, the customer portal and the Cloud dashboard widget, scoped to licence and billing issues. Enterprise gets Standard Support through the same channels, and this is the tier where bug troubleshooting and implementation guidance actually begin. Premium Support is an Enterprise add-on that adds a shared Slack channel, video calls, and Concierge Advisory, a 90-day programme with a named Implementation Manager.

That scoping is the single biggest gap between the tiers and almost nobody puts it in a comparison table.

The difference between Growth and Enterprise support is not faster answers to the same questions. It's whether "I think this is a bug in the Content Manager" is a question you're entitled to ask at all.

The clock you don't actually get

Now the bit most comparison posts leave out. Response-time SLAs exist on Premium Support only. Not Growth, not Standard. The published targets are one business day for P0, two for P1, three for P2 and five for P3, and Strapi sets the priority, not you. Support hours are Monday to Friday, 9-6 in AMER and EMEA, with APAC currently running on EMEA hours.

So if your actual requirement is "someone contractually answers within an hour when production is down", read those numbers carefully before you sign. What Enterprise support genuinely gives you is a team that knows your architecture, has seen your schema, and can escalate into the core engineering team. What it does not give you, at Standard tier, is a guaranteed clock.

I spend most of my working life in that Concierge Advisory window, so take this with the appropriate pinch of salt, but the pattern I see is consistent: the teams that use the kick-off session to get their content model and environment strategy right spend the next year shipping. The teams that skip it spend it refactoring. The 90 days is worth more than the SLA.

Why you'd choose Growth

You're one team. Three to ten editors. You want version history, scheduled publishing and a preview that isn't a deploy. You can live with 14 days of history and you either don't need SSO or you'll pay the add-on. You want to buy it on a card this afternoon.

Growth is also the right answer for a pilot. Run it for two quarters, find out which of the Enterprise features you actually reach for, then have the Enterprise conversation with evidence instead of a feature matrix.

Why you'd choose Enterprise

Three reasons, in the order they actually come up.

Identity and compliance. Your security team requires SSO and audit logs before the project goes near production, and someone is going to ask for the SOC 2 report. These aren't negotiable and they aren't on Growth without add-ons.

Editorial scale. Multiple teams, multiple brands or locales, a review process with more than one stage, and enough content velocity that 14 days of history is a real risk.

Access to people. A named implementation manager, a path into core engineering, and the option of a Slack channel and an SLA. On a build with a fixed go-live date and an agency or system integrator in the mix, this is usually what the money is buying. The features are table stakes; the escalation path is the product.

If none of those three describe you, Growth is not a compromise. It's the correct choice.

The AI question

Right now, Strapi AI is a Growth feature. Not Enterprise.

The docs are unusually direct about this: "Strapi AI is not available on Enterprise plans," and separately, "it isn't currently available in the Enterprise Plan, and there's no public timeline yet." It arrived in 5.30, it runs on a credit model (1,000 a month on Growth, pooled across everyone in the project, with overage billed automatically), and it covers AI-assisted content modelling in the Content-Type Builder, alt-text and caption generation in the Media Library, and automatic translation across locales when the source entry is saved. All requests go through Strapi-managed infrastructure.

That last sentence is why Enterprise doesn't have it yet.

If you are the kind of organisation that buys Enterprise, you have a policy about where your content goes and which models touch it. A credit pool routed through someone else's inference infrastructure is not a thing your security review will wave through, no matter how good the alt-text is. I hear this from customers constantly, and "AI is gated off Enterprise" was one of the top themes in the Enterprise feedback I pulled together in July.

Where the AI question is heading

The resolution everyone in enterprise software is converging on is bring-your-own-key. You supply the credentials for your own model provider, inference runs against your account under your data processing agreement, and the vendor ships the product surface rather than the tokens. It puts model choice, data residency, cost and audit trail on your side of the line. It also, incidentally, makes the credit question disappear.

I think that is where this lands for Strapi Enterprise, and I'd be surprised if it were anything else. To be clear, that is my read and not an announcement: there is no public timeline, no published design, and nothing I'm describing here has been committed to. If it matters to your architecture decision, ask your account manager to register the interest, because that's the signal that moves the priority.

The groundwork is already visible in the product, which is the part I find interesting. The MCP server is free and generally available. Since 5.49 there are typed builders for plugin authors: ai.mcp.defineTool, ai.mcp.defineResource, ai.mcp.definePrompt. Since 5.52 agent actions through MCP appear in audit logs. That's an AI integration surface that already assumes you're bringing your own client and your own model, with the compliance trail bolted on. The BYOK shape is the natural extension of what's already shipped, not a pivot away from it.

The new Media Library

Worth its own section because it is the largest visible change to the free edition this year, and it is genuinely good.

It shipped behind a betaMediaLibrary flag in 5.52.2 in late August. Strapi has said GA lands on 16 September 2026 in 5.54.0, where it becomes the default and the old one moves behind a permanent useLegacyMediaLibrary opt-out flag. As I write this, 5.54.0 hasn't been tagged; the latest release is 5.53.0 from 9 September, and the docs still describe the new library as a beta behind the flag. So treat the flag as still required until you see the tag.

What you get: folder management through a sidebar tree with drag-and-drop filing, search and sort and filter across both assets and folders, an image modal with crop and focal-point editing, an upload queue that survives navigating away from the page, and a layout that works on a tablet. The persistent upload queue sounds minor and isn't. Losing a 40-file upload because someone clicked into the Content Manager was a real and regular complaint.

All of it is in Community edition. The Media Library is a free feature and the minimum permission is "Access the Media Library" under Roles > Plugins - Upload. The new version is opt-in today and becomes the default at GA.

Media Library: notes for the upgrade

A few practical notes while you're upgrading. Default file size limit is 1GB, configurable via sizeLimit. Projects created on 5.52.2 or later reject image/svg+xml by default for security, so if you rely on SVG uploads you'll be re-enabling that deliberately. File replacement got atomic in 5.49 with a new provider replace method, so Cloudinary, S3 and local storage now invalidate cache properly on replace. And the S3 provider can take a function returning short-lived credentials, which is the answer for anyone who has been asking about credential rotation.

The AI features that sit on top of the Media Library (alt-text, captions, tags) are still Growth. The library itself is free.

Where I'd start

Model your content first, pick a plan second. The number of Strapi projects that go sideways because of a licensing decision is very small. The number that go sideways because the content model was designed around the first page of the website is not.

Then ask the two questions that actually separate the tiers. Does anyone in your organisation have to sign off on how administrators authenticate? And what happens, contractually, when it breaks?