🩺 Vitals
- 🟢 Last active: 2026-10-08
- 📦 Latest release: 2.69.0 (2026-10-06)
- 🐞 Open issues: 350
- 🌟 Stars: 5.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: kimai.org
- Source: github.com/kimai/kimai
- License: AGPL-3.0
- Deployment: Docker | SaaS
- Data Model: PHP (Symfony) + MariaDB/MySQL
- Jurisdiction: Austria 🇦🇹 / EU 🇪🇺 (Individual Maintainer)
- Compliance (SaaS): N/A (Undisclosed: no public trust page or audit reports)
- Compliance (Self-Hosted): GDPR Ready
- Complexity: Low (2/5) - PHP/Symfony app + MariaDB
- Maintenance: Low (2/5) - Container updates and MariaDB backups; Symfony migrations on upgrade
- User Management: Moderate (3/5) - Free SAML SSO, LDAP and turnkey RBAC (4 built-in roles plus custom) in the core; audit trail is a paid plugin, no free advanced leg
1. The Executive Summary
What is it? Kimai is a professional-grade time-tracking and invoicing suite designed for European professional services, agencies, and consulting firms. It provides a self-hostable, boardroom-ready alternative to US-based SaaS platforms by offering absolute data residency in the EU and full source-code transparency.
The Strategic Verdict:
- 🔴 For Large Scale Enterprises (SaaS): Caution. The project is run by an individual maintainer (bus factor of 1), which introduces key-person risk. Procurement teams should prioritize self-hosting to ensure long-term operational continuity.
- 🟢 For Privacy-First Organizations: Strong Buy. Kimai keeps data outside US CLOUD Act reach. Its strict adherence to EU data residency and "Privacy by Design" makes it a strong fit for firms handling sensitive government or corporate IP.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Harvest (SaaS) | Kimai (Self-Hosted) |
|---|---|---|
| Data Sovereignty | US-Centric (Liability Risk) | EU-Native (Zero Risk) |
| User Subscription | $14 - $18 / user / month | $0 (Core) / Fixed Cloud Fee |
| Feature Lock-in | High (Closed Database) | Zero (Standard SQL Export) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: Primarily deployed via Docker, leveraging a standard PHP/Nginx/MariaDB stack. The SaaS version is hosted exclusively on Hetzner in Germany.
- Scalability: Supports multi-user environments with complex hierarchical permissions. While PHP-based, its use of the Symfony framework ensures it can scale to support hundreds of concurrent users in an agency setting.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (Austria/EU): Kimai is operated by an individual developer domiciled in Vienna, Austria, with SaaS infrastructure hosted in Germany. As an EU-native entity, Kimai faces zero CLOUD Act exposure. The material governance risk is key-person concentration: with a bus factor of 1, long-term roadmap continuity and security patching depend entirely on a single maintainer.
- The Compliance Shift: Self-hosting shifts GDPR compliance obligations entirely to the enterprise. The operator must independently secure the infrastructure, maintain database backups, and manage timesheet data in accordance with the EU Working Time Directive. The audit trail is a paid plugin; SAML SSO, LDAP and RBAC are included free in the AGPL open-source core. SCIM provisioning is absent.
- License Risk (AGPL-3.0 Network Clause): The core is governed by AGPL-3.0. Any enterprise that modifies the core and deploys it over a network (internally or as a service) is legally required to open-source those modifications under the same AGPL license. Enterprise plugins are sold under restrictive proprietary terms that prohibit SaaS redistribution or sub-licensing. Internal forks or custom plugin development require formal legal review before deployment.
4. Market Landscape
🏢 Proprietary Incumbents
- Harvest: A US-based SaaS time-tracking platform; organizations switch to Kimai to eliminate per-user subscription costs and move timesheet data to EU-controlled infrastructure.
- Clockify: An aggressive freemium platform that gates audit logs, SSO, and advanced reporting behind high-cost enterprise tiers; Kimai ships SSO and RBAC free in its core, with audit logging as an optional paid plugin and no per-seat lock-in.
🤝 Open Source Ecosystem
- TimeTagger: A modern, minimal alternative for solo freelancers.
- InvoicePlane: Stronger focus on accounting/billing; Kimai remains the stronger choice for project-based time recording and reporting.