Félix Malfait

building @twentycrm (YC S23 - Open Source). Previously Luckey (acquired by Airbnb).

[Félix Malfait @_felx]

@joshm Every French kid has to learn La Fontaine fables by heart at school :). The context here is a lion caught in net who uses force in vain and a little rat he once spared saves him by patiently biting the mesh thread by thread until the net falls apart

[Félix Malfait @_felx]

@hellorymi Yes! https://t.co/YZWNNwLKcI it's not perfect yet / we still have some improvements to make, but it works and is quite powerful!

[Félix Malfait @_felx]

The great convergence in SaaS is happening:
Twenty is a CRM but we use it to run our eng org.
Part of me will miss the MySpace era of SaaS. One tool per problem, all slightly broken but with its own personality.

[Félix Malfait @_felx]

@chronark ofc how do you think we got into YC??

[Félix Malfait @_felx]

This workspace is fully defined as code, mostly built through Claude

[Twenty @twentycrm]

Introducing Custom Layouts 🎨

You now have full control over what your workspace looks like

[Félix Malfait @_felx]

@froehlichmmm @thomasdesfrancs Haha maybe we should pivot 👀

[Félix Malfait @_felx]

If you had told me 12 months ago that @thomasdesfrancs who has no software engineering background would be able to build this as code, I would not have believed it

[Thomas des Francs @thomasdesfrancs]

It was really fun developing our own tools to build @twentycrm new website. Available on /halftone. We've for sure open-sourced it too!

[Félix Malfait @_felx]

@froehlichmmm @thomasdesfrancs Thanks! The video is just a fake coding editor we’ve built to embed on our website and show the capabilities. Internally I would say the team is 50-50 Claude Code / Cursor

[Félix Malfait @_felx]

@imrogb @thomasdesfrancs True for dev but not Enterprise! We want to be a company like Twilio or Cloudflare, that attracts everyone from solo dev to Enterprise. 100% or the Enterprises we’ve signed so far involved migrating from Salesforce, they are still the undebated leader :)

[Twenty @twentycrm]

goodbye old friend

[Félix Malfait @_felx]

Open source isn't dead but it's true that our security model is.

Right now most SaaS products put all tenants on shared infrastructure. A free signup from a throwaway email often sits on the same database as a paying customer with sensitive data. If all code becomes more vulnerable then maybe the question is: when a breach does happen, how do we mitigate the scope/impact? Infrastructure is probably the most under-utilized lever outside of Enterprises.

At least SaaS will need to adopt standards inspired by how AWS handles service limits on new accounts, or how Stripe graduates merchants through risk tiers. We're currently exploring progressive tenant isolation on our cloud offering. The idea is simple: tenants earn trust over time and get moved into increasingly secure pools. A job evaluates security scores based on signals — KYC completed, payment history, usage patterns, anomalous behavior. New signups start sandboxed. Verified tenants graduate. Enterprise gets private endpoints.

But not sure if shared infrastructure even makes sense for most B2B applications (especially if you don't have a free tier). Starting at $20/month you can probably get a dedicated instance for each customer and give full network isolation from day one. Then open source makes even more sense becaus we're back to the traditional self-hosting model.
But the reason SaaS won over on-premise is that we were not able to build the right tooling to make upgrades and development easy. Our ecosystem is designed around shared databases with tenant_id columns. Managing a fleet of isolated instances, deploying migrations to thousands of tenants, monitoring across all of them, we don't really have the good framework for that. But it's a problem worth solving!

[Félix Malfait @_felx]

No issue with your business decision but stop framing it as a moral imperative. Tons of software will stay open source (including Twenty). It is true that the security risk is growing for all software, but there are more interesting and nuanced conversations to have than "open source is dead."

For example, https://t.co/a4NTTNTKH3 could separate the public booking API from the private management API, then protect that management layer at the network level ; enterprise customers on private endpoints, free-tier/low trust users on a different isolated network, etc.

This has a real cost, and it's fair to say not every company can afford to build that infrastructure. But it should be a conversation about engineering tradeoffs, not a declaration that open source is over.

[Félix Malfait @_felx]

Love you guys but you’re better than this "open source is dead" shitposting. Security by obscurity has never been a good solution. Closing the repo buys time but at the end of the day if the vulnerabilities remains then AI will also make it much easier to reverse engineer at the API layer / perform mass injection, etc.

[Félix Malfait @_felx]

Hey Chris, you can use it in prod with real customers without paying anything (for example you could create a cloud offering competing directly with https://t.co/fV9sU3DABu). The only limitation today is on SSO and our implementation of Stripe Billing. Happy to discuss on a PR if you want to suggest changes, I agree wording could be improved

[Félix Malfait @_felx]

@mitsuhiko Screens for inspiration (doesn’t have to go as far) https://t.co/ZerR3KE9sF

[Félix Malfait @_felx]

@mitsuhiko https://t.co/qgcdCasEPX would love to see you try on our repo! Challenge: add a Merge option to the command bar to merge multiple duplicate records into one. So far none of our attempt came close to building a feature of that level of complexity cleanly

[Y Combinator @ycombinator]

Congrats to the @twentycrm team on the $5M round!

Twenty (YC S23) is building a flexible Open Source CRM alternative to Salesforce: https://t.co/cA0W0PWIki

[Konstantin Vinogradov @vinogradovk]

OSS has a great fit with enterprise infrastructure — not only with the usual data/cloud infra and dev tools, but also core business suites like CRM and ERP.

And I am happy to announce that we led a $5M seed round of @twentycrm, building an open-source alternative to Salesforce!