The Open-Source Pivot: Why Open Core SaaS Often Traps You in Enterprise Hell

The short answer

Open source and open core are not the same thing, and the difference decides whether you actually own your stack. Open source means every feature ships in the code you can run. Open core means a company gives away a base version and gates the features enterprises actually need, SSO, audit logs, RBAC, behind a paid license it controls, and can change that arrangement whenever it wants.¹

Two recent stories make this concrete: PostHog's pricing structure, and OpenRouter's sale to Stripe. Neither is a scandal. Both are useful reminders that "open source" on a landing page is marketing, not a guarantee.

PostHog: open, until you need the enterprise bits

PostHog is genuinely useful and its free tier is real. Its core is MIT licensed, and the company maintains a stripped FOSS build for anyone who wants a fully open deployment. But PostHog itself is candid that this is an open-core business, not a fully open one. Self-hosted, open-source PostHog is explicitly built for hobbyists: MIT licensed, provided without a guarantee, and unlikely to scale past a few hundred thousand events without significant engineering effort.²

The company's own disclaimer lists what self-hosters lose compared to the hosted product: insight subscriptions, group analytics, data pipelines, multi-environment feature flags, and the entire Enterprise tier, SAML, RBAC, custom MSAs, audit logs, custom data retention.² Those are not cosmetic extras. They are the exact controls a security or compliance team asks for the moment a company has more than a handful of employees.

On top of that, PostHog layers three paid platform add-ons: Boost at $250 a month, Scale at $750 a month, and Enterprise at $2,000 a month, which is where SSO, RBAC, and SLAs actually live.³ A team that grows past the free tier does not just pay for more events. It pays for the privilege of basic access control, and the pricing page does not fully spell out where that line sits until you talk to sales.³

None of this makes PostHog dishonest. Founder Mo Shehu wrote plainly, years ago, that open core requires maintaining two editions of a product and "it takes a lot of work to separate your open-source code from your proprietary code," precisely because the business model depends on that separation.¹ The pattern is the model working as designed. The risk is assuming it works differently than it does.

OpenRouter: neutral infrastructure, one acquisition away from a new owner

OpenRouter built its reputation as neutral routing infrastructure for AI models, processing more than 10 trillion tokens a day across 400-plus models for over 10 million developers.⁴ In August 2026, Stripe agreed to acquire it in a deal reportedly worth more than $7 billion.⁵

OpenRouter's own announcement promised continuity: "same mission, same name, same product, same roadmap."⁴ That may well hold. But the announcement itself concedes the real point: a company that markets itself as the neutral layer for an entire ecosystem was, in fact, a single acquirable entity the whole time. Analysts reading the deal noted it gives Stripe visibility into token routing and purchasing behavior across the AI infrastructure stack, not just payments.⁶ If you built critical workflows on top of that neutrality, your dependency now sits inside a payments company's roadmap, not an independent one.

This is the OpenRouter lesson for any team relying on an open or open-adjacent SaaS layer: a product's governance can change ownership in a single transaction, regardless of how open or developer-friendly its API has always felt.

The pattern has a name, and a track record

This is not unique to PostHog or OpenRouter. A survey of self-hosted tools found a consistent pattern nicknamed the "SSO tax," where single sign-on and other basics get pulled behind a paywall well after teams have built on the free tier.⁷ Some of the runways were long: Redis was open for 15 years before its 2024 relicense, Elasticsearch for 11 years, Rocket.Chat capped self-hosted deployments at 25 users after 8 years of unlimited free use.⁷ The tracker's own framing captures it well: "open core has taught a generation of companies that you can build an audience on a free license and then meter the exits."⁷

A separate infrastructure-focused analysis lays out the mechanism clearly: with open core, "you're not locked into the open source part, you can always fork that. You're locked into the proprietary features you've come to depend on. And migrating away from those features often means migrating away from the entire platform."⁸

What this means for build vs buy

None of this is an argument against open source software. It is an argument for reading the license, not the logo. Before adopting any open-core tool for something load-bearing, three questions matter:

• Is every feature you'll eventually need actually in the open repo, or does it live in a separate enterprise binary?
• Has the vendor changed its license before? A history of relicensing is a signal, not a one-off.
• Who governs the project, a single VC-backed company, or a foundation with diverse contributors?

For internal tools where SSO, audit logs, and access control are not negotiable, the safer long-term bet is often to build the thin layer yourself on top of genuinely open infrastructure, rather than rent a workflow that becomes hostage to someone else's enterprise tier. That is the same logic behind Remy, which treats internally built software as an owned asset instead of a subscription you can be priced out of later.

FAQ

What is the real difference between open source and open core? Open source ships every feature in the code anyone can run under a permissive or copyleft license. Open core ships a free base version while gating enterprise-grade features, like SSO or audit logs, behind a separate proprietary license the vendor controls.¹⁸

Is PostHog fully open source? Its main codebase is MIT licensed, and it maintains a FOSS-only build, but the company is explicit that self-hosted open-source deployments are meant for hobbyists and lack commercial support, while enterprise features like SAML and RBAC sit behind paid add-ons.²³

Does the OpenRouter-Stripe deal change how OpenRouter works? OpenRouter says its product, mission, and roadmap stay unchanged, but the deal is a reminder that infrastructure marketed as neutral can still change ownership entirely in a single acquisition.⁴⁵

Why do open-core vendors gate SSO specifically? SSO, RBAC, and audit logs are the features companies need most once they scale past a small team, which makes them high-value gates. Trackers of the pattern call this the "SSO tax" because it repeatedly lands on the exact capability serious deployments require.⁷

How do I protect my team from an open-core rug pull? Check whether every feature you depend on ships in the open repo, look at the vendor's license-change history, and favor projects with diverse governance over single-company control. For anything mission-critical, weigh building it internally against renting a tier that can be repriced or restricted later.⁸