ResourceSpace

Positioning

• Montala presents ResourceSpace as "an enterprise-level DAM without the price tag", built on open source with "no vendor lock-in" S50 S96. Ethics is part of the pitch: employee ownership, B Corp status, climate-positive operations, profits given to charity S33 S40 S50.
• Sector pages and case studies target five groups S50 S51:
  • arts & heritage ("200+ museums, galleries, archives…");
  • charities & non-profits ("40+ countries");
  • education & academia;
  • the public sector (UK G-Cloud 14 supplier since 2024 S41);
  • brand/product marketing.
• Typical uses:
  • a central asset library with fine-grained permissions;
  • consent-tracked photo libraries for charities;
  • IIIF and collections-management links for museums;
  • brand hubs with the Brand Guidelines plugin S43 S51 S9 S70.
• Competitors as perceived by the market: Unknown (no analyst positioning found). Montala's own white papers compare open-source and proprietary DAM, and DAM against SharePoint S91.

Pricing & licensing

• Licence: BSD-style, under a licence file that names Oxfam GB, Montala Limited and other copyright holders (2006-2026). It allows redistribution and modification. An extra clause forbids derived products from using the registered trademark "ResourceSpace" in their name without Montala's permission; "Powered by ResourceSpace" is allowed S14. GitHub reports the licence as "Other" (NOASSERTION) S17. Montala's terms state that development work it does for customers is released under this licence S37.
• No software licence fee and no per-user fee for the software. Customers pay only for hosting and support S27 S30.
• Free cloud tier: 10 GB, up to 10 users, AI tagging, no credit card. Instances live at {name}.free.resourcespace.com S28.
• Paid cloud packages (GBP, excluding VAT, billed annually by default; monthly direct debit on request). Prices are calculated by the pricing page script; the page shows monthly equivalents by default S27 S27:

• All paid packages include SSO setup, API access, an SFTP "hot drop" folder, the AI tools and a dedicated DAM consultant / Customer Success Manager S27. Each additional terabyte is priced by the page script at £1,440 per year (£1.44/GB); totals above £50,000 show "call us" S27. Health checks run once a year (Team), twice a year (Business) or quarterly (Enterprise/Platinum) S27.
• Unverified The FAQ says the set plans go up to 70 TB, while the pricing page offers 100+ TB on Platinum S30 S27.
• Minimum terms: 12 months for On Premise support packages, 1 month for all others S37. Training, consultancy and configuration hours fall under a fair-use limit: 20 h per year, 35 h for Business Cloud, 50 h for Enterprise Cloud / Enterprise On Premise S37.
• Paid bolt-ons:
  • OpenAI image editing: £250 + VAT per user per year, £1,000 for five users S62;
  • 50,000 extra Google Vision calls (10,000 included with a support contract), price Not public S59.
• Exit: customers can download all files with a metadata CSV, or a complete copy of the system to run unsupported on their own servers S27.

Security & compliance

• ISO/IEC 27001: Montala runs an ISMS that it says is "independently certified" to ISO/IEC 27001 S38. It moved to the 2022 version of the standard in its 2025 audit S39. The pricing FAQ states that "both ResourceSpace and the data centres" are ISO 27001 certified S27. The certificate number and certification body are Not public.
• Unverified The general FAQ still names Telecity and Redstone data centres certified to "ISO 27001:2005". The pricing FAQ and sub-processor list now point to London Docklands and Mythic Beasts S30 S27 S37. The FAQ entry looks outdated.
• Data residency: all customer data of the hosted service is stored on servers in the United Kingdom S30. The terms include a data-processing section: breach notification within 24 hours and a published sub-processor list (Mythic Beasts for hosting; Google, OpenAI and others for optional services) S37 S36. Montala says OpenAI API content is not used for training by default, and that supported customers have an agreement so their data is not used for training S58 S36.
• SSO:
  • SAML 2.0 through the bundled SimpleSAML plugin (Entra ID, Okta, Google Workspace, OneLogin, Shibboleth, Keycloak…) S53;
  • LDAP / Active Directory through the Simple LDAP plugin S42.
  • OIDC: no native support documented (Unknown).
• MFA: through the SSO provider, or with the TOTP plugin (added in 10.7) S54 S21.
• Account security: configurable password rules, failed-login bans by account or IP, and idle auto-logout (300 minutes by default) S55. CSRF protection applies to state-changing browser API calls S1. All SQL has used prepared statements since 10.0 S21.
• Audit: resource logs and a version-control revert S1 S46. From 11.1, an API request log table (14-day default retention) S1.
• Support SLA: priority-0 response within 3 hours (24x7) on Team/Business Cloud and 1.5 hours on Enterprise/Platinum; 1 working day for On Premise S37. A contractual uptime percentage is Not public.
• Other: UK G-Cloud 14 supplier S41. Royal Warrant holder (2018, renewed 2025) S34. SOC 2: none found (Unknown).

Analyst & market recognition

• No Gartner, Forrester, IDC or G2 ranking found on public pages (Unknown). The vendor cites its own customer rating (4.9/5; 4.99/5 average satisfaction in its 2025 impact report) S27 S39.

History

• 2006: built as "Words and Pictures" for Oxfam by Dan Huby and Neale Hall; Oxfam later releases it under an open-source licence S31 S34.
• 2007-04-17: version 1.1 (earliest entry in the public release history) S22. Version 2.0 follows on 2008-04-24 S22.
• 2009-03-18: Montala Limited incorporated S35.
• 2013: first dedicated office, in Oxfordshire S34.
• 2016-09-16: version 7.9 introduces "API v2", the current signed-request REST API S22.
• 2018: Royal Warrant granted; renewed in 2025 S34.
• 2019: first G-Cloud listing (G-Cloud 11) S41.
• 2020-10: Montala becomes 100% employee-owned S33.
• 2022-08-26: B Corp certification announced S40.
• 2022-09-14: version 10.0 S21.
• 2023-02-13: version 10.1 adds a GPT metadata plugin and the API Webhooks plugin S21.
• 2024-07-24: Adobe connector through LinkrUI; Microsoft Office follows on 2024-08-14 S83 S84.
• 2024-11-12: G-Cloud 14 S41.
• 2025-05-27: version 10.6 adds CLIP smart search and AI Faces S21.
• 2025-10-06: version 10.7 adds Whisper, Tesseract and TOTP S21.
• 2026-01-19: GitHub repository resourcespace/resourcespace created; the project is moving from Subversion to GitHub S17 S13.
• 2026-06-29: version 11.0 brings an interface redesign; PHP 8.2 becomes the minimum S21 S26.
• 2026-07-14: ResourceSpace Labs launched S25.
• 2027-02-23: version 11.1 planned (roadmap), including an "MCP API interface" item under scoping S23.