croit: Virtualization Storage Ledger 2026 Scorecard

Part of the Virtualization Storage Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product
Owner: croit GmbH, Germany; founded January 2017 by Martin Verges and Matthias Grandl; privately owned by Verges, Grandl and Andy Muthmann with no outside capital (vendor statement); Ceph Foundation General member since 2018-11-12; Proxmox Gold Partner
Engine: Ceph (upstream builds by croit, Reef 18.2.8 and Tentacle 20.2.x) on an AlmaLinux-based immutable OS image served by PXE
Licence: Commercial software licence; SLAs only with a licence; two image variants since v2608.0, Core (upstream Ceph built and patched by croit) and Enhanced (croit's own Ceph build, stated to stay open source and upstream compatible); prices and metric not published (pricing page 404 on 2026-10-15)
Latest release: v2609.0 (September 2026 by version label, post undated), shipping Ceph Tentacle 20.2.4
Support lifecycle: Not published. Observed: Reef and Tentacle supported, Squid skipped ("upgrade directly to Tentacle"); 24/7 premium support sold as a service
Next milestone: None published
Hypervisors: Proxmox VE and other KVM hosts natively over RBD (croit Proxmox VE arm64 post, Gold Partner); VMware or Hyper-V only through the iSCSI or NVMe-oF export (v2609.0 post); no vSphere plug-in and no validated VMware target found
Tier: Ceph family
Archetype: Dependable builder
Evidence grade: C. Features come from croit's release posts for v2605 to v2609 and its about and solutions pages; the posts carry no dates, so months are read from the year-month version labels. docs.croit.io returned 503 and the pricing page 404 on 2026-10-15, so prices, licence terms and support windows are unverified. The company's founding year and ownership come from its own about page and the 2018 Ceph Foundation launch release. Steps before 2024 are inferred from the upstream Ceph the product managed and are grade C.

Scorecard

Dimension	Score	Direction
Capability today	70.8 / 100	higher is better
Momentum since end of 2022	+11.5 points (2017 to 2022: +0.0)	higher is better
Credibility	14.5 / 25	higher is better
Commercial risk	12.0 / 25	lower is better
Technical lock-in	7.5 / 25	lower is better
Integrator fit	9.5 / 20	higher is better
AI leverage	3.5 / 20	higher is better
Ledger Index	58.0 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Data services core (15)	n/a	3.5	3.5	4
Resilience and HA (15)	n/a	3.5	3.5	4
Performance and protocols (12)	n/a	2.5	2.5	3.5
Hypervisor integration (12)	n/a	2.5	2.5	3
Scale and topology (10)	n/a	3.5	3.5	4
Data protection and DR (10)	n/a	2.5	2.5	3
Security (8)	n/a	2.5	2.5	3
Operations and automation (8)	n/a	3	3	4
Hardware and deployment freedom (5)	n/a	4	4	4.5
Kubernetes and containers (5)	n/a	1.5	1.5	1.5
Total / 100	n/a	59.3	59.3	70.8

Year by year: 2017: 59.3 · 2018: 59.3 · 2019: 59.3 · 2020: 59.3 · 2021: 59.3 · 2022: 59.3 · 2023: 59.3 · 2024: 60.8 · 2025: 60.8 · 2026: 70.8

What moved the score

Year	Domain	Change	Points	Trigger
2024	Hardware and deployment freedom	4 → 4.5	+0.5	v2404.1: x86_64 and Arm nodes in one cluster (Arm preview images since 2018); management container x86-64 only
2024	Scale and topology	3.5 → 4	+1.0	v2404.1: separate default OS images for x86_64 and Arm nodes in one cluster
2026	Data protection and DR	2.5 → 3	+1.0	v2607.0: S3 multisite across clusters with promote-surviving-zone, configuration backup to S3; v2608.0 Enhanced: CephFS mirroring with snapdiff; no orchestrated failover, no immutable snapshots
2026	Data services core	3.5 → 4	+1.5	v2607.0: Tentacle 20.2.2 default for new clusters, bringing FastEC; v2609.0 ships 20.2.4; no deduplication
2026	Hypervisor integration	2.5 → 3	+1.2	v2609.0: NVMe-oF export with gateway failover for non-KVM hosts; Proxmox VE integration documented and croit is a Proxmox Gold Partner; still no vSphere plug-in or Hyper-V path
2026	Operations and automation	3 → 4	+1.6	v2605.1: guardrails against reboots that would make PGs inactive and PXE subnet checks; v2609.0: OSD replacement wizard, OS images as extendable OCI containers, IPv6-only clusters; Terraform and Ansible not found
2026	Performance and protocols	2.5 → 3.5	+2.4	v2607.0: SMB gateway rebuilt with POSIX or Windows ACLs and AD idmap, load-balanced S3 (v2608.0); v2609.0: NVMe-oF export with failover; no Fibre Channel, no published benchmarks
2026	Resilience and HA	3.5 → 4	+1.5	v2609.0: NVMe-oF export served by several gateways, one active and others standby, with exclusive-lock fencing; stretch mode not mentioned in croit's posts
2026	Security	2.5 → 3	+0.8	v2605: AlmaLinux CVE fixes with an image changelog; v2608.0: CephFS Guard ransomware and malicious client detection (experimental); v2609.0: Tentacle 20.2.4 with the CephX authentication bypass fix CVE-2025-30156 and three more CVEs (2026-08-19), with a key renewal guide

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2024-04	v2404.1: separate default OS images for x86_64 and Arm nodes	Hardware	C
2026-05	v2605.0: images with Reef 18.2.8 and Tentacle 20.2.1; AlmaLinux CVE fixes with an image changelog	Security	U
2026-05	v2605.1: reboot guardrails and PXE subnet check	Operations	C
2026-07	v2607.0: Tentacle 20.2.2 default for new clusters; Squid skipped	Packaging	U
2026-07	v2607.0: S3 multisite across clusters with promote-surviving-zone; configuration backup to S3	Data protection	C
2026-07	v2607.0: SMB gateway rebuilt with AD idmap and Windows ACLs	Performance	C
2026-08	v2608.0: croit Enhanced variant, croit's own Ceph build beside Core	Packaging	V
2026-08	v2608.0: CephFS Guard ransomware detection (experimental)	Security	V
2026-08	v2608.0: CephFS mirroring with snapdiff, MDS notifications over UDP or Kafka, load-balanced S3	Data protection	C
2026-08	Storage layer for Proxmox VE arm64 after Proxmox's official arm64 build (2026-08-05)	Hypervisor integration	M
2026-09	v2609.0: NVMe-oF export with active and standby gateways and exclusive-lock fencing	Resilience	C
2026-09	v2609.0: OSD replacement wizard, OS images as OCI containers, IPv6-only clusters	Operations	C
2026-09	v2609.0: backend rewritten from Kotlin to Go	Operations	V
2026-09	v2609.0: Tentacle 20.2.4 with the CephX bypass fix and a key renewal guide	Security	U
2026-09	aiplane (formerly croit LLM Gateway): separate AGPL-3.0 gateway product for models, agents and MCP tools; release date not stated	AI	V

Centre of gravity: Security (3), Operations (3), Packaging (2)
Blind spots (no items): Data services, Scale, Kubernetes, Licensing
Driver mix: Vision 27%, Customer need 47%, Market window 7%, Upstream 20%, Portfolio 0%
Idea-to-need index: 0.33 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 14.5 / 25

Criterion	Score	Basis
Cadence	3.5	Year-month version labels show a near-monthly rhythm (v2605, v2607, v2608, v2609), but the posts carry no dates and no schedule is published
Roadmap transparency	1.5	Release posts only; no roadmap, no public tracker, documentation unreachable on 2026-10-15
Say-do	3	No dated promises to check; experimental items are labelled as such
Velocity	4	Several substantive items per release in 2026: SMB rebuild, S3 multisite, Enhanced variant, NVMe-oF failover
Lifecycle stability	2.5	Backend language rewrite, a new Core and Enhanced split and a skipped Squid in one year; no support windows published

Commercial risk: 12.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	2.5	No public price or metric; a second edition appeared in 2026 with no statement on cost
Purchase constraints	2.5	Licence required for any SLA; terms not public; no free tier found
Channel and access	2.5	Direct sales and consulting only; pricing page 404 and documentation 503 when checked
Owner stability	2.5	Small founder-owned company with no outside capital; stability depends on three people
Cost of staying supported	2	Unknown; the Core image runs upstream Ceph and monthly releases suggest frequent but small updates

Technical lock-in: 7.5 / 25 (lower is better)

Criterion	Score	Basis
Formats	0.5	Stock Ceph: RBD, CephFS, S3
Export path	1.5	Core is upstream Ceph and Enhanced can switch back to Core without data migration; leaving croit for plain Ceph is not documented
Stack coupling	2.5	PXE-booted immutable OS images replace cephadm; the management node is a single x86-64 component
Hardware / cloud coupling	1	Commodity x86 and Arm servers; croit also sells servers; no cloud attach
Skills and tooling coupling	2	croit UI, REST API and templates on top of Ceph skills

Integrator fit: 9.5 / 20

Criterion	Score	Basis
Partner programme openness	2	No partner programme found; croit itself is a Proxmox Gold Partner and sells direct
Multi-tenancy and self-service	2.5	Pools, RGW multisite, SMB users and groups; no self-service portal
API and infrastructure-as-code	3	REST API, event scripts and configuration templates; no Terraform or Ansible content found
Skills and certification	2	croit offers consulting and training; no certification

AI leverage: 3.5 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI workload infrastructure	1	1	1	2017: S3 and CephFS for data; no GPU data path
AI platform stack	0	0	0.5	2026: aiplane, an OpenAI-compatible gateway to models, agents and MCP tools, sold as a separate AGPL-3.0 product that does not mention the storage platform
AI-assisted operations	0	0	0	2017: None shipped; croit describes internal AI support triage and an internal MCP server over its interface, with no statement that either is a product feature
Agent openness	2	2	2	2017: REST API and event scripts; an MCP server is described as internal, product status unclear

Year by year: 2017: 3 · 2018: 3 · 2019: 3 · 2020: 3 · 2021: 3 · 2022: 3 · 2023: 3 · 2024: 3 · 2025: 3 · 2026: 3.5

AI say-do, 2023 to 2026: 3 AI items announced; 1 GA, 0 still preview, 2 pending, 0 dropped. aiplane is released; the MCP control server and the support triage are described as internal tools with no shipping statement.

croit uses AI inside its own support process and sells a separate model gateway, but the storage product itself has no AI feature and no official agent interface beyond the REST API. If the internal MCP server ships, the agent strand should be re-scored.

Reading

croit delivers upstream Ceph with a management layer that moved fast in 2026: NVMe-oF with gateway failover, a rebuilt SMB gateway, S3 multisite and an Enhanced build of Ceph, all within five releases. Its capability therefore tracks the engine closely, and the half steps it loses are where croit's own pages do not confirm what the engine can do, such as stretch mode, mirroring in the UI and encryption at rest. The scores carry the lowest evidence grade in the group because the vendor publishes no prices, no support windows and no release dates, and its documentation was unreachable when checked. Ask for the licence terms and the support policy in writing before anything else.

Open questions and items to re-score

Price list, metric and licence terms were not found; the pricing page returned 404.
Support period per release and the upgrade policy are unpublished; docs.croit.io returned 503 on 2026-10-15.
Real release dates for v2605 to v2609 are inferred from version labels.
Whether RBD mirroring, stretch mode and encryption at rest are exposed in the croit product was not found.
Whether croit validates VMware ESXi as a target over iSCSI or NVMe-oF was not found.
First production release date of the croit product was not found; scoring starts with the company's founding year.
Whether the internal MCP server and the Enhanced variant carry extra cost was not stated.