diff --git a/src/apps.js b/src/apps.js
index 648b654bc..dd05ae1f8 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -1385,7 +1385,7 @@ async function install(data, auditSource) {
     error = validateEnv(env);
     if (error) throw error;
 
-    if (settings.isDemo() && constants.DEMO_BLACKLISTED_APPS.includes(appStoreId)) throw new BoxError(BoxError.BAD_FIELD, 'This app is blacklisted in the demo');
+    if (constants.DEMO && constants.DEMO_BLACKLISTED_APPS.includes(appStoreId)) throw new BoxError(BoxError.BAD_FIELD, 'This app is blacklisted in the demo');
 
     // sendmail is enabled by default
     const enableMailbox = 'enableMailbox' in data ? data.enableMailbox : true;
@@ -1406,7 +1406,7 @@ async function install(data, auditSource) {
     error = await validateLocations(locations);
     if (error) throw error;
 
-    if (settings.isDemo() && (await getCount() >= constants.DEMO_APP_LIMIT)) throw new BoxError(BoxError.BAD_STATE, 'Too many installed apps, please uninstall a few and try again');
+    if (constants.DEMO && (await getCount() >= constants.DEMO_APP_LIMIT)) throw new BoxError(BoxError.BAD_STATE, 'Too many installed apps, please uninstall a few and try again');
 
     const appId = uuid.v4();
     debug('Will install app with id : ' + appId);
diff --git a/src/appstore.js b/src/appstore.js
index 7034974fd..f68faa791 100644
--- a/src/appstore.js
+++ b/src/appstore.js
@@ -98,7 +98,7 @@ async function registerUser(email, password) {
 }
 
 async function getWebToken() {
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const token = await settings.set(settings.APPSTORE_WEB_TOKEN_KEY);
     if (!token) throw new BoxError(BoxError.NOT_FOUND); // user will have to re-login with password somehow
diff --git a/src/cloudron.js b/src/cloudron.js
index 47ce00c87..2b27a2515 100644
--- a/src/cloudron.js
+++ b/src/cloudron.js
@@ -144,7 +144,7 @@ async function getConfig() {
         mailFqdn: settings.mailFqdn(),
         version: constants.VERSION,
         ubuntuVersion,
-        isDemo: settings.isDemo(),
+        isDemo: constants.DEMO,
         cloudronName: await branding.getCloudronName(),
         footer: await branding.renderFooter(),
         features: appstore.getFeatures(),
@@ -159,7 +159,7 @@ async function prepareDashboardDomain(domain, auditSource) {
 
     debug(`prepareDashboardDomain: ${domain}`);
 
-    if (settings.isDemo()) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
 
     const fqdn = dns.fqdn(constants.DASHBOARD_SUBDOMAIN, domain);
 
@@ -197,7 +197,7 @@ async function updateDashboardDomain(domain, auditSource) {
 
     debug(`updateDashboardDomain: ${domain}`);
 
-    if (settings.isDemo()) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
 
     await setDashboardDomain(domain, auditSource);
 
diff --git a/src/constants.js b/src/constants.js
index df4c7357a..083bfaee7 100644
--- a/src/constants.js
+++ b/src/constants.js
@@ -50,6 +50,7 @@ exports = module.exports = {
 
     DEFAULT_MEMORY_LIMIT: (256 * 1024 * 1024), // see also client.js
 
+    DEMO: fs.existsSync('/etc/cloudron/DEMO'),
     DEMO_USERNAME: 'cloudron',
     DEMO_BLACKLISTED_APPS: [
         'org.jupyter.cloudronapp',
diff --git a/src/directoryserver.js b/src/directoryserver.js
index fd69c9b58..ef7c95316 100644
--- a/src/directoryserver.js
+++ b/src/directoryserver.js
@@ -83,7 +83,7 @@ async function applyConfig(config) {
 async function setConfig(directoryServerConfig) {
     assert.strictEqual(typeof directoryServerConfig, 'object');
 
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const config = {
         enabled: directoryServerConfig.enabled,
diff --git a/src/domains.js b/src/domains.js
index c08979317..b3c5f0382 100644
--- a/src/domains.js
+++ b/src/domains.js
@@ -17,6 +17,7 @@ module.exports = exports = {
 
 const assert = require('assert'),
     BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
     crypto = require('crypto'),
     database = require('./database.js'),
     debug = require('debug')('box:domains'),
@@ -200,7 +201,7 @@ async function setConfig(domain, data, auditSource) {
 
     let { zoneName, provider, config, fallbackCertificate, tlsConfig } = data;
 
-    if (settings.isDemo() && (domain === settings.dashboardDomain())) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
+    if (constants.DEMO && (domain === settings.dashboardDomain())) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
 
     const domainObject = await get(domain);
     if (zoneName) {
diff --git a/src/externalldap.js b/src/externalldap.js
index 9f36b04b3..bb184aaa4 100644
--- a/src/externalldap.js
+++ b/src/externalldap.js
@@ -71,7 +71,7 @@ async function getConfig() {
 async function setConfig(newConfig) {
     assert.strictEqual(typeof newConfig, 'object');
 
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const currentConfig = await getConfig();
 
diff --git a/src/network.js b/src/network.js
index abc204b10..aa17b9f69 100644
--- a/src/network.js
+++ b/src/network.js
@@ -23,6 +23,7 @@ exports = module.exports = {
 
 const assert = require('assert'),
     BoxError = require('./boxerror.js'),
+    constants = require('./constants.js'),
     cron = require('./cron.js'),
     fs = require('fs'),
     ipaddr = require('ipaddr.js'),
@@ -89,7 +90,7 @@ async function setBlocklist(blocklist, auditSource) {
         }
     }
 
-    if (settings.isDemo()) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode');
 
     // store in blob since the value field is TEXT and has 16kb size limit
     await settings.setBlob(settings.FIREWALL_BLOCKLIST_KEY, Buffer.from(blocklist));
@@ -121,7 +122,7 @@ async function getIPv4Config() {
 async function setIPv4Config(ipv4Config) {
     assert.strictEqual(typeof ipv4Config, 'object');
 
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const error = await testIPv4Config(ipv4Config);
     if (error) throw error;
@@ -137,7 +138,7 @@ async function getIPv6Config() {
 async function setIPv6Config(ipv6Config) {
     assert.strictEqual(typeof ipv6Config, 'object');
 
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const error = await testIPv6Config(ipv6Config);
     if (error) throw error;
diff --git a/src/settings.js b/src/settings.js
index 5e05d60b6..cca50d593 100644
--- a/src/settings.js
+++ b/src/settings.js
@@ -17,8 +17,6 @@ exports = module.exports = {
     dashboardOrigin,
     dashboardFqdn,
 
-    isDemo,
-
     get,
     set,
 
@@ -30,7 +28,6 @@ exports = module.exports = {
 
     // booleans. if you add an entry here, be sure to fix list()
     DYNAMIC_DNS_KEY: 'dynamic_dns',
-    DEMO_KEY: 'demo',
 
     // json. if you add an entry here, be sure to fix list()
     BACKUP_CONFIG_KEY: 'backup_config',
@@ -95,7 +92,6 @@ const gDefaults = (function () {
     result[exports.API_SERVER_ORIGIN_KEY] = 'https://api.cloudron.io';
     result[exports.WEB_SERVER_ORIGIN_KEY] = 'https://cloudron.io';
     result[exports.CONSOLE_SERVER_ORIGIN_KEY] = 'https://console.cloudron.io';
-    result[exports.DEMO_KEY] = false;
 
     return result;
 })();
@@ -176,7 +172,6 @@ async function initCache() {
         dashboardFqdn: allSettings[exports.DASHBOARD_FQDN_KEY],
         mailDomain: allSettings[exports.MAIL_DOMAIN_KEY],
         mailFqdn: allSettings[exports.MAIL_FQDN_KEY],
-        isDemo: allSettings[exports.DEMO_KEY],
     };
 }
 
@@ -216,7 +211,6 @@ function webServerOrigin() { return gCache.webServerOrigin; }
 function consoleServerOrigin() { return gCache.consoleServerOrigin; }
 function dashboardDomain() { return gCache.dashboardDomain; }
 function dashboardFqdn() { return gCache.dashboardFqdn; }
-function isDemo() { return gCache.isDemo; }
 function mailDomain() { return gCache.mailDomain; }
 function mailFqdn() { return gCache.mailFqdn; }
 function dashboardOrigin() { return 'https://' + dashboardFqdn(); }
diff --git a/src/users.js b/src/users.js
index c7fd7db49..99a4188a3 100644
--- a/src/users.js
+++ b/src/users.js
@@ -420,7 +420,7 @@ async function del(user, auditSource) {
     assert.strictEqual(typeof user, 'object');
     assert(auditSource && typeof auditSource === 'object');
 
-    if (settings.isDemo() && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const queries = [];
     queries.push({ query: 'DELETE FROM groupMembers WHERE userId = ?', args: [ user.id ] });
@@ -572,7 +572,7 @@ async function update(user, data, auditSource) {
     assert(!('active' in data) || (typeof data.active === 'boolean'));
     assert(!('loginLocations' in data) || (Array.isArray(data.loginLocations)));
 
-    if (settings.isDemo() && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     let error, result;
 
@@ -713,7 +713,7 @@ async function notifyLoginLocation(user, ip, userAgent, auditSource) {
 
     debug(`notifyLoginLocation: ${user.id} ${ip} ${userAgent}`);
 
-    if (settings.isDemo()) return;
+    if (constants.DEMO) return;
     if (constants.TEST && ip === '127.0.0.1') return;
 
     const response = await superagent.get('https://geolocation.cloudron.io/json').query({ ip }).ok(() => true);
@@ -754,7 +754,7 @@ async function setPassword(user, newPassword, auditSource) {
     let error = validatePassword(newPassword);
     if (error) throw error;
 
-    if (settings.isDemo() && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
     if (user.source) throw new BoxError(BoxError.CONFLICT, 'User is from an external directory');
 
     let salt, derivedKey;
@@ -849,7 +849,7 @@ async function setTwoFactorAuthenticationSecret(userId, auditSource) {
     const user = await get(userId);
     if (!user) throw new BoxError(BoxError.NOT_FOUND, 'User not found');
 
-    if (settings.isDemo() && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO && user.username === constants.DEMO_USERNAME) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     if (user.twoFactorAuthenticationEnabled) throw new BoxError(BoxError.ALREADY_EXISTS);
 
@@ -959,7 +959,7 @@ async function getProfileConfig() {
 async function setProfileConfig(profileConfig) {
     assert.strictEqual(typeof profileConfig, 'object');
 
-    if (settings.isDemo()) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
+    if (constants.DEMO) throw new BoxError(BoxError.BAD_FIELD, 'Not allowed in demo mode');
 
     const oldConfig = await getProfileConfig();
     await settings.setJson(settings.PROFILE_CONFIG_KEY, profileConfig);