As of 28 Oct 2026, the panel rates Camunda 2.5/5 and Flowable 2/5 in Workflow Management. Weighted by what each judge cares about, 5 of the 6 judges pick Camunda and 1 picks Flowable. Camunda scores higher on 6 of 6 criteria (Connectors, API & on-premise reach, Process design, forms & approvals, European sovereignty, plus 3 more). Provenance — Camunda: EU-Made; Flowable: UK / wider Europe. Ratings are the AI panel’s opinion, formed from public evidence: how scores are made.
Camunda leads the means on process design (6.2 vs 5.2; 4 judges lean Camunda), integrations and connectors (6.3 vs 3.3; 5 lean Camunda), governance and audit (3.7 vs 3.2), sovereignty (3.5 vs 2.5; 5 lean Camunda) and pricing transparency (2.3 vs 1.3). Hosting and portability is the genuine split — 5.8 vs 5.7, 2 judges lean each way, 2 tie — and run reliability sits at 3.3 vs 3.2 with 3 ties. The judges split on totals: the integrator, ops analyst and data protection officer score Camunda 6, 5.3 and 5.7 to Flowable's 4.6, 4.4 and 4.4; the head of IT scores Flowable 4.5 to Camunda's 0; the skeptic scores Camunda 5.6 to Flowable's 0. Camunda's sovereignty attributes read legal entity jurisdiction DE and data residency EU optional, with ownership and subprocessor exposure unknown; Flowable's read unknown for each of the four. That split is the bench's answer.
Choose Camunda if
You need connectors to SAP, Oracle and ServiceNow, where 5 of the judges lean Camunda on integrations and connectors (6.3 vs 3.3).
Your legal team requires the vendor's legal entity to sit in Germany — Camunda's legal entity jurisdiction attribute reads DE.
You need data residency with an EU option, which Camunda's data residency attribute lists as EU optional.
You model in BPMN 2.0 and need token-flow simulation with native escalation and compensation, where 4 judges lean Camunda on process design.
Your auditors ask for automatic audit capture and SOC 2 Type 2, areas 4 judges credit on governance and audit (3.7 vs 3.2).
Choose Flowable if
You need a free engine download to evaluate before any sales conversation, a hosting and portability strength where 2 judges lean Flowable and the highest single score recorded is 8.
Your team builds cases in CMMN and DMN alongside BPMN, which Flowable documents with dynamic routing and escalation and 1 judge credits on process design.
You want engine definitions the vendor calls portable by design with no vendor lock-in, another hosting and portability lean (2 judges for Flowable).
Your architecture relies on a catalogue of thirty connectors across six categories, which 1 judge credits on integrations and connectors.
Read this comparison as one judge. Each weighs the same scores by what they care about.
The Data Protection Officer
Reads every workflow as a chain of transfers. Asks where the execution log keeps its copy of the payload and for how long, which subprocessors and AI model providers a step sends data to, whether payloads can be masked, and what the approval trail records about employees before the works council asks.
Camunda
This judge's pick
Flowable
Criterion by criterion
Process design, forms & approvals
Camunda
BPMN 2.0 under ISO/IEC 19510 is the documented notation, with human tasks as a first-class element, native escalation and compensation patterns, all four gateway types, a form builder, a task list component for participants, and token-flow simulation before deployment. Approvals and escalation paths are built into the process itself, which is what I want an approval trail to rest on. We found no public information on versioning that keeps running instances on their original version, on substitutes, or on four-eyes rules, so the score stops below the top.
Flowable
BPMN, CMMN and DMN are named as the standards the platform runs, with case management offering dynamic routing, escalation and people in the loop — a documented notation is more than most tools show. But I found no public information on forms with validation, substitutes, four-eyes approvals, a task inbox or what happens to running instances when a process version changes, which is exactly what a works council will ask about the approval trail.
Connectors, API & on-premise reach
Camunda
SAP is among the named ERP connectors alongside Oracle and Workday, SOAP, REST, GraphQL, gRPC, AMQP and Kafka are supported as protocol steps, inbound webhook connectors trigger processes in real time, and the open-source Connector SDK builds connectors for private APIs and internal systems, deployable into a self-managed cluster so traffic can stay behind the firewall. The Marketplace is stated as community and partner-built; we found no public information on the vendor maintaining German-market connectors such as DATEV itself, nor on connector changelogs or per-connector rate limits.
Flowable
A catalogue of thirty connectors across six categories is published, with named connectors for Salesforce, SharePoint, ABBYY, Apache Camel, RPA and GenAI, several of them flagged as paid. I found no public information on a generic HTTP or webhook step, an API to start or query workflows, an on-premise agent, connectors to DACH ERP systems, or who maintains these connectors.
Execution, error handling & monitoring
Camunda
Every process execution, every agent decision and every exception is captured automatically with real-time runtime visibility, the Operate component shows running instances with per-agent detail such as model calls and tokens used, and escalation and compensation are native patterns. We found no public information on retries or replay from the failing step, failure alerting, runtime or rate limits, retention of the execution history that holds the payload copies, or a public status page, which caps the score mid-scale.
Flowable
The homepage claims every decision, step and override is logged for full audit and replay, and the privacy notice states server logs are kept 30 days and operational data 3 to 12 months — though those figures describe the vendor's own systems, not the customer's execution history. I found no public information on retries, error paths, failure alerting, runtime or throughput limits, or a status page with incident history.
Governance, credentials & audit trail
Camunda
One runtime, one audit trail: every step recorded automatically without extra instrumentation, every decision path documented by the process model itself, approvals and escalation built in, an Identity component, and SOC 2 Type 2 published alongside an external data protection officer for German data subjects. For what a works council asks next — field-level masking in logs, configurable retention of execution payloads, SSO and SCIM, environments with a publishing approval, and which fields the trail records about individual users — we found no public information, and the privacy policy itself states it does not cover Service Data.
Flowable
The vendor promises a complete record for regulators, full traceability with audit and replay, and runtime policy enforcement over what each agent may do — strong claims, marketed to banking, insurance, public sector and healthcare. But I found no public information on roles and permissions, SSO, where connection credentials are stored, separate environments with publishing approval, payload redaction or masking in logs, configurable retention, or what the trail records about individual users.
Hosting options & portability
Camunda
A self-managed edition runs production on the customer's own infrastructure, free for development and under an Enterprise licence for production, the engine's licences are published in detail — Zeebe Community License 1.1 with a documented managed-service restriction, Apache 2.0 for the clients and the exporter API — and models export as BPMN 2.0 XML, an ISO-standard format stated portable across vendors and supported by over 100 tools. We found no public information on system requirements for self-managed installs, versioning of definitions in Git, or a documented migration path between cloud and self-hosted in both directions.
Flowable
The engine is a free download built on the open standards BPMN, CMMN and DMN and marketed as portable by design with no vendor lock-in, and an Enterprise Cloud is offered — the definitions should survive the vendor. I found no public information on an EU cloud region, Git versioning of definitions, the engine's licence terms on these pages, or a documented migration path between cloud and self-hosted in either direction.
European sovereignty
Camunda
The contracting and operating entity is Camunda Services GmbH of Berlin with a commercial register number and an external data protection officer for German data subjects; the SaaS Console and Modeler are hosted in the EU, clusters can be created in other regions, and transfers rely on standard contractual clauses and adequacy decisions. The same privacy policy states processing in countries outside the EEA including the USA and that it does not cover Service Data, and the subprocessors visible — HubSpot, Clearbit, Stripe, Bizzabo, Auth0 — appear in policy changelogs about marketing and events, without locations and without a published list covering the AI providers behind the OpenAI, Amazon Bedrock and Hugging Face connector steps.
Flowable
Flowable AG of Zurich is the controller, Flowable Deutschland GmbH in Stuttgart is named as the EU representative under Article 27 GDPR, and standard contractual clauses or binding corporate rules cover third-country transfers, with Google Ireland and Pardot (USA) named for website analytics. But I found no public information on where workflows execute or where execution logs with their payload copies are stored, on a data processing agreement covering platform payloads, or on the AI model providers behind the GenAI connector — the dimensions the evidence marks unknown stay unknown to me.
Pricing transparency
Camunda
The free side is public and precise: modelling free forever for up to five users, a development tier with no licence required, and a 30-day trial whose usage is never billed. Beyond that, every production tier — SaaS or self-managed — is a quote via sales, and we found no public information on paid prices, the billing unit, or per-tier allowances.
Flowable
The captured pages give a free trial and a free engine download, and mark the ABBYY, GenAI, Salesforce and SharePoint connectors as not free — but no tier price, billing unit, allowance, overage or add-on figure is published anywhere I read. A buyer cannot compute the monthly cost of their own processes from these pages; every platform tier is a sales conversation.
Sovereignty, side by side
Dimension
Camunda
Flowable
Legal entity
Not determined
Not determined
Ownership
Not determined
Not determined
Data residency
Not determined
Not determined
Subprocessors
Not determined
Not determined
Facts, side by side
Only facts both products carry under the same definition — anything else would not be a fair row.
As of 28 Oct 2026, the panel rates Camunda higher: 2.5/5 against 2/5. Weighted by what each judge cares about, 5 of the 6 judges pick Camunda and 1 picks Flowable. Which one fits depends on the criteria that matter to you; the table on this page shows both side by side, and each judge’s reading has its own page. Both were scored by the same AI bench under the same rubric, from public evidence only, as the methodology describes.
Is Camunda or Flowable European?
Camunda is European (EU-Made). Flowable is European (UK / wider Europe). Provenance is read from each company’s own legal pages: who builds it and who owns it.
Do Camunda and Flowable have a free plan?
As of 28 Oct 2026, Camunda’s own pages state a free plan; Flowable’s pages as captured do not. Each product page links the pricing page it was read from.