Workflow Management
Camunda
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Camunda Services GmbH · camunda.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Camunda at a glance
- Vendor
- Camunda Services GmbH
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates Camunda 2.5/5, the mean of 6 judges. how scores are made
- As of
- Vendor pages captured 1 Oct 2026 to 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
No written verdict for this product
The panel scored Camunda, but the summary our synthesizer wrote did not survive our own contradiction check — twice. Rather than print a paragraph we cannot stand behind, we print none. Every score, rationale and source below is unaffected; read them and draw the conclusion yourself.
The scores
| Criterion | Panel median |
|---|---|
| Process design, forms & approvals | 4 of 5 |
| Connectors, API & on-premise reach | 3.5 of 5 |
| Execution, error handling & monitoring | 2 of 5 |
| Governance, credentials & audit trail | 2 of 5 |
| Hosting options & portability | 3.5 of 5 |
| European sovereignty | 1.5 of 5 |
Process design, forms & approvals
Show reasoningHide reasoning
How this is scored
Modelling the process people take part in: a visual designer or BPMN, forms, approval steps with roles and substitutes, deadlines and escalation, and versioning of a process that is already running — judged on whether a business owner can change a process without breaking the instances in flight.
0 — Linear trigger-action chains only; no human steps, no forms and no statement on approvals or roles.
3 — A visual builder with branching and a simple approval step, but approvers are named individuals rather than roles, there are no deadlines or escalation, and changing a process has no versioning.
5 — A visual designer with conditions and parallel paths, built-in forms, approval steps assigned to roles or groups, deadlines with reminders, and versions of a process kept with the running instances on their original version.
8 — BPMN 2.0 modelling or an equivalent documented notation, substitutes and escalation chains, multi-stage approvals with four-eyes rules, forms in German with validation and file upload, a task inbox for participants, and a test or simulation mode before publishing.
10 — The process is a governed asset: version history with diff and rollback, migration of running instances to a new version documented, process analytics on cycle time and bottlenecks per step, and the design documented well enough that a business team can maintain it without the vendor.
The Process Owner
BPMN 2.0 is the modelling language, with native human tasks, timer events, escalation and compensation, a Tasklist inbox for participants, a form builder and token-flow simulation before deployment — approvals and escalation paths are described as built into the process. That is a serious design layer. But I found no public information on substitutes for absent approvers, four-eyes rules, or what happens to the forty requests already in flight when a new process version is published, which is precisely what I need before changing our approval chain. 5 2 5 1
The Integration Engineer
BPMN 2.0 is the core of the product — the vendor says its engineers contributed to the OMG specification — and the captured pages show XOR, AND, OR and event-based gateways, compensation, escalation, call activities and ad-hoc subprocesses, a form builder, a Tasklist inbox for participants, a FEEL editor with validation, and token simulation before deployment. That is a documented notation with human steps and a test mode, plus approvals and escalation paths built into the process. We found no public information on approver substitutes, four-eyes rules, or on versioning and migration of running instances when a process changes. 1 5 6 2 5
The Operations Analyst
This is a real modelling environment: BPMN 2.0 as an ISO-ratified notation, a form builder, a task inbox for participants, token simulation before publishing, and escalation and compensation as native elements. What I did not find is any evidence on substitutes and four-eyes approval rules, or on diff-and-rollback versioning and migration of running instances, so the process is not yet shown as a fully governed asset. 2 6 5 1
The Head of IT
BPMN 2.0 as an ISO-ratified notation with the full gateway set, native user tasks, escalation and compensation, a task inbox, a form builder and token-flow simulation before deploy — the notation and inbox I want definitions held in. We found no public information on versioning that keeps running instances on their original version, on instance migration, or on approval substitutes and four-eyes configuration, so it stops short of a fully governed asset. 5 2 5
The Data Protection Officer
Full BPMN 2.0 notation with native escalation, compensation, parallel branches and ad-hoc sub-processes, first-class human tasks, a form builder, a task list component, and token simulation before deployment. But we found no public information on approver roles with substitutes, four-eyes approvals, or what happens to running instances when the model changes — approvals appear only as built-in policies for AI agents, not as a documented human approval construct. 5 6 2 5
The Skeptic
This is real BPMN 2.0 — ISO/OMG-maintained notation with XOR/AND/OR/event gateways, timers, compensation, native escalation and ad-hoc subprocesses, human tasks as a first-class element with a Tasklist inbox, a form builder, and token simulation before you publish. What I miss is the unglamorous half: we found no public information on approver substitutes, four-eyes configuration, or what happens to instances already running when a process is re-versioned. 1 5 6 2 5
Connectors, API & on-premise reach
Show reasoningHide reasoning
How this is scored
Reaching the systems a European company actually runs: maintained connectors judged by name rather than count, a generic HTTP and webhook step, custom connectors, and a way to reach systems behind the firewall without opening it.
0 — No connectors beyond email, and no API or webhook step.
3 — A large connector count on a logo wall, with no statement of which actions each supports or who maintains them, and no generic HTTP step.
5 — Named connectors with their triggers and actions documented, including Microsoft 365 and at least one ERP or accounting system common in DACH (e.g. SAP, DATEV, Microsoft Dynamics), a generic HTTP/REST step, inbound webhooks, and a documented API to start and query workflows.
8 — Custom connectors buildable from an OpenAPI description or code, an on-premise agent or self-hosted runner reaching internal databases and file shares, SOAP and database steps, OAuth handled per connection, and connector maintenance ownership (vendor, partner or community) stated.
10 — Integration is engineered: a versioned public API with a deprecation policy, connector changelogs, rate limits per connector published, event-driven triggers rather than polling where the source allows it, and the vendor maintaining the German-market connectors (DATEV, SAP, ELO or d.velop) itself.
The Process Owner
SAP, Microsoft Dynamics, Oracle and Workday appear as named connectors alongside REST, GraphQL, SOAP, gRPC, AMQP and Kafka protocol steps, real-time inbound webhooks, and an open-source Connector SDK with a marketplace of community and partner-built connectors for custom work. Connectors can run inside a self-managed cluster, which reaches systems behind our firewall. I found no public information on per-connector maintenance ownership beyond the marketplace description, OAuth handling per connection, or a DATEV connector. 7 8 8
The Integration Engineer
Connectors are named, not just counted — SAP, Oracle and Microsoft Dynamics on the ERP side, ServiceNow, Jira and Zendesk for service desk, plus REST, GraphQL, SOAP, gRPC, AMQP and Kafka protocol steps, inbound webhook triggers in real time, and an open-source Connector SDK for building connectors for any private API or internal system that then run either in SaaS or in your own self-managed cluster, which is the on-premise reach I look for. We found no public information on per-connection OAuth handling, per-connector rate limits or changelogs, or which party maintains each named connector, and no DATEV connector appears among the named ones. 5 7 8 8
The Operations Analyst
Named connectors across SAP, Oracle, Microsoft Dynamics, ServiceNow and the standard protocols including SOAP, REST and Kafka, inbound webhook triggers, an open-source Connector SDK, and connectors that run inside a self-managed cluster to reach internal systems. I found no public information on per-connector rate limits, changelogs, a deprecation policy, or who maintains each connector, which is what separates a wall of logos from engineered integration. 7 8 8 5
The Head of IT
Named connectors for SAP, Microsoft Dynamics and ServiceNow, protocol steps for REST, SOAP, gRPC and Kafka, inbound webhooks, an open-source SDK for custom connectors, and a connector runtime that can run inside a self-managed cluster — that is how internal systems are reached without opening the firewall. We found no public information on OAuth handling per connection, on connector changelogs, rate limits or a deprecation policy, or on maintenance ownership of the pre-built set versus the community marketplace. 5 7 8
The Data Protection Officer
Named SAP, Oracle, Microsoft Dynamics, ServiceNow and AWS connectors, protocols covering REST, SOAP, gRPC and Kafka, inbound webhooks, an open-source SDK for custom connectors, and a connector runtime that can run in the customer's own cluster to reach internal systems. We found no public information on per-connection OAuth handling, a versioned public API with a deprecation policy, or who maintains the four hundred prebuilt connectors — ownership is stated only for community and partner listings on the marketplace. 7 8 8
The Skeptic
Named connectors include SAP, Microsoft Dynamics, ServiceNow and the Microsoft stack, with SOAP, REST, gRPC, Kafka and inbound webhook steps, an open-source Connector SDK, and a connector runtime that can run inside a self-managed cluster to reach internal systems — that is the substance a buyer needs. But the '400+ pre-built connectors' headline says nothing about who maintains each one, and we found no public information on per-connector OAuth handling, rate limits or changelogs; the marketplace is candid that its entries are community and partner built, which is exactly the maintenance question that decides whether a connector survives a vendor API change. 5 7 8
Execution, error handling & monitoring
Show reasoningHide reasoning
How this is scored
What happens when a step fails at 3 a.m.: retries, error paths, alerting, an execution history someone can search, limits on runtime and throughput, and a status page that admits incidents.
0 — Nothing stated about failed runs; an error stops the workflow silently.
3 — Failed runs are marked and an email is sent, but retries are manual, execution history is short or undocumented, and runtime and throughput limits are unstated.
5 — Automatic retries with configurable back-off, an error path or error workflow, a searchable execution log with input and output per step, failure alerts by email or chat, and runtime, payload and rate limits documented.
8 — Replay of a failed run from the failing step, idempotency guidance, queueing and concurrency controls, execution history retention stated per plan, monitoring exportable to the customer's own tools, and a public status page with incident history and an uptime commitment.
10 — Operations are designed for production: an SLA with service credits, horizontal scaling or high-availability setup documented for self-hosted installs, dead-letter handling, end-to-end tracing across workflows, and post-incident reports published.
The Process Owner
Every exception is stated to be captured automatically with real-time runtime visibility, and Operate shows each process instance with per-step detail including agent model calls. Beyond that I found no public information on automatic retries, failure alerting, runtime or throughput limits, history retention per plan, or a status page with incident history — exactly what I would need to know before trusting overnight invoice approvals. 1 1
The Integration Engineer
The Operate component shows running process instances with a detail panel for agent model calls and tokens, the vendor states every execution, agent decision and exception is captured automatically with real-time visibility, and compensation and escalation are native process patterns. Beyond that visibility we found no public information on retries with configurable back-off, replay of a failed run from the failing step, failure alerting, retention of execution history, or documented runtime and throughput limits, and no status page. 1 1 2 5
The Operations Analyst
Every execution and exception is captured automatically with real-time visibility in Operate, and error events and compensation are native to the notation. But the captured pages say nothing about automatic retries with back-off, whether the history is searchable with input and output per step, alerts reaching a channel, or the runtime and throughput limits a month-end run will hit, and there is no status page or stated retention for the history. 1 2 5 1
The Head of IT
Every exception is captured automatically with real-time runtime visibility, Operate shows per-instance detail down to model calls, and compensation and escalation are native modelling patterns. We found no public information on automatic retries, replay from the failing step, failure alerting, runtime or throughput limits, or a public status page, so the 3 a.m. question is not answered on the captured pages. 1 9 1 5
The Data Protection Officer
Every execution and exception is captured automatically with real-time visibility through Operate and improvement reporting through Optimize, and BPMN compensation and escalation are native error patterns. But we found no public information on automatic retries with back-off, failure alerting channels, limits on runtime and throughput, or how long the execution log keeps its copy of each payload — the retention question a works council will ask first goes unanswered. 1 1 2 5
The Skeptic
The pages promise that every exception is captured automatically with real-time runtime visibility in Operate, per-instance detail including agent model calls and tokens, and Optimize analytics — plus in-model compensation and escalation as designed error paths. What happens at 3 a.m. is unstated: we found no public information on retry behaviour, replay from a failing step, execution-history retention, runtime or throughput limits, or a status page with incident history, and the only SLA mentioned is 24x7 support, not service credits. 1 9 1
Governance, credentials & audit trail
Show reasoningHide reasoning
How this is scored
Keeping automation from becoming shadow IT: roles and permissions, SSO, where connection credentials are stored, separate environments with controlled publishing, an audit trail of changes and approvals, and what the execution log retains of the payload. An approval record is also a record of employees' behaviour, so what the trail captures matters to a works council.
0 — Single-user accounts or one shared login; no roles, no audit log and no statement on credential storage.
3 — Admin and member roles and shared team folders, but credentials are visible to anyone who can edit a workflow, there is no audit log, and execution payloads are kept without a stated period.
5 — Role-based permissions per workflow or folder, SSO via SAML or OIDC, credentials stored encrypted and usable without being revealed, an audit log of workflow changes, and the retention period of execution data stated.
8 — Separate development, test and production environments with a publishing approval, SCIM provisioning, external secret stores supported, payload redaction or log-off per workflow, configurable execution data retention, and the audit trail exportable — with the fields it records about users described.
10 — Governance a works council and an auditor can both sign off: field-level masking of personal data in logs, delegated administration per department, a central inventory of every workflow and connection with its owner, certifications published (ISO 27001 or SOC 2), and documentation of what the platform records about individual users.
The Process Owner
Every execution and decision path is recorded automatically, the process model itself is described as the audit trail, and there is an Identity component plus a published item on a completed SOC 2 Type 2 audit. I found no public information on credential storage, single sign-on, separate environments with publishing approval, or an audit log of who changed a process definition; the privacy policy explicitly does not cover the Service Data customers submit, so retention of execution payloads is unstated — a problem for any works council review of approval records. 5 1 2 10 3
The Integration Engineer
An Identity component ships with the platform, every step is recorded automatically as an audit trail without extra instrumentation, and the vendor has announced a completed SOC 2 Type 2 compliance audit. We found no public information on role-based permissions, SSO via SAML or OIDC, where connection credentials are stored, an audit log of workflow changes, or the retention period of execution payloads — the privacy policy states that Service Data processing is a matter for the customer organization and is outside that policy. 1 3 5 10 2
The Operations Analyst
The execution audit trail is automatic and complete — one runtime, one trail, every step recorded — and a completed SOC 2 Type 2 audit is announced. For keeping automation out of shadow IT, though, I found no public information on SSO, where connector credentials are stored, separate environments with a publishing approval, or how long execution payloads are kept; the privacy policy states it does not cover Service Data. 5 10 3 2
The Head of IT
An audit trail that records every step and agent decision without extra instrumentation, an Identity component, and a published announcement of a completed SOC 2 Type 2 audit are real governance signals. We found no public information on SSO via SAML or OIDC, role-based permissions, credential storage, separate development and production environments with a publishing approval, or execution-log retention — and the privacy policy states it does not cover Service Data, leaving payload custody unaddressed. 3 5 10 2
The Data Protection Officer
An automatic audit trail covering every execution and agent decision, an Identity component, a Trust Center and an announced SOC 2 Type 2 completion give a real approval record. But we found no public information on roles and permissions, SSO, where connector credentials are stored, payload redaction, or a retention period for execution data — and the privacy policy states outright that Service Data, the content customers run through the products, falls outside what it covers. 3 5 10 2
The Skeptic
Every execution step lands in one automatic audit trail and an Identity component exists, and a captured press-release page announces SOC 2 Type 2 — but an execution trail is not a change trail. We found no public information on role-based permissions, SSO or SCIM provisioning, where connection credentials are stored, separate environments with a publishing approval, or execution-payload retention; the privacy policy states it does not cover 'Service Data' and retains personal data only 'as long as necessary', which tells a works council very little. 3 5 10 2
Hosting options & portability
Show reasoningHide reasoning
How this is scored
Where the engine runs and whether the workflows can leave: cloud regions, self-hosted or on-premise editions, the licence of the engine, and export of workflow definitions in a format another tool or a later version can read.
0 — Cloud-only with no stated region, and no export of workflow definitions.
3 — Cloud-only with a region named, and an export that produces a proprietary file only the same product can import.
5 — An EU cloud region selectable, workflow definitions exportable as documented JSON or BPMN 2.0, and an API to read definitions and execution history for backup.
8 — A self-hosted or on-premise edition with its system requirements documented, workflow definitions versionable in Git, the engine's licence published, and a documented migration path between cloud and self-hosted in both directions.
10 — The customer owns its automation: an open-source or source-available engine, definitions in an open standard executable elsewhere, air-gapped installation supported, and a stated exit process that hands back definitions, credentials metadata and execution history in documented formats.
The Process Owner
The SaaS console and modeler are stated to be hosted in the EU with clusters creatable in other regions, a self-managed production edition on our own infrastructure is offered under an Enterprise licence, and models export as BPMN 2.0 XML that 100+ other tools can read, with a free development licence and an engine licence overview page present. That is real portability in an open standard. I found no public information on a documented migration path between cloud and self-managed in both directions, Git versioning of definitions, or a stated exit process handing back history. 2 2 6 5 11
The Integration Engineer
A self-managed production edition on your own infrastructure sits next to a SaaS offering whose Console and Modeler are stated to be hosted in the EU with clusters creatable in other regions, and models export as BPMN 2.0 XML — an ISO-ratified open standard the vendor calls portable across vendors and runtimes, with SDKs in Java, Go, Python and Node and a licence overview page for the Zeebe engine. We found no public information on documented system requirements for self-managed installs, versioning of definitions in Git, or a migration path between cloud and self-hosted in both directions. 2 5 6 11 2
The Operations Analyst
Self-managed production on your own infrastructure, SaaS with the Console and Modeler hosted in the EU, and definitions exportable as ISO-ratified BPMN 2.0 XML that other tools can run — the workflows can genuinely leave. I found no public information on documented system requirements for self-managed installs, versioning definitions in Git, or a documented move between cloud and self-managed in either direction. 2 2 6 5 12
The Head of IT
A self-managed production edition on the customer's own infrastructure under an Enterprise licence, definitions exportable as BPMN 2.0 XML that 100+ other tools can read, and an EU-hosted SaaS console give me most of the exit I demand. We found no public information on documented system requirements for self-hosting, a migration path in both directions between cloud and self-managed, or Git versioning of definitions, and the engine's licence appears as an overview and FAQ page rather than quoted terms. 2 5 6 11 2
The Data Protection Officer
A self-managed production edition on the customer's own infrastructure under an Enterprise licence, EU hosting for the SaaS Console and Modeler, and definitions exportable as BPMN 2.0 XML that the vendor itself describes as portable across other runtimes and tools. We found no public information on documented system requirements for self-managed installs, Git-based versioning of definitions, or a documented migration path between cloud and self-hosted in both directions. 2 6 2 5
The Skeptic
A self-managed production edition on your own infrastructure under an Enterprise licence sits beside a SaaS offering whose Console and Modeler are hosted in the EU, and models export as BPMN 2.0 XML — an ISO standard the vendor says 100+ tools support, so definitions can genuinely leave the platform. The gaps are operational: we found no public information on self-hosting system requirements, versioning definitions in Git, the engine's licence terms, or a documented migration path between cloud and self-hosted in either direction. 2 5 6 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where workflows execute and where execution logs with their payload copies are stored, and who the subprocessors are — including the AI model providers behind any AI steps. Independently sourced by the sovereignty pipeline. A self-hosted edition counts only for the data that actually stays on the customer's servers.
0 — Non-EU vendor and contracting entity, execution location unstated, and subprocessors unnamed.
3 — An EU region offered as an option while the contracting entity is non-EU, or the subprocessor list is absent, or AI steps send data to model providers of unstated location.
5 — EU execution and log storage as standard and an EU contracting entity, but parts of the chain — AI steps, support access, telemetry — are non-EU without an explained safeguard.
8 — EU execution on named infrastructure, EU contracting entity, subprocessor list published with locations including AI providers, a DPA covering execution payloads, and a self-hosted option that sends no workflow data to the vendor.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, AI steps runnable on European or self-hosted models, certification published, and a self-hosted edition that works without any call home.
The Process Owner
The SaaS console and modeler are stated to be hosted in the EU, and connectors to OpenAI, Azure OpenAI and Hugging Face exist for AI steps with no stated model-provider location. The captured pages give no subprocessor list and no statement of where execution logs and their payloads are stored, the privacy policy explicitly excludes the Service Data customers submit, and the captured vendor pages did not confirm contracting entity or data residency. Self-managed hosting can keep data on our servers, but no call-home behaviour is documented either way. 2 7 3
The Integration Engineer
The captured legal notice names a Berlin company, and the SaaS Console and Modeler components are stated to be hosted in the EU with clusters creatable in other regions. Beyond that we found no public information confirming the contracting entity's jurisdiction and ownership on the captured pages, where execution logs with their payload copies are stored, or on any subprocessor list — including the locations of the OpenAI and Amazon Bedrock model providers behind the AI connectors. 4 7 2
The Operations Analyst
The Console and Modeler are hosted in the EU with clusters creatable in other regions, and the vendor identifies itself as Camunda Services GmbH of Berlin. But there is no subprocessor list on the captured pages, the AI connectors point at OpenAI, Azure OpenAI, Amazon Bedrock and Hugging Face with nothing on where that data goes, and the privacy policy states it does not cover Service Data — I found no DPA covering execution payloads. 2 7 3
The Head of IT
The SaaS console and modeler are stated as EU-hosted, with clusters creatable in other regions per documentation. The captured pages leave the contracting entity unconfirmed, and we found no public information on a subprocessor list or on the locations of the AI providers behind the OpenAI, Azure OpenAI, Amazon Bedrock and Hugging Face connectors; the privacy policy's exclusion of Service Data leaves execution payloads outside its safeguards. 3 7 2
The Data Protection Officer
The independently sourced attributes leave contracting entity, ownership and data residency unconfirmed on the captured pages, and we found no public subprocessor list; the AI connectors named — OpenAI, Azure OpenAI, Hugging Face, Amazon Bedrock — send model calls to providers whose location and handling of the payload are unstated. The EU hosting statement covers only the SaaS Console and Modeler, with clusters creatable in other regions, and the privacy policy explicitly does not cover Service Data, so the chain of transfers is essentially unevidenced. 3 7 2
The Skeptic
Console and Modeler are hosted in the EU but clusters can be created in other regions, and the captured pages leave the contracting entity's jurisdiction and the location of execution payloads and logs unconfirmed. We found no public information on subprocessors — and the AI connectors are OpenAI, Azure OpenAI, Amazon Bedrock and Hugging Face, model providers of unstated location, which is precisely the exposure an EU buyer must price in. 3 7 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the monthly cost of their own processes from public pages alone: what the billing unit is (task, operation, execution, run, user or flow) and what counts as one, the allowance per tier, overage prices, and the cost of premium connectors, self-hosting, environments and AI steps.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but the billing unit is undefined or what counts as one task or execution is unstated — the invoice is unknowable.
5 — Tier prices public with the billing unit defined and the monthly allowance given, but at least one commonly needed piece (overage, premium connectors, extra environments, self-hosted licence, AI steps) is unpriced.
8 — Every tier priced publicly with its unit, allowance and limits, overage priced per unit, premium connector and add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: the monthly cost derivable for a given number of workflows, runs and steps per run, with a published calculator or worked examples, every add-on and overage on a public page, and the effect of loops and retries on the count explained.
The Process Owner
The only figures published are free: a no-licence development tier, unlimited free modelling for up to five users after a 30-day trial, and a free non-commercial licence. Production on our own infrastructure requires an Enterprise licence with no price attached, and the SaaS tiers are described with support levels but no prices, no billing unit and no allowance — before sign-off I cannot compute what a 400-person company would pay per month. 2 2 6 12
The Integration Engineer
The public pricing pages show a free Development tier for local building with no licence required, a 30-day SaaS trial that leaves free unlimited modelling afterwards, and a free Non-Commercial licence with the full feature set, while production use is described only as requiring an Enterprise licence. We found no public price figure for any paid tier, no billing unit or allowance, and no prices for support, environments or premium add-ons — a buyer cannot compute a monthly cost from these pages. 2 12 2
The Operations Analyst
The free side is well defined — development at no licence, unlimited modelling for up to five users, a non-commercial licence by application form — but there is no public commercial price anywhere, no billing unit, no allowance and no overage; production requires an Enterprise licence through sales. I cannot compute what a loop over 5,000 rows costs from these pages, so the invoice is unknowable in advance. 2 6 12 2
The Head of IT
The public pages give structure — a free development tier with no licence required, free unlimited modelling after a 30-day SaaS trial, and production self-managed under an Enterprise licence — but we found no monetary figures for any production deployment. We found no public information on the billing unit, allowances, overage or premium connector pricing, so a buyer cannot compute a monthly cost from public pages alone. 2 12 2
The Data Protection Officer
The starting point is public: a free Development tier with no licence required for local testing, and free unlimited modelling for up to five users after the thirty-day execution trial. But production self-managed requires an Enterprise licence, non-commercial access goes through an application form, and we found no public prices, billing unit or monthly allowance for any paid tier — a buyer cannot compute their monthly cost from these pages. 2 6 12 2
The Skeptic
The free end is well documented — a no-licence development tier, unlimited modeling for up to five users, and a non-commercial licence with published eligibility rules — but everything payable is a sales conversation: production requires an Enterprise licence with no figure attached. We found no public information on the billing unit, what counts as one execution, tier allowances, or overage pricing, so a buyer cannot compute a monthly cost from public pages. 2 12 2
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Camunda
Is Camunda European?
Yes. whats-best.ai classifies Camunda as EU-Made.
Where does Camunda store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Camunda have a free plan?
Yes. Camunda has a free plan, per the vendor’s page captured 13 Oct 2026.
What are the best alternatives to Camunda?
As of 15 Oct 2026, the panel rates Tray.ai (3/5), n8n (3/5) and Frends (2.5/5) highest among the other 16 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is n8n (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Camunda alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 14 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
- The panel’s written verdict is withheld: our own re-read found claims in it that the evidence does not carry, and a second synthesis did not fix them. The scores and the material below are unaffected. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage camunda.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 2 Pricing page camunda.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 3 Privacy policy legal.camunda.com Checked 13 Oct 2026 Details →
- 4 Legal notice camunda.com Checked 13 Oct 2026 Details →
- 5 Process design, forms & approvals — found from sitemap camunda.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 6 Process design, forms & approvals — found from sitemap camunda.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 7 Connectors, API & on-premise reach — found from sitemap camunda.com Checked 13 Oct 2026 Details →
- 8 Connectors, API & on-premise reach — found from sitemap camunda.com Checked 13 Oct 2026 +1 earlier capture: 1 Oct 2026 Details →
- 9 Execution, error handling & monitoring — found from sitemap camunda.com Checked 13 Oct 2026 Details →
- 10 Governance, credentials & audit trail — found from sitemap camunda.com Checked 13 Oct 2026 Details →
- 11 Hosting options & portability — found from sitemap camunda.com Checked 13 Oct 2026 Details →
- 12 Hosting options & portability — found from sitemap camunda.com Checked 13 Oct 2026 Details →