Workflow Management
Flowable
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Flowable AG · www.flowable.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Flowable at a glance
- Vendor
- Flowable AG
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Flowable 2/5, the mean of 6 judges. Flowable — Flowable AG of Zurich, with Flowable Deutschland GmbH in Stuttgart — is strongest on hosting and portability, 6 to 8: the engine is a free download, BPMN, CMMN and DMN definitions are described as portable by design with no vendor lock-in, with an Enterprise Cloud alongside. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Flowable — Flowable AG of Zurich, with Flowable Deutschland GmbH in Stuttgart — is strongest on hosting and portability, 6 to 8: the engine is a free download, BPMN, CMMN and DMN definitions are described as portable by design with no vendor lock-in, with an Enterprise Cloud alongside. Process design, 4 to 6, rests on standards the vendor says it has run for 15+ years, dynamic routing and escalation in case management, and human-in-the-loop agents — but the pages give no information on forms, role-assigned approvals or substitutes. Integration and connector scores sit at 3 to 4, the pages documenting no per-connector triggers, no API and no SAP or DATEV. Sovereignty spans 1 to 3: the head of IT credited the European legal entities; the skeptic weighed wholly unknown residency and subprocessors. Run reliability spreads 2 to 4 — the operations analyst scored 2 on absent retries, error paths and limits, while others credited stated retention — 30 days for server logs, 3 to 12 months for operational data. No price figures appear; only a free trial, free download and free/paid connector flags.
Speaks for it
- Free download of an engine built on the BPMN, CMMN and DMN standards, with definitions the vendor calls portable by design and free of vendor lock-in
- Case management with dynamic routing and escalation, plus agents with people in the loop where it matters
- Thirty connectors across six categories with free-or-paid status flagged per connector — Apache Camel and RPA Framework free, Salesforce, SharePoint, ABBYY and GenAI paid
- Retention and destruction stated concretely: server logs 30 days, operational data 3 to 12 months, contract data ten years after termination, with irreversible destruction once retention ends
- An audit-and-replay claim covering every decision, step and override, with runtime policy enforcement over what each agent may do
Held against it
- We found no public information on forms, approval steps assigned to roles, substitutes, deadlines, or how running instances are treated when a process definition changes
- We found no public information on per-connector triggers and actions, a generic HTTP or webhook step, a documented API, or connectors for SAP, DATEV or Microsoft Dynamics
- We found no public information on retries, error paths, failure alerting, runtime and throughput limits, or a public status page
- We found no public information on single sign-on, permission roles, where connection credentials are stored, separate environments with publishing approval, or certifications
- The published sovereignty attributes — contracting entity jurisdiction, ownership, data residency, subprocessor exposure — all read unknown
Best for
- You want an exit path before committing: a free engine download, open BPMN, CMMN and DMN definitions and a stated no-vendor-lock-in position earned hosting and portability its 6 to 8, the table's top scores
- You run long-lived, regulated cases — banking, insurance, public sector and healthcare are the vendor's named industries — needing dynamic routing, escalation and agents with people in the loop
- Your data-protection review needs stated retention and destruction commitments, which the privacy notice gives in concrete figures
Avoid if
- You must document data residency or subprocessor exposure before sign-off; sovereignty scored 1 to 3 and the published attributes read unknown
- Your runbook needs retries, error paths and failure alerting for a live month-end process; run reliability spans 2 to 4 on exactly that gap
- Your stack centres on SAP, DATEV or Microsoft Dynamics; the captured catalog of thirty connectors names none of them
The scores
| Criterion | Panel median |
|---|---|
| Process design, forms & approvals | 3 of 5 |
| Connectors, API & on-premise reach | 2 of 5 |
| Execution, error handling & monitoring | 2 of 5 |
| Governance, credentials & audit trail | 2 of 5 |
| Hosting options & portability | 3.5 of 5 |
| European sovereignty | 1 of 5 |
Process design, forms & approvals
Show reasoningHide reasoning
How this is scored
Modelling the process people take part in: a visual designer or BPMN, forms, approval steps with roles and substitutes, deadlines and escalation, and versioning of a process that is already running — judged on whether a business owner can change a process without breaking the instances in flight.
0 — Linear trigger-action chains only; no human steps, no forms and no statement on approvals or roles.
3 — A visual builder with branching and a simple approval step, but approvers are named individuals rather than roles, there are no deadlines or escalation, and changing a process has no versioning.
5 — A visual designer with conditions and parallel paths, built-in forms, approval steps assigned to roles or groups, deadlines with reminders, and versions of a process kept with the running instances on their original version.
8 — BPMN 2.0 modelling or an equivalent documented notation, substitutes and escalation chains, multi-stage approvals with four-eyes rules, forms in German with validation and file upload, a task inbox for participants, and a test or simulation mode before publishing.
10 — The process is a governed asset: version history with diff and rollback, migration of running instances to a new version documented, process analytics on cycle time and bottlenecks per step, and the design documented well enough that a business team can maintain it without the vendor.
The Process Owner
BPMN, CMMN and DMN modelling, case management with dynamic routing and escalation, and agents with people in the loop are stated up front, which covers the notation. But we found no public information on forms, approvers assigned by role, substitutes, four-eyes steps, or how a process change treats the requests already running — exactly what I need before I move forty open approvals onto a new version. 1
The Integration Engineer
The standards are named outright — BPMN, CMMN and DMN, run for 15+ years — with case management offering dynamic routing and escalation and people kept in the loop, which is the notation half of what I need. But the captured pages stop there: I found no public information on forms, approval steps by role with substitutes, deadlines, a task inbox, or how a process version change treats instances already running — and that last one decides whether a business owner can safely touch a live process. 1
The Operations Analyst
Standards are the strong suit: BPMN, CMMN and DMN engines with case management offering dynamic routing and escalation, and agents kept in a human-in-the-loop step where it matters. I found no public information on forms, approval steps with roles and substitutes, deadlines with reminders, or what happens to running instances when the process definition changes — the exact question I ask before touching a live month-end process. 1
The Head of IT
BPMN, CMMN and DMN with fifteen years behind them, plus case management with dynamic routing and escalation and people kept in the loop, is the notation depth I want in a governed process asset. But we found no public information on forms, approval steps assigned to roles with substitutes, a task inbox for participants, a simulation mode, or what happens to running instances when a process is changed — the human-task apparatus I need a business owner to run is unevidenced. 1
The Data Protection Officer
BPMN, CMMN and DMN modelling with fifteen years behind the engines, case management with dynamic routing and escalation, and human-in-the-loop agents are clearly evidenced, and every decision, step and override is claimed to be logged for audit and replay. We found no public information on forms, approval steps with four-eyes rules, substitutes, deadlines, a participant task inbox, or how running instances are handled when a process definition is versioned — and an approval trail that records employee behaviour needs exactly that machinery documented. 1
The Skeptic
The pages confirm BPMN, CMMN and DMN as the modelling standards, case management with dynamic routing and escalation, and people in the loop — a real notation, not a trigger-action chain. Beyond that the marketing copy runs out: we found no public information on approval steps assigned to roles, substitutes, forms, deadlines, or what happens to running instances when a process changes. A documented notation without evidenced approval machinery lands mid-table. 1
Connectors, API & on-premise reach
Show reasoningHide reasoning
How this is scored
Reaching the systems a European company actually runs: maintained connectors judged by name rather than count, a generic HTTP and webhook step, custom connectors, and a way to reach systems behind the firewall without opening it.
0 — No connectors beyond email, and no API or webhook step.
3 — A large connector count on a logo wall, with no statement of which actions each supports or who maintains them, and no generic HTTP step.
5 — Named connectors with their triggers and actions documented, including Microsoft 365 and at least one ERP or accounting system common in DACH (e.g. SAP, DATEV, Microsoft Dynamics), a generic HTTP/REST step, inbound webhooks, and a documented API to start and query workflows.
8 — Custom connectors buildable from an OpenAPI description or code, an on-premise agent or self-hosted runner reaching internal databases and file shares, SOAP and database steps, OAuth handled per connection, and connector maintenance ownership (vendor, partner or community) stated.
10 — Integration is engineered: a versioned public API with a deprecation policy, connector changelogs, rate limits per connector published, event-driven triggers rather than polling where the source allows it, and the vendor maintaining the German-market connectors (DATEV, SAP, ELO or d.velop) itself.
The Process Owner
The catalog shows thirty connectors across six categories, with Salesforce, SharePoint and ABBYY marked paid and Apache Camel and the RPA Framework free. We found no public information on each connector's triggers and actions, who maintains them, a generic HTTP or webhook step, or a documented API — and no DACH ERP such as SAP or DATEV appears among what was captured. 4
The Integration Engineer
The connector catalog returns thirty results with named entries — Apache Camel and RPA agents for free, Salesforce, SharePoint, ABBYY and GenAI paid, each with a one-line purpose — which is more than a pure logo wall. Still, I found no public information on the triggers and actions each connector supports, a generic HTTP or webhook step, a documented API to start and query workflows, an on-premise agent, or a DATEV, SAP or Microsoft Dynamics connector, and for a DACH shop that silence on the ERP side is the whole ballgame. 4 1
The Operations Analyst
Thirty connectors in a categorised catalogue, with Salesforce, SharePoint, ABBYY, Apache Camel and an RPA framework connector each described by purpose and flagged free or paid — more than a logo wall. The captured pages do not document the triggers and actions per connector, I found no named ERP or accounting connector common in DACH such as SAP or DATEV, and no public information on a generic HTTP step, inbound webhooks or a documented API to start and query workflows. 4 1
The Head of IT
The connector catalog names thirty connectors across categories and marks which are free and which are paid — Salesforce, SharePoint, ABBYY, Apache Camel, RPA Framework — but each gets one sentence of purpose. We found no public information on per-connector triggers and actions, who maintains each connector, a generic HTTP or webhook step, a documented API, or an ERP or accounting system common in DACH such as SAP or DATEV. 4
The Data Protection Officer
Named connectors including Salesforce, SharePoint, ABBYY, Apache Camel and an RPA framework are documented with their purpose and free-or-paid status, in a catalog of 30 results across six categories. We found no public information on a generic HTTP or webhook step, a documented API to start and query workflows, connectors for ERP systems common in DACH, or on who maintains each connector and where its data flows. 4 1
The Skeptic
Thirty connectors in six categories, with ABBYY, Salesforce, SharePoint, Apache Camel, an RPA framework and the paid GenAI add-on actually named — a curated catalog, not a logo wall in the thousands. But we found no public information on the actions each connector supports, who maintains them, a generic HTTP or webhook step, or a documented API, and the captured catalog names no ERP or accounting system common in DACH such as SAP, DATEV or Microsoft Dynamics. Several connectors are merely flagged paid, with no price attached. 4
Execution, error handling & monitoring
Show reasoningHide reasoning
How this is scored
What happens when a step fails at 3 a.m.: retries, error paths, alerting, an execution history someone can search, limits on runtime and throughput, and a status page that admits incidents.
0 — Nothing stated about failed runs; an error stops the workflow silently.
3 — Failed runs are marked and an email is sent, but retries are manual, execution history is short or undocumented, and runtime and throughput limits are unstated.
5 — Automatic retries with configurable back-off, an error path or error workflow, a searchable execution log with input and output per step, failure alerts by email or chat, and runtime, payload and rate limits documented.
8 — Replay of a failed run from the failing step, idempotency guidance, queueing and concurrency controls, execution history retention stated per plan, monitoring exportable to the customer's own tools, and a public status page with incident history and an uptime commitment.
10 — Operations are designed for production: an SLA with service credits, horizontal scaling or high-availability setup documented for self-hosted installs, dead-letter handling, end-to-end tracing across workflows, and post-incident reports published.
The Process Owner
Full audit-and-replay logging of every decision, step and override is claimed, with a billion events per day as a scale statement. But we found no public information on retries, error paths, failure alerting, runtime or rate limits, execution-history retention per plan, or a public status page with incident history. 1
The Integration Engineer
"Every decision, step, and override logged for full audit and replay" plus stated retention — server logs 30 days, operational data 3–12 months — is more than most marketing pages commit to. But I found no public information on automatic retries with back-off, error paths or error workflows, failure alerting, or runtime and throughput limits, and a replay claim in a hero line is not the same as resuming a failed run from the step that failed. 1 2
The Operations Analyst
The pages promise observability and an audit trail with every decision, step and override logged for full audit and replay, which is the searchable execution history I want — in principle. I found no public information on retries, error paths, alerting to a channel, or runtime and throughput limits; the billion-events-per-day claim is a scale boast, not a limit I can plan the month-end run against. 1
The Head of IT
Audit and replay are claimed — every decision, step and override logged — and the privacy notice states server logs kept 30 days and operational data 3–12 months, which gives me a retention position. We found no public information on automatic retries and back-off, error paths, failure alerting, runtime and throughput limits, a public status page, or an uptime commitment. 1 2
The Data Protection Officer
The homepage claims every decision, step and override is logged for full audit and replay, which points to a serious execution record, and the privacy notice states logged data is kept 30 days and operational data 3 to 12 months. We found no public information on retries, error paths, failure alerting, runtime or throughput limits, execution history retention per plan, or a public status page with incident history. 1 2
The Skeptic
The homepage promises every decision, step and override logged for full audit and replay, and the privacy notice is the only place with retention figures — 30 days for server logs, three to twelve months for operational data. We found no public information on retries, error paths, failure alerting, or runtime, payload and throughput limits, and nothing on a status page or uptime commitment. A traceability slogan is not a failure-handling story at 3 a.m. 1 2
Governance, credentials & audit trail
Show reasoningHide reasoning
How this is scored
Keeping automation from becoming shadow IT: roles and permissions, SSO, where connection credentials are stored, separate environments with controlled publishing, an audit trail of changes and approvals, and what the execution log retains of the payload. An approval record is also a record of employees' behaviour, so what the trail captures matters to a works council.
0 — Single-user accounts or one shared login; no roles, no audit log and no statement on credential storage.
3 — Admin and member roles and shared team folders, but credentials are visible to anyone who can edit a workflow, there is no audit log, and execution payloads are kept without a stated period.
5 — Role-based permissions per workflow or folder, SSO via SAML or OIDC, credentials stored encrypted and usable without being revealed, an audit log of workflow changes, and the retention period of execution data stated.
8 — Separate development, test and production environments with a publishing approval, SCIM provisioning, external secret stores supported, payload redaction or log-off per workflow, configurable execution data retention, and the audit trail exportable — with the fields it records about users described.
10 — Governance a works council and an auditor can both sign off: field-level masking of personal data in logs, delegated administration per department, a central inventory of every workflow and connection with its owner, certifications published (ISO 27001 or SOC 2), and documentation of what the platform records about individual users.
The Process Owner
An audit trail covering every decision and override, plus runtime policy enforcement over agents, is claimed, and the privacy notice states retention periods — server logs 30 days, operational data three to twelve months. We found no public information on user roles and permissions, SSO, where connection credentials are stored, separate environments with publishing approval, or certifications such as ISO 27001 or SOC 2, which is what my works council would ask about first. 1 2
The Integration Engineer
Runtime policy enforcement — "set what every agent can and cannot do" — with "every action logged" and a trust center is a start, and the retention and irreversible-destruction statements are unusually concrete. I found no public information on role-based permissions, SSO, where connection credentials are stored, separate environments with a publishing approval, audit-trail export, or what the trail records about individual users, so I cannot tell a works council what is actually captured. 1 2
The Operations Analyst
Retention is the best-evidenced part: server logs stored for 30 days, operational data for 3 to 12 months, contract data ten years after termination, alongside every decision and action being logged and runtime enforcement of what every agent can and cannot do. I found no public information on user roles and permissions, single sign-on, where connection credentials are stored, or separate environments with controlled publishing — the questions a works council asks first. 1 2
The Head of IT
Every action logged with runtime policy enforcement over agents is the right ambition for an approval record a works council could review, and retention periods for logs and operational data are stated. We found no public information on SSO, roles and permissions, separate test and production environments with a controlled publishing step, credential storage, or an exportable change history — the controls that keep automation from becoming shadow IT. 1 2
The Data Protection Officer
A complete, regulator-ready audit trail and runtime policy enforcement over what every agent may do are headline claims, and the privacy notice commits to irreversible destruction of personal data once retention ends. We found no public information on roles and permissions, SSO, where connection credentials are stored, payload redaction, exportable audit records, certifications, or which fields the trail records about individual users — the questions a works council asks first. 1 2
The Skeptic
The audit trail is the vendor's headline claim — every decision and action logged, agent behaviour constrained by runtime policy — and the privacy notice states retention periods and data-subject rights. But we found no public information on permission roles, single sign-on, where connection credentials are stored, separate environments with approval before publishing, or certifications, and what the trail actually records about individual employees is a marketing sentence rather than a specification a works council could review. 1 2
Hosting options & portability
Show reasoningHide reasoning
How this is scored
Where the engine runs and whether the workflows can leave: cloud regions, self-hosted or on-premise editions, the licence of the engine, and export of workflow definitions in a format another tool or a later version can read.
0 — Cloud-only with no stated region, and no export of workflow definitions.
3 — Cloud-only with a region named, and an export that produces a proprietary file only the same product can import.
5 — An EU cloud region selectable, workflow definitions exportable as documented JSON or BPMN 2.0, and an API to read definitions and execution history for backup.
8 — A self-hosted or on-premise edition with its system requirements documented, workflow definitions versionable in Git, the engine's licence published, and a documented migration path between cloud and self-hosted in both directions.
10 — The customer owns its automation: an open-source or source-available engine, definitions in an open standard executable elsewhere, air-gapped installation supported, and a stated exit process that hands back definitions, credentials metadata and execution history in documented formats.
The Process Owner
The engine is offered as a free download and models are built on BPMN, CMMN and DMN, described as portable by design with no vendor lock-in, alongside an Enterprise Cloud offering. We found no public information on selectable cloud regions, the licence terms on the captured pages, system requirements for self-hosting, or a documented migration path in either direction. 1
The Integration Engineer
A free download of the engine plus BPMN, CMMN and DMN that you can "inspect, extend, and own", "portable by design, no vendor lock-in" — the workflows are not welded to this vendor's cloud, and an Enterprise Cloud offering sits alongside the downloadable engine. I found no public information on the self-hosted edition's system requirements, the engine licence terms, Git versioning of definitions, or a documented migration path in either direction, so portability is credible in substance and thin on paper. 1 4
The Operations Analyst
The engine is built on open standards — BPMN, CMMN and DMN the customer can inspect, extend and own — offered as a free download alongside an enterprise cloud, with portability and no vendor lock-in stated as a design goal. I found no public information on the engine's licence terms, documented system requirements for a self-hosted install, a migration path between cloud and self-hosted in either direction, or a selectable EU cloud region. 1 2
The Head of IT
An open-source BPMN, CMMN and DMN engine with a free download and definitions the vendor calls portable by design with no vendor lock-in is the exit I ask every automation vendor for. It stops short of the paperwork I need to bank on it: we found no public information on system requirements, the engine's published licence terms, definitions versionable in Git, or a documented migration path between cloud and self-hosted. 1
The Data Protection Officer
The engine is offered as a free download and built on the BPMN, CMMN and DMN standards, with a stated design goal of portability and no vendor lock-in, alongside an enterprise cloud offering. We found no public information on the engine's licence terms, system requirements for self-hosting, versioning of definitions in Git, or a documented migration path between the cloud and a self-hosted install. 1 4
The Skeptic
The strong suit: the engine is downloadable free, BPMN, CMMN and DMN definitions are claimed portable with an explicit no-vendor-lock-in statement, and an Enterprise Cloud offering sits alongside the free download. We found no public information on selectable cloud regions, the engine's licence terms, documented system requirements, or a migration path between the cloud and a self-hosted install in either direction. 1 4
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where workflows execute and where execution logs with their payload copies are stored, and who the subprocessors are — including the AI model providers behind any AI steps. Independently sourced by the sovereignty pipeline. A self-hosted edition counts only for the data that actually stays on the customer's servers.
0 — Non-EU vendor and contracting entity, execution location unstated, and subprocessors unnamed.
3 — An EU region offered as an option while the contracting entity is non-EU, or the subprocessor list is absent, or AI steps send data to model providers of unstated location.
5 — EU execution and log storage as standard and an EU contracting entity, but parts of the chain — AI steps, support access, telemetry — are non-EU without an explained safeguard.
8 — EU execution on named infrastructure, EU contracting entity, subprocessor list published with locations including AI providers, a DPA covering execution payloads, and a self-hosted option that sends no workflow data to the vendor.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, AI steps runnable on European or self-hosted models, certification published, and a self-hosted edition that works without any call home.
The Process Owner
The vendor's legal notice places it in Switzerland with a German subsidiary, but we found no public information on where workflows and their execution logs are stored or on the contracting terms. No subprocessor list appears, and the paid AI and GenAI features state nothing about model provider locations, so I could not clear a purchase approval on data-protection grounds from these pages alone. 1 3 4
The Integration Engineer
The privacy notice pins retention and destruction but we found no public information on where workflows execute and where log payloads sit, and there is no subprocessor list — including which model providers sit behind the GenAI connector, which is paid and of unstated location. With data residency and the contracting jurisdiction unconfirmed on the captured pages, I cannot sign this off for a European deployment. 2 4
The Operations Analyst
The vendor sits in Zurich with a German subsidiary in Stuttgart, a European start, but the published sovereignty attributes — contracting entity jurisdiction, ownership, data residency, subprocessor exposure — all came back unknown. I found no public information on where workflows and their execution logs are stored, and no subprocessor list including the model providers behind the AI steps; the privacy notice refers only to unnamed Group entities and affiliates. 2 3
The Head of IT
The legal notice names Flowable AG in Zurich and Flowable Deutschland GmbH in Stuttgart, so there is a European counterparty. But we found no public information on where workflows and their logs execute, on data residency, or on a subprocessor list — including the model providers behind the paid GenAI connector — so I cannot tell a works council where approval data actually travels. 3 4
The Data Protection Officer
The legal notice identifies a Swiss parent company and a German subsidiary, and the privacy notice commits to retention periods and destruction, but neither states where workflows execute or where execution logs with their payload copies are stored. We found no public information on a subprocessor list, on where the GenAI connector's model providers process data, or on hosting locations for the enterprise cloud. 1 2 3 4
The Skeptic
Every sovereignty attribute came back unknown — contracting entity jurisdiction, ownership, execution location, subprocessors — and the captured pages name no hosting infrastructure and no subprocessor list. The GenAI connector sends data to model providers of unstated location, and a GDPR-style privacy notice settles none of that. We found no public information on where workflows execute or where execution payloads are stored. 1 2 4
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the monthly cost of their own processes from public pages alone: what the billing unit is (task, operation, execution, run, user or flow) and what counts as one, the allowance per tier, overage prices, and the cost of premium connectors, self-hosting, environments and AI steps.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but the billing unit is undefined or what counts as one task or execution is unstated — the invoice is unknowable.
5 — Tier prices public with the billing unit defined and the monthly allowance given, but at least one commonly needed piece (overage, premium connectors, extra environments, self-hosted licence, AI steps) is unpriced.
8 — Every tier priced publicly with its unit, allowance and limits, overage priced per unit, premium connector and add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: the monthly cost derivable for a given number of workflows, runs and steps per run, with a published calculator or worked examples, every add-on and overage on a public page, and the effect of loops and retries on the count explained.
The Process Owner
We found no public prices for any tier, and no billing unit, allowance, overage rate, minimum term or VAT treatment, so the monthly invoice cannot be computed from public pages. The only signals are a free trial, a free engine download, and free-versus-paid flags on connectors in the catalog. 1 4
The Integration Engineer
We found no public price figures at all — only a free trial, a free engine download, and free/paid flags on individual connectors. There is no tier price, no billing unit, no allowance and no overage anywhere in the captures, so a buyer cannot begin to compute a monthly cost and every tier is a sales conversation. 1 4
The Operations Analyst
I found no public pricing beyond a free trial, a free engine download, and free-versus-paid flags on connectors such as Salesforce, SharePoint, ABBYY and the GenAI features. No tier, billing unit, allowance or overage is stated, so the monthly cost of a given set of processes is not computable from public pages and the price of a paid connector is a sales conversation. 4 1
The Head of IT
Not one price figure appears in the captured pages: no tiers, no billing unit, no allowance, no overage and no self-hosting licence. The only pricing-relevant facts are that a free trial exists and that the ABBYY, GenAI, Salesforce and SharePoint connectors are marked paid while Apache Camel and RPA Framework are free — which tells me I will pay, never how much. 1 4
The Data Protection Officer
The only public prices are zero ones: a free trial, a free engine download, and connectors flagged free (Apache Camel, RPA Framework) or paid (Salesforce, SharePoint, ABBYY, GenAI) without amounts. We found no public information on tiers, the billing unit, allowances, overage or self-hosting licence costs, so a buyer cannot compute a monthly cost from these pages. 1 4
The Skeptic
Not one price figure appears on any captured page: a free trial, a free download button, and connectors merely flagged free or paid — ABBYY, GenAI, Salesforce and SharePoint cost something, amount unstated. What the enterprise edition costs, what the billing unit is, and what an allowance contains is entirely a sales conversation, so a buyer cannot compute anything from these pages. 1 4
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Flowable
Is Flowable European?
Yes, though not from the EU. whats-best.ai classifies Flowable as UK / wider Europe.
Where does Flowable store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Flowable have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Flowable?
As of 15 Oct 2026, the panel rates Tray.ai (3/5), n8n (3/5) and Camunda (2.5/5) highest among the other 16 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is n8n (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Flowable alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (flowable.com, flowable.com/privacy-notice, flowable.com/imprint, flowable.com/product/platform/connectors). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (4)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.flowable.com Checked 13 Oct 2026 Details →
- 2 Privacy policy www.flowable.com Checked 13 Oct 2026 Details →
- 3 Legal notice www.flowable.com Checked 13 Oct 2026 Details →
- 4 Connectors, API & on-premise reach — found from sitemap www.flowable.com Checked 13 Oct 2026 Details →