Workflow Management
Kissflow
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Kissflow Inc. · kissflow.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Kissflow at a glance
- Vendor
- Kissflow Inc.
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Panel verdict
- The AI panel rates Kissflow 2/5, the mean of 6 judges. Kissflow is a no-code workflow and low-code application platform from Kissflow Inc., a US company with development in Chennai, India. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Kissflow is a no-code workflow and low-code application platform from Kissflow Inc., a US company with development in Chennai, India. The bench is firmest on governance and audit, where scores cluster at 5-7: an audit trail on by default with no opt-out toggle, field edits logged with before-and-after values, integration calls recorded with payload and response, and a governance hub with log exports, API-key expiry tracking and connection monitoring. Integrations and connectors follow at 5-6, built on named connectors for SAP, Salesforce, Oracle, Microsoft 365 and ServiceNow, a generic API connector, REST and SOAP consumption and workflows exposed as APIs. Sovereignty is the weakest area at 0-1: transfers from the EEA, UK and Switzerland are made under Standard Contractual Clauses and their UK and Swiss adaptations, and we found no public information on subprocessors, execution location or log storage. Hosting and portability scores span 2-4, reflecting how differently judges treated the editorially discussed on-premise option; the flagged splits recorded none of note. No price figures appear on the captured pages; a demo and a free trial are offered.
Speaks for it
- Always-on audit trail logs field edits with before-and-after values, timestamped and attributed step transitions, field-level viewer capture, and integration calls with payload and response
- Central governance hub provides log exports, an inventory of apps and their builders, API-key expiry tracking, and connection monitoring
- Named connectors cover SAP, Salesforce, Oracle, Microsoft 365 and ServiceNow, with a generic API connector, REST and SOAP consumption, and workflows exposed as APIs
- Real-time execution tracking flags delays, bottlenecks and SLA breaches, backed by automatic anomaly alerts
- Developer Hub with API documentation is published alongside help docs and an academy
Held against it
- Sovereignty scores sit at 0-1: the vendor is a US company, transfers from the EEA are made under Standard Contractual Clauses, and we found no public information on subprocessors or where execution logs are stored
- We found no public information on hosting region, on a documented self-hosted edition with system requirements, or on the format of the standard export promised at termination
- We found no public information on retries, error paths, execution-history retention, runtime or throughput limits, or a public status page
- We found no public information on deadlines and escalation, substitutes for absent approvers, or how a changed process treats instances already running
- We found no public information on single sign-on, credential storage, separate development and production environments, or a stated retention period for execution payloads
Best for
- You run approval-heavy processes — purchase requests, expense claims, leave applications — and need multi-level approvals assigned by role with real-time tracking
- Your estate centres on SAP, Salesforce, Oracle, Microsoft 365 or ServiceNow, with custom systems reachable through a generic API connector
- You need an audit record a works council or auditor can inspect: always on, field-level, with payload and response copies of integration calls
- You want IT to govern users, apps, builders, connections and API keys from one central hub
Avoid if
- You need data to remain within the EEA — the contracting entity is Kissflow Inc. of the USA and transfers from the EEA are made under Standard Contractual Clauses
- You need a self-hosted or air-gapped deployment you can scope and licence now — the captured on-premise pages discuss costs and use cases editorially, and the terms grant a terminable right to use the cloud platform
- You must account for every subprocessor, including the model providers behind the electable AI features, before enabling them — we found no public information on either
The scores
| Criterion | Panel median |
|---|---|
| Process design, forms & approvals | 2 of 5 |
| Connectors, API & on-premise reach | 2.5 of 5 |
| Execution, error handling & monitoring | 2 of 5 |
| Governance, credentials & audit trail | 3 of 5 |
| Hosting options & portability | 1.5 of 5 |
| European sovereignty | 0 of 5 |
Process design, forms & approvals
Show reasoningHide reasoning
How this is scored
Modelling the process people take part in: a visual designer or BPMN, forms, approval steps with roles and substitutes, deadlines and escalation, and versioning of a process that is already running — judged on whether a business owner can change a process without breaking the instances in flight.
0 — Linear trigger-action chains only; no human steps, no forms and no statement on approvals or roles.
3 — A visual builder with branching and a simple approval step, but approvers are named individuals rather than roles, there are no deadlines or escalation, and changing a process has no versioning.
5 — A visual designer with conditions and parallel paths, built-in forms, approval steps assigned to roles or groups, deadlines with reminders, and versions of a process kept with the running instances on their original version.
8 — BPMN 2.0 modelling or an equivalent documented notation, substitutes and escalation chains, multi-stage approvals with four-eyes rules, forms in German with validation and file upload, a task inbox for participants, and a test or simulation mode before publishing.
10 — The process is a governed asset: version history with diff and rollback, migration of running instances to a new version documented, process analytics on cycle time and bottlenecks per step, and the design documented well enough that a business team can maintain it without the vendor.
The Process Owner
Multi-level approvals assigned through role-based access, customizable approval paths, and a drag-and-drop form designer with validation, conditional fields, attachments and a user field that dynamically assigns a task cover the heart of what I run every week. I found no public information on substitutes when an approver is on holiday, on deadlines that escalate, on parallel paths, or on versioning that keeps forty live requests on their original process version — for me those absences are half the requirement. 5 6
The Integration Engineer
The visual form designer is genuinely evidenced — validation rules, conditional fields, attachments, signatures, tables, a user field that dynamically assigns the task — and approvals are multi-level with role-based access and customizable paths, which clears the middle ground between a toy builder and real process work. We found no public information on deadlines and escalation, substitutes, a documented modelling notation, or how a version change treats processes already in flight. 5 6
The Operations Analyst
Multi-level approvals assigned by role, a drag-and-drop form designer with validation, conditional logic and file attachments, and templates for purchase requests and expense claims are all documented. We found no public information on deadlines and escalation, substitutes, parallel paths, or what happens to running instances when a process is changed — that last question is exactly what I need answered before month-end. 5 6 9
The Head of IT
Forms and approvals are real: a drag-and-drop designer with conditional logic, validation rules, file attachments and signatures, plus multi-level approvals assigned by role rather than to named individuals. We found no public information on deadlines with escalation, substitutes, a test or simulation mode before publishing, or versioning that keeps running instances on their original version, so a business owner changing a live process is unproven. 5 6
The Data Protection Officer
Approvals sit at the centre of the evidence: multi-level approvals assigned by role, a user field that dynamically assigns tasks to a list of people, and forms with validation, attachments, conditional logic and templates — the bones of an approval chain a works council can read, with real-time tracking and SLA-breach flagging on top. I found no public information on substitutes, escalation chains, four-eyes steps, a documented notation like BPMN, or how a changed process treats the instances already in flight. 5 6 9
The Skeptic
Multi-level approvals assigned by role and a real drag-and-drop form designer with validation rules, conditional logic, calculated fields, tables and file attachments put this past the named-individuals stage. What holds it under the mid anchor is everything about live processes: we found no public information on deadlines and escalation, substitutes, parallel paths, versioning of an already-running process, or any test or simulation mode before publishing. 5 6
Connectors, API & on-premise reach
Show reasoningHide reasoning
How this is scored
Reaching the systems a European company actually runs: maintained connectors judged by name rather than count, a generic HTTP and webhook step, custom connectors, and a way to reach systems behind the firewall without opening it.
0 — No connectors beyond email, and no API or webhook step.
3 — A large connector count on a logo wall, with no statement of which actions each supports or who maintains them, and no generic HTTP step.
5 — Named connectors with their triggers and actions documented, including Microsoft 365 and at least one ERP or accounting system common in DACH (e.g. SAP, DATEV, Microsoft Dynamics), a generic HTTP/REST step, inbound webhooks, and a documented API to start and query workflows.
8 — Custom connectors buildable from an OpenAPI description or code, an on-premise agent or self-hosted runner reaching internal databases and file shares, SOAP and database steps, OAuth handled per connection, and connector maintenance ownership (vendor, partner or community) stated.
10 — Integration is engineered: a versioned public API with a deprecation policy, connector changelogs, rate limits per connector published, event-driven triggers rather than polling where the source allows it, and the vendor maintaining the German-market connectors (DATEV, SAP, ELO or d.velop) itself.
The Process Owner
Named connectors for SAP, Salesforce, Oracle, Microsoft 365 and ServiceNow, a generic API connector for the rest, REST and SOAP consumption, and event-driven and scheduled patterns where SAP stays the system of record are all documented. I found no public information on which actions each connector supports, on who maintains them, or on any agent that reaches our internal databases and file shares without opening the firewall. 8 1 2
The Integration Engineer
Connectors are named rather than logo-counted — SAP, Salesforce, Oracle, Microsoft 365, ServiceNow — with a generic API connector for the rest, REST and SOAP consumption, workflows exposed as their own APIs, and event-driven plus scheduled patterns written out for SAP and Salesforce; developer API documentation exists. We found no public information on the triggers and actions each connector supports, who maintains them, inbound webhooks, or an on-premise agent that reaches an internal SQL server without a hole in the firewall — and no DATEV connector is named. 1 2 8
The Operations Analyst
Named connectors for SAP, Salesforce, Oracle, Microsoft 365 and ServiceNow, a generic API connector for the custom ones, REST and SOAP consumption, workflows exposed as APIs, and both event-driven and scheduled patterns cover the ERP and Microsoft reach I actually have to automate against. We found no public information on an on-premise agent reaching systems behind the firewall, custom connector tooling, per-connector maintenance ownership, or published rate limits. 8 1 2
The Head of IT
Named connectors for SAP, Oracle and Microsoft 365, a generic API connector for custom systems, REST and SOAP consumption, event-driven triggers, and a documented developer API put this solidly in the middle band. We found no public information on an on-premise agent to reach systems behind the firewall, on per-connector action lists, or on who maintains each connector, which is what separates the top rungs. 1 8
The Data Protection Officer
SAP, Salesforce, Oracle, Microsoft 365 and ServiceNow are named as pre-built connectors alongside a generic API connector for everything else, with REST and SOAP consumption, workflows exposed as APIs, and event-driven triggers that fire the moment a record changes — the strongest transfer-relevant part of the pages. I found no public information on who maintains each connector, per-connection OAuth handling, or an on-premise runner that reaches internal databases and file shares without opening the firewall. 8 1
The Skeptic
Named connectors — SAP, Salesforce, Oracle, Microsoft 365, ServiceNow — plus a generic API connector, REST and SOAP consumption, event-driven triggers, workflows exposed as APIs and a documented developer hub land this squarely at the mid anchor. It stays there because we found no public information on which triggers and actions each connector supports, who maintains them, building custom connectors, or any agent reaching systems behind the firewall without opening it. 8 1
Execution, error handling & monitoring
Show reasoningHide reasoning
How this is scored
What happens when a step fails at 3 a.m.: retries, error paths, alerting, an execution history someone can search, limits on runtime and throughput, and a status page that admits incidents.
0 — Nothing stated about failed runs; an error stops the workflow silently.
3 — Failed runs are marked and an email is sent, but retries are manual, execution history is short or undocumented, and runtime and throughput limits are unstated.
5 — Automatic retries with configurable back-off, an error path or error workflow, a searchable execution log with input and output per step, failure alerts by email or chat, and runtime, payload and rate limits documented.
8 — Replay of a failed run from the failing step, idempotency guidance, queueing and concurrency controls, execution history retention stated per plan, monitoring exportable to the customer's own tools, and a public status page with incident history and an uptime commitment.
10 — Operations are designed for production: an SLA with service credits, horizontal scaling or high-availability setup documented for self-hosted installs, dead-letter handling, end-to-end tracing across workflows, and post-incident reports published.
The Process Owner
Real-time tracking that flags delays and SLA breaches, automatic anomaly alerts, and an audit trail that records every integration call with payload and response give me something to look at when a step fails overnight. I found no public information on retries, error paths, searchable history retention or runtime and rate limits, and service credits are only referenced as residing in the community support terms. 9 10 12 4
The Integration Engineer
Monitoring is the strong side: real-time execution tracking that flags delays, bottlenecks and SLA breaches as they occur, automatic anomaly alerts, and a log where every step transition is timestamped and every integration call keeps payload and response. We found no public information on automatic retries or back-off, error paths, replay of a failed run from the failing step, runtime and throughput limits, execution history retention, or a public status page — service credits are only pointed at as living in the Community support terms. 8 9 10 12
The Operations Analyst
Real-time tracking flagging delays, bottlenecks and SLA breaches, automatic anomaly alerts, integration calls logged with payload and response, and a terms-level pointer to service credits give me monitoring I would trust. But we found no public information on retries and back-off, error paths, replay from the failing step, a searchable execution history, or any runtime, payload and throughput limits — so I cannot predict what the month-end run will hit, only detect it after the fact. 9 10 12 4
The Head of IT
Real-time execution tracking that flags delays, bottlenecks and SLA breaches, automatic anomaly alerts, and an audit trail that records every integration call with payload and response are documented; the terms point to service credits communicated through the vendor's community pages. We found no public information on retries, error paths, execution-history retention, runtime or throughput limits, or a public status page with incident history. 4 9 10 12
The Data Protection Officer
Monitoring is genuinely evidenced: real-time execution tracking that flags delays, bottlenecks and SLA breaches, automatic anomaly alerts, and an execution record where every step is timestamped and attributed and every integration call keeps its payload and response — that payload copy is exactly what I look for, and it is documented. But I found no public information on retries, error paths, retention of the execution history, or runtime and throughput limits, and service credits are only referenced through the Community site. 9 10 12 4
The Skeptic
Real-time monitoring that flags delays, bottlenecks and SLA breaches, automatic anomaly alerts, and an audit trail recording every integration call with payload and response are stated. Beyond that, we found no public information on retries, error paths, alert channels, searchable execution history retention, runtime or throughput limits, or a public status page — the 3 a.m. failure is essentially undescribed. 9 10 12
Governance, credentials & audit trail
Show reasoningHide reasoning
How this is scored
Keeping automation from becoming shadow IT: roles and permissions, SSO, where connection credentials are stored, separate environments with controlled publishing, an audit trail of changes and approvals, and what the execution log retains of the payload. An approval record is also a record of employees' behaviour, so what the trail captures matters to a works council.
0 — Single-user accounts or one shared login; no roles, no audit log and no statement on credential storage.
3 — Admin and member roles and shared team folders, but credentials are visible to anyone who can edit a workflow, there is no audit log, and execution payloads are kept without a stated period.
5 — Role-based permissions per workflow or folder, SSO via SAML or OIDC, credentials stored encrypted and usable without being revealed, an audit log of workflow changes, and the retention period of execution data stated.
8 — Separate development, test and production environments with a publishing approval, SCIM provisioning, external secret stores supported, payload redaction or log-off per workflow, configurable execution data retention, and the audit trail exportable — with the fields it records about users described.
10 — Governance a works council and an auditor can both sign off: field-level masking of personal data in logs, delegated administration per department, a central inventory of every workflow and connection with its owner, certifications published (ISO 27001 or SOC 2), and documentation of what the platform records about individual users.
The Process Owner
The audit trail is on by default with no opt-out, field edits logged with before-and-after values, steps timestamped and attributed, viewers captured at field level, and field permissions enforced at the data layer so a user without permission cannot query a field's history — a works council can see exactly what is recorded. Log exports, role and group visibility, API key tracking and connection monitoring sit in one governance hub. I found no public information on SSO or SCIM, on credential storage, on separate environments with a publishing approval, or on a stated retention period, and no named certification such as ISO 27001. 12 11 5 3
The Integration Engineer
The audit trail is unusually well documented — on by default with no opt-out toggle, field edits logged with before-and-after values, viewers captured at field level, and field permissions enforced at the data layer so a user without permission cannot even query a field's history — and the governance hub adds API-key and connection tracking, an inventory of who built which app, and log exports. We found no public information on SSO via SAML or OIDC, SCIM provisioning, how connection credentials are stored, separate development and production environments with publishing approval, or a stated retention period for execution payloads. 5 11 12
The Operations Analyst
The audit trail is unusually well documented and always on: field edits with before-and-after values, integration calls with payload and response, timestamped and attributed step transitions, field-level viewer capture, permissions enforced at the data layer, plus a central hub with roles, API key expiry tracking and log exports. We found no public information on SSO, where connection credentials are stored and whether workflow editors can see them, separate development and production environments, or a stated retention period for execution payloads — the privacy text offers only a principle, and a works council will want the number. 11 12 3 5
The Head of IT
This is the strong suit: an always-on audit trail with timestamped and attributed step transitions and before-and-after field values, log exports, field-level permissions enforced at the data layer, and a governance hub that inventories apps, workflows, their builders and API keys — the workflow inventory with owners I demand from every department. We found no public information on SSO, credential storage, separate test and production environments with controlled publishing, or a stated execution-data retention period, which holds it to the middle rung. 11 12
The Data Protection Officer
The audit trail is generated by default with no opt-out, logging every field edit with before-and-after values, every step transition attributed and timestamped, every viewer at field level, and every integration call with payload and response — a works council can see precisely what behavioural record the platform keeps, and field-level permissions stop a user without permission from querying a field's history. The governance hub adds log exports, a central inventory of workflows, builders, connections and API keys with expiry dates. What holds it back: I found no public information on SSO, SCIM or credential storage, the only retention statement is the principle that data is kept as long as necessary, and no masking or redaction of payloads in the trail is described — the trail is generated whether or not the owner opts in. 12 11 3 5
The Skeptic
The audit story is unusually concrete: default-on with no opt-out, step transitions timestamped and attributed, field edits with before-and-after values, viewers captured at field level, integration calls with payload and response, plus a governance hub with log exports, key expiry tracking and role and group visibility. But we found no public information on single sign-on, where connection credentials are stored, separate development and production environments with publishing approval, or a stated retention period for execution payloads — only a purpose-limitation sentence about keeping data as long as necessary. 11 12 3
Hosting options & portability
Show reasoningHide reasoning
How this is scored
Where the engine runs and whether the workflows can leave: cloud regions, self-hosted or on-premise editions, the licence of the engine, and export of workflow definitions in a format another tool or a later version can read.
0 — Cloud-only with no stated region, and no export of workflow definitions.
3 — Cloud-only with a region named, and an export that produces a proprietary file only the same product can import.
5 — An EU cloud region selectable, workflow definitions exportable as documented JSON or BPMN 2.0, and an API to read definitions and execution history for backup.
8 — A self-hosted or on-premise edition with its system requirements documented, workflow definitions versionable in Git, the engine's licence published, and a documented migration path between cloud and self-hosted in both directions.
10 — The customer owns its automation: an open-source or source-available engine, definitions in an open standard executable elsewhere, air-gapped installation supported, and a stated exit process that hands back definitions, credentials metadata and execution history in documented formats.
The Process Owner
The captured pages describe a browser-based cloud platform, claim 'public and private cloud hosting', and offer a standard data export of customer data before termination; the on-premise material is a general discussion of costs and use cases rather than a documented product edition, with a hybrid choice mentioned. I found no public information on hosting regions, on export of workflow definitions in a documented format another tool could read, on a self-hosted edition with system requirements, or on the engine's licence. 2 4 14 13
The Integration Engineer
The pricing page names public and private cloud hosting, and a blog article discusses choosing on-premise and cloud together for processes with different requirements, but that article argues the category's case rather than describing an installable edition. We found no public information on a self-hosted edition with system requirements, a selectable EU region, the engine's licence, or export of workflow definitions in a documented format — the terms promise only a standard data export function before termination, format unstated. 2 4 14
The Operations Analyst
Public and private cloud hosting plus a hybrid cloud-and-on-premise choice are claimed, the terms give the customer ownership of its data with a standard export before termination, and the on-premise pages name when that route fits, including air-gapped networks. We found no public information on a selectable EU region, the format of the export, the engine's licence, system requirements for self-hosting, or a documented migration path in either direction. 2 14 4
The Head of IT
The captured pages show public and private cloud hosting and a standard data-export path on termination, and a hybrid cloud-and-on-premise choice is discussed editorially. We found no public information naming a hosting region, on export of workflow definitions as BPMN or documented JSON, or on a self-hosted edition with system requirements and a published engine licence — the terms grant only a terminable right to use the cloud platform, which is not the five-year footing I want. 2 4 14
The Data Protection Officer
The platform is presented as cloud with a private cloud hosting option and a claim that both can be chosen for processes with different requirements, but I found no public information on any hosting region — so where the execution logs with their payload copies physically live is unknown — nor on a self-hosted edition with documented system requirements, a published engine licence, or a migration path. The terms point to a standard data export at termination, with no documented format for workflow definitions. 2 4 14 13
The Skeptic
Public and private cloud hosting, a hybrid claim that you can choose both, and a contractual promise of standard data export on termination are stated. We found no public information on a selectable EU region, the format the export produces, an API to read definitions and history for backup, the engine's licence, or system requirements for a self-hosted installation — the on-premise pages discuss the deployment model's costs in general terms rather than a documented edition. 2 4 14
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where workflows execute and where execution logs with their payload copies are stored, and who the subprocessors are — including the AI model providers behind any AI steps. Independently sourced by the sovereignty pipeline. A self-hosted edition counts only for the data that actually stays on the customer's servers.
0 — Non-EU vendor and contracting entity, execution location unstated, and subprocessors unnamed.
3 — An EU region offered as an option while the contracting entity is non-EU, or the subprocessor list is absent, or AI steps send data to model providers of unstated location.
5 — EU execution and log storage as standard and an EU contracting entity, but parts of the chain — AI steps, support access, telemetry — are non-EU without an explained safeguard.
8 — EU execution on named infrastructure, EU contracting entity, subprocessor list published with locations including AI providers, a DPA covering execution payloads, and a self-hosted option that sends no workflow data to the vendor.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, AI steps runnable on European or self-hosted models, certification published, and a self-hosted edition that works without any call home.
The Process Owner
Kissflow Inc. is the contracting party in the terms, and the captured pages give no execution location, no EU region, no subprocessor list and no location for the AI providers behind the AI features. The privacy policy at least names EU Standard Contractual Clauses for transfers out of the EEA, which is why this earns minimal rather than no credit from me. 3 4
The Integration Engineer
The contracting entity is Kissflow Inc. in the USA, and the privacy policy leans on EU Standard Contractual Clauses, the UK Addendum and the Swiss adaptation for transfers out of Europe — which tells me data leaves rather than stays. We found no public information on where workflows and their execution logs are actually stored, on a subprocessor list with locations, or on which model providers sit behind the AI features the subscriber can switch on. 3 4
The Operations Analyst
Provenance places the vendor in the USA, execution and log storage location is not stated on any captured page, the subprocessor list is absent, and the only visible European safeguard is standard contractual clauses for transfers out of the EEA. AI features are enabled at the subscriber's election with no statement of which model providers run them or from where, so the chain behind any AI-assisted step is unaccounted for. 3 4
The Head of IT
Kissflow Inc. of the USA is the contracting entity, and we found no public information on where workflows and execution logs are stored, on subprocessors, or on the providers and locations behind the AI features; the privacy policy's standard contractual clauses confirm transfers out of the EEA. Nothing in the sourcing confirms EU residency, European ownership or subprocessor exposure, so there is no European footing here at all. 3 4
The Data Protection Officer
The contracting entity named in the terms is Kissflow Inc., described as a US company with development in India, execution and log-storage locations are unstated, and no subprocessor list is published — including the providers behind the AI features, whose location and identity remain unknown even though the privacy policy confirms electable AI features. The EEA transfer documentation consists of Standard Contractual Clauses with a UK Addendum, which govern the transfer out of the EEA rather than avoid it, and the Indian DPDPA section confirms processing in India. 4 3 8
The Skeptic
The vendor is a US company, and the only safeguards in evidence are EU Standard Contractual Clauses, the UK addendum and a DPDPA transfer clause — the legal minimum for any non-EU SaaS. Execution location and log storage are unstated, and we found no public information on subprocessors, including which model providers receive the data behind the AI features a subscriber may enable. 3 4
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the monthly cost of their own processes from public pages alone: what the billing unit is (task, operation, execution, run, user or flow) and what counts as one, the allowance per tier, overage prices, and the cost of premium connectors, self-hosting, environments and AI steps.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but the billing unit is undefined or what counts as one task or execution is unstated — the invoice is unknowable.
5 — Tier prices public with the billing unit defined and the monthly allowance given, but at least one commonly needed piece (overage, premium connectors, extra environments, self-hosted licence, AI steps) is unpriced.
8 — Every tier priced publicly with its unit, allowance and limits, overage priced per unit, premium connector and add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: the monthly cost derivable for a given number of workflows, runs and steps per run, with a published calculator or worked examples, every add-on and overage on a public page, and the effect of loops and retries on the count explained.
The Process Owner
The pricing page lists inclusions — unlimited applications, unlimited integrations, AI features, professional services — and a per-user subscription model is described elsewhere, but no figure for any tier appears on any captured page. Without a single price, an allowance per tier, or a definition of what counts as a user, I cannot compute even one month of invoice for my approvals, and that is where this sits. 2 14
The Integration Engineer
The pricing page communicates unlimited integrations, unlimited applications, hosting options and professional services, and an article describes predictable per-user pricing without infrastructure costs, but we found no public price figure for any tier anywhere in the captured pages. A free trial is offered; the monthly cost of a buyer's own processes is not computable from what is published. 2 9 14
The Operations Analyst
The captured pricing page lists plan features — unlimited applications, unlimited integrations, support and services — with no figures, and the billing model is described elsewhere only as predictable per-user pricing without infrastructure costs. No tier prices, allowances, overage rates, premium connector or environment costs are public, so I cannot compute what an invoice run or a loop over 5,000 rows costs before signing; only a free trial is offered. 2 14 9
The Head of IT
The pricing page lists plan features — unlimited applications, unlimited integrations — but no prices, and the site steers buyers to a demo; only a predictable per-user subscription model is stated anywhere. A buyer cannot compute a monthly cost from public pages, and we found no public information on tier allowances, overages, add-on connectors, AI steps or self-hosting licences. 1 2 14
The Data Protection Officer
The pricing page lists service and feature bundles — unlimited integrations, unlimited applications, 25+ AI-powered automation features, public and private cloud hosting — and a per-user subscription model with predictable pricing is described, but I found no public price figures, tier allowances, overage costs, or the price of AI steps, environments or premium connectors. A free trial and a demo are offered where a computable monthly cost would be. 2 14 9
The Skeptic
The captured pricing page carries plan content — unlimited applications, unlimited integrations, 25-plus AI features — and the vendor speaks of predictable per-user pricing, but we found no public information on an actual price figure, the allowance per tier, or overage; the page's calls to action are a demo and a free trial. A buyer cannot compute a monthly cost from what is published. 2 14 1
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Kissflow
Is Kissflow European?
No. whats-best.ai classifies Kissflow as Rest of world.
Where does Kissflow store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Kissflow have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Kissflow?
As of 15 Oct 2026, the panel rates Tray.ai (3/5), n8n (3/5) and Camunda (2.5/5) highest among the other 16 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is n8n (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Kissflow alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage kissflow.com Checked 13 Oct 2026 Details →
- 2 Pricing page kissflow.com Checked 13 Oct 2026 Details →
- 3 Privacy policy kissflow.com Checked 13 Oct 2026 Details →
- 4 Terms of service kissflow.com Checked 13 Oct 2026 Details →
- 5 Process design, forms & approvals — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 6 Process design, forms & approvals — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 7 Connectors, API & on-premise reach — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 8 Connectors, API & on-premise reach — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 9 Execution, error handling & monitoring — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 10 Execution, error handling & monitoring — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 11 Governance, credentials & audit trail — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 12 Governance, credentials & audit trail — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 13 Hosting options & portability — found from sitemap kissflow.com Checked 13 Oct 2026 Details →
- 14 Hosting options & portability — found from sitemap kissflow.com Checked 13 Oct 2026 Details →