Workflow Management
Pipefy
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Pipefy Inc. · www.pipefy.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Pipefy at a glance
- Vendor
- Pipefy Inc.
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Yes, per the vendor’s own page source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates Pipefy 1.5/5, the mean of 6 judges. Pipefy is a no-code workflow and request-management platform from Pipefy Inc., a US company. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Pipefy is a no-code workflow and request-management platform from Pipefy Inc., a US company. The strongest row is integrations and connectors at 4-5, the only criterion reaching 5, resting on a catalog of 170+ connectors (Salesforce, HubSpot, SAP Ariba, Workday, OpenAI) and HTTP and HTTP (OAuth2) steps documented to authentication methods. Process design, run reliability and governance and audit cluster at 4: drag-and-drop start forms, SLA alerts in minutes, hours or days with weekday-only counting, a 50-concurrent-slot queue with unique run IDs, and granular roles with SAML and Azure Native single sign-on. Hosting and portability sits at 0 — we found no public information on cloud regions, a self-hosted edition, or export of workflow definitions. Sovereignty and pricing transparency span 0-1: the pages state no execution or log-storage location, we found no public information on a subprocessor list with locations, and the pricing page shows no tier prices or price per credit; the only score above 0 on sovereignty credits the stated zero-data-retention commitment for AI training and the controller-and-processor declaration. The flagged splits flag none.
Speaks for it
- Connector catalog names 170+ systems including Salesforce, HubSpot, SAP Ariba, Workday and OpenAI, with HTTP and HTTP (OAuth2) steps documented to authentication methods, conditional branches and a test step.
- SLA alerts run in minutes, hours or days with optional weekday-only counting and can trigger automation actions on late, expired and overdue cards.
- The run queue is documented concretely — 50 concurrent slots, strict first-come-first-served order, unique run IDs, and a stated guarantee that no data is dropped during volume spikes.
- The permission model is public — five company roles plus pipe and database roles, SAML and Azure Native single sign-on with an SSO-only mode, multi-factor authentication, and credentials encrypted in a platform secret manager.
- The privacy policy states a zero-data-retention commitment for AI training and declares controller and processor roles.
Held against it
- Hosting and portability scored 0 — we found no public information on cloud regions, a self-hosted or on-premise edition, or export of workflow definitions in any format.
- The captured pricing page shows no tier prices, and the credit billing unit is never priced or sized, so no monthly cost can be derived from public pages.
- Sovereignty scored 0-1 — Pipefy Inc. is a US company, and we found no public information on execution location, log storage, or a subprocessor list with locations.
- We found no public information on automatic retries, replay from the failing step, alerting when a run fails, or a public status page; the documented alert types are card deadlines.
- We found no public information on an audit log of workflow changes, separate test and production environments with a publishing approval, or an exportable audit trail.
Best for
- You need no-code request intake — drag-and-drop start forms, shareable links, deadline alerts — that a business owner can build without IT, starting from the free Procurement Approval Process Template.
- Your systems are cloud SaaS such as Salesforce, Workday or SAP Ariba, reachable through named connectors or generic HTTP with OAuth2.
- You value vendors who publish operational limits — 50 concurrent slots, strict queue order, run IDs — alongside a public role-and-permission matrix with SSO, an SSO-only mode and multi-factor authentication.
Avoid if
- You must budget before committing — the pricing page shows no figures, support plans are an explore link, and custom integrations run through a quote request, so no monthly cost can be computed from public pages.
- You need an exit you can plan — the captured pages describe a cloud product only, and we found no public information on export of workflow definitions or a self-hosted edition.
- Your compliance review requires stated execution and storage locations and a subprocessor list — the pages state no execution or log-storage location, and the contracting entity is Pipefy Inc. of the USA.
- Your approval flows need substitutes, escalation chains or safe changes to a live process — we found no public information on these, and changed SLA settings apply only to new cards.
The scores
| Criterion | Panel median |
|---|---|
| Process design, forms & approvals | 2 of 5 |
| Connectors, API & on-premise reach | 2 of 5 |
| Execution, error handling & monitoring | 2 of 5 |
| Governance, credentials & audit trail | 2 of 5 |
| Hosting options & portability | 0 of 5 |
| European sovereignty | 0 of 5 |
| Pricing transparency | 0.5 of 5 |
Process design, forms & approvals
Show reasoningHide reasoning
How this is scored
Modelling the process people take part in: a visual designer or BPMN, forms, approval steps with roles and substitutes, deadlines and escalation, and versioning of a process that is already running — judged on whether a business owner can change a process without breaking the instances in flight.
0 — Linear trigger-action chains only; no human steps, no forms and no statement on approvals or roles.
3 — A visual builder with branching and a simple approval step, but approvers are named individuals rather than roles, there are no deadlines or escalation, and changing a process has no versioning.
5 — A visual designer with conditions and parallel paths, built-in forms, approval steps assigned to roles or groups, deadlines with reminders, and versions of a process kept with the running instances on their original version.
8 — BPMN 2.0 modelling or an equivalent documented notation, substitutes and escalation chains, multi-stage approvals with four-eyes rules, forms in German with validation and file upload, a task inbox for participants, and a test or simulation mode before publishing.
10 — The process is a governed asset: version history with diff and rollback, migration of running instances to a new version documented, process analytics on cycle time and bottlenecks per step, and the design documented well enough that a business team can maintain it without the vendor.
The Process Owner
Forms with drag-and-drop fields, automatic emails on approval decisions and a Kanban-style pipe come straight from the procurement template, and deadline alerts in minutes, hours or days — weekdays only if I choose, triggering automation actions — cover the escalation basics. I found no public information on substitutes for an approver on holiday, four-eyes multi-stage approvals, or versioning that keeps the forty requests already in flight on their original process version; the closest statement says changed deadline settings apply only to new cards. 5 6 9 11
The Integration Engineer
Forms, portals and the SLA machinery are real — due dates and per-phase late and expired alerts in minutes, hours or days, weekday-only counting, and alerts that trigger automation actions put this above a simple trigger chain. But we found no public information on parallel paths, on approval steps assigned to roles or groups with substitutes and escalation chains, or on versioning of a process definition for instances already in flight; the alerts page only says changed settings apply to new cards. 5 6 9
The Operations Analyst
Drag-and-drop start forms, shareable request links and SLA clocks in minutes, hours or days with weekday-only counting give a business owner real deadlines, and pipes have their own role set. We found no public information on versioning of a process that is already running, parallel paths, escalation chains or a simulation mode before publishing, and the test capability shown covers a single HTTP step rather than a whole-process test. 5 6 9 11
The Head of IT
Forms with drag-and-drop fields, approval templates with automatic decision emails, and SLA alerts in minutes, hours or days with weekday-only counting are all evidenced, which takes this past a bare trigger chain. We found no public information on parallel paths, approver substitutes, escalation chains, or versioning of a process that is already running, and no BPMN or other documented notation — so a business owner changing a live process has no evidenced safety net. 5 6 9
The Data Protection Officer
Forms, an approval template, SLA clocks in minutes, hours or days, weekday-only deadline counting and Kanban-style phases let a business owner model an approval process end to end. What I found no public information on is the parts a works council probes: approvers assigned as roles with substitutes and escalation chains, four-eyes steps, and versioning of a process that is already running, so a change to a live approval flow is not shown to preserve the cards in flight. 1 5 6 9
The Skeptic
The forms and deadline side is real: drag-and-drop start forms with shareable links, a free approval template, and phase-level SLAs with late, expired and overdue alerts that notify assignees and can fire automations. We found no public information on approvers as roles with substitutes, escalation chains, parallel paths, or versioning of a process definition for cards already in flight — the only version-adjacent statement is that changed SLA settings apply just to new cards. 5 6 9
Connectors, API & on-premise reach
Show reasoningHide reasoning
How this is scored
Reaching the systems a European company actually runs: maintained connectors judged by name rather than count, a generic HTTP and webhook step, custom connectors, and a way to reach systems behind the firewall without opening it.
0 — No connectors beyond email, and no API or webhook step.
3 — A large connector count on a logo wall, with no statement of which actions each supports or who maintains them, and no generic HTTP step.
5 — Named connectors with their triggers and actions documented, including Microsoft 365 and at least one ERP or accounting system common in DACH (e.g. SAP, DATEV, Microsoft Dynamics), a generic HTTP/REST step, inbound webhooks, and a documented API to start and query workflows.
8 — Custom connectors buildable from an OpenAPI description or code, an on-premise agent or self-hosted runner reaching internal databases and file shares, SOAP and database steps, OAuth handled per connection, and connector maintenance ownership (vendor, partner or community) stated.
10 — Integration is engineered: a versioned public API with a deprecation policy, connector changelogs, rate limits per connector published, event-driven triggers rather than polling where the source allows it, and the vendor maintaining the German-market connectors (DATEV, SAP, ELO or d.velop) itself.
The Process Owner
The catalog names its connectors — Salesforce, HubSpot, SAP Ariba, Workday among 170-plus — and the HTTP and OAuth2 connectors, with credentials kept encrypted in a secret manager and a Test Step for sample payloads, make generic REST work credible. I found no public information on a DATEV connector, on which triggers and actions each connector supports, on who maintains them, or on any on-premise agent to reach systems behind our firewall. 2 7 8
The Integration Engineer
The generic HTTP step is proper work — REST with basic, bearer and custom-header auth, a dedicated OAuth2 connector holding Client ID, Client Secret and scopes in an encrypted secret manager, conditional branches on status codes and a test step for sample payloads. The catalog names 170-plus connectors from Salesforce to SAP Ariba and Workday, but we found no public information on the triggers and actions each connector supports, who maintains them, inbound webhooks, an on-premise agent reaching systems behind the firewall, or a DATEV or Microsoft Dynamics connector for the DACH market. 7 8 2
The Operations Analyst
The catalog names 170-plus integrations including Salesforce, Workday and SAP Ariba, and the HTTP and HTTP (OAuth2) connectors are documented down to authentication methods and conditional branches on status codes, which earns real credit. We found no public information on the triggers and actions each connector supports, on DATEV or another DACH accounting connector, on inbound webhooks, or on any way to reach systems behind the firewall — custom integrations are a quote-based service rather than a connector a team can build. 2 7 8
The Head of IT
The catalog names real systems — Salesforce, HubSpot, SAP Ariba, Workday, OpenAI — and the HTTP and HTTP (OAuth2) connectors with basic, bearer-token and custom-header auth are genuine generic steps, with integration flows triggered by events. We found no public information on which triggers and actions each connector supports, who maintains them, or any on-premise agent reaching internal databases behind the firewall, and custom integrations run through a quote request rather than self-service. 2 7 8
The Data Protection Officer
Named connectors including Salesforce, HubSpot, Workday and SAP Ariba plus generic HTTP and OAuth2 steps with a platform secret manager give the shape of a real integration layer. I found no public information on per-connector trigger and action documentation, inbound webhooks, connectors built from an OpenAPI description, or any agent that reaches systems behind the firewall; the OpenAI connector is named while nothing public says where the model calls behind AI steps are served. 2 7 8
The Skeptic
The HTTP and HTTP (OAuth2) connectors are documented properly — auth methods, conditional branches on status codes, a test step — and the catalog names Salesforce, SAP Ariba and Workday rather than just counting logos. We found no public information on inbound webhooks, per-connector triggers and actions, connector maintenance ownership, or reaching systems behind the firewall; "custom integrations" routes to a quote request rather than a build-it-yourself path. 2 7 8
Execution, error handling & monitoring
Show reasoningHide reasoning
How this is scored
What happens when a step fails at 3 a.m.: retries, error paths, alerting, an execution history someone can search, limits on runtime and throughput, and a status page that admits incidents.
0 — Nothing stated about failed runs; an error stops the workflow silently.
3 — Failed runs are marked and an email is sent, but retries are manual, execution history is short or undocumented, and runtime and throughput limits are unstated.
5 — Automatic retries with configurable back-off, an error path or error workflow, a searchable execution log with input and output per step, failure alerts by email or chat, and runtime, payload and rate limits documented.
8 — Replay of a failed run from the failing step, idempotency guidance, queueing and concurrency controls, execution history retention stated per plan, monitoring exportable to the customer's own tools, and a public status page with incident history and an uptime commitment.
10 — Operations are designed for production: an SLA with service credits, horizontal scaling or high-availability setup documented for self-hosted installs, dead-letter handling, end-to-end tracing across workflows, and post-incident reports published.
The Process Owner
Runs are acknowledged asynchronously, queued first-come-first-served below a documented fifty concurrent slots, given unique run IDs and a succeeded-versus-failed breakdown, and the vendor states no data is dropped when volume spikes. I found no public information on automatic retries, replay from the failing step, alerts when a run fails, or how long execution history is kept; support with an SLA appears only as plans to explore. 2 10
The Integration Engineer
The queue is engineered: every run gets a unique Run ID, triggers are acknowledged asynchronously, excess runs wait first-come-first-served until concurrent slots drop below fifty, and the Runs dashboard counts succeeded and failed with a queue status widget. But we found no public information on automatic retries, on replaying a failed run from the failing step, on alerting when a run fails, or on execution-history retention — the documented error handling is the builder's own conditional branch on an HTTP status code. 10 8
The Operations Analyst
The runs dashboard with its queue widget, unique run IDs, succeeded and failed counts, a published concurrency ceiling of 50 slots with first-come-first-served queueing and a no-data-dropped guarantee is more operational honesty than most vendors publish. For production use, we found no public information on automatic retries with back-off, replay from the failing step, a searchable per-step execution log with inputs and outputs, or a status page with incident history, and retention is stated only for access logs at six months. 3 9 10
The Head of IT
Failed runs are marked on a runs dashboard with unique run IDs, a first-come-first-served queue that holds data through volume spikes, and a documented limit of 50 concurrent slots with pagination guidance — limits being stated matters to me. We found no public information on automatic retries with back-off, an error path or error workflow, replay from the failing step, or a public status page with incident history. 10
The Data Protection Officer
Run IDs per execution, a queue widget splitting succeeded from failed runs, a fifty-slot concurrency limit with first-come queueing, and test steps before going live give genuine visibility when something breaks. But I found no public information on automatic retries, a searchable execution log showing the input and output of each step, alerting when a run fails, or how long execution history with its payload copies is kept — the privacy policy's six-month figure is about access logs, and its 180-day figure about data after contract termination. 3 8 9 10
The Skeptic
The queue documentation is refreshingly concrete: 50 concurrent slots, strict arrival order, unique run IDs, and a dashboard that separates succeeded from failed runs with a definition of what failure means. But we found no public information on automatic retries, replay from the failing step, per-step input and output logs, or failure alerting — the documented alert types are card deadlines, not failed runs — and no public information on a status page or uptime commitment. 8 9 10
Governance, credentials & audit trail
Show reasoningHide reasoning
How this is scored
Keeping automation from becoming shadow IT: roles and permissions, SSO, where connection credentials are stored, separate environments with controlled publishing, an audit trail of changes and approvals, and what the execution log retains of the payload. An approval record is also a record of employees' behaviour, so what the trail captures matters to a works council.
0 — Single-user accounts or one shared login; no roles, no audit log and no statement on credential storage.
3 — Admin and member roles and shared team folders, but credentials are visible to anyone who can edit a workflow, there is no audit log, and execution payloads are kept without a stated period.
5 — Role-based permissions per workflow or folder, SSO via SAML or OIDC, credentials stored encrypted and usable without being revealed, an audit log of workflow changes, and the retention period of execution data stated.
8 — Separate development, test and production environments with a publishing approval, SCIM provisioning, external secret stores supported, payload redaction or log-off per workflow, configurable execution data retention, and the audit trail exportable — with the fields it records about users described.
10 — Governance a works council and an auditor can both sign off: field-level masking of personal data in logs, delegated administration per department, a central inventory of every workflow and connection with its owner, certifications published (ISO 27001 or SOC 2), and documentation of what the platform records about individual users.
The Process Owner
Company, pipe and database roles with a permission matrix, SAML and Azure-native single sign-on with an SSO-only mode, credentials encrypted in a secret manager and stated retention periods give me solid role-based control over who may approve what. I found no public information on an audit log of workflow changes, on separate test and production environments with a publishing approval, or on what the trail records about individual users — the questions my works council asks first. 3 8 11 12
The Integration Engineer
The role model is granular — five company roles with a per-action permission matrix down to pipe and database level, SSO via SAML or Azure native with an SSO-only mode and user auto-provisioning, a multi-factor authentication section, and HTTP credentials held encrypted in the platform's secret manager. But we found no public information on an audit log of workflow changes, on separate development, test and production environments with a publishing approval, or on payload redaction and exportable audit trails; the stated periods (six months for access logs, up to 180 days after contract termination) come from the privacy policy rather than a configurable execution-data setting. 11 12 8 3
The Operations Analyst
A five-role company permission matrix with per-pipe and per-database roles, SAML and Azure Native single sign-on with an SSO-only mode, multi-factor authentication, automatic user provisioning and credentials encrypted in a platform secret manager is solid governance plumbing. We found no public information on an audit log of workflow changes, separate environments with a publishing approval, export of the audit trail, or what execution logs retain of the payload — the only retention figures given cover access logs and post-termination platform data. 3 8 11 12
The Head of IT
Single sign-on via SAML and Azure Native with an SSO-only mode and auto-provisioning, multi-factor authentication, five company roles plus pipe-level roles down to read-only, and credentials held encrypted in a secret manager give me most of the access control I demand. We found no public information on an audit log of workflow changes, separate test and production environments with a publishing approval, or an exportable audit trail, and enabling SSO starts with a review of up to 15 business days. 8 11 12
The Data Protection Officer
Company, pipe and database roles, customizable permissions, SAML and Azure-native single sign-on with an SSO-only mode, multi-factor authentication and credentials encrypted in the platform secret manager are a real governance base. What is missing for a works council and an auditor: I found no public information on an audit log of workflow changes and approvals, separate environments with a publishing gate, masking or redaction of payload data in logs, export of the trail, or documentation of what the platform records about individual users beyond Google Analytics telemetry. 3 8 11 12
The Skeptic
The permission model is unusually public — five company roles plus pipe and database roles, a matrix covering who may create pipes, databases and AI agents — with SSO in two flavours, an SSO-only mode, MFA, and connector credentials encrypted in the platform's secret manager. For the audit half we found no public information on a log of workflow changes, separate environments with a publishing approval, or named certifications; "governance certifications" appears only as marketing phrasing. 1 8 11 12
Hosting options & portability
Show reasoningHide reasoning
How this is scored
Where the engine runs and whether the workflows can leave: cloud regions, self-hosted or on-premise editions, the licence of the engine, and export of workflow definitions in a format another tool or a later version can read.
0 — Cloud-only with no stated region, and no export of workflow definitions.
3 — Cloud-only with a region named, and an export that produces a proprietary file only the same product can import.
5 — An EU cloud region selectable, workflow definitions exportable as documented JSON or BPMN 2.0, and an API to read definitions and execution history for backup.
8 — A self-hosted or on-premise edition with its system requirements documented, workflow definitions versionable in Git, the engine's licence published, and a documented migration path between cloud and self-hosted in both directions.
10 — The customer owns its automation: an open-source or source-available engine, definitions in an open standard executable elsewhere, air-gapped installation supported, and a stated exit process that hands back definitions, credentials metadata and execution history in documented formats.
The Process Owner
I found no public information on selectable cloud regions, a self-hosted or on-premise edition, export of workflow definitions in a documented format, or the engine's licence — the captured pages describe a cloud product only. With nothing on where workflows execute or how our definitions could be taken out, there is nothing here for me to approve against our exit requirements. 1 3
The Integration Engineer
We found no public information on cloud regions, on a self-hosted or on-premise edition, on the engine's licence, or on exporting workflow definitions in a documented format another tool could read — none of the vendor pages captured say where the engine runs or how a workflow definition leaves it. 1 2
The Operations Analyst
We found no public information on selectable cloud regions, a self-hosted or on-premise edition, the engine's licence, or export of workflow definitions in any documented format another tool could read. With nothing captured on where the engine runs or how a process definition could leave it, the captured pages sit at the bottom of this criterion. 1 3
The Head of IT
We found no public information on selectable cloud regions, a self-hosted or on-premise edition, the licence under which the engine ships, or export of workflow definitions in BPMN or documented JSON. With no evidenced export path and no self-hosted edition on the product or pricing pages, there is no exit I can plan for. 1 2
The Data Protection Officer
I found no public information on cloud regions, a self-hosted or on-premise edition, the engine's licence, or any export format for workflow definitions — so nothing shows the workflows can leave. The only territorial signal in the captured pages is a Brazilian access-log retention rule in the privacy policy, which is a legal retention rule, not a statement of where the engine or its logs run. 1 3
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where workflows execute and where execution logs with their payload copies are stored, and who the subprocessors are — including the AI model providers behind any AI steps. Independently sourced by the sovereignty pipeline. A self-hosted edition counts only for the data that actually stays on the customer's servers.
0 — Non-EU vendor and contracting entity, execution location unstated, and subprocessors unnamed.
3 — An EU region offered as an option while the contracting entity is non-EU, or the subprocessor list is absent, or AI steps send data to model providers of unstated location.
5 — EU execution and log storage as standard and an EU contracting entity, but parts of the chain — AI steps, support access, telemetry — are non-EU without an explained safeguard.
8 — EU execution on named infrastructure, EU contracting entity, subprocessor list published with locations including AI providers, a DPA covering execution payloads, and a self-hosted option that sends no workflow data to the vendor.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, AI steps runnable on European or self-hosted models, certification published, and a self-hosted edition that works without any call home.
The Process Owner
Pipefy Inc. is a US company, the captured pages leave execution location and every subprocessor unnamed, and the privacy policy confirms third-party analytics such as Google Analytics. The controller-and-processor declaration, the data-subject request channel and the zero-data-retention statement for AI are welcome touches, but I found no public information on EU execution or a published subprocessor list with locations. 1 3
The Integration Engineer
The vendor is a US company and its privacy policy is anchored in Brazilian law — access logs are kept six months under the Brazilian Civil Rights Framework, data subject requests run through a Be Compliance form, and Google Analytics is named as a third-party analytics tool. We found no public information on where workflows and their payload copies execute or are stored, on a subprocessor list with locations, or on which model providers sit behind the AI steps; an OpenAI connector appears in the catalog with no location statement. 3 7 1
The Operations Analyst
The vendor is a US company and the captured pages leave execution location, log storage and the subcontractor list unstated — the only pointers are Google Analytics for usage analytics and OpenAI in the connector catalog, with the privacy policy framed around the Brazilian Civil Rights Framework. We found no public information on EU execution and storage as standard, an EU contracting entity, or where AI steps send their data. 1 3 7
The Head of IT
The contracting entity is Pipefy Inc. of the USA, and we found no public information on where workflows execute or where execution logs with their payloads are stored; the privacy policy instead anchors retention to the Brazilian Civil Rights Framework for the Internet, names Google Analytics as a third-party analytics tool, and routes data-subject requests through a Be Compliance platform. We found no public information on a subprocessor list, and AI steps can call an OpenAI connector whose processing location is not described. 3 7
The Data Protection Officer
The contracting vendor is a US company, and I found no public information on where workflows execute or where the execution logs with their payload copies are stored; the privacy policy is framed around Brazilian retention law. Google Analytics and a rights-request channel through the Be Compliance platform are named, but there is no published subprocessor list with locations, and the OpenAI connector appears in the catalog with no public statement of where the model provider behind the AI steps processes data, though a zero-data-retention commitment for AI is stated. 1 3 7
The Skeptic
Pipefy Inc. is a US company and the captured pages state no execution or log-storage location; Google Analytics appears in the privacy policy as a third-party analytics tool, and we found no public information on a subprocessor list with locations. The policy does promise zero data retention for AI training, but we found no public information on which model providers sit behind the built-in AI agents or where those endpoints are. 1 3 7
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the monthly cost of their own processes from public pages alone: what the billing unit is (task, operation, execution, run, user or flow) and what counts as one, the allowance per tier, overage prices, and the cost of premium connectors, self-hosting, environments and AI steps.
0 — No public prices at all; every tier is a sales conversation.
3 — A starting price exists, but the billing unit is undefined or what counts as one task or execution is unstated — the invoice is unknowable.
5 — Tier prices public with the billing unit defined and the monthly allowance given, but at least one commonly needed piece (overage, premium connectors, extra environments, self-hosted licence, AI steps) is unpriced.
8 — Every tier priced publicly with its unit, allowance and limits, overage priced per unit, premium connector and add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: the monthly cost derivable for a given number of workflows, runs and steps per run, with a published calculator or worked examples, every add-on and overage on a public page, and the effect of loops and retries on the count explained.
The Process Owner
The captured pricing page publishes no price figures at all: consumption is credit-based with real-time monitoring, custom integrations go through a quote request, and support plans are something to explore. As the person who releases invoices, I cannot begin to compute a monthly cost for our purchase approvals from these pages, and the billing unit behind the credits is left unexplained. 1 2
The Integration Engineer
The captured pricing page names dedicated support plans with an SLA and recommends partner consultants for complex operations, and custom integrations route through "Request a quote here". We found no public prices at all — no tier prices, no defined billing unit or allowance, no overage or add-on pricing — so a buyer cannot compute a monthly cost from these pages. 2
The Operations Analyst
The captured pricing page shows no tier prices, no billing unit and no allowance — only support plans with an SLA and a quote request for custom integrations. A credit system with real-time consumption monitoring is advertised, but we found no public information on what consumes a credit, its price, or overage terms, so a buyer cannot compute a month-end invoice from public pages. 1 2
The Head of IT
The captured pricing page shows no tier prices at all — custom integrations are "Request a quote here" and support plans are mentioned without figures — while the homepage speaks of managing "credits" without any price per credit, monthly allowance, or definition of what counts as one. A buyer cannot begin to compute their monthly cost from public pages. 1 2
The Data Protection Officer
The captured pricing page carries no figures: support plans with SLA are offered without numbers and custom integrations route to a quote. Consumption is measured in credits with real-time monitoring claimed, but we found no public price per credit, no allowances and no overage rates, so a buyer cannot compute the monthly cost of their own processes from public pages. 1 2
The Skeptic
The captured pricing page shows no tier prices at all — support plans are a link to explore, custom integrations a quote request — while the homepage talks of monitoring "credits" in real time, implying a credit billing unit that is never priced or sized. A buyer cannot derive a monthly cost for their own processes from these pages. 1 2
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Pipefy
Is Pipefy European?
No. whats-best.ai classifies Pipefy as Rest of world.
Where does Pipefy store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Pipefy have a free plan?
Yes. Pipefy has a free plan, per the vendor’s page captured 13 Oct 2026.
What are the best alternatives to Pipefy?
As of 15 Oct 2026, the panel rates Tray.ai (3/5), n8n (3/5) and Camunda (2.5/5) highest among the other 16 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is n8n (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Pipefy alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (12)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.pipefy.com Checked 13 Oct 2026 Details →
- 2 Pricing page www.pipefy.com Checked 13 Oct 2026 Details →
- 3 Privacy policy www.pipefy.com Checked 13 Oct 2026 Details →
- 4 Terms of service www.pipefy.com Checked 13 Oct 2026 Details →
- 5 Process design, forms & approvals — found from sitemap www.pipefy.com Checked 13 Oct 2026 Details →
- 6 Process design, forms & approvals — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 7 Connectors, API & on-premise reach — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 8 Connectors, API & on-premise reach — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 9 Execution, error handling & monitoring — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 10 Execution, error handling & monitoring — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 11 Governance, credentials & audit trail — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →
- 12 Governance, credentials & audit trail — found from sitemap help.pipefy.com Checked 13 Oct 2026 Details →