# Pipefy — Workflow Management

Pipefy by Pipefy Inc. holds a panel rating of 1.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Pipefy Inc. (https://www.pipefy.com)
- Category: [Workflow Management](https://whats-best.ai/software/workflow-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/workflow-management/pipefy
- Alternatives: https://whats-best.ai/software/workflow-management/pipefy/alternatives ([markdown](https://whats-best.ai/software/workflow-management/pipefy/alternatives.md))
- Data as of: 2026-10-20 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Pipefy Inc.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Yes, per the vendor’s own page [S2]

## The panel's verdict

Pipefy is a no-code workflow and request-management platform from Pipefy Inc., a US company. The strongest row is integrations and connectors at 4-5, the only criterion reaching 5, resting on a catalog of 170+ connectors (Salesforce, HubSpot, SAP Ariba, Workday, OpenAI) and HTTP and HTTP (OAuth2) steps documented to authentication methods. Process design, run reliability and governance and audit cluster at 4: drag-and-drop start forms, SLA alerts in minutes, hours or days with weekday-only counting, a 50-concurrent-slot queue with unique run IDs, and granular roles with SAML and Azure Native single sign-on. Hosting and portability sits at 0 — we found no public information on cloud regions, a self-hosted edition, or export of workflow definitions. Sovereignty and pricing transparency span 0-1: the pages state no execution or log-storage location, we found no public information on a subprocessor list with locations, and the pricing page shows no tier prices or price per credit; the only score above 0 on sovereignty credits the stated zero-data-retention commitment for AI training and the controller-and-processor declaration. The flagged splits flag none.

**Speaks for it:**
- Connector catalog names 170+ systems including Salesforce, HubSpot, SAP Ariba, Workday and OpenAI, with HTTP and HTTP (OAuth2) steps documented to authentication methods, conditional branches and a test step.
- SLA alerts run in minutes, hours or days with optional weekday-only counting and can trigger automation actions on late, expired and overdue cards.
- The run queue is documented concretely — 50 concurrent slots, strict first-come-first-served order, unique run IDs, and a stated guarantee that no data is dropped during volume spikes.
- The permission model is public — five company roles plus pipe and database roles, SAML and Azure Native single sign-on with an SSO-only mode, multi-factor authentication, and credentials encrypted in a platform secret manager.
- The privacy policy states a zero-data-retention commitment for AI training and declares controller and processor roles.

**Held against it:**
- Hosting and portability scored 0 — we found no public information on cloud regions, a self-hosted or on-premise edition, or export of workflow definitions in any format.
- The captured pricing page shows no tier prices, and the credit billing unit is never priced or sized, so no monthly cost can be derived from public pages.
- Sovereignty scored 0-1 — Pipefy Inc. is a US company, and we found no public information on execution location, log storage, or a subprocessor list with locations.
- We found no public information on automatic retries, replay from the failing step, alerting when a run fails, or a public status page; the documented alert types are card deadlines.
- We found no public information on an audit log of workflow changes, separate test and production environments with a publishing approval, or an exportable audit trail.

**Best for:**
- You need no-code request intake — drag-and-drop start forms, shareable links, deadline alerts — that a business owner can build without IT, starting from the free Procurement Approval Process Template.
- Your systems are cloud SaaS such as Salesforce, Workday or SAP Ariba, reachable through named connectors or generic HTTP with OAuth2.
- You value vendors who publish operational limits — 50 concurrent slots, strict queue order, run IDs — alongside a public role-and-permission matrix with SSO, an SSO-only mode and multi-factor authentication.

**Avoid if:**
- You must budget before committing — the pricing page shows no figures, support plans are an explore link, and custom integrations run through a quote request, so no monthly cost can be computed from public pages.
- You need an exit you can plan — the captured pages describe a cloud product only, and we found no public information on export of workflow definitions or a self-hosted edition.
- Your compliance review requires stated execution and storage locations and a subprocessor list — the pages state no execution or log-storage location, and the contracting entity is Pipefy Inc. of the USA.
- Your approval flows need substitutes, escalation chains or safe changes to a live process — we found no public information on these, and changed SLA settings apply only to new cards.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Process Owner | The Integration Engineer | The Operations Analyst | The Head of IT | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Process design, forms & approvals | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Connectors, API & on-premise reach | 2/5 | 2/5 | 2/5 | 2.5/5 | 2.5/5 | 2/5 |
| Execution, error handling & monitoring | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Governance, credentials & audit trail | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Hosting options & portability | 0/5 | 0/5 | 0/5 | 0/5 | 0/5 | 0/5 |
| European sovereignty | 0.5/5 | 0/5 | 0/5 | 0/5 | 0/5 | 0/5 |
| Pricing transparency | 0.5/5 | 0/5 | 0.5/5 | 0/5 | 0/5 | 0.5/5 |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **1.5/5** | **1/5** | **1/5** | **1/5** |

### The judges

- **The Process Owner** (v1.0): Runs purchase approvals and invoice release for a 400-person Mittelstand company. Wants approvers set by role rather than by name, a substitute when someone is on holiday, deadlines that escalate, and a process change that does not break the forty requests already in flight.
- **The Integration Engineer** (v1.0): Wires the ERP to the shop, the shop to DATEV and the CRM to everything else. Wants connectors documented by action rather than counted in logos, a generic HTTP step for the rest, an on-premise agent that reaches the SQL server without a hole in the firewall, and a failed run replayable from the step that failed.
- **The Operations Analyst** (v1.0): Is asked every Monday why invoices took eleven days. Wants a searchable execution history, cycle times per step, alerts that reach a channel rather than an unread mailbox, runtime and throughput limits published before the month-end run hits them — and to know what a loop over 5,000 rows costs in tasks.
- **The Head of IT** (v1.0): Answers for every automation a department builds without asking. Wants SSO, separate test and production, an inventory of workflows with their owners — and an exit: definitions exportable as BPMN or documented JSON, a self-hosted edition, and an engine licence that will still apply in five years.
- **The Data Protection Officer** (v1.0): Reads every workflow as a chain of transfers. Asks where the execution log keeps its copy of the payload and for how long, which subprocessors and AI model providers a step sends data to, whether payloads can be masked, and what the approval trail records about employees before the works council asks.
- **The Skeptic** (v1.0): Knows that "7,000 integrations" counts connectors nobody maintains, that "unlimited workflows" says nothing about the tasks each run consumes, and that "no-code" ends at the first API without a connector. Reads for what counts as a task, how long failed runs are kept, which model an "AI agent" step sends data to, and whether the workflows can leave the platform at all.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- CCPA no sale: no [S3]
- Dpf certified: yes · yes · yes [S3]
- Encryption: AES-256 or equivalent · TLS [S3]
- Ethics page: yes [S4]
- EU representative: European Data Protection Office (EDPO) [S3]
- International transfers: adequacy decisions (EC/UK) · Standard Contractual Clauses (SCCs) [S3]
- UK representative: EDPO UK Ltd [S3]

**Data**
- Retention labor: 20 · 5 [S3]
- Retention logs: 6 [S3]
- Retention platform: 180 [S3]
- Retention tax: 6 [S3]

**Integrations**
- Apps: ERP · HRIS · CRM [S5]
- Article updated: 2026-04-24 [S7]
- Catalog scope: A–Z connector catalog spanning CRMs (HubSpot, Salesforce), HR, e-commerce, AI, messaging, payments, storage and utilities [S7]
- Connector count: 170+ [S7]
- Http auth methods: no_auth · basic_auth · bearer_token · custom_headers [S8]
- Http connector: HTTP and HTTP (OAuth2) connectors for external REST APIs [S8]
- Http oauth2 connector: HTTP (OAuth2) connector handles Authorization URL, Token URL, Client ID, Client Secret, scopes [S8]
- Hundreds: Hundreds of integrations [S1]
- Methods: custom integrations · native (Slack, GitHub, BitBucket, Google Hangouts) · API · HTTP requests · Zapier [S2]
- Notable connectors: Salesforce · HubSpot · Slack · Microsoft Teams · OpenAI · Stripe · Jira Cloud · SAP Ariba · Workday [S7]

**Legal**
- AI annex: Pipefy AI Terms of Use · yes · 5 [S4]
- Documents downloadable: yes · yes [S4]
- DPA annex: Data Protection Annex (DPA) · yes · 1 [S4]
- Entity: Pipefy Inc. [S4]
- Entity: Pipefy Inc. · Delaware · 1209 Orange Street, Wilmington, Delaware, USA [S3]
- Entity: Pipefy Inc. [S1]
- Partnership agreement: Pipefy Partnership Program Agreement · yes [S4]
- Pipesign annex: PipeSign (digital signature) Terms of Use · yes · 6 [S4]
- Privacy policy: Privacy Policy · yes [S4]
- Single tenant annex: Single Tenant terms · yes · 4 [S4]
- SLA annex: Service Level Agreement · yes · 2 [S4]
- Support plans annex: Pipefy Support Plans · yes · 3 [S4]
- Terms and conditions: Terms and Conditions of Service · yes [S4]
- Terms of use: Pipefy Solution Terms of Use · yes [S4]

**Pricing**
- Active plan required admin dashboard: yes [S11]
- Admin roles charged: super_admin · admin · member · yes [S11]
- Business includes: Pipefy AI, unlimited processes, unlimited users (per-user billing), API access, role-based access, private processes, conditional logic, data recovery, electronic signature, standard support [S2]
- Business plan: Business · contact_sales · yes [S2]
- Enterprise includes: Multiple automations, integrations, two-factor authentication, single sign-on, custom email domain, support from Pipefy's team, higher database and storage limits, white label, electronic signature [S2]
- Enterprise plan: Enterprise · contact_sales · yes [S2]
- Feature plan availability: Business · Enterprise · Unlimited [S11]
- Free includes: Pipefy AI, up to 5 processes, up to 10 users, basic automations, plug-n-play process templates, request tracker, visual customization [S2]
- Free plan: Starter (Free) · 0 · yes [S2]
- Free trial: yes · yes [S1]
- Guests no charge: no [S11]
- Per user billing: yes [S2]
- Smb discount: yes · 90 · 500 [S2]
- Smb eligibility: 200 · 11 [S2]

**Product**
- AI no training: yes · no [S3]
- Alert types: overdue · late · expired [S9]
- Analytics tools: Google Analytics [S3]
- Approval template free: free · Procurement Approval Process Template · yes [S5]
- Async processing: yes [S10]
- Automations: email notifications · task assignment [S5]
- Branches conditionals: Conditional Branches to check status codes [S8]
- Built in AI assistants: yes [S1]
- Company permission matrix: super_admin · admin [S11]
- Company permission reports: super_admin · admin · member [S11]
- Company roles: super_admin · admin · member · company_guest · external_guest [S11]
- Controller processor roles: all other data entered, registered, stored and processed on the platform · personal data used to create platform users [S3]
- Credentials encrypted: credentials encrypted in platform secret manager [S8]
- Custom forms: custom forms for request intake [S5]
- Custom portals: yes [S1]
- Customizable permissions: admin · member · company_guest · super_admin · external_guest [S11]
- Dashboards realtime: dashboard with real-time data charts and performance tracking [S5]
- Database roles: database_admin · database_member · read_only [S11]
- Departments: Finance and Risk · Human Resources · Legal [S1]
- Enterprise messaging: WhatsApp · Teams · Slack [S1]
- Expired alert display: Expired cards show a red clock alert on card and next to phase name with expired count [S9]
- Expired alert purpose: Expired alert defines maximum time a card can stay in a pipe until moving to the final phase [S9]
- Failed run definition: Failed = runs stopped due to structural errors, data payload issues, or governance boundary breach [S10]
- Form advanced options: start_form_title · create_card_button_text · card_title [S6]
- Form field operations: Add, drag-and-drop, name, rearrange, edit and delete form fields [S6]
- Form sharing link: forms shareable via unique link on any channel [S5]
- Guest scope: no · yes [S11]
- Guest user notifications: automatic emails to team or guest users on approval decisions [S5]
- Industries: Financial Services · Insurance Operations · Consumer Goods [S1]
- Ipaas automation: yes [S1]
- Kanban board customizable: customizable Kanban board fields, formats and visual components [S5]
- Kyc automation: credit analysis · identity checks · regulatory monitoring · KYC/KYB [S1]
- Late alert display: Late cards show a yellow clock icon at the top; phase name shows count of late cards [S9]
- Late alert purpose: Late alert sets a maximum time (SLA) for a card to stay in a phase [S9]
- Late alert SLA units: minutes · hours · days [S9]
- MFA section: Page contains a Multi-factor authentication section [S12]
- Mobile guest requests: yes [S11]
- No data loss in queue: Queue ensures no data is dropped during volume spikes [S10]
- No low code: no/low-code customization without IT department [S5]
- Nocode workflow builder: No-code workflow and AI Agent builder using natural language prompts [S1]
- Overdue alert colors: due date exceeded · time remaining · due date approaching [S9]
- Overdue alert purpose: Overdue alert notifies assignees when a card exceeds its due date [S9]
- Overdue alert setup: due date can be set via start form field or calendar icon on the card, autosaved, or left blank [S9]
- Pagination recommendation: use pagination and small delays to stay under 50 simultaneous slots [S10]
- Permission AI agents: super_admin · admin · member [S11]
- Permission automations: super_admin · admin · member [S11]
- Permission create databases: super_admin · admin · member [S11]
- Permission create pipes: super_admin · admin · member [S11]
- Pipe roles: pipe_admin · pipe_member · read_only · restricted_view [S11]
- Portals: forms and portals for gathering internal and external requests [S5]
- Process orchestration: yes [S1]
- Products list: P2P AI Studio · CRM AI Studio · Platform · Business Orchestration & Automation Technology · Enterprise · Pipefy AI [S1]
- Queue ordering: Queued runs execute first-come, first-served when concurrent slots drop below 50 [S10]
- Queue status widget: yes · top right corner of Runs dashboard [S10]
- Queue widget metrics: Total Runs · Succeeded (Green bar) · Failed (Red bar) [S10]
- Ready to use AI agents: yes [S1]
- Request channel: Data Subject Request Form via Be Compliance platform [S3]
- Run id creation: Each triggered integration flow gets a unique Run ID [S10]
- SLA automation: Alerts can control SLAs and trigger automation actions [S9]
- SLA change behavior: Changing SLA settings does not remove existing late/expired alerts; new settings apply only to new cards or phases entered with SLA for the first time [S9]
- SSO activation review time: 15 [S12]
- SSO azure native provisioning: yes · yes · yes [S12]
- SSO only mode: yes [S12]
- SSO types: Azure Native (non-SAML) and SAML [S12]
- Start form editing: Users can edit a pipe's Start Form and its fields [S6]
- Test step feature: Test Step feature to send sample payload [S8]
- Timers: card created · time in phase · last updated · company settings [S9]
- Usage monitoring: yes [S1]
- Weekday only scope: due · overdue · expired [S9]
- Weekday only SLA: Alerts can count only weekdays, excluding weekends [S9]

**Support**
- Academy: Free courses at Pipefy Academy [S6]
- Community: Pipefy Community forum available [S6]
- Developer hub: yes [S1]
- Help center: Help Center · Pipefy Academy · Pipefy Community [S1]
- Plans: Dedicated support plans with SLA offered [S2]
- Response times: simplified answers on existence of processing or access · 15 [S3]
- Technical skills: No advanced technical skills needed; consultant partners recommended for complex operations [S2]

## Questions

### Is Pipefy European?

No. whats-best.ai classifies Pipefy as Rest of world.

### Where does Pipefy store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Pipefy have a free plan?

Yes. Pipefy has a free plan, per [the vendor’s page captured 13 Oct 2026](https://whats-best.ai/evidence/5787).

### What are the best alternatives to Pipefy?

As of 15 Oct 2026, the panel rates [Tray.ai (3/5)](https://whats-best.ai/software/workflow-management/tray-ai), [n8n (3/5)](https://whats-best.ai/software/workflow-management/n8n) and [Camunda (2.5/5)](https://whats-best.ai/software/workflow-management/camunda) highest among the other 16 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [n8n](https://whats-best.ai/software/workflow-management/n8n) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Pipefy alternatives](https://whats-best.ai/software/workflow-management/pipefy/alternatives).

## What this page leaves out

- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.pipefy.com/ (checked 2026-10-13)
- [S2] Pricing page: https://www.pipefy.com/pricing/ (checked 2026-10-13)
- [S3] Privacy policy: https://www.pipefy.com/privacy-policy/ (checked 2026-10-13)
- [S4] Terms of service: https://www.pipefy.com/legal-portal/category/legal/ (checked 2026-10-13)
- [S5] Process design, forms & approvals — found from sitemap: https://www.pipefy.com/templates/approval-process/ (checked 2026-10-13)
- [S6] Process design, forms & approvals — found from sitemap: http://help.pipefy.com/en/articles/614623-edit-the-start-form (checked 2026-10-13)
- [S7] Connectors, API & on-premise reach — found from sitemap: http://help.pipefy.com/en/articles/12685184-integrations-connectors-catalog-a-z (checked 2026-10-13)
- [S8] Connectors, API & on-premise reach — found from sitemap: http://help.pipefy.com/en/articles/14693081-using-the-http-connector-in-pipefy-integrations (checked 2026-10-13)
- [S9] Execution, error handling & monitoring — found from sitemap: http://help.pipefy.com/en/articles/625596-set-up-alerts-in-the-pipe (checked 2026-10-13)
- [S10] Execution, error handling & monitoring — found from sitemap: http://help.pipefy.com/en/articles/15275092-understanding-the-integration-queue-status-and-flow-runs (checked 2026-10-13)
- [S11] Governance, credentials & audit trail — found from sitemap: http://help.pipefy.com/en/articles/6027079-company-roles-and-permissions (checked 2026-10-13)
- [S12] Governance, credentials & audit trail — found from sitemap: http://help.pipefy.com/en/articles/2527875-how-to-enable-and-use-enterprise-single-sign-on-sso (checked 2026-10-13)

---

Cite as: whats-best.ai, "Pipefy — Workflow Management", AI panel analysis, as of 2026-10-20. https://whats-best.ai/software/workflow-management/pipefy

Corrections: https://whats-best.ai/correct/561?target=page