Workflow Management
ProcessMaker
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by ProcessMaker Inc. · www.processmaker.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
ProcessMaker at a glance
- Vendor
- ProcessMaker Inc.
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates ProcessMaker 3/5, the mean of 6 judges. ProcessMaker — a workflow management platform whose captured pages state it is now part of Decisions — is strongest where its documentation is deepest: process design, clustering at 6-7, and hosting and portability, also 6-7, built on a BPMN 2.0 modeler with automatic validation during design and an open-source edition that installs on-premises against published requirements. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 4 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
ProcessMaker — a workflow management platform whose captured pages state it is now part of Decisions — is strongest where its documentation is deepest: process design, clustering at 6-7, and hosting and portability, also 6-7, built on a BPMN 2.0 modeler with automatic validation during design and an open-source edition that installs on-premises against published requirements. It is weakest on run reliability, flat at 4 — exception handling lives in the model as boundary events, but we found no public information on automatic retries, replay of failed runs, failure alerting or a status page — and on sovereignty, the widest split at 0 to 3: four of six judges declined to score it, finding no public information on jurisdiction, data residency or subprocessors, while two credited the on-premises edition as keeping execution on the customer's own servers. Governance and audit spreads 4 to 6: granular permissions and masked secrets earn the higher scores, and the judges who stopped lower cite no public information on single sign-on or separate environments. We found no public information on prices, the billing unit or allowances.
Speaks for it
- Process design scores cluster at 6-7 on a BPMN 2.0 modeler with automatic validation during design, boundary timer, error, signal, conditional and message events, and multi-instance loops with FEEL exit conditions.
- Hosting and portability scores cluster at 6-7 on a documented open-source on-premises edition with published requirements — Ubuntu 20.04 or later recommended, MySQL 8.0, Redis 5.0.3, Docker 20 or later, PHP 8.2 or later.
- Each published process exports as one password-protectable, BPMN 2.0-compliant JSON file carrying the model, scripts, screens and environment variables, importable into the same or later platform version.
- Permissions are granular and cumulative across process and platform functions, environment-variable values stay hidden from the designers who use them, and client secrets are masked in the interface.
- The generic data connector handles REST with GET, POST, PUT, PATCH and DELETE plus SOAP via WSDL, connectors can be auto-generated by importing API documentation, and a RESTful API with OAuth2 exposes processes, requests, tasks and scripts.
Held against it
- Run reliability scores sit at 4, and we found no public information on automatic retries, replay of a failed run from the failing step, failure alerting or a status page.
- We found no public information on single sign-on via SAML or OIDC, or on separate development, test and production environments with a publishing approval.
- We found no public information on the contracting entity's jurisdiction, data residency, subprocessors or a data processing agreement — sovereignty scores range from 0 to 3.
- We found no public information on connectors to SAP, DATEV or other DACH ERP and accounting systems, on inbound webhooks or on database steps.
- We found no public information on holiday substitutes, four-eyes approvals, or whether running cases stay on their original process version when a new version is published.
Best for
- You need a genuine BPMN 2.0 modeler for approval workflows, with due times, manager escalation, reassignment and self-service queues.
- You want to run the workflow engine on your own servers — an open-source edition installs on-premises against published system requirements.
- You integrate mainly over REST and SOAP and value connectors auto-generated from imported API documentation.
- You need process definitions to move between instances — export produces a BPMN 2.0-compliant JSON file importable into the same or later platform version.
Avoid if
- You need documented automatic retries, replay of failed runs and failure alerting in production — run reliability scores sit at 4 and we found no public information on these.
- Your governance requires single sign-on via SAML or OIDC and separate development, test and production environments before departments build — governance and audit scores spread 4 to 6.
- You must document jurisdiction, data residency or subprocessors for procurement — sovereignty scores range from 0 to 3 and we found no public information on these.
- You rely on task actions by email — a forwarded notification completes the action and is recorded as the original assignee unless the Require Login setting is enabled.
The scores
| Criterion | Panel median |
|---|---|
| Process design, forms & approvals | 3.5 of 5 |
| Connectors, API & on-premise reach | 3 of 5 |
| Execution, error handling & monitoring | 2 of 5 |
| Governance, credentials & audit trail | 2.5 of 5 |
| Hosting options & portability | 3.5 of 5 |
| European sovereignty | 1.5 of 5 |
Process design, forms & approvals
Show reasoningHide reasoning
How this is scored
Modelling the process people take part in: a visual designer or BPMN, forms, approval steps with roles and substitutes, deadlines and escalation, and versioning of a process that is already running — judged on whether a business owner can change a process without breaking the instances in flight.
0 — No human steps at all: neither forms nor approval steps, only machine-to-machine automation.
3 — A visual builder with branching and a simple approval or form step.
5 — A visual designer with conditions and parallel paths, forms and approval steps assigned to roles or groups, and deadlines or reminders for open tasks.
8 — BPMN 2.0 modelling or an equivalent documented notation, versions of a process kept with running instances on their original version, substitutes and escalation chains, multi-stage approvals with four-eyes rules, forms in German with validation and file upload, a task inbox for participants, and a test or simulation mode before publishing.
10 — The process is a governed asset: version history with diff and rollback, migration of running instances to a new version documented, process analytics on cycle time and bottlenecks per step, and the design documented well enough that a business team can maintain it without the vendor.
The Process Owner
BPMN 2.0 modelling with live validation, boundary timer and error events, group-based task assignment, due times with due-date notifications and automatic manager reassignment, plus screen preview and script testing before publishing. We found no public information on a dedicated holiday substitute, four-eyes approvals, or whether cases in flight stay on their original version after publishing a change. 2 3 7 9
The Integration Engineer
BPMN 2.0 modelling with an auto-validating Process Modeler, boundary timer, error, signal, conditional and message events, and multi-instance parallel and sequential loops with FEEL exit conditions sit alongside real human machinery: due dates with dynamic values, manager escalation, reassignment, self-service queues and a task inbox. Version history exists as a permissions category covering processes, scripts and screens. We found no public information on substitutes with four-eyes approvals, on running instances staying on their original process version after a change, or on a simulation mode before publishing. 2 3 7
The Operations Analyst
A documented BPMN 2.0 modeler with automatic validation, boundary error, timer, signal, conditional and message events, form tasks with a 72-hour default due time and dynamic due dates, notifications on assigned, completed and due, manager escalation, reassignment, self-service queues and a task inbox — deadlines and escalation work the way an approver's week actually runs. The captured pages do not show what happens to running instances when a new process version publishes, nor four-eyes approval patterns or a simulation mode before go-live. 2 3 7
The Head of IT
The BPMN 2.0 modeler is genuine and documented — auto-validation with a compliance indicator, boundary timer, error, signal, conditional and message events, loops with FEEL exit conditions, and screens with an in-modeler preview. Form tasks assign to a specific user, a group member, the previous assignee or the case starter, with a 72-hour default due time, due notifications, manager escalation, reassignment and a task inbox. We found no public information on four-eyes rules, substitute chains, or keeping running cases on their original process version, which is why I stop below the top band. 2 3 7
The Data Protection Officer
The BPMN 2.0 modeler auto-validates as you work, with boundary timer, error, signal, conditional and message events and multi-instance loops with FEEL exit conditions; tasks assign to a user, group, previous assignee or case starter, carry due times with reminders on assignment and due, manager escalation, reassignment and self-service queues, and land in a task inbox with optional email actions. We found no public information on running instances keeping their original process version, substitutes, multi-stage four-eyes approvals or a simulation mode, which keeps it below the top band. 2 3 7
The Skeptic
The Process Modeler is BPMN 2.0 with automatic validation while you design, form tasks bound to screens with preview, assignment to a user, group member, self-service queue or the case starter, a 72-hour default due time with dynamic due dates, manager escalation and reassignment, plus boundary timer, error, signal, conditional and message events and multi-instance loops, with tasks landing in a task inbox. We found no public information on four-eyes approvals, substitutes, a simulation of a whole process before publishing, or whether running cases stay on their original version when a new version is published. 2 3
Connectors, API & on-premise reach
Show reasoningHide reasoning
How this is scored
Reaching the systems a European company actually runs: maintained connectors judged by name rather than count, a generic HTTP and webhook step, custom connectors, and a way to reach systems behind the firewall without opening it.
0 — No connectors beyond email, and no API or webhook step.
3 — A catalogue of connectors to common SaaS tools, or webhooks and an HTTP step to call other systems.
5 — Named connectors with their triggers and actions documented, including Microsoft 365 or Google Workspace, a generic HTTP/REST step with inbound webhooks, and an API to start or query workflows.
8 — Connectors to an ERP or accounting system common in DACH (e.g. SAP, DATEV, Microsoft Dynamics), custom connectors buildable from an OpenAPI description or code, an on-premise agent or self-hosted runner reaching internal databases and file shares, SOAP and database steps, and connector maintenance ownership (vendor, partner or community) stated.
10 — Integration is engineered: a versioned public API with a deprecation policy, connector changelogs, rate limits per connector published, event-driven triggers rather than polling where the source allows it, and the vendor maintaining the German-market connectors (DATEV, SAP, ELO or d.velop) itself.
The Process Owner
Connectors are documented by name with their purpose (DocuSign, Slack, PDF generation, email dispatch, document processing) alongside a generic REST/SOAP data connector, connectors auto-generated from API documentation, and a RESTful API over processes, requests, tasks and users secured by OAuth2. We found no public information on Microsoft 365 or Google Workspace connectors, inbound webhooks, connectors to SAP, DATEV or Microsoft Dynamics, or an on-premise agent for a cloud install. 4 5 6 10
The Integration Engineer
Connectors are named and each described by purpose — DocuSign, IDP, PDF Generator, Slack, Send Email, Actions by Email, Decision Task — and the Data Connector is the generic step I want: any REST endpoint with GET, POST, PUT, PATCH and DELETE, SOAP via a WSDL file, auto-generatable by importing API documentation, usable from screens, processes and watchers. A documented RESTful API with OAuth2 starts and queries workflows. We found no public information on ERP or accounting connectors for the DACH market such as SAP or DATEV, on inbound webhooks, on database steps, or on connector maintenance ownership — and reaching behind the firewall is answered by self-hosting the whole platform rather than by an agent. 4 5 6 10
The Operations Analyst
Named connectors with described capabilities — DocuSign, Slack notifications, intelligent document processing, PDF generation, email-based task triggers — sit on a generic data connector layer speaking REST and SOAP that can generate connectors from imported API documentation, backed by a broad RESTful API covering processes, requests, tasks and scripts. We found no public information on connectors to ERP or accounting systems common in DACH, inbound webhooks, or who maintains each connector. 4 5 6 10
The Head of IT
Named connectors are documented with their purposes — DocuSign, intelligent document processing, PDF generation, Slack and email — and data connectors cover REST and SOAP via WSDL, with new connectors auto-generated by importing API documentation from a file or URL; a broad RESTful API exposes processes, requests and tasks. We found no public information on connectors to SAP, DATEV or other DACH ERP systems, on inbound webhooks, on database steps, or on who maintains the connectors. 4 5 10
The Data Protection Officer
Named connectors are documented by purpose — electronic signing, intelligent document processing, PDF generation, Slack and email dispatch and email-triggered actions — and the generic data connector reaches REST APIs and SOAP services via WSDL with all common methods, with connectors generatable by importing API documentation and a broad documented REST API for processes, requests, tasks and scripts. We found no public information on connectors to ERP or accounting systems common in DACH, an inbound webhook step, or who maintains each connector. 4 5 6 10
The Skeptic
DocuSign, Slack, intelligent document processing, PDF generation and email connectors are named with their purpose, a generic data connector speaks REST and SOAP and can be auto-generated by importing API documentation, and the RESTful API exposes processes, requests, tasks and screens; the whole platform can also be installed on-premise, one way to reach systems behind a firewall. We found no public information on inbound webhooks, connectors to ERP or accounting systems common in DACH, database steps, or who maintains each connector. 4 5 10
Execution, error handling & monitoring
Show reasoningHide reasoning
How this is scored
What happens when a step fails at 3 a.m.: retries, error paths, alerting, an execution history someone can search, limits on runtime and throughput, and a status page that admits incidents.
0 — Nothing runs unattended: the product executes no automated workflows whose runs could fail or be monitored.
3 — Failed runs marked with a notification, and a history of recent executions.
5 — Automatic retries or an error path, an execution log with input and output per step, failure alerts by email or chat, and runtime or rate limits documented.
8 — Configurable retries with back-off and replay of a failed run from the failing step, queueing and concurrency controls, execution history retention stated per plan, monitoring exportable to the customer's own tools, and a public status page with incident history and an uptime commitment.
10 — Operations are designed for production: an SLA with service credits, horizontal scaling or high-availability setup documented for self-hosted installs, dead-letter handling, end-to-end tracing across workflows, and post-incident reports published.
The Process Owner
Error paths exist in the modelling layer through boundary timer and error events, a script execution's response is retrievable by key, and tasks notify on assignment, completion and due date. We found no public information on automatic retries, replay of a failed run, failure alerting, execution-history retention, monitoring export or a status page. 2 6 10
The Integration Engineer
Exception handling lives in the modelling notation — boundary error, timer, signal, conditional and message events — and a script execution's response is fetchable by execution key through the API, with requests, cases and signals available as API modules over a Redis queue server. We found no public information on automatic retries with back-off, replaying a failed run from the failing step, failure alerts, execution history retention, or a public status page with incident history. 2 6 10
The Operations Analyst
Exceptions are handled at design time through boundary error, timer, signal, conditional and message events, a script's execution response is retrievable by execution key, and task notifications go by email with a Slack connector for case updates — alerts can reach a channel. The pages do not document retries, replay of a failed run from the failing step, execution history retention, or runtime and throughput limits, and no status page or uptime commitment appears in this evidence. 2 4 6 10
The Head of IT
Exception handling exists at design time — boundary error, timer, signal, conditional and message events to handle exceptions — and a script execution's response is retrievable by key through the API. We found no public information on automatic retries with back-off, failure alerting, execution log retention, runtime or rate limits, or a public status page. 2 6
The Data Protection Officer
Exception handling is designed into the model through the boundary events, a script's execution response can be retrieved by key after it runs, and the platform names a Redis-backed queue, due notifications and a Slack notification connector. We found no public information on automatic retries, replay of failed runs, per-step execution logs with their inputs and outputs, failure alerting, runtime or rate limits, or a status page. 2 6 10
The Skeptic
Exception handling lives in the process model as boundary timer, error, signal, conditional and message events, and a script execution's response can be retrieved by its key — the only execution history the pages describe, with a Slack connector available for case notifications. We found no public information on automatic retries, replay of a failed run from the failing step, alerts when a run fails, execution history retention, or a status page. 2 6
Governance, credentials & audit trail
Show reasoningHide reasoning
How this is scored
Keeping automation from becoming shadow IT: roles and permissions, SSO, where connection credentials are stored, separate environments with controlled publishing, an audit trail of changes and approvals, and what the execution log retains of the payload. An approval record is also a record of employees' behaviour (BetrVG § 87 (1) 6), so what the trail captures matters to a works council.
0 — No user management: one account per person or one shared login, with no team workspace.
3 — Admin and member roles with shared team folders or workspaces.
5 — Role-based permissions per workflow or folder, SSO via SAML or OIDC, credentials stored encrypted and usable without being revealed, and an audit log of workflow changes.
8 — Separate development, test and production environments with a publishing approval, SCIM provisioning, external secret stores supported, payload redaction or logging off per workflow, configurable execution data retention, and the audit trail exportable — with the fields it records about users described.
10 — Governance a works council and an auditor can both sign off: field-level masking of personal data in logs, delegated administration per department, a central inventory of every workflow and connection with its owner, certifications published (ISO 27001 or SOC 2), and documentation of what the platform records about individual users.
The Process Owner
Permissions are granular across processes, screens, scripts and individual API operations, assigned to users or groups and cumulative; sensitive values sit in organization-wide environment variables that designers cannot see, client secrets are masked, and security logs and version history are available as API modules. We found no public information on single sign-on via SAML or OIDC, separate environments with a publishing approval, or payload retention and redaction of the execution log. 7 8 10
The Integration Engineer
Permissions run two layers deep — process permissions like Start a Case, Cancel a Case, View and Complete Tasks, Reassign Tasks and Edit Data, plus platform permissions — and credentials are handled properly: environment variables hide values from the designers who use them, client secrets are fully masked, and a script's API token is only valid for that script's execution. Security logs and version history appear as an API module and a permissions category. We found no public information on SSO via SAML or OIDC, separate development, test and production environments with a publishing approval, SCIM provisioning, payload redaction, or configurable execution data retention. 7 8 10
The Operations Analyst
Permissions are granular and cumulative across processes, screens, scripts and API scopes, Super Admin assignment is restricted to Admin users, and environment variables keep sensitive values hidden even from the designers who use them, with client secrets masked in the interface. We found no public information on single sign-on, separate environments with publishing approval, or payload retention and redaction; an audit trail shows up only as a security-logs API module with its recorded fields not described. 7 8 10
The Head of IT
The permission model is granular — process permissions to start, cancel, view, reassign and edit data, cumulative user and group permissions, and Super Admin assignment restricted to Admins — and sensitive values are held as organization-wide environment variables that designers never see, with client secrets masked in the interface and a security logs module in the API. We found no public information on SSO via SAML or OIDC, separate test and production environments, SCIM provisioning, external secret stores, or retention and redaction of execution payloads — SSO and environments are exactly what I would require before letting departments build here. 7 8 10
The Data Protection Officer
Permissions are granular and cumulative across processes and the platform, sensitive values sit in environment variables that designers never see, client secrets are fully masked in the interface, and a security-logs API module plus version history for processes, scripts and screens gives change traceability — though the on-premises edition ships with default admin credentials an operator must change, and a forwarded email action is recorded as the original assignee unless require-login is enabled. We found no public information on single sign-on, separate environments with a publishing approval, external secret stores, payload redaction, configurable execution-data retention or what the trail records about individual users. 2 7 8 10
The Skeptic
Permissions are granular and cumulative across users and groups for a long list of process and platform functions, secrets sit in environment variables whose values designers never see, exports containing them are password-protected and encrypted, and a security logs module exists in the API. We found no public information on single sign-on, separate development, test and production environments with a publishing approval, or what the trail actually records about users and payloads — which matters if approvals become a record of employee behaviour. 7 8 9 10
Hosting options & portability
Show reasoningHide reasoning
How this is scored
Where the engine runs and whether the workflows can leave: cloud regions, self-hosted or on-premise editions, the licence of the engine, and export of workflow definitions in a format another tool or a later version can read.
0 — Workflows cannot be exported in any form and live only in the vendor's cloud.
3 — Cloud hosting with the region named, and workflows exportable as a file the same product can import.
5 — An EU cloud region available, workflow definitions exportable as documented JSON or BPMN 2.0, and an API to read definitions and execution history.
8 — A self-hosted or on-premise edition with its system requirements documented, workflow definitions versionable in Git, the engine's licence published, and a documented migration path between cloud and self-hosted in both directions.
10 — The customer owns its automation: an open-source or source-available engine, definitions in an open standard executable elsewhere, air-gapped installation supported, and a stated exit process that hands back definitions, credentials metadata and execution history in documented formats.
The Process Owner
An open-source edition installs on-premises with detailed system requirements, and processes export as a BPMN 2.0-compliant JSON file with password protection, importable into the same or later platform versions, with the API exposing processes, requests and version history. We found no public information on the engine's specific licence terms, Git-versionable definitions, or a documented migration path between cloud and self-hosted. 9 10
The Integration Engineer
An Open-Source on-premises edition is documented with real system requirements — Ubuntu 20.04 or later, MySQL 8.0, NGINX with PHP-FPM, PHP 8.2, Docker 20, Redis — built on Laravel 10, and processes export as one BPMN 2.0-compliant JSON file, encrypted and password-protected when it contains environment variables or data connectors, importable into the same or a later platform version on another instance. We found no public information on definitions versionable in Git, on a documented migration path between cloud and self-hosted in both directions, or on cloud hosting regions. 9 10
The Operations Analyst
An on-premises edition is documented down to Ubuntu, PHP, MySQL, Redis, NGINX, Node and Docker versions, and processes export as BPMN 2.0-compliant JSON including screens, scripts and environment variables, password-protected when secrets ride along, importable into the same or later platform versions. The engine's licence is not named on these pages, Git versioning of definitions and a cloud-to-self-hosted migration path are not shown, and no EU cloud region is stated. 9 10
The Head of IT
An on-premises edition exists with full system requirements published — Ubuntu, MySQL, Docker, NGINX with PHP-FPM, PHP, Redis and Node — and the vendor calls it an Open-Source edition, though the licence text itself is not quoted and that edition carries no commercial support. Processes export as one BPMN 2.0-compliant JSON file importable into the same or later platform versions, and the API exposes version history, but only the most recent published version exports and non-compliant processes will not re-import. We found no public information on versioning definitions in Git or a documented migration path between cloud and self-hosted in either direction. 9 10
The Data Protection Officer
A documented on-premises open-source edition with full system requirements — Ubuntu, Docker, MySQL, Redis, NGINX, PHP and Node — means the engine can run on the customer's own servers, and process export produces a BPMN 2.0-compliant JSON file carrying the model, scripts, screens in original and translated languages, environment variables and permissions, password-protected and encrypted when it contains sensitive assets, importable into the same or later versions, with an API to read definitions and requests. We found no public information on versioning definitions in Git, the engine's licence terms, or a documented migration path between cloud and self-hosted. 9 10
The Skeptic
An open-source edition installs on-premise against fully documented requirements (Ubuntu, Docker, MySQL, Redis, NGINX, PHP), and a published process exports as one password-protectable, BPMN 2.0-compliant JSON file carrying model, scripts, screens and environment variables, importable into another instance of the same or later platform version, with definitions and version history readable through the API. We found no public information on the engine's licence terms, Git-based versioning of definitions, a migration path between cloud and self-hosting in either direction, or an EU cloud region. 9 10
European sovereignty
panel opinion
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
Who the contracting entity is, where workflows execute and where execution logs with their payload copies are stored, and who the subprocessors are — including the AI model providers behind any AI steps. Independently sourced by the sovereignty pipeline. A self-hosted edition counts only for the data that actually stays on the customer's servers.
0 — Proven non-EU throughout: non-EU vendor and contracting entity, execution outside the EU, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, while an EU contracting entity and EU execution are not shown, or an EU region is an option under a non-EU contracting entity.
5 — EU execution and log storage stated (as standard or selectable) and an EU contracting entity or EU representative, with a data processing agreement; parts of the chain such as AI steps, support access or telemetry may run outside the EU.
8 — EU execution on named infrastructure, EU contracting entity, subprocessor list published with locations including AI providers, a DPA covering execution payloads, and a self-hosted option that sends no workflow data to the vendor.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, AI steps runnable on European or self-hosted models, certification published, and a self-hosted edition that works without any call home.
The Process Owner
The one dimension the captured pages speak to is hosting: an on-premises edition exists with documented system requirements, which would keep execution and payloads on our own servers. We found no public information on the contracting entity's jurisdiction, EU execution or log storage for the cloud service, subprocessors including any AI model providers, or a data processing agreement. 5 10
The Integration Engineer
What the captured pages prove is limited: a self-hosted on-premises edition keeps execution and data on the customer's own servers, and the copyright names ProcessMaker, Inc. without stating a jurisdiction. We found no public information on EU execution or log storage for the cloud edition, a data processing agreement, or any subprocessor list with locations, including the AI providers behind the IDP and Smart Extract features. 5 10
The Operations Analyst not rated — no public information
We found no public information on the contracting entity's jurisdiction, where workflows execute and logs are stored, subprocessors, or a data processing agreement — every sovereignty dimension is unproven in the captured pages, and the documented on-premises edition does not say whether it exchanges data with the vendor. 1 5 10
The Head of IT not rated — no public information
We found no public information on the contracting entity's jurisdiction, where cloud workflows and their logs execute, the subprocessors behind the AI features, or a data processing agreement. The captured pages name ProcessMaker, Inc. and document an on-premises edition, but we found no public information on EU execution or on whether a self-hosted install keeps workflow data off the vendor's and its AI providers' servers. 1 5 10
The Data Protection Officer not rated — no public information
We found no public information on the contracting entity's jurisdiction, where workflows execute or where execution logs with their payload copies are stored, the subprocessors or AI model providers behind the first- and third-party agents and the Smart Extract service, or a data processing agreement; the vendor page and on-premises documentation name these services without locations. The on-premises edition exists, but the captured pages do not show whether it calls home, so no sovereignty dimension is proven either way. 1 8 10
The Skeptic not rated — no public information
We found no public information on the contracting entity's jurisdiction, where workflows and their logs with payload copies are executed or stored, the subprocessor list, or which model providers sit behind the AI agent and Smart Extract steps; the captured vendor and documentation pages are silent on all of it, and the on-premise edition says nothing about calls home. 1 8 10
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the monthly cost of their own processes from public pages alone: what the billing unit is (task, operation, execution, run, user or flow) and what counts as one, the allowance per tier, overage prices, and the cost of premium connectors, self-hosting, environments and AI steps.
0 — No public prices at all; every tier is a sales conversation.
3 — A public "from" price or one tier priced, with the rest on request.
5 — Prices public for each tier with the billing period, the billing unit named and the allowance per tier given.
8 — Every tier priced publicly with its unit defined (what counts as one task or execution), allowance and limits, overage priced per unit, premium connector and add-on prices listed, self-hosted licensing stated, minimum term and VAT treatment given.
10 — Complete price computability: the monthly cost derivable for a given number of workflows, runs and steps per run, with a published calculator or worked examples, every add-on and overage on a public page, and the effect of loops and retries on the count explained.
The Process Owner not rated — no public information
We found no public information on pricing in the captured pages, which name Mid-Market and Enterprise offerings and an open-source edition without commercial support, but give no price, billing unit, allowance, term or VAT treatment for any of them. 1 10
The Integration Engineer not rated — no public information
We found no public information on pricing in the captured pages: no price for any edition or tier, no billing unit or allowance, and no licence terms for the Open-Source or self-hosted edition, so a buyer cannot compute a monthly cost from these pages alone. 1 10
The Operations Analyst not rated — no public information
We found no public prices in the captured pages — no tier price, billing unit, allowance or overage — so a buyer cannot compute the monthly cost of their own processes from this evidence; the only cost-adjacent statement is that the open-source on-premises edition has no commercial support. 1 10
The Head of IT not rated — no public information
We found no public information on prices, tiers, the billing unit, or allowances; the captured pages name Mid-Market and Enterprise segments and an Enterprise cloud edition but quote no figures, so a buyer cannot compute any monthly cost from them. 1 10
The Data Protection Officer not rated — no public information
We found no public information on prices, the billing unit, tier allowances or overages, or the cost of the on-premises edition; the captured vendor page names mid-market and enterprise offerings without any figures. 1
The Skeptic not rated — no public information
We found no public information on prices, the billing unit, allowances, overages or terms; the pages name Mid-Market and Enterprise offerings and an open-source edition without commercial support, but no figure or unit appears anywhere we read, so a buyer cannot compute anything from public pages alone. 1 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about ProcessMaker
Is ProcessMaker European?
Not determined: the vendor’s pages as captured do not say where ProcessMaker is based.
Where does ProcessMaker store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does ProcessMaker have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to ProcessMaker?
As of 4 Nov 2026, the panel rates n8n (3.5/5), Frends (3/5) and Appian (3/5) highest among the other 22 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is n8n (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: ProcessMaker alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (processmaker.com, docs.processmaker.com/docs/form-task, docs.processmaker.com/docs/validate-your-process-is-bpmn-20-compliant, docs.processmaker.com/docs/connectors, docs.processmaker.com/docs/data-connectors, docs.processmaker.com/apidocs/get-the-response-of-a-script-execution-by-execution-key and 4 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (10)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.processmaker.com Checked 3 Nov 2026 Details →
- 2 Process design, forms & approvals — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 3 Process design, forms & approvals — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 4 Connectors, API & on-premise reach — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 5 Connectors, API & on-premise reach — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 6 Execution, error handling & monitoring — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 7 Governance, credentials & audit trail — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 8 Governance, credentials & audit trail — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 9 Hosting options & portability — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →
- 10 Hosting options & portability — found from sitemap docs.processmaker.com Checked 3 Nov 2026 Details →