# ProcessMaker — Workflow Management

ProcessMaker by ProcessMaker Inc. holds a panel rating of 3/5 from 6 AI judges (category median 2/5), as of 2026-11-04. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: ProcessMaker Inc. (https://www.processmaker.com)
- Category: [Workflow Management](https://whats-best.ai/software/workflow-management.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/workflow-management/processmaker
- Alternatives: https://whats-best.ai/software/workflow-management/processmaker/alternatives ([markdown](https://whats-best.ai/software/workflow-management/processmaker/alternatives.md))
- Data as of: 2026-11-04 · evaluated 2026-11-04 · oldest source captured 2026-11-03

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: ProcessMaker Inc.
- Headquarters: Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 3 Nov 2026

## The panel's verdict

ProcessMaker — a workflow management platform whose captured pages state it is now part of Decisions — is strongest where its documentation is deepest: process design, clustering at 6-7, and hosting and portability, also 6-7, built on a BPMN 2.0 modeler with automatic validation during design and an open-source edition that installs on-premises against published requirements. It is weakest on run reliability, flat at 4 — exception handling lives in the model as boundary events, but we found no public information on automatic retries, replay of failed runs, failure alerting or a status page — and on sovereignty, the widest split at 0 to 3: four of six judges declined to score it, finding no public information on jurisdiction, data residency or subprocessors, while two credited the on-premises edition as keeping execution on the customer's own servers. Governance and audit spreads 4 to 6: granular permissions and masked secrets earn the higher scores, and the judges who stopped lower cite no public information on single sign-on or separate environments. We found no public information on prices, the billing unit or allowances.

**Speaks for it:**
- Process design scores cluster at 6-7 on a BPMN 2.0 modeler with automatic validation during design, boundary timer, error, signal, conditional and message events, and multi-instance loops with FEEL exit conditions.
- Hosting and portability scores cluster at 6-7 on a documented open-source on-premises edition with published requirements — Ubuntu 20.04 or later recommended, MySQL 8.0, Redis 5.0.3, Docker 20 or later, PHP 8.2 or later.
- Each published process exports as one password-protectable, BPMN 2.0-compliant JSON file carrying the model, scripts, screens and environment variables, importable into the same or later platform version.
- Permissions are granular and cumulative across process and platform functions, environment-variable values stay hidden from the designers who use them, and client secrets are masked in the interface.
- The generic data connector handles REST with GET, POST, PUT, PATCH and DELETE plus SOAP via WSDL, connectors can be auto-generated by importing API documentation, and a RESTful API with OAuth2 exposes processes, requests, tasks and scripts.

**Held against it:**
- Run reliability scores sit at 4, and we found no public information on automatic retries, replay of a failed run from the failing step, failure alerting or a status page.
- We found no public information on single sign-on via SAML or OIDC, or on separate development, test and production environments with a publishing approval.
- We found no public information on the contracting entity's jurisdiction, data residency, subprocessors or a data processing agreement — sovereignty scores range from 0 to 3.
- We found no public information on connectors to SAP, DATEV or other DACH ERP and accounting systems, on inbound webhooks or on database steps.
- We found no public information on holiday substitutes, four-eyes approvals, or whether running cases stay on their original process version when a new version is published.

**Best for:**
- You need a genuine BPMN 2.0 modeler for approval workflows, with due times, manager escalation, reassignment and self-service queues.
- You want to run the workflow engine on your own servers — an open-source edition installs on-premises against published system requirements.
- You integrate mainly over REST and SOAP and value connectors auto-generated from imported API documentation.
- You need process definitions to move between instances — export produces a BPMN 2.0-compliant JSON file importable into the same or later platform version.

**Avoid if:**
- You need documented automatic retries, replay of failed runs and failure alerting in production — run reliability scores sit at 4 and we found no public information on these.
- Your governance requires single sign-on via SAML or OIDC and separate development, test and production environments before departments build — governance and audit scores spread 4 to 6.
- You must document jurisdiction, data residency or subprocessors for procurement — sovereignty scores range from 0 to 3 and we found no public information on these.
- You rely on task actions by email — a forwarded notification completes the action and is recorded as the original assignee unless the Require Login setting is enabled.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v2). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Process Owner | The Integration Engineer | The Operations Analyst | The Head of IT | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Process design, forms & approvals | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Connectors, API & on-premise reach | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Execution, error handling & monitoring | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 |
| Governance, credentials & audit trail | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 3/5 | 2/5 |
| Hosting options & portability | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 1/5 | 1.5/5 | n/r | n/r | n/r | n/r |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **3/5** | **3/5** | **3/5** | **3/5** |

### The judges

- **The Process Owner** (v1.0): Runs purchase approvals and invoice release for a 400-person Mittelstand company. Wants approvers set by role rather than by name, a substitute when someone is on holiday, deadlines that escalate, and a process change that does not break the forty requests already in flight.
- **The Integration Engineer** (v1.0): Wires the ERP to the shop, the shop to DATEV and the CRM to everything else. Wants connectors documented by action rather than counted in logos, a generic HTTP step for the rest, an on-premise agent that reaches the SQL server without a hole in the firewall, and a failed run replayable from the step that failed.
- **The Operations Analyst** (v1.0): Is asked every Monday why invoices took eleven days. Wants a searchable execution history, cycle times per step, alerts that reach a channel rather than an unread mailbox, runtime and throughput limits published before the month-end run hits them — and to know what a loop over 5,000 rows costs in tasks.
- **The Head of IT** (v1.0): Answers for every automation a department builds without asking. Wants SSO, separate test and production, an inventory of workflows with their owners — and an exit: definitions exportable as BPMN or documented JSON, a self-hosted edition, and an engine licence that will still apply in five years.
- **The Data Protection Officer** (v1.0): Reads every workflow as a chain of transfers. Asks where the execution log keeps its copy of the payload and for how long, which subprocessors and AI model providers a step sends data to, whether payloads can be masked, and what the approval trail records about employees before the works council asks.
- **The Skeptic** (v1.0): Knows that "7,000 integrations" counts connectors nobody maintains, that "unlimited workflows" says nothing about the tasks each run consumes, and that "no-code" ends at the first API without a connector. Reads for what counts as a task, how long failed runs are kept, which model an "AI agent" step sends data to, and whether the workflows can leave the platform at all.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Hosting**
- Database requirement: MySQL 8.0 [S10]
- Docker requirement: 20 or later [S10]
- Node requirement: 16.15.0 [S10]
- Os requirement: Ubuntu 20.04 or later recommended [S10]
- Php requirement: 8.2 or later [S10]
- Redis requirement: Single-node Redis 5.0.3 [S10]
- Web server requirement: NGINX 1.x or later with PHP-FPM [S10]

**Integrations**
- API modules: AnalyticsReporting, Cases, Collections, Comments, CssSettings, DataSources, DataSourcesCategories, DecisionTables, DecisionTableCategories, Environment Variables, Files, Group Members, Groups, Notifications, Permissions, Personal Tokens, P… [S10]
- Export components: process model elements · scripts with configurations and Script Executors · screens in original and translated languages · environment variables · assignment rules · process permissions · process launchpad configuration [S9]
- Export cross instance sharing: Complete business solutions can be shared with other ProcessMaker Platform instances via export/import [S9]
- Export file format: json [S9]
- Export password encryption: password-protected when export contains environmental variables or data connectors · yes [S9]
- Export password minimum length: 8 [S9]
- Export permission: Processes: Export Processes · Processes: View Processes [S9]
- Export recent published version only: Only the most recent published version is exported; draft-only changes are not included [S9]
- Export requires published version: yes [S9]
- Export type options: basic (all associated assets) · custom (select assets) [S9]
- Import users not included: no [S9]
- Net development: Platform is approachable for .NET developers adding workflow to existing .NET applications (per customer testimonial) [S1]
- Non compliant processes exportable: Non-BPMN-2.0-compliant processes export but will not import successfully [S9]
- Process export bpmn json: Processes export in a BPMN 2.0-compliant format as JSON files [S9]
- Process import same or later version: same or later platform versions [S9]

**Legal**
- Copyright: 2024 · ProcessMaker, Inc. [S5]
- Processmaker rebrand: ProcessMaker is now Decisions; the ProcessMaker site redirects to the Decisions platform [S1]

**Product**
- Actions by email: yes [S2]
- Actions by email connector: Execute specific tasks in response to received emails (email-based triggers) [S4]
- Actions by email forwarding risk: forwarded emails complete actions attributed to original assignee [S2]
- Actions by email require login: yes [S2]
- AI agent orchestration: Supports building and managing first- and third-party AI agents with visual design tools, rules engine, and agent workflow visibility [S1]
- AI data connectors: yes · import API documentation from a file or URL [S5]
- Analytics reporting permission: Analytics Reporting category includes View Analytics permission [S7]
- API documentation link: yes [S5]
- API file permissions: Files (API) permissions control create/delete/edit/view of files via RESTful API [S7]
- API token lifetime: script execution only [S8]
- Assign all permissions option: Assign all permissions option keeps permission checks, unlike Super Admin [S7]
- Auth clients permissions: Auth Clients category supports create/delete/edit/view client authentication keys [S7]
- Authentication required: yes [S5]
- Boundary events supported: Boundary Timer · Boundary Error · Boundary Signal · Boundary Conditional · Boundary Message [S2]
- Bpmn export import compliance: BPMN 2.0 compliance required for successful export/import of processes [S3]
- Bpmn validation auto validate: Auto validate toggle validates process model automatically during design [S3]
- Bpmn validation indicators: BPMN VALID indicator with green check mark when no errors; BPMN ISSUES drop-down with error count when errors found [S3]
- Bpmn validation permissions: Processes: Edit Processes · Processes: View Processes · yes [S3]
- Client secret masked: yes [S8]
- Collection auto data connector: yes · yes [S5]
- Collection resources: ListAll · GET · GetRecord · GET · CreateRecord · POST · DeleteRecord · DELETE · UpdateRecord · PUT · TruncateCollection · DELETE [S5]
- Connectors definition: Connectors are third-party service integrations configurable by Process Designers, extending ProcessMaker Platform functionality outside the BPMN 2.0 specification [S4]
- Connectors usage model: Connectors are used via drag-and-drop in Process Modeler, then configured [S4]
- Data connector: Integrates data from external sources into cases with dynamic data access and updates [S4]
- Data connector source types: REST API · SOAP service via XML WSDL · Collections [S5]
- Data connector usage: Screens · Processes · Watchers [S5]
- Decision task connector: Applies decision-making logic so workflows can branch based on set criteria [S4]
- Default credentials: admin · admin [S10]
- Default due time: 72 [S2]
- Default email notification: Task Start · yes · Assigned User [S2]
- Default environment variables: HOST_URL · API_HOST · API_TOKEN · GOOGLE_API_TOKEN · SMART_EXTRACT_DASHBOARD_URL · SMART_EXTRACT_API_HOST · SMART_EXTRACT_CLIENT_ID · SMART_EXTRACT_CLIENT_SECRET · SMART_EXTRACT_HITL_ENABLED [S8]
- Deployment scope: Enterprise · yes [S10]
- Display next assigned task: yes [S2]
- Documentation AI permission: Documentation permissions include AI-based documentation editing via Process Launchpad [S7]
- Documentation panel: WYSIWYG rich text [S2]
- Docusign connector: Secure electronic signing within cases (approvals, formal document handling) [S4]
- Due dynamic variables: yes [S2]
- Environment variables definition: yes · secure abstract proxy for sensitive information reusable across Processes [S8]
- Environment variables designer no value access: no [S8]
- Environment variables management: search · create · edit · delete · use in scripts [S8]
- Environment variables org wide: organization-wide reuse [S8]
- Environment variables permissions: yes · Environment Variables: View Environment Variables [S8]
- Environment variables script usage: yes [S8]
- Flowgenies permissions: FlowGenies category supports CRUD plus import/export and categories [S7]
- Form task assignment targets: specific user, group member, previous task assignee, or case starter [S2]
- Form task definition: Form Task is an interactive step where users provide input or make decisions using screens built in the Screens Builder [S2]
- Idp connector: Automates document processing: data extraction and classification within workflows [S4]
- Industries: Insurance · Financial Services · Higher Education · Healthcare · Manufacturing · Public Sector [S1]
- Laravel version: Laravel 10 [S10]
- Legacy system support: yes [S1]
- Loop exit condition feel: FEEL [S2]
- Loop modes: No Loop Mode · Loop · Multi-instance (Parallel) · Multi-instance (Sequential) [S2]
- Multi instance email behavior: multi-instance assignment works for users without email addresses; email notifications skipped for them [S2]
- Open source edition: Open-Source · Spring 2024 · yes [S10]
- Pdf generator connector: Generates PDF documents from case data [S4]
- Permission categories: Process Permissions · Platform Permissions [S7]
- Permission change requires relogin: Permission changes require users to log out and log back in to take effect [S7]
- Permissions cumulative: User and group platform permissions are cumulative [S7]
- Platform description: Business process automation and orchestration platform coordinating workflows, systems, business rules, people, and AI [S1]
- Process automation: Process automation with workflow orchestration and enterprise integrations [S1]
- Process catalog default permission: View Process Catalog permission is assigned to all users by default [S7]
- Process intelligence: Process intelligence module providing operational visibility and accountability for AI-driven outcomes [S1]
- Process permissions key: Start a Case · Cancel a Case · View and Complete Tasks · Reassign Tasks · Edit Data [S7]
- Projects no permissions: No Project-level permissions; project members get unrestricted design access within that project only [S7]
- Reassignment options: yes [S2]
- Recognition everest: Major Contender in Everest Group Process Orchestration Products PEAK Matrix [S1]
- Recognition gartner: Gartner Critical Capabilities for Decision Intelligence Platforms report 2026 · 1 · yes [S1]
- Required permissions: Processes: Edit Processes · Processes: View Processes [S2]
- Rest methods: GET · POST · PUT · PATCH · DELETE [S5]
- Restful API task assignments: Task Assignments (API) permissions control assignments via RESTful API [S7]
- Rules engine: Enterprise rules engine for designing, testing, and automating business rules and intelligent decisioning [S1]
- Screen preview: yes [S2]
- Screen required: yes [S2]
- Script API key path parameter: key · string · yes [S6]
- Script API oauth security: OAuth2 via Laravel Passport [S6]
- Script API oauth urls: Authorization Code · /oauth/token · /token/refresh · /oauth/authorize [S6]
- Script execution response endpoint: GET · Get the response of a script execution by execution key · /scripts/execution/{key} [S6]
- Script executor docker: Docker container [S8]
- Scripts API operations: Scripts · list scripts · create script · test script code without saving · execute script · get execution response by key · get script by ID · update script · delete script · update draft script · duplicate script [S6]
- Segments midmarket enterprise: Mid-Market · Enterprise [S1]
- Self service assignment: yes [S2]
- Send email connector: Automated email dispatching from cases [S4]
- Slack notification connector: Sends notifications to Slack channels about case progress [S4]
- Slideshow placeholder: PNG · JPG · JPEG · GIF · 2 [S2]
- Soap wsdl operations: XML WSDL file [S5]
- Super admin assignment restricted to admin: Only users with the Admin role can assign or modify Super Admin access [S7]
- Super admin unrestricted: Super Admin grants unrestricted access to all Platform features [S7]
- Support: Open-Source · no [S10]
- Task notification events: Assigned · Completed · Due [S2]
- Translations UI permissions: Translations permissions include editing and resetting UI text labels [S7]
- Use cases: Use cases include approvals, case management, lending, insurance, transfer credit evaluation, healthcare operations, manufacturing workflows [S1]
- Username password permission: Users category includes Edit User And Password permission [S7]
- Version history scope: Version History permissions apply to Processes, Scripts and Screens [S7]
- View other users profiles: View Other Users Profiles permission required to view another user's profile, else Error 404 [S7]
- Watcher usage: Screen control value change [S5]
- Web entry modes: Disabled · Anonymous · Authenticated · Disabled [S2]
- Web entry password protect: yes [S2]

## Questions

### Is ProcessMaker European?

Not determined: the vendor’s pages as captured do not say where ProcessMaker is based.

### Where does ProcessMaker store data?

Not stated on the vendor’s pages as of 3 Nov 2026.

### Does ProcessMaker have a free plan?

Not stated on the vendor’s pages as of 3 Nov 2026.

### What are the best alternatives to ProcessMaker?

As of 4 Nov 2026, the panel rates [n8n (3.5/5)](https://whats-best.ai/software/workflow-management/n8n), [Frends (3/5)](https://whats-best.ai/software/workflow-management/frends) and [Appian (3/5)](https://whats-best.ai/software/workflow-management/appian) highest among the other 22 Workflow Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [n8n](https://whats-best.ai/software/workflow-management/n8n) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [ProcessMaker alternatives](https://whats-best.ai/software/workflow-management/processmaker/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (processmaker.com, docs.processmaker.com/docs/form-task, docs.processmaker.com/docs/validate-your-process-is-bpmn-20-compliant, docs.processmaker.com/docs/connectors, docs.processmaker.com/docs/data-connectors, docs.processmaker.com/apidocs/get-the-response-of-a-script-execution-by-execution-key and 4 more). If the vendor publishes it somewhere else, send us the page.
- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind.
- 9 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown.

## Sources

- [S1] Vendor page: https://www.processmaker.com (checked 2026-11-03)
- [S2] Process design, forms & approvals — found from sitemap: https://docs.processmaker.com/docs/form-task (checked 2026-11-03)
- [S3] Process design, forms & approvals — found from sitemap: https://docs.processmaker.com/docs/validate-your-process-is-bpmn-20-compliant (checked 2026-11-03)
- [S4] Connectors, API & on-premise reach — found from sitemap: https://docs.processmaker.com/docs/connectors (checked 2026-11-03)
- [S5] Connectors, API & on-premise reach — found from sitemap: https://docs.processmaker.com/docs/data-connectors (checked 2026-11-03)
- [S6] Execution, error handling & monitoring — found from sitemap: https://docs.processmaker.com/apidocs/get-the-response-of-a-script-execution-by-execution-key (checked 2026-11-03)
- [S7] Governance, credentials & audit trail — found from sitemap: https://docs.processmaker.com/docs/permission-descriptions-for-users-and-groups (checked 2026-11-03)
- [S8] Governance, credentials & audit trail — found from sitemap: https://docs.processmaker.com/docs/environment-variables (checked 2026-11-03)
- [S9] Hosting options & portability — found from sitemap: https://docs.processmaker.com/docs/export-a-bpmn-compliant-processmaker-platform-process (checked 2026-11-03)
- [S10] Hosting options & portability — found from sitemap: https://docs.processmaker.com/apidocs/open-source-edition-for-on-premises-installation (checked 2026-11-03)

---

Cite as: whats-best.ai, "ProcessMaker — Workflow Management", AI panel analysis, as of 2026-11-04. https://whats-best.ai/software/workflow-management/processmaker

Corrections: https://whats-best.ai/correct/1530?target=page