Compare

How Sheptra compares

A capability-by-capability comparison of Sheptra with Camunda 8, Decisions (formerly ProcessMaker), Flowable and Temporal. Each entry describes what the product offers today and links to the vendor's own documentation.

Last verified 16 September 2026. Vendor capabilities may have changed since that date.

YesAvailable and documented.
PartialAvailable, with a stated limitation.
PlannedOn the roadmap; not available today.
NoNot offered, or not in the vendor’s public documentation.

Compare against

Select up to 3 products to view alongside Sheptra.

Capability	SheptraManaged cloud, pre-launch	Camunda 8SaaS and Self-Managed	Decisions (formerly ProcessMaker)ProcessMaker Platform, as documented at docs.processmaker.com
Standards & modelling
BPMN 2.0 element coverageWhat runs, and what the engine refuses at deploy	Partial Most of the executable core: every gateway but complex, timer / message / signal / error / escalation / compensation / link / terminate events, event sub-processes, non-interrupting boundary events, call activities, multi-instance. Transactions, cancel and conditional events, complex gateways, ad-hoc sub-processes and standard loops are rejected at deploy time with the element named, never mid-instance. bpmn-support.mdEngine section and FAQ	Partial Most of the executable set, including event sub-processes, multi-instance, compensation, escalation, conditional events and ad-hoc sub-processes. Not executable: transactions and cancel events, link events, complex gateways, multiple events and the standard loop marker. BPMN coverage	Partial Timer, signal, message, conditional, error and terminate events; exclusive, inclusive, parallel and event-based gateways; form, manual and script tasks; sub-processes. Not documented: transactions, cancel and link events, complex gateways, compensation, escalation, event sub-processes, multi-instance markers. Process modeling object descriptions
DMN decision tablesHit policies, and who evaluates the table	Yes Decision tables with all seven hit policies, literal expressions and required decisions, evaluated inside the engine by the business rule task — no job, one step. A deployed decision can also be evaluated directly as a dry run. Measured against the DMN TCK. capabilities.mddmn-conformance-corpus.md	Yes Decision tables with Unique, Any, First, Rule Order and Collect (sum, min, max, count) hit policies, evaluated by the DMN engine inside Zeebe when a business rule task calls them. Decision table hit policy Business rule tasks	Yes Decision Tables saved as DMN with First, Unique, Any, Collect (sum, min, max, count) and Rule Order hit policies, evaluated by the Drools engine. The docs do not say whether evaluation is embedded or a separate service. Decision Tables
FEEL expression languageImplementation and how conformance is measured	Partial Own interpreter: literals, paths, arithmetic, comparisons, if / then / else, lists with filters, contexts, and the string, number and list builtins. Temporal types and the remainder of the function library are not yet implemented; conformance is measured against a shared corpus. capabilities.mdfeel-conformance-corpus.md	Yes FEEL-Scala evaluates every BPMN and DMN expression in-engine, following the OMG FEEL specification; feelin covers Forms in the browser. No conformance-suite figure is published. What is FEEL?	Partial A FEEL-style syntax for gateway conditions, screen visibility and assignment rules, described as extending Symfony’s operators. No implementation is named and no claim of full FEEL is made. FEEL expression syntax
Scripting inside the engineWhich languages a script task can run	Partial FEEL only, evaluated in-engine and sandboxed by construction. Any other language runs in a worker you operate; no user code runs inside the engine, by design. capabilities.md	Partial In-engine script tasks run FEEL only; Groovy, JavaScript, Python and the rest run through a job worker, such as the community script worker the docs point to. Script tasks	Yes Scripts in PHP, JavaScript, Python, Lua, C# and Java, each run in a per-language Docker script executor bundling the ProcessMaker SDK. Script Executor management Scripts
Forms for human tasksA builder, and a runtime that renders them	Planned Form files can be versioned and deployed, but no runtime renders them yet; user tasks are completed in Drive through a variables form. A forms builder and runtime are on the roadmap. sheptra.modeler READMEsheptra.drive README	Yes Camunda Forms built in the Web or Desktop Modeler, rendered by Tasklist or embedded through the open-source form-js library. Camunda Forms reference	Yes Screen Builder: drag-and-drop Form, Display, Email and Conversational screens, rendered in Form Tasks as a Request runs. Professional and Enterprise plans. Screen Builder
Browser modelerVersioning and deploying to environments	Yes Browser modeler on bpmn-js with autosave, in-browser lint mirroring the engine’s deploy validators, token simulation, numbered versions with visual and XML diffs, restore, and deploy to a chosen environment and partition. DMN editing sits behind a feature flag. sheptra.modeler README	Yes Web Modeler on SaaS and Self-Managed, with named versions, visual and XML diffs and restore. On SaaS the deploy dialog picks the target cluster; on Self-Managed the cluster is preconfigured. Web Modeler	Yes Browser Process Modeler with a version history, named versions and a “copy to latest” restore; DevLink links instances and moves asset bundles from development to production. Process Modeler Configure process version history DevLink
Connector marketplacePrebuilt integrations	No Not offered. Integrations are written as workers against the job API. A connector marketplace is not on the near-term roadmap. sheptra.modeler README	Yes An out-of-the-box catalogue — REST, SOAP, GraphQL, AWS, Azure, GCP, Slack, SQL and more — plus a Marketplace of partner and community connectors that are not commercially supported. Out-of-the-box connectors Camunda Marketplace	Partial Eight documented connectors (email, DocuSign, Slack, PDF, IDP, decision task and a generic Data Connector for REST and Collections). No marketplace. Connectors Data Connector
Execution & integration
External workersHow work is handed to your code	Yes Long-poll activation across every job type in one request, complete / fail / throw-error, lease extension for long handlers, at-least-once delivery with an idempotency key on every write, a traceparent on every job. Plain HTTP; no SDK required. Workers: the job loophttp-api.md	Yes Job workers activate jobs by type with long polling, then complete or fail them with a retry count. A job whose activation times out is handed to another worker without spending a retry. Job workers	Partial No polling worker model. Script Tasks run in the executors, Data Connectors call external REST APIs (with an optional asynchronous callback), and outside code drives Requests through the REST API. Script Executor management Data Connector ProcessMaker REST API
Retries and incidentsWhere the retry budget is declared	Yes The retry budget is declared on the task in the model; a worker failing a job spends it, and exhausting it raises an incident an operator resolves one at a time or by a bulk retry. http-api.mdcapabilities.md	Yes Retries declared on the task definition in the model (default three); an incident is raised when they reach zero and is resolved from Operate or the API. Service tasks Incidents	Yes Retry attempts and wait time set per Script Task and Data Connector; when exhausted the Request enters Error status, and a super admin can retry it. Script Task Request details
Migrate running instancesMoving in-flight work to a new version	Yes An alteration plan migrates a filtered set of running instances to another version, with an element-id mapping for renames and a preview that reports the affected count before anything changes. Applied by the scheduler under the instance lock, audited as the plan’s creator. http-api.mdEngine section and FAQ	Yes Migration through the REST or gRPC API, or in batch from Operate, mapping active elements onto the target version. An element cannot change type or nesting on the way. Process instance migration	No Version changes are not reflected in Requests already in progress or completed; a new version applies to new Requests only. Configure process version history
Instance modificationMoving, cancelling and adding tokens by hand	Yes Cancel tokens, activate elements or flows, and merge variables in one validated, atomic batch — from the instance diagram in Drive or the API — and as a bulk alteration across many instances. Every batch is audited with its instructions. http-api.mdsheptra.drive README	Yes Activate, terminate and move element instances and set variables, from the API or Operate. Start events, boundary events and sequence flows cannot be targeted. Process instance modification	Partial An errored Request can be retried, rolled back to an earlier Form Task, or completed by hand; an in-progress Request can be cancelled. No token move or added activity. Request details
Messages, signals, timers, compensationCorrelation and the event vocabulary	Yes Message correlation by key with buffering and a replayable dead letter, broadcast signals, timer start / catch / boundary events, escalation, error propagation with worker-thrown errors, compensation when the model throws it, link events. capabilities.mdEngine section and FAQ	Yes Messages with a correlation key, time-to-live and message id; broadcast signals; ISO 8601 and cron timers; escalation and compensation handlers — all in-engine. Messages	Partial Message events matched by name between pools, broadcast signals, timers, conditional and error events. No compensation or escalation events. Process modeling object descriptions Intermediate Message Catch Event
API versioning and compatibilityWhat a version number promises	Yes Everything under /v1 with a written policy: the surface only grows within a contract number, breaking changes ship under a new one, and every host reports the contract numbers it serves. The deprecation policy is published beside it. api-versioning.mdAPI reference	Yes A minor every April and October with eighteen months of standard maintenance and monthly alphas; the REST API is versioned as a whole (v2, semantic versioning); deprecations are listed in each release announcement. Release policy Orchestration Cluster REST API	Partial Seasonal releases plus numbered updates — fourteen so far in the 2026 line — and a recommended thirty-day development-before-production window. No published support window, deprecation policy or API version policy. Upgrade guidelines Release notes 2026
REST API, OpenAPI and SDKsThe contract, and clients over it	Partial REST with an OpenAPI document and an interactive reference on every environment, on both hosts. No SDK yet; a typed .NET client is planned. Plain HTTP is the contract today. API reference	Yes Orchestration Cluster REST API v2 with a downloadable OpenAPI document, plus gRPC. Java client, Spring Boot starter, TypeScript and Python SDKs, a C# SDK in technical preview, and a CLI. Orchestration Cluster REST API Working with APIs and tools	Partial An OpenAPI-compliant REST API with Swagger UI on every instance. The SDK is what scripts call from inside an executor (PHP, Lua, JavaScript, C#, Java, Python); no standalone client catalogue is published. ProcessMaker REST API SDK and script examples
Capability discoveryAsking a cluster what it can run	Yes GET /v1/system reports the release, the contract numbers and the engine’s capability catalogue — one stable, additive-only identifier per feature — so a client asks a cell what it runs instead of inferring it from a version number. http-api.mdAPI reference	Partial The topology endpoint reports brokers, partitions, cluster size, replication factor, versions and partition health — the shape of the cluster, not the features it runs. Get cluster topology	No No capability or feature endpoint in the API documentation or the 2026 release notes. ProcessMaker REST API
Operate & tenancy
Operations console and task inboxInstances, incidents, and human work	Yes Drive: instance search, a timeline interleaving engine steps and operator commands, incidents grouped by cause with one-click resolve, live variable edits, message publishing to unblock waits, modification from the diagram, alteration plans with progress — and a Tasks page to claim, release and complete user tasks. sheptra.drive README	Yes Operate: instances, incidents, batch retry and cancel, modification and migration. Tasklist: the task inbox, rendering Camunda Forms. Introduction to Operate Introduction to Tasklist	Yes Requests and Cases views with retry, rollback and cancel; a Tasks inbox with reassignment, priority, drafts and quick fill. View Requests Tasks
Multi-tenancy and data residencyIsolation model and regions	Partial Organizations isolated by row-level security on a shared cell, with optional sub-tenant partitions inside one. Dedicated database, dedicated compute, private networking and a choice of region are roadmap rungs, labelled as such. capabilities.mdIsolation ladder and trust grid	Yes Tenant identifiers partition one cluster (Self-Managed, and SaaS on 8.8+ clusters); SaaS clusters are dedicated per customer. Seven GCP and six AWS regions, custom regions for Enterprise. Multi-tenancy Camunda 8 SaaS Regions	Partial One instance per customer on AWS or Azure, with the hosting location chosen by the customer. No tenant-identifier model is documented; the GDPR statement names US data centres. Security statement GDPR statement
History retentionWindows, archive, and who sets them	Partial Per-workspace retention windows for execution history and finished instances, archived before anything is purged. Configured per workspace by Sheptra today; a customer-facing setting is not yet available. data-retention.md	Yes SaaS production defaults: thirty days of orchestration data, 180 for Optimize, seven for Zeebe, negotiable on Enterprise. Self-Managed sets it in the Helm chart, thirty days by default. Data retention	No No configurable retention window found in the docs. A Case Deletion API (v2026.3) removes a case and its Requests on demand, logged to the security log. Release notes 2026
SSO and SCIMSingle sign-on and directory sync	Yes Sign-in through WorkOS AuthKit; SSO and directory sync configured from the hosted admin portal linked off the Members page, with memberships mirrored from directory webhooks. sheptra.drive READMEIsolation ladder and trust grid	Partial SaaS: SAML or Entra ID on the Enterprise plan, set up through a support ticket. Self-Managed: OIDC. SCIM is claimed on the platform page; no documentation page for it was found. External SSO (Console)camunda.com	Yes SAML plus Auth0, Microsoft, Google, Keycloak, GitHub and Atlassian logins; SCIM provisioning of users and groups from Okta or Entra ID. Professional and Enterprise plans. SSO settings SCIM settings
Audit logWho did what, on the engine and on the organization	Yes Two trails: every operator command against the engine, and every administrative action on the organization, each filterable by actor, action, target and time, with before / after diffs and actor names denormalised so rows survive a member leaving. sheptra.drive READMEhttp-api.md	Yes The 8.9 audit log records process, identity and user-task operations — who, when, what — on SaaS and Self-Managed; Console adds an exportable organization activity log. Audit log	Yes Security Logs record ninety-plus event types — logins, SSO and SCIM changes, process publishes, task reassign, retry and rollback, API tokens — downloadable. Enterprise plan. Download security logs
Delivery & commercials
Hosting optionsSaaS, dedicated, self-managed	Partial Managed cloud only, operated by Sheptra. Every workspace runs on a shared cell today; dedicated database, dedicated compute and private networking are on the roadmap. No self-managed edition is offered or planned. Isolation ladder and trust grid	Yes SaaS on dedicated single-tenant clusters (GCP or AWS, PrivateLink for Enterprise); Self-Managed with Helm on Kubernetes, Docker, or plain JARs. Camunda 8 SaaS About Self-Managed	Partial Primarily an enterprise cloud offering on AWS or Azure. The open-source edition installs on-premises (PHP, MySQL, Docker) without commercial support; no Kubernetes guide, and enterprise on-premises is not documented. Open-source edition, on-premises installation Security statement
Licensing and tiersHow it is sold	Planned Not yet available for purchase. Four planned tiers — Developer (free sandbox), Team, Business and Enterprise — priced on environments, seats and history rather than instance volume. Prices will be published once set. Planned tiers	Yes Since 8.6 the core components are source-available under the Camunda License 1.0: free for non-production use, an Enterprise licence for production. Web Modeler free up to five users; the connector SDK is Apache 2.0. Licenses camunda.com	Partial Professional and Enterprise plans gate features throughout the docs; pricing is per case (one per process start, unlimited users), by quote. The public pricing page now redirects to a higher-education package. Screen Builder Pricing (redirect target)
ComplianceAttestations and the paperwork behind them	Planned Encryption at rest and in transit, SSO and audit trails today. SOC 2 Type II, an independent penetration test and a DPA with a sub-processor list are planned. Isolation ladder and trust grid	Yes Trust Center lists SOC 2 Type II, ISO 27001, GDPR, TISAX and the Cloud Security Alliance. No penetration-test or HIPAA statement on the public page. Camunda Trust Center	Yes SOC 2 Type II reports under NDA, ISO 27001, an ISO/IEC 42001 framework, a GDPR DPA and annual penetration tests. HIPAA is not stated. Security statement GDPR statement
Process analyticsReporting on what ran	Partial Drive dashboards: running, incident and completed counts with per-process rollups, plus a statistics endpoint for usage. No process-mining or reporting product on the near-term roadmap. sheptra.drive READMEhttp-api.md	Yes Optimize: reports, dashboards, heatmaps and alerts over exported process data. A separate component; production use needs a licence. What is Optimize?	Yes Embedded Process Analytics — overview, analysis and trend reports, KPIs, CSV export — plus dashboards. Professional and Enterprise plans. Process Analytics
RPARobotic process automation	No Not offered. Desktop automation would run in a worker you operate. capabilities.md	Yes Camunda RPA: Robot Framework scripts run by a standalone RPA worker, documented for 8.7 and later on SaaS and Self-Managed. The page does not state a maturity level. Camunda RPA overview	Partial An integration with UiPath — robots and jobs monitored from ProcessMaker — rather than a native bot runtime. Document extraction comes from the IDP connector on Enterprise. Robotic Process Automation (RPA)

Capability

SheptraManaged cloud, pre-launch

Camunda 8SaaS and Self-Managed

Decisions (formerly ProcessMaker)ProcessMaker Platform, as documented at docs.processmaker.com

Standards & modelling

BPMN 2.0 element coverageWhat runs, and what the engine refuses at deploy

Partial

Most of the executable core: every gateway but complex, timer / message / signal / error / escalation / compensation / link / terminate events, event sub-processes, non-interrupting boundary events, call activities, multi-instance. Transactions, cancel and conditional events, complex gateways, ad-hoc sub-processes and standard loops are rejected at deploy time with the element named, never mid-instance.

bpmn-support.mdEngine section and FAQ

Partial

Most of the executable set, including event sub-processes, multi-instance, compensation, escalation, conditional events and ad-hoc sub-processes. Not executable: transactions and cancel events, link events, complex gateways, multiple events and the standard loop marker.

BPMN coverage

Partial

Timer, signal, message, conditional, error and terminate events; exclusive, inclusive, parallel and event-based gateways; form, manual and script tasks; sub-processes. Not documented: transactions, cancel and link events, complex gateways, compensation, escalation, event sub-processes, multi-instance markers.

Process modeling object descriptions

DMN decision tablesHit policies, and who evaluates the table

Yes

Decision tables with all seven hit policies, literal expressions and required decisions, evaluated inside the engine by the business rule task — no job, one step. A deployed decision can also be evaluated directly as a dry run. Measured against the DMN TCK.

capabilities.mddmn-conformance-corpus.md

Yes

Decision tables with Unique, Any, First, Rule Order and Collect (sum, min, max, count) hit policies, evaluated by the DMN engine inside Zeebe when a business rule task calls them.

Decision table hit policy Business rule tasks

Yes

Decision Tables saved as DMN with First, Unique, Any, Collect (sum, min, max, count) and Rule Order hit policies, evaluated by the Drools engine. The docs do not say whether evaluation is embedded or a separate service.

Decision Tables

FEEL expression languageImplementation and how conformance is measured

Partial

Own interpreter: literals, paths, arithmetic, comparisons, if / then / else, lists with filters, contexts, and the string, number and list builtins. Temporal types and the remainder of the function library are not yet implemented; conformance is measured against a shared corpus.

capabilities.mdfeel-conformance-corpus.md

Yes

FEEL-Scala evaluates every BPMN and DMN expression in-engine, following the OMG FEEL specification; feelin covers Forms in the browser. No conformance-suite figure is published.

What is FEEL?

Partial

A FEEL-style syntax for gateway conditions, screen visibility and assignment rules, described as extending Symfony’s operators. No implementation is named and no claim of full FEEL is made.

FEEL expression syntax

Scripting inside the engineWhich languages a script task can run

Partial

FEEL only, evaluated in-engine and sandboxed by construction. Any other language runs in a worker you operate; no user code runs inside the engine, by design.

capabilities.md

Partial

In-engine script tasks run FEEL only; Groovy, JavaScript, Python and the rest run through a job worker, such as the community script worker the docs point to.

Script tasks

Yes

Scripts in PHP, JavaScript, Python, Lua, C# and Java, each run in a per-language Docker script executor bundling the ProcessMaker SDK.

Script Executor management Scripts

Forms for human tasksA builder, and a runtime that renders them

Planned

Form files can be versioned and deployed, but no runtime renders them yet; user tasks are completed in Drive through a variables form. A forms builder and runtime are on the roadmap.

sheptra.modeler READMEsheptra.drive README

Yes

Camunda Forms built in the Web or Desktop Modeler, rendered by Tasklist or embedded through the open-source form-js library.

Camunda Forms reference

Yes

Screen Builder: drag-and-drop Form, Display, Email and Conversational screens, rendered in Form Tasks as a Request runs. Professional and Enterprise plans.

Screen Builder

Browser modelerVersioning and deploying to environments

Yes

Browser modeler on bpmn-js with autosave, in-browser lint mirroring the engine’s deploy validators, token simulation, numbered versions with visual and XML diffs, restore, and deploy to a chosen environment and partition. DMN editing sits behind a feature flag.

sheptra.modeler README

Yes

Web Modeler on SaaS and Self-Managed, with named versions, visual and XML diffs and restore. On SaaS the deploy dialog picks the target cluster; on Self-Managed the cluster is preconfigured.

Web Modeler

Yes

Browser Process Modeler with a version history, named versions and a “copy to latest” restore; DevLink links instances and moves asset bundles from development to production.

Process Modeler Configure process version history DevLink

Connector marketplacePrebuilt integrations

Not offered. Integrations are written as workers against the job API. A connector marketplace is not on the near-term roadmap.

sheptra.modeler README

Yes

An out-of-the-box catalogue — REST, SOAP, GraphQL, AWS, Azure, GCP, Slack, SQL and more — plus a Marketplace of partner and community connectors that are not commercially supported.

Out-of-the-box connectors Camunda Marketplace

Partial

Eight documented connectors (email, DocuSign, Slack, PDF, IDP, decision task and a generic Data Connector for REST and Collections). No marketplace.

Connectors Data Connector

Execution & integration

External workersHow work is handed to your code

Yes

Long-poll activation across every job type in one request, complete / fail / throw-error, lease extension for long handlers, at-least-once delivery with an idempotency key on every write, a traceparent on every job. Plain HTTP; no SDK required.

Workers: the job loophttp-api.md

Yes

Job workers activate jobs by type with long polling, then complete or fail them with a retry count. A job whose activation times out is handed to another worker without spending a retry.

Job workers

Partial

No polling worker model. Script Tasks run in the executors, Data Connectors call external REST APIs (with an optional asynchronous callback), and outside code drives Requests through the REST API.

Script Executor management Data Connector ProcessMaker REST API

Retries and incidentsWhere the retry budget is declared

Yes

The retry budget is declared on the task in the model; a worker failing a job spends it, and exhausting it raises an incident an operator resolves one at a time or by a bulk retry.

http-api.mdcapabilities.md

Yes

Retries declared on the task definition in the model (default three); an incident is raised when they reach zero and is resolved from Operate or the API.

Service tasks Incidents

Yes

Retry attempts and wait time set per Script Task and Data Connector; when exhausted the Request enters Error status, and a super admin can retry it.

Script Task Request details

Migrate running instancesMoving in-flight work to a new version

Yes

An alteration plan migrates a filtered set of running instances to another version, with an element-id mapping for renames and a preview that reports the affected count before anything changes. Applied by the scheduler under the instance lock, audited as the plan’s creator.

http-api.mdEngine section and FAQ

Yes

Migration through the REST or gRPC API, or in batch from Operate, mapping active elements onto the target version. An element cannot change type or nesting on the way.

Process instance migration

Version changes are not reflected in Requests already in progress or completed; a new version applies to new Requests only.

Configure process version history

Instance modificationMoving, cancelling and adding tokens by hand

Yes

Cancel tokens, activate elements or flows, and merge variables in one validated, atomic batch — from the instance diagram in Drive or the API — and as a bulk alteration across many instances. Every batch is audited with its instructions.

http-api.mdsheptra.drive README

Yes

Activate, terminate and move element instances and set variables, from the API or Operate. Start events, boundary events and sequence flows cannot be targeted.

Process instance modification

Partial

An errored Request can be retried, rolled back to an earlier Form Task, or completed by hand; an in-progress Request can be cancelled. No token move or added activity.

Request details

Messages, signals, timers, compensationCorrelation and the event vocabulary

Yes

Message correlation by key with buffering and a replayable dead letter, broadcast signals, timer start / catch / boundary events, escalation, error propagation with worker-thrown errors, compensation when the model throws it, link events.

capabilities.mdEngine section and FAQ

Yes

Messages with a correlation key, time-to-live and message id; broadcast signals; ISO 8601 and cron timers; escalation and compensation handlers — all in-engine.

Messages

Partial

Message events matched by name between pools, broadcast signals, timers, conditional and error events. No compensation or escalation events.

Process modeling object descriptions Intermediate Message Catch Event

API versioning and compatibilityWhat a version number promises

Yes

Everything under /v1 with a written policy: the surface only grows within a contract number, breaking changes ship under a new one, and every host reports the contract numbers it serves. The deprecation policy is published beside it.

api-versioning.mdAPI reference

Yes

A minor every April and October with eighteen months of standard maintenance and monthly alphas; the REST API is versioned as a whole (v2, semantic versioning); deprecations are listed in each release announcement.

Release policy Orchestration Cluster REST API

Partial

Seasonal releases plus numbered updates — fourteen so far in the 2026 line — and a recommended thirty-day development-before-production window. No published support window, deprecation policy or API version policy.

Upgrade guidelines Release notes 2026

REST API, OpenAPI and SDKsThe contract, and clients over it

Partial

REST with an OpenAPI document and an interactive reference on every environment, on both hosts. No SDK yet; a typed .NET client is planned. Plain HTTP is the contract today.

API reference

Yes

Orchestration Cluster REST API v2 with a downloadable OpenAPI document, plus gRPC. Java client, Spring Boot starter, TypeScript and Python SDKs, a C# SDK in technical preview, and a CLI.

Orchestration Cluster REST API Working with APIs and tools

Partial

An OpenAPI-compliant REST API with Swagger UI on every instance. The SDK is what scripts call from inside an executor (PHP, Lua, JavaScript, C#, Java, Python); no standalone client catalogue is published.

ProcessMaker REST API SDK and script examples

Capability discoveryAsking a cluster what it can run

Yes

GET /v1/system reports the release, the contract numbers and the engine’s capability catalogue — one stable, additive-only identifier per feature — so a client asks a cell what it runs instead of inferring it from a version number.

http-api.mdAPI reference

Partial

The topology endpoint reports brokers, partitions, cluster size, replication factor, versions and partition health — the shape of the cluster, not the features it runs.

Get cluster topology

No capability or feature endpoint in the API documentation or the 2026 release notes.

ProcessMaker REST API

Operate & tenancy

Operations console and task inboxInstances, incidents, and human work

Yes

Drive: instance search, a timeline interleaving engine steps and operator commands, incidents grouped by cause with one-click resolve, live variable edits, message publishing to unblock waits, modification from the diagram, alteration plans with progress — and a Tasks page to claim, release and complete user tasks.

sheptra.drive README

Yes

Operate: instances, incidents, batch retry and cancel, modification and migration. Tasklist: the task inbox, rendering Camunda Forms.

Introduction to Operate Introduction to Tasklist

Yes

Requests and Cases views with retry, rollback and cancel; a Tasks inbox with reassignment, priority, drafts and quick fill.

View Requests Tasks

Multi-tenancy and data residencyIsolation model and regions

Partial

Organizations isolated by row-level security on a shared cell, with optional sub-tenant partitions inside one. Dedicated database, dedicated compute, private networking and a choice of region are roadmap rungs, labelled as such.

capabilities.mdIsolation ladder and trust grid

Yes

Tenant identifiers partition one cluster (Self-Managed, and SaaS on 8.8+ clusters); SaaS clusters are dedicated per customer. Seven GCP and six AWS regions, custom regions for Enterprise.

Multi-tenancy Camunda 8 SaaS Regions

Partial

One instance per customer on AWS or Azure, with the hosting location chosen by the customer. No tenant-identifier model is documented; the GDPR statement names US data centres.

Security statement GDPR statement

History retentionWindows, archive, and who sets them

Partial

Per-workspace retention windows for execution history and finished instances, archived before anything is purged. Configured per workspace by Sheptra today; a customer-facing setting is not yet available.

data-retention.md

Yes

SaaS production defaults: thirty days of orchestration data, 180 for Optimize, seven for Zeebe, negotiable on Enterprise. Self-Managed sets it in the Helm chart, thirty days by default.

Data retention

No configurable retention window found in the docs. A Case Deletion API (v2026.3) removes a case and its Requests on demand, logged to the security log.

Release notes 2026

SSO and SCIMSingle sign-on and directory sync

Yes

Sign-in through WorkOS AuthKit; SSO and directory sync configured from the hosted admin portal linked off the Members page, with memberships mirrored from directory webhooks.

sheptra.drive READMEIsolation ladder and trust grid

Partial

SaaS: SAML or Entra ID on the Enterprise plan, set up through a support ticket. Self-Managed: OIDC. SCIM is claimed on the platform page; no documentation page for it was found.

External SSO (Console)camunda.com

Yes

SAML plus Auth0, Microsoft, Google, Keycloak, GitHub and Atlassian logins; SCIM provisioning of users and groups from Okta or Entra ID. Professional and Enterprise plans.

SSO settings SCIM settings

Audit logWho did what, on the engine and on the organization

Yes

Two trails: every operator command against the engine, and every administrative action on the organization, each filterable by actor, action, target and time, with before / after diffs and actor names denormalised so rows survive a member leaving.

sheptra.drive READMEhttp-api.md

Yes

The 8.9 audit log records process, identity and user-task operations — who, when, what — on SaaS and Self-Managed; Console adds an exportable organization activity log.

Audit log

Yes

Security Logs record ninety-plus event types — logins, SSO and SCIM changes, process publishes, task reassign, retry and rollback, API tokens — downloadable. Enterprise plan.

Download security logs

Delivery & commercials

Hosting optionsSaaS, dedicated, self-managed

Partial

Managed cloud only, operated by Sheptra. Every workspace runs on a shared cell today; dedicated database, dedicated compute and private networking are on the roadmap. No self-managed edition is offered or planned.

Isolation ladder and trust grid

Yes

SaaS on dedicated single-tenant clusters (GCP or AWS, PrivateLink for Enterprise); Self-Managed with Helm on Kubernetes, Docker, or plain JARs.

Camunda 8 SaaS About Self-Managed

Partial

Primarily an enterprise cloud offering on AWS or Azure. The open-source edition installs on-premises (PHP, MySQL, Docker) without commercial support; no Kubernetes guide, and enterprise on-premises is not documented.

Open-source edition, on-premises installation Security statement

Licensing and tiersHow it is sold

Planned

Not yet available for purchase. Four planned tiers — Developer (free sandbox), Team, Business and Enterprise — priced on environments, seats and history rather than instance volume. Prices will be published once set.

Planned tiers

Yes

Since 8.6 the core components are source-available under the Camunda License 1.0: free for non-production use, an Enterprise licence for production. Web Modeler free up to five users; the connector SDK is Apache 2.0.

Licenses camunda.com

Partial

Professional and Enterprise plans gate features throughout the docs; pricing is per case (one per process start, unlimited users), by quote. The public pricing page now redirects to a higher-education package.

Screen Builder Pricing (redirect target)

ComplianceAttestations and the paperwork behind them

Planned

Encryption at rest and in transit, SSO and audit trails today. SOC 2 Type II, an independent penetration test and a DPA with a sub-processor list are planned.

Isolation ladder and trust grid

Yes

Trust Center lists SOC 2 Type II, ISO 27001, GDPR, TISAX and the Cloud Security Alliance. No penetration-test or HIPAA statement on the public page.

Camunda Trust Center

Yes

SOC 2 Type II reports under NDA, ISO 27001, an ISO/IEC 42001 framework, a GDPR DPA and annual penetration tests. HIPAA is not stated.

Security statement GDPR statement

Process analyticsReporting on what ran

Partial

Drive dashboards: running, incident and completed counts with per-process rollups, plus a statistics endpoint for usage. No process-mining or reporting product on the near-term roadmap.

sheptra.drive READMEhttp-api.md

Yes

Optimize: reports, dashboards, heatmaps and alerts over exported process data. A separate component; production use needs a licence.

What is Optimize?

Yes

Embedded Process Analytics — overview, analysis and trend reports, KPIs, CSV export — plus dashboards. Professional and Enterprise plans.

Process Analytics

RPARobotic process automation

Not offered. Desktop automation would run in a worker you operate.

capabilities.md

Yes

Camunda RPA: Robot Framework scripts run by a standalone RPA worker, documented for 8.7 and later on SaaS and Self-Managed. The page does not state a maturity level.

Camunda RPA overview

Partial

An integration with UiPath — robots and jobs monitored from ProcessMaker — rather than a native bot runtime. Document extraction comes from the IDP connector on Enterprise.

Robotic Process Automation (RPA)

Entries for other products link to that vendor's own documentation, product or trust pages as read on 16 September 2026. Sheptra entries reference the engine's documentation, which is being published with the customer docs. Hover over a source for its full title.

Camunda, ProcessMaker, Decisions, Flowable and Temporal are trademarks of their respective owners. ProcessMaker merged with Decisions in November 2025; the product compared here is ProcessMaker Platform as described in its documentation. This comparison reflects Sheptra's reading of publicly available documentation and has not been reviewed or endorsed by any of these companies. Corrections are welcome at privacy@sheptracloud.com.