Open-source alternatives to Tines: Shuffle, StackStorm, n8n

Which open-source alternatives to Tines fit your security workflows

If you are facing a Tines renewal, a pricing change or a hosting requirement you cannot meet in the cloud, the short answer is this: Shuffle fits teams that want visual, self-hosted workflows with an app creator for security tools, StackStorm fits teams that prefer code-first, event-driven automation for remediation and incident response, and n8n should be considered only after your legal team has checked its Sustainable Use License. Teams usually start looking elsewhere for one of four reasons: licensing terms they must review again, a data residency rule that requires workflow execution inside their own network, concern about lock-in to a single vendor's workflow format, or cost questions as automation volume grows. Tines' free edition lists unlimited users, spaces and connectors but limits you to 3 live workflows, and its pricing FAQ says flexible hosting options are available on request. Confirm directly with Tines whether a self-hosted or customer-controlled deployment is offered to your organization, what it includes, and which terms apply, before you plan around it.

Shuffle's backend is licensed under AGPLv3, while its workflows, documentation, apps and app specifications are licensed under MIT, so your legal review should look at both layers separately, especially if you plan to modify the backend. Its install guide lists Docker and Kubernetes, notes that the default Docker Compose setup is not a scalable build without changes, and requires at least 4 GB of RAM. Plan for that scaling work and for OpenSearch as its database (Elasticsearch also works). StackStorm is Apache 2.0 licensed, and its 3.9.0 release, dated January 12, 2025, supports Python 3.8 to 3.11, so check that your Python standard matches before you commit to it. n8n's license permits internal business use and non-commercial use, but files marked .ee require an n8n Enterprise License, so confirm that your intended use falls within the first category.

Use a short proof of concept to test one or two of your highest-value Tines stories on each candidate before you choose. Measure how well each tool handles the HTTP integrations your team depends on, whether your analysts can maintain the workflows, and what the platform needs to run at your expected volume. Ask Tines for written confirmation of hosting options, and ask each open-source project's community or commercial support providers what they offer for your scale. A quote for any rebuild or hardening work should follow from a written scope that names the workflows, integrations and environments included.

Shuffle, StackStorm and n8n compared as Tines replacements

Each option below can run in your own infrastructure, but they differ sharply in license terms, runtime model and how much of a Tines story translates directly. Read the license and deployment notes before you compare features, because those decide what you can run and for whom.

Shuffle for Tines-style workflows

Shuffle is the closest structural match to Tines, since it is a visual, workflow-first SOAR tool. Its backend is licensed under AGPLv3, while workflows, documentation, apps and app specifications are MIT, so review how the AGPL applies if you modify and offer the backend as a network service. Its app creator builds integrations from OpenAPI specifications, which can shorten HTTP connector work. Plan for Docker or Kubernetes, a minimum of 4 GB of RAM, and OpenSearch as the database. The default Docker Compose setup is not scalable without changes, so budget for that hardening work.

StackStorm for event-driven automation

StackStorm is Apache 2.0 licensed and built around event-driven automation for auto-remediation, incident response, troubleshooting and deployments. It fits teams whose Tines stories are really infrastructure runbooks triggered by sensors and chained actions, rather than analyst-facing case flows. The 3.9.0 release, dated January 12, 2025, supports Python 3.8 to 3.11 and moved to pymongo 4.x. Rebuilding stories means writing actions and rules in code, so the effort lands on your engineers rather than on analysts. Confirm the supported Python and MongoDB versions against your platform baseline before you commit.

n8n under the Sustainable Use License

n8n is a general workflow automation tool with a large HTTP connector library, which makes it a practical option for rebuilding simple API-driven Tines stories. Its Sustainable Use License permits internal business and non-commercial use, but it is source-available rather than OSI open source. Files marked .ee require a valid n8n Enterprise License, so confirm which features your stories depend on. If you plan to offer automation as a service to other organizations, get a written reading of the license terms from counsel before you build on it.

Choosing between the three

Pick by runtime and license, not by feature count. Shuffle matches the analyst-facing case workflow model, StackStorm suits code-first infrastructure automation, and n8n suits general integration work where license scope is acceptable. Map a sample of your highest-value Tines stories to each option, then count how many need custom code, how many depend on paid or enterprise-only features and how many depend on Tines-specific connectors. The result will show the rebuild effort more clearly than any feature matrix.

How Tines capabilities map to Shuffle, StackStorm and n8n

This table maps the main Tines capabilities to Shuffle, StackStorm and n8n so you can see where each open-source option covers the need and where you must confirm features yourself. Treat blank or uncertain cells as questions for a proof of concept against your own workflows, not as settled answers. The main takeaway is that Shuffle is the closest match for a no-code security story builder, StackStorm fits code-first automation, and n8n needs license review before use in security operations.

Capability	Shuffle	StackStorm	n8n
No-code workflow builder	Visual workflow editor built for security automation with app-based steps	No visual story builder; workflows are written as rules, actions and workflows in YAML and Python	Visual node-based editor for general automation, not designed specifically for security stories
HTTP and connector integrations	App creator builds integrations from OpenAPI specifications; premade apps for many security tools	Integrations packaged as packs of Python actions; HTTP calls are written as code	Large library of built-in nodes plus generic HTTP request node; confirm coverage for your security tools
Scheduling and webhook triggers	Schedule and webhook triggers supported; confirm trigger types against the install guide and current docs	Event-driven triggers via sensors and rules; scheduled execution through timers in packs	Schedule and webhook trigger nodes available; confirm behavior under high-volume alerts
Human-in-the-loop and approvals	Confirm whether approval steps exist in your version and how they integrate with chat or ticketing	Not a native approval step; typically built as a custom action or external integration	Wait and approval patterns are possible but must be confirmed for your deployment and license
Case management	Confirm case or incident record features; many teams pair it with a separate case system	No built-in case management; usually integrated with an external ticketing or case tool	No native case management; typically connected to an external system
Team and access controls	Confirm role-based access, groups and SSO support in current documentation	Role-based access and authentication options exist; confirm fit with your identity provider	Role management and SSO are tied to paid editions; confirm against the current license terms
Audit logging	Confirm execution history and audit trail coverage before relying on it for evidence	Execution history is recorded; confirm retention and export for your assessors	Execution logs available; confirm audit log detail in your plan
Hosting options	Self-host with Docker or Kubernetes; hosted service at shuffler.io also available	Self-host on Linux; the project is maintained as open source for your own infrastructure	Self-host or use n8n cloud; self-hosting falls under the Sustainable Use License

What you give up when leaving Tines and how teams work around it

Moving from Tines to a self-hosted platform trades vendor-run operations for control over data and hosting. The gaps below are the ones teams most often underestimate, each paired with the workaround that usually closes it.

Vendor-managed hosting and uptime

Tines runs the platform for hosted customers, so patching, scaling, backups and availability are the vendor's job. Self-hosting moves those duties to your team: Shuffle's install guide notes that the default Docker Compose setup is not scalable without changes, so you own capacity planning and high availability. Workaround: keep a hosted tier for non-sensitive workflows, or contract a retainer for upgrades and monitoring. Ask any implementation partner who owns on-call and recovery objectives in writing.

Vendor support and escalation

Tines support is a contract term you pay for, with defined channels for production incidents. Open-source projects rely on community issues and documentation, and a security automation outage at 2 a.m. has no contractual responder. Workaround: a support retainer with a named engineer and an agreed response process, plus internal runbooks for restarting and rolling back workflows. Confirm which support levels any partner covers and which upstream components they will not touch.

Polished no-code editing experience

Tines offers a mature visual story builder that analysts often use without engineering help. Shuffle's workflow editor is capable but less refined, and StackStorm is driven by YAML and Python, which shifts authoring to engineers. Expect a learning curve for analysts and a period where one or two people maintain most workflows. Workaround: a short pilot where analysts rebuild two or three representative stories, and written conventions for naming, error handling and version control.

Out-of-the-box integration breadth

Tines ships a large catalog of connectors that teams can use immediately. Shuffle includes premade apps for common security tools and an app creator that builds integrations from OpenAPI specifications, but coverage for a specific product may be missing or outdated. Workaround: write custom app specifications for your highest-value tools first, and check each premade app against the vendor API version you run. Confirm coverage for every tool in your first wave before you commit.

n8n license limits

n8n is a source-available option, not OSI open source. Its Sustainable Use License permits internal business use and non-commercial use, and files marked .ee need a valid n8n Enterprise License. If you plan to offer automation as a service to customers, or to use enterprise-only features, the license terms need legal review before you build on it. Workaround: choose Shuffle or StackStorm where you need unrestricted commercial licensing, or confirm in writing that your planned use fits the license.

How to move Tines stories and HTTP integrations to self-hosted tools

This sequence turns live Tines stories and their HTTP connectors into documented, tested workflows on a self-hosted platform, with a cutover that your team can verify and reverse if needed.

Inventory live stories and connectors
List every story in your Tines tenant, marking which ones are live, which are paused or drafts, and which feed other stories through webhooks or emits. For each one, record the triggers, the alert sources, the downstream systems it calls, and the credentials it uses. Tines documents a Free edition limited to 3 live workflows, so confirm how many live stories you run and which plan covers them before you plan the move. The output is a single inventory sheet that a security engineer and the story owner have both reviewed, with each row tagged for migration, retirement or consolidation.
Confirm export options with Tines
No export procedure for Tines stories was supplied with this research, so ask Tines directly what options exist for exporting story definitions, actions, credentials references and run history in your plan and deployment type. Get the answer in writing and note any format limits, such as whether credentials are exported at all or must be re-entered. Your team should not start rebuilding until this is confirmed, because the export method decides whether you copy definitions by hand or import them. The output is a short written answer from Tines and a decision on the migration method.
Document each story's logic and dependencies
For each story in scope, write down the trigger, each action in order, the branching conditions, the data transformations, the error handling and the human approval points. Include the exact HTTP requests: method, URL pattern, headers, authentication type and expected response fields. Store this documentation with the story owner's name and the date of review, so that it does not depend on memory or on the Tines interface. The output is one specification per story that an engineer on the target platform can follow without opening Tines.
Map HTTP calls to Shuffle apps
Take each HTTP action from the specifications and find its equivalent. Shuffle includes an app creator that builds integrations from OpenAPI specifications and ships premade apps for many security tools, so check the premade app list first for each vendor. Where no app exists and the target API publishes an OpenAPI specification, generate an app and review its authentication and parameter handling. Where neither exists, plan a custom HTTP step with the same request details. Mark any mapping that depends on an undocumented API or a feature you have not verified. The output is a mapping table listing each HTTP call, its Shuffle app or custom step, and its open questions.
Pilot on low-risk workflows
Build the first few rebuilt stories on the self-hosted platform, choosing ones that enrich alerts, post notifications or open tickets rather than those that isolate hosts or disable accounts. Run them against test data and a non-production copy of the target systems where possible. Check that the outputs match the Tines versions for identical inputs, and record every difference. Confirm that secrets are stored in the platform's credential store and not in workflow text. The output is a pilot report listing passed tests, differences and fixes, signed off by the security owner.
Run both platforms against live alerts
Send the same live alerts to the Tines story and the rebuilt workflow at the same time, with the rebuilt version limited to read-only or notification actions until results match. Compare the enrichment data, routing decisions, ticket fields and timing for each alert. Keep a log of mismatches and how each was resolved, and confirm that the self-hosted deployment is sized for your alert volume, since the install guide states the default Docker Compose setup is not a scalable build without changes and needs at least 4 GB of RAM. The output is a parallel-run log showing agreement for a defined set of alert types before cutover.
Cut over and decommission Tines
Switch alert routing to the self-hosted workflows one story at a time, starting with the lowest-risk ones, and keep the matching Tines story available for a rollback period agreed in advance. Update runbooks, on-call documentation and any webhook sources that pointed at Tines. Once every story is stable, disable the Tines stories, revoke the API keys and connector credentials they used, and confirm with Tines how your data is retained or deleted under your contract. The output is a closed change record for each story, a credential revocation list and written confirmation from Tines about data handling.

Which Tines alternative fits data residency, cost and customization needs

When regulators, contracts or internal policy require security telemetry, playbook execution and case data to stay inside your own accounts, data centers or air-gapped networks, self-hosting is the starting requirement. Shuffle and StackStorm both run in infrastructure you control, so the choice between them depends on how the team will operate the platform day to day.

Shuffle deployment: Shuffle supports Docker and Kubernetes. Its install guide notes that the default Docker Compose setup is not a scalable build without changes, so plan a Kubernetes or hardened Compose layout for production.
Shuffle storage: Shuffle uses OpenSearch as its database, with Elasticsearch also supported, so the datastore becomes part of your residency boundary.
StackStorm deployment: StackStorm is Apache 2.0 licensed and runs as event-driven automation you install and operate yourself, which keeps execution logs and secrets local.
Hosted option caveat: Shuffle offers a hosted cloud at shuffler.io. If residency is the constraint, that service does not meet it, so confirm where it stores data before counting it as an option.
Confirm with the vendor: Ask each project which components handle secrets, logs and case data, and where each component sends telemetry by default.

Before selecting a platform, map every system that will receive or store alert data and confirm each one sits inside the residency boundary.

How much effort and cost does replacing Tines take?

How long does it take to rebuild Tines workflows on open source?

No supplied figure gives a reliable duration, so the honest answer depends on the work inventory. The main drivers are how many live stories you run, how many of them call custom HTTP endpoints, how much logic depends on Tines-specific transforms and how many approval or case steps they include. Start by counting live workflows and grouping them by the systems they touch. Workflows that call a handful of well-documented APIs are usually quicker to recreate than those with branching logic and internal data handling. Ask any implementation partner to size the work from that inventory and to state assumptions in writing before work starts.

Can our team self-host Shuffle without outside help?

Yes, a capable platform team can self-host Shuffle, but the install guide sets expectations. Shuffle supports Docker and Kubernetes, requires a minimum of 4 GB of RAM, and notes that the default Docker Compose setup is not a scalable build without changes. Uses OpenSearch as its database, with Elasticsearch also working, and runs executions through its Orborus component. Teams without container and search operations experience often find the production hardening, backup and upgrade work the most demanding part. Decide early whether you will staff that internally or contract it out.

What skills does a Tines replacement project require?

The work needs a mix of security automation, API integration and platform operations skills. Engineers must understand the incident response processes the stories support, read OpenAPI or vendor API documentation, and write or adapt HTTP calls and transforms. Someone must own container or Kubernetes deployment, database operations, secrets handling and access control. For StackStorm, Python skills matter more because its automation is built as Python packs. Plan for analysts who can validate that rebuilt workflows behave the same way during testing as they did in production.

Is n8n usable commercially under its license?

Not for most commercial uses without checking the terms. n8n is distributed under the Sustainable Use License, which permits use for internal business purposes or non-commercial or personal use, and files marked .ee require a valid n8n Enterprise License. It is source-available rather than OSI open source. If you plan to offer n8n-based automation to customers, embed it in a product or run it as a service for third parties, have counsel read the LICENSE.md file against your use case before you build. Confirm the terms with n8n directly for any use the license text does not clearly address.

Is Shuffle's hosted option at shuffler.io a real alternative to self-hosting?

It is an alternative if your priority is reducing infrastructure operations rather than keeping every component in your own environment. Shuffle offers a hosted cloud service at shuffler.io alongside self-hosting. Choosing it moves hosting, upgrades and scaling to the vendor, but the data residency, access and retention questions still need written answers. Ask where workflow data and execution logs are stored, who can access them, and how they are deleted. If your data residency rules require your own cloud account, data center or air-gapped network, self-hosting is the path to evaluate.

What should we ask for in a fixed-scope quote?

A useful fixed-scope quote lists the work in terms you can check. Ask for the inventory of workflows and integrations in scope, the target platform and hosting model, and which items are included, such as integration rebuilds, testing, hardening, backup setup, documentation and handover. Require the assumptions behind any timeline, the number of integrations counted as custom, and the acceptance criteria for each workflow. Separate one-time build costs from recurring items such as upgrades, support retainers and infrastructure you pay for directly. Confirm who is responsible for any third-party licenses or hosting charges.

What drives the ongoing cost after the migration is finished?

Ongoing cost is mostly infrastructure, staff time and support, not software license fees. Open-source platforms have no per-workflow license charge for the core product, but you pay for compute, storage, backups, monitoring and the engineers who upgrade and patch the platform. Costs rise with the number of integrations you maintain, the volume of executions and the number of environments you run. Tines' pricing page lists a Free edition with 3 live workflows and paid editions with unlimited workflows, so compare total cost against that baseline with your own workflow count, not a generic figure. Ask a partner to estimate the recurring work in the quote.

How DeployOpen scopes and hands over a Tines replacement

DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a Tines replacement, we start from a written scope that covers which stories, integrations and alert sources move, and we hand over the result with documentation your team can run.

How we scope

Inventory every live Tines story, its triggers, connectors and the systems each one calls
Agree in writing which stories move, which are retired and which are rebuilt in a different form
Confirm where the platform will run, including cloud accounts, data centers or air-gapped networks
Define the deliverables, timeline and acceptance criteria before any build work begins

How we build

Stand up the chosen platform, such as Shuffle, StackStorm or n8n, in your environment with the required database and workers
Rebuild HTTP integrations from vendor API documentation or OpenAPI specifications where they exist
Test each rebuilt workflow against replayed or sample alerts and compare outputs with the original Tines story
Apply hardening for secrets handling, access control and network segmentation as agreed in scope

How we hand over

Document each workflow, its inputs, outputs, credentials used and the owner responsible for it
Provide runbooks for deployment, backup, restore and upgrades of the self-hosted platform
Walk your security and platform teams through the system and record the knowledge transfer
Deliver evidence of configuration and testing that your internal reviewers or external auditors can examine

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after handover
Ask us to confirm how a retainer covers platform upgrades, new integrations and incident response to workflow failures
Clarify with us which tasks stay with your team once the fixed-scope engagement closes
Review licensing terms for your chosen platform with your legal team before production use

Open-source alternatives to Tines