Tines free edition limits: open-source alternatives

Tines Free allows unlimited users, spaces and connectors but only 3 live workflows. Self-hosted Shuffle or Tracecat remove that workflow cap, in exchange for running the platform yourself.

On this page

Tines free edition limits: open-source alternatives for teams past three live workflows

A security team that has reached the three live workflow ceiling on Tines Free has three choices: pay for a higher Tines edition, host an open-source platform, or combine the two. Self-hosted Shuffle or Tracecat remove the live workflow cap, but the team then owns hosting, upgrades, backups and availability. This section covers only the Free edition limit. Tines' paid editions and its flexible hosting options are available on request, so the commercial side of the decision needs a direct conversation with Tines about which edition and deployment model match your environment.

The cap is the variable that changes the cost model. Tines Free allows unlimited users, spaces and connectors, but only 3 live workflows. Shuffle prices its enterprise tiers on app runs, meaning actions that actually execute in a workflow, while its open-source edition offers all features. Tracecat's core is AGPL-3.0 and its Enterprise features are separately licensed. Before you choose, count the workflows that must stay live, estimate how many actions they execute per month, and check which features (SSO, multi-tenant workspaces, scaling, support) your team needs from each vendor in writing.

Self-hosting moves cost from licenses to operations. A self-hosted Shuffle deployment needs at least 4 GB of RAM according to its install guide, plus an OpenSearch database, Orborus runtime nodes and, for high availability, an OpenSearch cluster, NFS and more than one Orborus node. Tracecat's self-hosted stack runs PostgreSQL, Temporal and an S3-compatible store. Your team pays for infrastructure, staff time for upgrades and backups, and the rebuild of existing stories. Protect the SHUFFLE_ENCRYPTION_MODIFIER secret from day one, because losing it breaks every saved app authentication.

What the workflow ceiling requires from a replacement

Moving past three live workflows changes what the platform must do, not only how many workflows it runs. The cards below cover the capabilities a self-hosted replacement needs once several teams depend on it, and what to verify in each before committing.

Live workflow capacity

The Tines Free edition caps live workflows at 3, while paid editions offer unlimited workflows. Shuffle's open-source edition is documented as having all features available, but Shuffle states that limits between its open-source and enterprise editions are actively enforced since v2.1.1. Confirm in the current configuration docs and your own test environment whether the open-source build imposes any workflow or scale limit before you plan around it.

Encrypted credential storage

Saved app credentials and API keys are the most sensitive data a SOAR platform holds. Shuffle encrypts them in OpenSearch with AES-256 using the SHUFFLE_ENCRYPTION_MODIFIER secret. Losing or changing that value breaks every saved app authentication, so the secret needs to be backed up with the database and rotated through a planned procedure, not by editing the value in place.

Operator single sign-on

Shared admin logins do not survive a team of analysts and engineers. Shuffle added SAML single sign-on in version 0.9.16 and OpenID Connect in 1.0.0, both available on-premises and in its cloud, with per-tenant enforcement. SAML is being deprecated on Shuffle Cloud in favor of OpenID Connect, so new deployments should plan around OpenID Connect and confirm how your identity provider's group claims map to Shuffle roles.

Scalable runtime and high availability

The default single-server Docker Compose setup is not scalable without changes, so production use needs a deliberate architecture. Shuffle's docs recommend an OpenSearch cluster, shared Memcached and NFS when running several backends, and more than one Orborus node so workflows keep running if one fails. Choose between Docker Swarm and Kubernetes with Helm charts, then test failover of an Orborus node under load before relying on it.

Licensing that does not scale with automations

Shuffle prices its licensing on app runs, meaning actions that execute in a workflow, while users, apps and workflows are unlimited. Triggers and skipped actions are not counted. Ask for the expected monthly app-run volume for your automations, since that is the metric that rises as you add stories. Under a per-workflow or per-user model, cost grows with each new automation, so compare the two against a realistic run forecast.

Ongoing platform maintenance

Once you host the platform, you own its upgrades, backups of OpenSearch data, certificate renewals and version pinning. Shuffle recommends the latest Docker tag for stable releases and the nightly tag only for experiments, so a production change process should pin tags and test each release in staging. Confirm who on your team carries that work and how often upgrades are scheduled.

Shuffle or Tracecat: which open-source platform fits this limit

Shuffle is a security automation platform that began in mid-2019 for the CERT and SIRT community. Its backend is licensed under AGPLv3, while its workflows, documentation, apps and app specifications are licensed under MIT, so the code that runs your playbooks is handled differently from the code that defines them. Shuffle's data layer is OpenSearch (Elasticsearch also works), and its runtime uses Orborus, which polls the backend for jobs and starts a worker for each workflow execution. The worker then starts app containers.

  • Deployment paths: Shuffle documents a single server with Docker Compose, distributed Docker Swarm, a hybrid with Shuffle Cloud and a local Orborus, and Kubernetes with Helm charts.
  • Hardware floor: The install guide says the default Docker Compose setup is not scalable without changes and needs at least 4 GB of RAM.
  • High availability: The configuration docs recommend an OpenSearch cluster, shared files over NFS when running several backends, and more than one Orborus node.
  • Credential handling: Saved app credentials are encrypted with AES-256 using the SHUFFLE_ENCRYPTION_MODIFIER secret, and losing or changing it breaks every saved authentication.
  • Enterprise limits: Shuffle states all features are in the open-source edition, but since v2.1.1 limits between editions are enforced. SAML and OpenID Connect SSO are documented with per-tenant enforcement, so confirm which tier your SSO model requires.

Confirm with Shuffle which limits apply to your planned scale and whether your SSO model needs a paid tier before you commit to a design.

How Shuffle, Tracecat and Tines paid editions compare on the workflow limit

This table compares the Tines Free edition and its paid editions with self-hosted Shuffle and self-hosted Tracecat on workflow limits, licensing, deployment, SSO and the operating work each path takes on. Cells marked to verify are points the available sources do not confirm, so ask the vendor or check project documentation before you decide. The main takeaway is that the three-workflow cap ends with either open-source platform, but hosting, scaling, upgrades and key management become your responsibility.

DimensionTines (Free and paid editions)Self-hosted ShuffleSelf-hosted Tracecat
Live workflow limitFree: 3 live workflows. Paid editions: unlimited workflows. Confirm current tier details with Tines.Unlimited workflows under Shuffle's licensing model. Confirm enforced limits for your edition.Not confirmed in our sources. Verify the workflow limit for your edition in the Tracecat documentation.
Licensing metricFree: unlimited users, spaces and connectors. Paid pricing metric and cost: verify on the Tines pricing page.Priced on app runs, meaning executed actions. Triggers and skipped actions are not counted. Open-source edition includes all features.Core is AGPL-3.0. Code in packages/tracecat-ee and enterprise feature gates requires a paid Enterprise license.
Deployment optionsCloud on the Free edition. Paid editions offer flexible hosting on request. Verify self-hosted options per plan.Docker Compose, distributed Docker Swarm, hybrid with Shuffle Cloud, or Kubernetes with Helm charts.Docker Compose on one host, AWS ECS Fargate through Terraform, Kubernetes with Helm, or air-gapped Kubernetes.
Single sign-onVerify which SSO protocols are included in each Tines plan with the vendor.SAML since 0.9.16 and OpenID Connect since 1.0.0, with per-tenant enforcement. SAML is being deprecated on Shuffle Cloud.Listed as an Enterprise feature. Confirm which authentication and SSO options your license covers.
Platform components and sizingVendor operates the hosted platform. You do not size servers or databases.OpenSearch database, Go backend, frontend and Orborus runtime. Minimum 4 GB RAM. Default Compose setup needs changes to scale.Python FastAPI backend, Next.js frontend, Temporal, PostgreSQL, S3-compatible object store and nsjail sandboxing.
Who maintains the platformTines maintains the hosted service. Confirm support and maintenance terms in your contract.Your team or a partner handles upgrades, backups, scaling, high availability and monitoring.Your team handles the stack, including Temporal, PostgreSQL, object storage and upgrades for each release.
Credential protectionVerify how stored credentials are encrypted and who controls key material on your plan.Saved credentials are encrypted with AES-256 using SHUFFLE_ENCRYPTION_MODIFIER. Losing or changing it breaks saved authentications.Verify how secrets are encrypted and where key material is held in the Tracecat documentation.
Latest release named in sourcesNot stated in our sources. Confirm the current edition and release with Tines.v2.3.0, published on GitHub on September 28, 2026.1.2.0, released on GitHub on October 16, 2026.

What a paid Tines edition adds beyond the 3-workflow Free limit

The main thing a paid Tines edition adds is the removal of the workflow cap. Tines lists its Free edition with unlimited users, spaces and connectors but only 3 live workflows, while its paid editions carry unlimited workflows and flexible deployment options. For a team that has outgrown three live workflows, that is the core change: the question shifts from which workflows fit the free tier to which deployment model and support level the organization needs. The Tines pricing page is the reference for current edition contents, so check it against what your team actually runs before you request anything.

Tines' pricing FAQ says flexible hosting options are available on request. That phrase matters if you need self-hosting, a dedicated environment or a specific region, because those options are not described as standard on the public pricing page. Ask for a written quote that states, for each paid edition: which deployment modes are included (cloud, self-hosted or hybrid), whether self-hosting is covered by the subscription or by a separate agreement, what support response levels apply, and who performs upgrades and backups in each mode. Do not treat a verbal answer as confirmation of any of these points.

Price is not stated here because no supplied figure exists. Your comparison should use the written quote alongside the cost of running a self-hosted alternative. Recurring costs in a Tines subscription are the license and support terms, while an open-source platform shifts recurring cost to servers, storage, maintenance and staff time. Confirm with Tines what is included in the quote, including any charges that depend on the number of stories, runs or environments.

How to deploy Shuffle to remove the workflow cap

This sequence takes a team from its current Tines workflow count to a self-hosted Shuffle deployment that runs more workflows than the Tines Free limit, with the secrets, high availability and identity setup a production instance needs. Each step ends with a check you can confirm before moving on.

  1. Inventory workflows and run volumes

    Before choosing any infrastructure, list every live Tines workflow, its triggers, the apps and credentials it uses, and how often each one runs. Your team lead or automation owner does this from the Tines workflow list and the event history. Confirm the output is a spreadsheet with one row per workflow, a named owner and a rough daily run count, because Shuffle licensing is priced on app runs, and that count drives your sizing and any paid tier decision.

  2. Choose the deployment architecture

    Read the Shuffle install guide and the architecture documentation, then pick one of the documented options: a single server with Docker Compose, distributed Docker Swarm, a hybrid with Shuffle Cloud and a local Orborus, or Kubernetes with Helm charts. Platform engineering leads this decision with the security team, since it sets who operates the servers. Confirm the choice in a written design note that names the hosts or cluster and the owner of each component.

  3. Provision hosts that meet the memory minimum

    Provision the hosts or cluster nodes for the chosen architecture, starting with the install guide's minimum of 4 GB of RAM for a Shuffle server. Infrastructure engineering does this in your own cloud account or data center, and the cost is the compute, storage and network you pay for, which recurs monthly or per contract term. Confirm each host meets the minimum and that the Docker or Kubernetes runtime starts cleanly before installing Shuffle.

  4. Replace the default Compose setup for scale

    The install guide notes that the default Docker Compose setup is not a scalable build without changes, so this step replaces it with a configuration sized for your workflow volume. Platform engineers adjust the Compose or Helm files, set resource limits and plan persistent volumes for OpenSearch. Confirm the stack comes up from your version-controlled files, not from the out-of-the-box defaults, and that a restart preserves stored workflows.

  5. Set and back up the encryption secret

    Set the SHUFFLE_ENCRYPTION_MODIFIER secret before saving any app credentials, because Shuffle uses it to encrypt saved app authentications and API keys in OpenSearch with AES-256. Store the value in your existing secrets manager and back it up under the same controls as other root keys. The configuration docs warn that losing or changing it breaks every saved app authentication, so confirm a restore test succeeds on a separate instance before relying on it.

  6. Configure OpenSearch and extra Orborus nodes

    For high availability, the configuration docs recommend an OpenSearch cluster, optional Memcached for a shared cache, NFS for shared files when running several backends, and more than one Orborus node so workflows keep running if one fails. Platform engineering builds these components and scales the backend and frontend across servers. Confirm by stopping one Orborus node in a test environment and checking that a scheduled workflow still executes on another node.

  7. Integrate single sign-on

    Connect your identity provider using the SAML or OpenID Connect options described in the Shuffle extensions documentation. Identity engineers handle the provider configuration and the security team reviews role mapping and enforcement settings. Note that SAML is being deprecated on Shuffle Cloud in favor of OpenID Connect, so new deployments should plan for OpenID Connect. Confirm that a test user signs in through the provider and that accounts without the right group cannot access the editor.

  8. Migrate and test workflows before switching triggers

    Rebuild each inventoried Tines workflow in Shuffle, recreating credentials in the app configuration and using premade apps or the App Creator where an OpenAPI specification exists. Run every workflow against test data and compare outputs with the Tines results. Move triggers one workflow at a time, starting with the lowest-risk, and keep the Tines version disabled as a rollback path. Confirm each workflow's test output matches the expected result before its webhook or schedule is repointed.

What running the platform yourself costs in time and skills

Self-hosting Shuffle removes the workflow cap, but the cost moves to your team. The recurring costs are the servers and storage for the frontend, the Go backend on port 5001, and the OpenSearch document database, plus at least one Orborus node that starts a worker for each execution. The Shuffle install guide sets a minimum of 4 GB of RAM for a single host, but it also warns that the default Docker Compose setup is not scalable without changes. Production sizing depends on workflow volume, execution frequency and retention, so ask a partner to size these from your actual Tines story inventory rather than from a generic figure. Shuffle's high availability guidance adds an OpenSearch cluster, NFS for shared files and more than one Orborus node, each of which is another component to pay for and patch. The skills cost is less visible. Someone must own OpenSearch health, index growth and backups, and the SHUFFLE_ENCRYPTION_MODIFIER secret. That key encrypts saved app credentials with AES-256 in OpenSearch, and the Shuffle configuration docs warn that losing or changing it breaks every saved app authentication. Store it in a secrets manager, back it up separately from the database, and test a restore before you go live. Upgrades are a second recurring task. Shuffle v2.3.0 was published on September 28, 2026, and the docs recommend the latest Docker tag for stable use and the nightly tag only for experiments. Pin a version, test upgrades in a staging copy and plan a rollback path.

The largest one-time cost is the workflow rebuild. Tines stories do not port automatically, so each story needs its HTTP actions, credentials, webhooks and schedules recreated as Shuffle workflows and apps. Effort depends on how many stories you run, how many use custom HTTP calls rather than prebuilt connectors, and how many need a new app built with the App Creator from an OpenAPI specification. Ask a partner to estimate this per story, with a test plan for each one before triggers move, because a missed trigger fails silently in production. On-call coverage is the cost most teams underestimate. A self-hosted SOAR that runs containment playbooks is now an operational dependency, so someone must respond when Orborus stops polling or the backend fails. For a fixed-scope quote, ask for: sizing and architecture options, OpenSearch and backup setup, the secret handling and restore procedure, an upgrade runbook for tag changes, the story-by-story rebuild plan with acceptance tests, and the on-call model and hours included after handover. Compare that written scope with the Tines paid editions and their hosting options, which the Tines pricing page describes.

What auditors and internal reviewers ask to see for a self-hosted SOAR

A self-hosted SOAR puts the platform, its credentials and its workflow logic inside your own control boundary, so reviewers will ask for records of how it was built, secured and recovered. The cards below list the evidence to prepare; auditors and certification bodies, not DeployOpen, decide whether that evidence meets any assessment criteria.

Deployed version and change records

Reviewers will want to know exactly which Shuffle release runs in production, which Docker tags were pulled, and how each upgrade was approved and tested. Shuffle's docs recommend the latest Docker tag for stable releases and the nightly tag for experimental changes, so a stable-only policy should be written down. Keep a dated inventory of image tags, the Orborus and backend versions, and the change ticket behind each one. Confirm with the vendor how security fixes are announced before you set your patch window.

Access control and SSO configuration

Shuffle added SAML single sign-on in version 0.9.16 and OpenID Connect in 1.0.0, with per-tenant SSO enforcement. Reviewers will check that administrator and analyst accounts sign in through your identity provider, that local fallback accounts are restricted and logged, and that role assignments match the duties of the people who edit workflows. Export the SSO settings and the list of accounts with admin rights as evidence. Because SAML is being deprecated on Shuffle Cloud, confirm the protocol you should use for any hybrid setup.

Encryption key custody for the modifier secret

Shuffle encrypts saved app credentials and API keys in OpenSearch with AES-256 using the SHUFFLE_ENCRYPTION_MODIFIER secret. Losing or changing that value breaks every saved app authentication, so reviewers will ask where the secret is stored, who can read it, and how it is backed up. Store it in a dedicated secrets manager with access logging, keep a sealed copy under dual control, and document the rotation procedure, which must include re-entering credentials. Test recovery by restoring to a separate environment before you depend on it.

Backup and restore tests

A backup that has never been restored is an assumption, not evidence. Reviewers will expect backups of the OpenSearch document database, the encryption secret, workflow exports and the Compose or Helm configuration, with a record of the retention period and who can delete backups. Schedule restore drills into a clean host, then check that workflows, saved credentials and execution history come back intact. Keep the dated drill results with the names of the people who signed off, so the evidence shows the restore worked, not only that a job ran.

High availability design

The Shuffle configuration docs recommend an OpenSearch cluster, optional Memcached for a shared cache, NFS for shared files when running several backends, and more than one Orborus node so workflows keep running if one fails. Reviewers will ask for a diagram showing which components are single points of failure and what happens when each one stops. Document the chosen architecture, whether single server Docker Compose, Docker Swarm or Kubernetes with Helm, and the reason it meets the availability your business requires. Note that the default Docker Compose setup is not a scalable build without changes.

Workflow test results and change approval

Each workflow that handles alerts or containment actions should have recorded test runs before it is switched to live triggers. Reviewers will look for test cases, expected and actual outputs, the approver for each production change, and proof that disabled or failed actions were investigated. Shuffle counts app runs for licensing on the open-source side, so keep execution logs that show what ran and when. Confirm with your own change board which test depth it requires for workflows that can isolate hosts or disable accounts.

Questions teams ask before moving off the Tines Free limit

What does it cost to self-host Shuffle compared with paying for Tines?

Self-hosted Shuffle has no per-workflow license fee on the open-source edition, but you pay for the servers, storage, the time to rebuild workflows and the people who run the platform. Tines charges for its paid editions, which add unlimited workflows and flexible deployment options, according to its pricing page. Shuffle's paid tiers are priced on app runs, meaning actions that actually execute, while users, apps and workflows are unlimited. Compare the recurring hosting and staff time against the Tines subscription, and ask any vendor for a written quote tied to your expected run volume. Your own environment and workflow count will decide which side is cheaper.

How long does a migration off the Tines Free limit take?

The duration depends mainly on how many live workflows you run, how many distinct external systems they call and how many credentials need re-entering. Shuffle needs its own installation, including OpenSearch and at least one Orborus runtime node, before any workflow is rebuilt. Each workflow then needs its actions mapped to Shuffle apps, its webhooks and schedules recreated and its outputs tested before triggers move over. Teams with a small set of workflows and existing API knowledge usually finish faster than teams with many custom integrations. Ask any implementation partner for a written timeline based on a workflow inventory, not a generic estimate.

Can our team run a self-hosted Shuffle platform without outside help?

Yes, many teams do, but it depends on whether they have people who can operate containers, databases and secrets. Shuffle documents installation with Docker and Kubernetes, and its default Docker Compose setup is not scalable without changes. High availability calls for an OpenSearch cluster, shared files for multiple backends and more than one Orborus node. Those tasks need ongoing patching, backups and upgrades. If your team lacks that capacity, a fixed-scope engagement or a retainer for upgrades and support is an option. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms in your own infrastructure, and scope, deliverables and timelines are agreed in writing before work starts.

What does the work need from our security and platform staff?

Expect to need people who understand your identity provider, network egress rules, container runtimes and the systems your workflows call. Shuffle's install guide states it needs a minimum of 4 GB of RAM, and a production setup adds database and storage planning. Secrets need careful handling: Shuffle encrypts saved app credentials with AES-256 using the SHUFFLE_ENCRYPTION_MODIFIER value, and losing or changing that value breaks every saved app authentication. Your staff will also own workflow review, change control and access rules. Ask any partner to list which roles are needed, how knowledge transfer is handled and what documentation you receive at handover.

Do we need Tracecat's enterprise features if we move off Tines?

Usually not for a first migration, but check the specific features against your requirements. Tracecat's core is AGPL-3.0 licensed, and its repository lists more than 100 prebuilt connectors. Multi-tenant workspace management, Git version control integration, and the authentication and single sign-on capabilities are described as enterprise features under a separate paid license. If you need several isolated tenants, Git-based change control or SSO, get the Enterprise Edition terms in writing before you design around them. If you only need workflow automation on a single workspace, the community scope may cover your needs.

What should we ask for in a written scope and quote?

Ask for a scope that lists the workflows in the migration, the platform components to be installed, the target deployment (Docker Compose, Kubernetes or a hybrid with Shuffle Cloud) and the high-availability design. Include who handles credential re-entry, testing, backups, upgrades and handover documentation. Request the assumptions behind each deliverable and the exclusions, such as custom app development or Tines features that have no direct equivalent. The quote should follow from that written scope, and the timeline should be tied to milestones you can verify. DeployOpen does not publish a price list, so use the scope to compare options.

Which Tines features might not carry over to a self-hosted platform?

Start with a full inventory of your live workflows, then map each Tines feature your team relies on to a Shuffle or Tracecat equivalent. Confirm whether each required connector exists as a premade app or needs an OpenAPI-based app or custom code. Check how webhooks, schedules and approval steps are recreated and how logs and event history are retained. Some Tines features may not have a direct match, so record those gaps in the scope before the migration starts. Confirm each mapping with the vendor documentation and a test run in your own environment.

How DeployOpen deploys Shuffle or Tracecat under a workflow limit

DeployOpen plans, implements, integrates, hardens, backs up, upgrades and documents self-hosted platforms inside the client's own infrastructure, including cloud accounts, data centers and air-gapped networks. For a team leaving the Tines Free edition, that work covers the platform itself, its identity integration, secrets handling and the operating runbooks that keep it running. Engagements are fixed-scope: the scope, deliverables and timelines are agreed in writing before any work starts, and ongoing support, upgrades and continuous testing are available as retainers. DeployOpen does not publish a price list, so a quote follows from the written scope rather than from a standard package.

In practice, the first decisions are architectural. For Shuffle, the reader needs to choose among a single server with Docker Compose, Docker Swarm, a hybrid with Shuffle Cloud and a local Orborus, or Kubernetes with Helm charts, and the install guide notes that the default Docker Compose setup is not scalable without changes. For Tracecat, the choice is between Docker Compose on one host, AWS ECS Fargate through Terraform, Kubernetes through a Helm chart, or an air-gapped Kubernetes deployment. Hardening work covers the SHUFFLE_ENCRYPTION_MODIFIER secret, which must be backed up and never changed, SSO configuration, and network paths for app containers. Confirm the current minimum resource and version requirements with each vendor before sizing hardware.

Backup and upgrade planning matter more once workflows run in production. Shuffle stores saved credentials in OpenSearch, so backup scope has to include the database and the encryption secret together. Tracecat depends on PostgreSQL, an S3-compatible object store and Temporal, so each needs its own recovery point. Ask any implementation partner, DeployOpen included, to document a tested restore procedure, an upgrade path between releases, and who on your side owns each runbook. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit report or certification. DeployOpen is not an official partner, reseller or certified provider of Shuffle or Tracecat.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.