Tines vs Tracecat: when each one fits your security automation
The core question is whether your team wants a managed, no-code product that the vendor operates, or a self-hosted platform that your own engineers run. A security or platform lead weighing a Tines renewal, a ceiling on the Free edition, or a hosting requirement should answer that first, because it decides almost everything else on the list. Tines fits teams that want stories built in a visual, no-code editor, that prefer the vendor to operate the service, and that can work within its paid editions. Tines lists a Free edition with unlimited users, spaces and connectors but 3 live workflows, and its pricing page says flexible hosting options are available on request. If you need a self-hosted deployment, ask the vendor in writing what that option includes, which version it supports, and what internet access the host needs, because those answers vary by contract.
Tracecat fits teams that want the platform under their own control. Its repository is licensed under AGPL-3.0, and its documentation describes self-hosted deployment with Docker Compose on a single host, on AWS ECS Fargate through Terraform, on Kubernetes through a Helm chart, and as an air-gapped Kubernetes deployment with no runtime internet access. It provides webhook-triggered workflows, case management, structured tables, and custom AI agents that can use tools and MCP servers. Code in its enterprise package and feature gates sits under a separate paid Enterprise Edition license, and multi-tenant workspace management, Git version control integration, and the single sign-on capabilities described as enterprise features are part of that tier. Confirm with Tracecat which features your deployment needs before you assume they are included.
The decision turns on three questions. First, who will run the platform: a vendor-managed service suits a team without capacity for upgrades, backups and on-call support, while a self-hosted platform needs named owners for Temporal, PostgreSQL and object storage. Second, where the data may live: if case data, credentials and alert payloads must stay inside your network, Tines needs a confirmed self-hosted path, while Tracecat can run in your own accounts or disconnected sites. Third, how many live workflows and paid features you need: count your production workflows now and compare them with the Free edition's 3 live workflows, then list the enterprise features you rely on, and ask both vendors to quote against that written list.
Which fits your team: Tines or Tracecat for each scenario
This table matches common buyer situations to the platform that fits better, and gives the condition behind each choice. Read each row against your own constraints: licensing, data location, staffing, AI tooling, identity needs and network access. Where a row favors one side, the reason names the condition that makes it true, so you can check whether it applies to you.
| Scenario | Better fit | Reason |
|---|---|---|
| Small team that stays within three live workflows | Tines Free | The Free edition includes unlimited users, spaces and connectors with 3 live workflows, so a small set of automations may run without a paid edition or a platform you operate. |
| Regulated team that must keep alert data on its own servers | Tracecat | Tracecat is AGPL-3.0 and documents self-hosted deployment on a single host, AWS ECS Fargate, Kubernetes or air-gapped Kubernetes, so alert data can stay in infrastructure you control. Confirm hosting terms with Tines if you consider its paid editions. |
| Team with no spare platform engineers | Tines | Tines runs as a managed cloud service, so the vendor operates the platform. Self-hosting either tool means your staff patch, back up and upgrade it, which is the cost to weigh against licensing. |
| Team that wants AI agents calling MCP tools | Tracecat | Tracecat documents custom AI agents with tools and MCP servers and names more than 50 hosted MCP servers in its repository. Confirm which MCP servers and agent features your edition includes before you commit. |
| Team that needs SSO and multi-tenant workspaces | Tines (confirm with vendor) | Tracecat names SSO and multi-tenant workspace management as Enterprise features under a separate paid license. Tines paid editions and flexible hosting are arranged through Tines, so ask for the written feature list for both. |
| Team that must run disconnected from the internet | Tracecat | Tracecat documents an air-gapped Kubernetes deployment with no runtime internet access. Tines self-hosting expects internet access on the host, so confirm any offline option with Tines before relying on it. |
How Tracecat workflows, cases and agents map to Tines stories
The core unit in Tines is the story, a graph of actions that receives events, transforms them and calls outside tools. Tracecat organizes automation differently. Its workflows start from triggers, and the most common one for security teams is a webhook trigger that receives alerts from a SIEM, an EDR console or a mailbox. Around those workflows sit three pieces that Tines users often manage in other places: case management for tracking incidents, structured tables for lookup and enrichment data, and custom AI agents that call tools and MCP servers. Tracecat also supports custom actions synced from Git, which is a different way to package reusable logic than building it inside the editor. Expect a workable first pass for most stories, but check each Tines action against a Tracecat workflow step rather than assuming a one-to-one copy.
Tracecat's documentation lists more than 100 prebuilt connectors and more than 50 hosted MCP servers, which matters if your Tines stories depend on a long tail of integrations. Count the connectors your highest-volume stories use and confirm each one exists in the current release, because a catalog count does not show whether a specific vendor API is covered. Git version control integration is named as an Enterprise feature, as are multi-tenant workspace management and the authentication and single sign-on capabilities described in the documentation. If your change control depends on reviewing workflow changes in Git, confirm with Tracecat which edition includes that before you plan the rollout.
Do not decide on the basis of a feature table alone. Pick three or four of your most valuable stories, including one with a case, one with a lookup table and one that calls an external API with credentials, and rebuild them on a trial deployment. Measure whether triggers fire as expected, whether case fields carry the data your analysts need and whether an agent produces consistent output with the tools you grant it. Record the gaps as you go. That test will tell you more about the migration effort than any mapping in this section.
Capability by capability: Tines and Tracecat compared
This table sets Tines against Tracecat across licensing, editions, hosting, workflows, cases, tables, AI agents, connectors, identity and Git integration. Where the supplied facts do not settle a point, the cell tells you what to confirm with the vendor. Use it to shortlist features, then test the rows that matter most to your team.
| Capability | Tines | Tracecat |
|---|---|---|
| Licensing | Proprietary commercial platform with a Free edition and paid editions | AGPL-3.0 for the core, with a separate paid Enterprise Edition license for enterprise features |
| Editions | Free edition plus paid editions with unlimited workflows | Open-source core plus Enterprise Edition for gated features |
| Workflow limits | Free allows 3 live workflows, with unlimited users, spaces and connectors | No live-workflow cap is stated in the supplied sources; confirm in the docs |
| Hosting | Cloud and flexible self-hosted options, which Tines says are available on request | Self-hosted via Docker Compose, AWS ECS Fargate with Terraform, Helm on Kubernetes, or air-gapped Kubernetes |
| Workflow automation | No-code stories with a visual editor | Webhook-triggered workflows on Temporal durable execution |
| Case management | Cases supported; confirm scope against your current edition | Built-in case management |
| Structured tables | Confirm table availability and limits with Tines | Structured tables included |
| AI agents with tools and MCP servers | Confirm agent and MCP capabilities with Tines | Custom AI agents with tools and MCP servers |
| Custom actions | Confirm custom action support with Tines | Custom actions synced from Git |
| Prebuilt connectors | Connectors included in all editions, including Free | More than 100 prebuilt connectors and more than 50 hosted MCP servers |
| Authentication and SSO | Confirm SSO tier with Tines pricing and sales | Authentication and single sign-on are listed as Enterprise features |
| Multi-tenant workspaces | Spaces included; confirm multi-tenant scope with Tines | Multi-tenant workspace management is an Enterprise feature |
| Git integration | Confirm version control options with Tines | Git version control integration is an Enterprise feature |
Where the data sits and who runs the platform
Tines and Tracecat both let a security team decide where workflow data, credentials and case records live, but they differ in how documented the self-hosted path is. The cards below set out the questions to settle before a proof of concept, from hosting model to network reach and audit evidence.
Where workflow data lives
Tines data sits in Tines-hosted cloud unless you take a self-hosted option, which Tines describes as available on request. Tracecat stores its data in PostgreSQL and an S3-compatible object store that you run. Ask Tines which regions and tenancy model apply, and confirm where story run history, webhook payloads and stored credentials are kept in each option. Map those locations against your data residency rules before any connector is turned on.
Tines hosting options
Tines lists paid editions with flexible deployment options, and its pricing FAQ says flexible hosting is available on request. That wording does not describe what a self-hosted install requires from your hosts, network or support. Ask Tines in writing for the supported platform, the internet access it expects from the host, the upgrade process and who operates the instance day to day.
Tracecat deployment paths
Tracecat documents four self-hosted paths: Docker Compose on a single host, AWS ECS Fargate through Terraform, Kubernetes through a Helm chart, and an air-gapped Kubernetes deployment with no runtime internet access. A single-host Compose install suits a pilot, while production usually points to Kubernetes or ECS. Your platform team owns the database backups, Temporal workers and object store, so decide that ownership before choosing a path.
Identity and single sign-on
Tracecat's documentation lists authentication and single sign-on as enterprise features, so check whether your planned edition includes SSO before you commit to local accounts for administrators. Tines identity options depend on its plan and deployment model, so confirm them in writing. Verify how each platform handles role mapping, service accounts for webhooks and offboarding of users who hold workflow edit rights.
Network access and trust boundaries
A workflow platform calls ticketing, identity, endpoint and cloud APIs, so its network position defines its blast radius. In a Tracecat deployment, you decide which egress paths the workers, sandbox and Temporal services can use, and an air-gapped Kubernetes install removes runtime internet access entirely. Ask Tines which outbound destinations its cloud or self-hosted option requires, and document the allow list for each option.
Audit evidence and assessment support
DeployOpen prepares systems, controls and evidence for compliance assessments, including access logs, change records and backup tests for the platform. It does not issue audit reports, attestations or certifications. Independent auditors and certification bodies perform that assessment. Ask each vendor which audit logs, retention settings and third-party reports it can provide, and agree on which evidence your own team must retain.
What a Tines or Tracecat program costs to run
A Tines program is mostly a subscription and a rebuild, while a Tracecat program is mostly infrastructure and people who run it. Both carry one-time migration work and recurring operating work, and the size of each depends on live workflows, environments and the availability you need.
Tines subscription and hosting
Tines is paid by subscription, and its paid editions remove the three live workflow limit of the Free edition. Its pricing page says flexible hosting options are available on request, so a self-hosted or dedicated arrangement is a separate negotiated item. Ask for each edition, the hosting model, the number of environments and any support tier listed separately in writing.
Tracecat infrastructure components
Your own cloud or data center bill covers compute, PostgreSQL, an S3-compatible object store and the services that run Temporal and the workers. Docker Compose on one host is the simplest footprint, while Kubernetes with the Helm chart or AWS ECS Fargate adds nodes, load balancing and managed services. Ask your team to size each component against your expected run volume and retention.
Platform operations and upgrades
Someone must patch the stack, rotate credentials, watch queues and restore backups on a schedule you can test. In a Tines subscription, the vendor operates the platform, so this time moves from your staff to a vendor invoice. Estimate the on-call coverage you need for the availability target you set, and confirm which upgrade and backup tasks the vendor or you own.
One-time workflow rebuild and testing
Rebuilding stories as Tracecat workflows, recreating HTTP actions, moving cases and testing each workflow before switching triggers is a one-time cost that scales with the number of live workflows. Plan a test window for each workflow, and count the staff hours for review. This cost is the same whether you stay on Tines or move, so separate it on your quote.
Connector and credential setup
Each integration needs a credential, a scope review and a tested action, and that work repeats for every environment. Tracecat ships more than 100 prebuilt connectors, which lowers build time for common tools, but custom internal APIs still need custom actions synced from Git. Ask who maintains credentials, how rotation is handled and whether connector updates are included in your support scope.
Tracecat Enterprise license and support
Some Tracecat features, including multi-tenant workspace management, Git version control integration, and authentication and single sign-on, are Enterprise features under a separate paid license. Support contracts are a further item if you want a vendor to answer for production incidents. Ask for the Enterprise license price, the scope of support and the renewal terms in writing before you assume a Tracecat program is free to run.
What a move from Tines to Tracecat involves
The sequence turns Tines stories into a tested set of Tracecat workflows, cases and tables on infrastructure you run, and ends with triggers switched over only after the new workflows have matched the old ones.
Inventory every Tines story and dependency
Export each story as a story file and list every story, its triggers, actions, credentials, cases, tables and any Tines pages it depends on. The security engineering lead or automation owner does this, with input from the teams that receive the outputs. The step is done when every live and paused story has a line in one inventory with its owner, its trigger type and the external systems it calls. Export format and content details should be checked against the current Tines documentation before you rely on them.
Choose the Tracecat deployment path
Decide between Docker Compose on a single host, the Helm chart on Kubernetes, the AWS ECS Fargate option through Terraform, or the air-gapped Kubernetes deployment, based on your hosting, network and operations skills. Confirm with Tracecat's documentation which components each path requires, including PostgreSQL, the S3-compatible object store and Temporal, and who will patch and back them up. The step is done when a written decision names the path, the owner of the platform and the hosting location for workflow data and credentials.
Stand up a non-production Tracecat environment
Install Tracecat in a staging environment that cannot reach production systems with live credentials. Configure authentication, decide which features need the paid Enterprise Edition, such as single sign-on or multi-tenant workspaces, and confirm the license position for your use. The platform team does this work. The step is done when a health check passes, a test user can sign in and a sample webhook workflow runs end to end in staging.
Recreate HTTP actions and credentials
Rebuild each Tines HTTP request action as a Tracecat action, using the inventory as the specification. Re-enter credentials in Tracecat's secrets handling, scoped to the least privilege each workflow needs, and rotate any credential that was exposed during the move. Developers and the security team do this together. The step is done when each action returns the same response shape in staging as the Tines original, and no credential is stored in a workflow definition in plain text.
Move cases, tables and agent tools
Map Tines cases and any lookup tables to Tracecat case management and structured tables, and define custom AI agents only where a stakeholder has approved their tools and MCP server access. Record which data is migrated, which is recreated by hand and which is left in Tines for reference. The step is done when case fields, table columns and agent tool permissions have been reviewed and signed off by the workflow owners.
Identify Tines-only features and assign a tool
Check the inventory for features that have no direct Tracecat equivalent, such as Tines pages, and assign each one to another tool or a manual process. Ask the Tracecat project or your own testing to confirm what is supported before deciding. The step is done when every gap has a named replacement or an accepted manual workaround, and the owner has signed off that no dependency is silently dropped.
Test each workflow against known alerts
Replay known alerts and historical events through each rebuilt Tracecat workflow and compare the outputs, case creation and enrichment results with what the Tines story produced for the same input. Security engineers run these tests and record every difference. The step is done when each workflow has a pass record for its test cases and every difference has been fixed or explicitly accepted.
Run in parallel, then cut over triggers
Run the Tracecat workflows alongside the Tines stories for a period agreed by the security team, with outputs compared but actions gated so that duplicate tickets or containment steps do not fire twice. Then move each webhook or schedule trigger to Tracecat one workflow at a time and retire the matching Tines story. The step is done when the parallel comparison is clean, each trigger has moved with a dated change record and rollback steps are documented for every workflow.
Which Tracecat deployment path fits your environment
Docker Compose on a single host suits a team that wants to evaluate Tracecat or run a contained workflow environment without a container orchestrator. It is the simplest documented path, and it keeps the number of moving parts small enough for a small platform or security team to operate directly.
- Host ownership: You provide one Linux host in your own data center or cloud account, with Docker and Docker Compose installed.
- Dependencies: Tracecat's stack includes PostgreSQL, an S3-compatible object store and Temporal, so confirm which of these the Compose file runs locally and which you must supply.
- Backups: You own backup and restore for the PostgreSQL data and object store. A single host is also a single point of failure.
- Secrets and TLS: You manage the encryption keys, environment secrets and certificates that front the web interface.
- Upgrades: You pull new images and apply them yourself on your own schedule.
Before you commit, ask Tracecat which Compose configuration it supports for production use, what host sizing it expects and how it recommends you handle upgrades and recovery.
AWS ECS Fargate through Terraform suits organizations already standardized on AWS that want infrastructure defined as code and no servers to patch. Your cloud team owns the account, networking and identity, and the Terraform modules provision Tracecat's components inside it.
- Cloud account: You provide the AWS account, VPC layout, IAM roles and the Terraform state location and access controls.
- Managed services: Confirm which data stores the modules create, such as managed PostgreSQL and object storage, and which you must bring.
- Change control: Terraform plans and applies become part of your change process, so review them like any other infrastructure change.
- Network placement: Decide whether the workflow environment reaches internal tools through private subnets, and document each egress path.
- Cost drivers: Your AWS bill grows with the compute, storage and data transfer the deployment consumes, and you pay that cost directly to AWS.
Confirm with the Tracecat documentation which AWS resources the Terraform module provisions, which versions of Terraform it targets and how it handles updates to existing state.
Kubernetes through the Helm chart suits platform engineering teams that already run clusters and want Tracecat deployed with the same tooling as their other services. It fits organizations that need high availability, namespace isolation and standard cluster policies, provided they have the operational skills to run the cluster itself.
- Cluster ownership: You provide and operate the Kubernetes cluster, including its upgrades, node pools and storage classes.
- Chart configuration: You set values for ingress, secrets, persistence and resource requests through the chart's values file.
- Stateful components: Confirm whether the chart deploys PostgreSQL, Temporal and object storage or connects to existing services, and who backs them up.
- Ingress and identity: Plan how users reach the interface and how single sign-on is configured, since the documentation lists authentication features as Enterprise features.
- Operations: Your platform team owns monitoring, logging and rolling upgrades of the release.
Ask Tracecat which chart version matches each Tracecat release and how it recommends you handle schema migrations during upgrades.
The air-gapped Kubernetes deployment, documented with no runtime internet access, suits sites where workflows, data and the cluster must stay disconnected from the public internet, such as isolated government or critical infrastructure networks. The operator must move every image, chart and dependency across the boundary through an approved process before the cluster starts.
- Artifact transfer: You provide an internal registry and a documented process to import container images and chart artifacts into the disconnected network.
- Integrations: Workflows can only reach internal tools, so each connector must point to an address inside the enclave, and any vendor API that requires internet access will not work.
- Updates: Every upgrade needs a new transfer cycle, so plan a release calendar and a rollback path in advance.
- Access and logs: Your security team controls who may import artifacts, and you must keep audit logs inside the enclave.
- Dependencies: Confirm which components need outbound access during install and which need it at runtime, since the documented model assumes none at runtime.
Ask Tracecat for the exact air-gapped installation procedure, the list of artifacts it requires and the supported way to update the environment without internet access.
What do buyers ask before moving from Tines to Tracecat?
Can our team migrate from Tines to Tracecat without outside help?
Yes, a capable internal team can rebuild workflows in Tracecat, provided it has people who can run containers or Kubernetes, manage PostgreSQL and object storage, and author Python or Tracecat workflow logic. The harder question is whether those people have time to run the platform after cutover. Many teams split the work: internal staff own the target environment and day-to-day operation, while an implementation partner handles the migration plan, rebuild and testing. Confirm your in-house skills against the deployment method you choose before committing.
What does the migration need from our team in skills, credential handling and testing time?
The work needs four things: someone who can deploy and patch Tracecat, someone who understands each Tines story's purpose, a process for moving API keys and tokens into Tracecat's secret handling, and time for side-by-side testing. Credentials deserve the most care because they are re-entered rather than copied, so inventory every connection first. Ask your team to list which stories are live, which fire on which triggers, and who owns each one. Testing time depends on how many live workflows you run and how many depend on external systems.
What makes the effort of a Tines to Tracecat move grow?
Effort rises with the number of live workflows, the number of distinct third-party connections, and how much logic depends on Tines-specific features. Workflows that use case handling, scheduled runs or custom code need more rebuild and review than simple webhook-to-ticket flows. Requirements for high availability, air-gapped operation or SSO also add infrastructure and configuration work. Your Tines export and an inventory of connections are the fastest way to size the work accurately.
Is a Tines Free account with three live workflows a good test bed for Tracecat?
It can be useful for comparing how stories and workflows translate, but it is not a full proof of production readiness. The Free edition allows 3 live workflows with unlimited users, spaces and connectors, which covers a small pilot. Use it to map a few representative stories, then run equivalent workflows in a Tracecat test environment with your real data flows and failure cases. Do not treat a pilot on one platform as a stand-in for the load, retries and access patterns of the other.
Does Tracecat's AGPL-3.0 license affect our internal use?
Tracecat's core is licensed under AGPL-3.0, and the repository states that code in its enterprise package and enterprise feature gates falls under a separate paid Enterprise Edition license. The AGPL is a copyleft license with obligations that apply when you modify and provide the software to others over a network. Internal use of an unmodified platform is generally a different question from offering a modified version to customers. Have your legal team review the license text and your specific use before rollout.
Which Tracecat features require the Enterprise license?
According to the Tracecat repository, multi-tenant workspace management and Git version control integration are Enterprise features. The Tracecat documentation also describes authentication and single sign-on capabilities as enterprise features. Confirm the current boundary with Tracecat before you plan, because feature gates can change between releases. Map each capability your Tines setup depends on against this list so you know which items carry a licensing cost.
How do we get a written quote for a Tines to Tracecat engagement?
Start with a written scope. List the Tines stories and their triggers, the connections that need credentials, the target deployment (Docker Compose, Helm on Kubernetes or an air-gapped install), the hosting location, and the testing and cutover expectations. Ask Tracecat about Enterprise licensing for any feature you need. DeployOpen does not publish a price list. Most engagements are fixed-scope, so a quote follows from the written scope, with scope, deliverables and timelines agreed in writing before work starts.
What does DeployOpen do for evaluation, implementation or migration?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, including cloud accounts, data centers or air-gapped networks. For this move, that can cover a fit assessment, deployment, rebuilding selected workflows, testing and documentation. Ongoing support and upgrades are available as retainers. DeployOpen does not issue compliance attestations, so any evidence you need for an assessment comes from independent auditors.
How DeployOpen helps you evaluate, implement and migrate
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For Tines vs Tracecat, we start by agreeing on which Tines stories and cases matter, then test whether Tracecat covers them in your environment before any migration work begins.
How we scope
- Inventory your live Tines workflows, triggers, credentials and case types before naming any target platform.
- Agree in writing which Tracecat deployment model fits your hosting, whether Docker Compose, Helm or air-gapped Kubernetes.
- Confirm which Tracecat features you need that sit in the Enterprise Edition, such as single sign-on or multi-tenant workspaces.
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
How we build
- Deploy Tracecat in your cloud account, data center or disconnected network, using the method your scope specifies.
- Rebuild priority workflows as Tracecat workflows, connecting HTTP actions and credentials through your own secrets handling.
- Configure webhook triggers, case management, structured tables and any AI agent tools against your internal systems only.
- Test each workflow with representative inputs and document the results before switching live triggers.
How we hand over
- Deliver architecture, configuration and runbook documentation for the deployment you chose.
- Document each rebuilt workflow, its owner, its inputs and its dependencies so your team can maintain it.
- Provide backup and upgrade procedures for the PostgreSQL database, object store and workflow engine in your environment.
- Prepare operational evidence for your compliance assessors, while independent auditors remain responsible for any assessment outcome.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Review Tracecat releases against your deployment and schedule upgrades with your change process.
- Re-run security testing of workflows, integrations and any AI agents after material changes.
- Request a quote based on your written scope, since DeployOpen does not publish a price list.
