Open-source BPM engines compared

Flowable, Camunda 7 and Activiti are the main embeddable BPMN engines on the shortlist, and Camunda 8 is a different product under a non-OSI license. This page shows which engine fits which situation, based on maintenance status, Spring integration and migration effort.

On this page

Which open-source BPM engine fits your situation

If you run an existing Camunda 7 or Activiti estate, the first decision is whether you keep the Java engine you already have or move to a different platform. Camunda 7 Community Edition has stopped receiving releases and security patches, so an unpatched Community deployment is a risk you need to plan around, not a stable baseline. Camunda 7 Enterprise Edition is supported to April 9, 2030, with paid extended support through April 2032, so an organization that needs a vendor support path has a dated option. Flowable is the most direct embeddable successor for teams that want to keep BPMN process execution inside a Java application: its engines are Apache-2.0 licensed, and Flowable states that Camunda 7 and Activiti data can be migrated in place, including active instances and history. Confirm the exact migration steps with Flowable before you commit, using the free Flowable LEAP assessment tool.

If you are starting a new embeddable BPMN build on Java and Spring, the Spring Boot version you run should drive the choice. Flowable 8.0.0, released February 27, 2026, is built on Spring Framework 7 and Spring Boot 4 and drops Spring Boot 3 support, so a platform still on Spring Boot 3 needs a planned upgrade or a version 7 line. Flowable's Spring Boot starters and its /actuator/flowable endpoint support that style of build directly. Activiti is also Apache-licensed, integrates with Spring, and had its 8.8.1 release on July 14, 2026, but you should check its release cadence and support posture against your own requirements before adopting it.

Camunda 8 is not a drop-in replacement for an OSI-licensed engine. Its Zeebe, Operate and Tasklist source files sit under the Camunda License 1.0, which limits use to non-production environments and requires a commercial license for production. Choosing Camunda 8 is therefore a licensing and architecture decision as much as a technical one. Ask Camunda for the production license terms in writing, and ask whether commercial support is included, before you plan a migration. If you need a commercial support path with an OSI-licensed engine, weigh Flowable's paid platform and professional services against Camunda's terms. Whichever path you take, test your migration tooling and your Spring Boot version on a copy of production data first.

Which engine suits which scenario

This table matches five common situations to the engine that fits them best and names the condition that would change that choice. Read each row against your own release calendar, Spring version and license obligations, since the right answer often depends on a date or a dependency rather than on features alone.

ScenarioBest fitWhy and when it would change
New embedded BPMN build on Spring Boot 4Flowable 8.0.0Flowable 8.0.0 (released February 27, 2026) targets Spring Framework 7 and Spring Boot 4 and is Apache-2.0 licensed. It would change if your platform is pinned to Spring Boot 3, since Flowable 8 drops Spring Boot 3 support and Flowable 7 is the line that runs on it.
Existing Camunda 7 estate that must keep runningFlowable or a Camunda 7 fork, chosen by migration pathCamunda 7 Community Edition received no releases or security patches after 7.24 (scheduled October 14, 2025). Enterprise customers have support through April 9, 2030. Flowable offers an in-place migration path for Camunda 7 data, so confirm the migration plan and test it on a copy of production before choosing.
Existing Activiti estateFlowable, with an assessment firstActiviti is still released (8.8.1 on July 14, 2026) and its README describes a BPMN 2 engine for Java. Flowable publishes an in-place migration path for Activiti data. Stay on Activiti if your team has a documented reason to remain on it and its support model meets your needs, and confirm its maintenance outlook with the project.
Team that wants Camunda 8's cloud-native orchestrationCamunda 8, if production use is licensedCamunda 8 components such as Zeebe, Operate and Tasklist fall under the Camunda License 1.0, which limits use to non-production environments unless you hold a commercial license. The choice changes if you cannot obtain that license or do not want a commercial dependency for production.
Team that needs a paid vendor support pathFlowable commercial products or Camunda enterprise offeringsFlowable's open-source engines are Apache-2.0, and Flowable sells separate commercial products built on the same engines, with professional services offered separately. Confirm the support terms, response expectations and exit options in writing, since the open-source license alone does not include vendor support.

Flowable, Camunda 7, Activiti and Camunda 8 in brief

These four cards cover the Java BPMN engines most teams shortlist when they want a process engine inside their own application. Each card sets out the license, the latest supplied release and the main trade-off, so the license and maintenance status can be checked before the architecture comparison begins.

Flowable open source

Apache-2.0 engines for BPMN, CMMN and DMN, embeddable in a Java application or run as a service with Java and REST APIs. Flowable 8.0.0 was released on February 27, 2026, and it targets Spring Framework 7 and Spring Boot 4 with no backward compatibility for Spring Boot 3. The trade-off is that the upgrade path from Spring Boot 3 is a real change to plan for, and low-code modeling, visual debugging and governance sit in Flowable's separate commercial products. Confirm which of those capabilities your team needs before you assume the open-source engines cover them.

Camunda 7 Community Edition

Apache-2.0 Java BPMN engine whose repository is archived, with 7.24.0 as its last tag. Camunda's final feature release, 7.24, was scheduled for October 14, 2025, and no further releases or security patches are made for the Community Edition after that. The trade-off is that the engine, its API and its relational schema remain familiar to many teams, but running it unpatched shifts all future security and compatibility work to your own team or a fork. Enterprise Edition support runs on a separate, paid timeline.

Activiti

Apache-licensed BPMN 2 process engine for Java, designed to run in any Java application, on a server, on a cluster or in the cloud, with Spring integration. Activiti 8.8.1 was published on July 14, 2026, and its code base targets Java 21. The trade-off is that Activiti is distributed through the Alfresco-published website and its Activiti Cloud building blocks, so confirm the project's current governance, roadmap and support options directly with the maintainers before you select it as a long-term engine.

Camunda 8 platform

Not OSI open source. Zeebe, Operate and Tasklist are under the Camunda License 1.0, while the Java client, Spring Boot starter, exporter API and protocol modules are Apache-2.0. The license limits use to non-production environments such as development, testing and evaluation, so production use requires a commercial license from Camunda. The trade-off is a different architecture from Camunda 7 that calls for a migration project, with Camunda's Diagram Converter and migration tooling as the starting point. Camunda 8.10.4 was released on October 13, 2026.

Standards, maintenance and integration side by side

This table compares Flowable, Camunda 7 and Activiti on standards, license, release status, Spring and REST support, identity hooks, databases and commercial support paths. Camunda 8 is a different architecture and license, so its position appears in the license and maintenance rows. Treat this as a snapshot: check each project's current release page before deciding, and confirm any cell marked to confirm.

AttributeFlowableCamunda 7Activiti
BPMN, CMMN and DMN supportBPMN, CMMN and DMN engines are all included in the open-source distribution.BPMN, CMMN and DMN are supported. Camunda 8 is a separate product; confirm its CMMN and DMN scope before buying.Core is a BPMN 2 engine. Confirm CMMN and DMN support in the current release.
LicenseApache-2.0 for the open-source engines. Commercial products are sold separately.Apache-2.0 for the archived repository. Camunda 8 Zeebe, Operate and Tasklist use Camunda License 1.0.Apache license, per the Activiti README.
Latest supplied releaseFlowable 8.0.0, released February 27, 2026.Final feature release 7.24, last tag 7.24.0. Camunda 8.10.4 released October 13, 2026.Activiti 8.8.1, published July 14, 2026.
Maintenance statusActively released. The 8.x line is the current major version.Community Edition has no further releases or security patches. Enterprise support ends April 9, 2030.Master branch holds the current major version. Version 6.x changes go to a separate branch.
Spring and Spring Boot integrationSpring Boot starters for all engines and REST. Version 8 requires Spring Boot 4 and drops Spring Boot 3.Embeddable in Spring applications. Confirm supported Spring Boot versions for your target release.Integrates with Spring, per the Activiti README. Confirm supported Spring Boot versions.
REST APIJava and REST APIs, with a REST application available over HTTP.REST APIs shipped with the engine, alongside Tasklist, Cockpit and Admin.Not covered by the supplied facts. Confirm REST coverage in the current release.
Identity integrationIdentity service can be replaced by overriding or implementing IdmIdentityService, with an LDAP reference implementation.Confirm how user and group identity is wired in your deployment, including LDAP or SSO options.Confirm identity extension points with the project before design work starts.
Supported databasesH2, MySQL, Oracle, PostgreSQL, DB2 and Microsoft SQL Server are listed in the configuration docs.Relational database via MyBatis. Confirm the exact supported list for your release.Confirm the supported database list in the current release documentation.
Commercial support pathOpen-source users get a community forum. Professional services and partners are offered separately, along with commercial platforms.Enterprise Edition with long-term support on 7.24 and paid extended support through April 2032.Published by Alfresco Software. Confirm whether commercial support is available and from whom.

What Camunda's license change means for Camunda 7 users

Camunda 7 users need to separate two dates that are easy to conflate. The final Camunda 7 feature release, 7.24, was scheduled for October 14, 2025. After that date, Camunda makes no further releases or security patches for the Camunda 7 Community Edition, so any open-source deployment running it is on a fixed codebase that will not receive fixes for newly found vulnerabilities. The camunda/camunda-bpm-platform repository is archived on GitHub, with 7.24.0 as its last tag, which means the public source is no longer a place to expect changes.

The commercial path is different. Camunda extended the end of life for Camunda 7 Enterprise Edition to April 9, 2030. Release 7.24 is a long-term support line that receives updates twice a year, in April and October, and paid extended support is available from April 2030 through April 2032. Enterprise customers should confirm with Camunda exactly which patch and support terms their contract covers, and whether the extended support period is priced as a separate line item. Community users have no equivalent option in the supplied facts, so they should plan for either a commercial agreement, a community fork, or a migration path before their own risk tolerance is exceeded.

Camunda 8 is not a drop-in free replacement for Camunda 7. Its Zeebe, Operate and Tasklist source files are under the Camunda License 1.0, and that license limits use to non-production environments such as development, testing and evaluation. Production use requires a commercial license from Camunda. Only the Java client, the Spring Boot starter, the exporter API and some protocol modules are Apache-2.0. Before planning a production move, get the license terms in writing from Camunda and review them with your legal team, including how they apply to your hosting model and any internal tools that depend on the engine.

How each engine runs inside a Spring application

Flowable's engines are compact Java libraries, so the most direct path is to add the engine as a dependency and let it run in the same process as your Spring application. The Spring Boot starters cover all engines, the REST application, and the individual process, CMMN and DMN engines, so a team can include only the parts it needs.

  • Embedded JAR: The engine runs inside your application's JVM and uses your application's database configuration, so process work and application work can share one deployment unit.
  • Starter selection: Starters exist for all engines, for REST, and for each of the process, CMMN and DMN engines individually.
  • Monitoring endpoint: An actuator endpoint at /actuator/flowable exposes information about running processes for monitoring.
  • Spring Boot version: Flowable 8.0.0, released February 27, 2026, is based on Spring Framework 7 and Spring Boot 4 and drops Spring Boot 3 support. Teams still on Spring Boot 3 should look at the 7.x line, which the release notes tie to Spring Boot 3, or plan a dependency upgrade.
  • Identity integration: Identity management can be replaced by implementing the IdmIdentityService interface, and an LDAP reference implementation is provided.

Confirm the Spring Boot 4.x support statement in the current Flowable Spring Boot documentation and against your own dependency tree before you pick a version line.

How migration from Camunda 7 or Activiti to Flowable works

The first decision is whether an in-place move to Flowable is realistic for your estate, and that answer depends on an assessment, not on the engine's marketing. In a September 7, 2022 engineering post, Flowable says Camunda 7 and Activiti data can be migrated in place, including active process instances and history, and it offers the free Flowable LEAP tool to report ahead of time what a migration involves. Run LEAP, or an equivalent assessment with Flowable, against a copy of your production database before any cutover date is agreed. Confirm with Flowable whether the tool's output covers your specific Camunda 7 or Activiti version, since the post is the only supplied source for this claim.

Effort is driven by a handful of measurable factors. The number of running instances and the depth of history determine how long the data conversion and validation take. Custom Java delegates, listeners and scripts must be reviewed against Flowable's APIs, because the engine is not a drop-in replacement for the Camunda 7 Java classes. Identity handling is a separate workstream: Flowable's docs say identity management can be replaced by implementing the IdmIdentityService interface, so your user and group lookups must be mapped before testing. The database type matters too, since Flowable supports H2, MySQL, Oracle, PostgreSQL, DB2 and Microsoft SQL Server, and the MySQL precision note should be checked if you run an older MySQL. Finally, Flowable 8.0.0 requires Spring Framework 7 and Spring Boot 4 and drops Spring Boot 3, so any application that is not already on that stack needs its own upgrade plan.

The Camunda 8 path is a different kind of move. Camunda provides a Diagram Converter that analyzes Camunda 7 BPMN, DMN and form files, lists migration tasks and converts them to the Camunda 8 format, along with an AI agent skill that orchestrates the migration. These tools convert process models, so they change the artifacts, not the running engine. Running instances, history and the Java code behind your delegates still need their own plan, and Camunda 8's Zeebe, Operate and Tasklist fall under the Camunda License 1.0, which limits use to non-production environments, so a production license must be in place before go-live. Ask the Flowable and Camunda teams in writing which path they recommend for your workload, then set dates only after the assessment has produced a task list, a list of unsupported elements and a validated test plan.

How to choose and pilot a BPM engine

This sequence turns a shortlist of Flowable, Camunda 7 and Activiti into a documented decision backed by evidence from your own process inventory, license review and a pilot run against your real identity and database setup.

  1. Inventory existing process models and custom code

    Have the process owners and the engineering lead list every BPMN, CMMN and DMN file in use, the count of running instances, the timers and asynchronous jobs they depend on, and every custom Java listener, delegate, form or script that touches the engine. Include the REST calls that other systems make into the engine, because those become integration work. The step is done when the inventory names each model, its owner, its active instance count and its custom code, and when someone outside the project team has reviewed it for gaps. Ask each candidate vendor which of these artifacts they can read directly and which need conversion.

  2. Confirm target Java and Spring Boot versions

    Platform and application teams should record the Java runtime, Spring Framework and Spring Boot versions they must support for the next several years, then check each candidate against them. Flowable 8.0.0 was released on February 27, 2026 and is based on Spring Framework 7 and Spring Boot 4, dropping Spring Boot 3 support. Flowable 7.x runs on Spring Boot 3, so an application still on Spring Boot 3 has a different upgrade path than one moving to Spring Boot 4. The step closes when the team has a written version matrix for each candidate and a decision on whether the application upgrade is in scope for the project.

  3. Check each license against intended production use

    Legal, procurement and the engineering lead should review the license of each candidate against the planned production deployment. Flowable's open-source engines are Apache-2.0 licensed, and Flowable sells a separate commercial platform on top. Camunda 7 Community Edition no longer receives releases or security patches after 7.24, so an enterprise that needs vendor-backed patches must review Camunda 7 Enterprise terms. Camunda 8 components such as Zeebe are under the Camunda License 1.0, which limits use to non-production environments and requires a commercial license for production. Record the license decision, the named contact for any commercial quote and the date the review was completed.

  4. Run a migration assessment where it applies

    If the estate includes Camunda 7 or Activiti models and running instances, run the vendor's migration assessment before choosing a target. Flowable states that Camunda 7 and Activiti data can be migrated in place, including active process instances and history, and offers the free Flowable LEAP tool to report ahead of time what a migration involves. Camunda's own path to Camunda 8 uses the Diagram Converter, which analyzes Camunda 7 BPMN, DMN and form files and lists migration tasks. Ask each vendor to run its tool against a copy of your models, and treat the output as a list of work items to estimate, not as a finished migration. The step is complete when the team has the tool report and a list of models that need manual work.

  5. Build a pilot with real identity and database

    Build one representative process in a non-production environment that uses the same identity source, database type and deployment model planned for production. Flowable supports H2, MySQL, Oracle, PostgreSQL, DB2 and Microsoft SQL Server, and its identity management can be replaced through a custom IdmIdentityService implementation, with an LDAP reference provided. Confirm that user and group lookups for task assignment work against your directory, not a test list. The pilot is done when a human task is assigned through the real directory, the process runs on the production database type, and the team has written down any custom identity code it needed.

  6. Test async jobs and restart recovery

    Engineers should test timers, asynchronous jobs and recovery from node failure under load that resembles production. Flowable's async executor coordinates nodes through lock owners and lock expiration times stored in the database, so expired locks should be recovered and picked up by another node. Stop one application node during a batch of running timers, then confirm that the other node completes the jobs without duplicates or losses. Repeat the test for Camunda 7 and Activiti if they remain candidates, using each engine's own job executor documentation. The step closes with a test report that records the failure scenarios, the observed recovery times and any jobs that needed manual intervention.

  7. Decide on the support model

    Leadership, the platform owner and procurement should decide how the chosen engine will be patched, upgraded and supported after go-live. Options include the vendor's commercial support, a community support path, or an implementation partner under a written scope. Flowable offers a community forum for open-source users, with professional services and partners offered separately. Ask any vendor or partner for the release and support windows that apply to the version you plan to run, and compare them with your own patch policy. Record who is responsible for each upgrade and for security response, and get any commercial support terms in writing before the production decision is signed.

What do buyers ask before moving off Camunda 7?

How much does moving off Camunda 7 cost?

No single price applies to every team, because cost follows scope. The main components are internal engineering and testing time, any outside services you buy for analysis, conversion or implementation, the infrastructure and database that run the new engine, and licensing only if you choose a paid product. The Flowable open-source engines are Apache-2.0 licensed, so the engine carries no license fee, while Flowable's commercial products are a separate purchase. The biggest drivers are the number of process definitions, the amount of custom Java delegate and listener code, how deeply identity and authorization are wired in, and the size of the test suite. Ask any provider for a written quote that lists the process inventory assumed, the custom code in scope, the identity integration, the database, who owns testing, and which items recur, such as support and upgrades.

How long does a Camunda 7 migration take?

The timeline depends on an inventory you do not yet have, so no duration applies until one exists. It is set by the number of models, how much custom code must be rewritten, whether running instances must move or can finish on the old system, the state of your test coverage, and how many integration points change. Running instances usually drive the schedule most. Flowable states that Camunda 7 data, including active process instances and history, can be migrated in place, but confirm that against your own versions and data before relying on it. Camunda's Diagram Converter analyzes Camunda 7 BPMN, DMN and form files and lists migration tasks, which helps size the work early. Ask for a phased plan with a cutover approach for in-flight work and a rollback path, and confirm dates in writing before work starts. Flowable's migration article describes the in-place approach.

What skills does our internal team need for the move?

Your team needs Java engineers who know the application's deployment model, whether embedded in Spring, a servlet container or a standalone service. You also need a named owner for the BPMN, CMMN and DMN model inventory, an identity and access owner for the authorization model, a database administrator for schema and connection changes, a QA owner for regression testing, and a platform owner who runs the new engine after go-live. Version choice affects skills. Flowable 8.0.0 is based on Spring Framework 7 and Spring Boot 4 and drops Spring Boot 3 support, so an application still on Spring Boot 3 must also be upgraded. Confirm the Flowable release line against your framework roadmap, and decide early who will answer for production incidents during the transition.

Can we migrate off Camunda 7 without outside help?

Yes, a team with Java and BPM experience can do this internally, especially for a modest process inventory with limited custom code. The migration tools are public: Camunda's Diagram Converter and Flowable's free LEAP assessment tool can show what a move involves before you commit. Outside help is most useful where the internal team lacks recent engine experience, where the process count or custom code is large, or where a production cutover must happen with little room for error. DeployOpen plans, implements, customizes, integrates, documents and supports self-hosted open-source platforms inside the client's own infrastructure, and most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. Ask for a written scope that shows which tasks your team keeps.

Is Camunda 7 still safe to run after end of life?

It depends on which edition you run. Camunda 7 Community Edition receives no further releases or security patches after the final feature release, 7.24, which was scheduled for October 14, 2025, and the camunda-bpm-platform repository is archived with 7.24.0 as its last tag. Running that edition means carrying the security risk yourself. Camunda 7 Enterprise Edition has a later end of life, April 9, 2030, with 7.24 as a long-term support release that receives updates in April and October, and paid extended support available from April 2030 through April 2032. Confirm the exact version and contract terms with Camunda, and map the choice to your risk appetite and audit commitments. Your options are staying on a supported edition, moving to Flowable, moving to Camunda 8, or adopting a community fork.

Can we run Camunda 8 in production under its license?

Not under the Camunda License 1.0 alone. The Zeebe, Operate and Tasklist source files are under that license, which limits use to non-production environments such as development, testing and evaluation. Production use requires a commercial license from Camunda. The Java client, Spring Boot starter, exporter API and protocol modules are Apache-2.0, but they do not change the terms for the runtime components. Camunda 8 is also a different architecture from Camunda 7, so moving to it is a re-platforming project rather than a version upgrade. Ask Camunda for the commercial terms for production in writing, and include the license cost and the platform work in any comparison with Flowable.

Do we need Flowable's commercial products to run Flowable?

No. The Flowable open-source engines are Apache-2.0 licensed, support BPMN, CMMN and DMN, run embedded in a Java application or as a service, and expose Java and REST APIs. Flowable's commercial products, including Flowable Work, Engage, Orchestrate and Design, are built on the same engines and add low-code modeling, visual debugging, security controls, monitoring and governance. Open-source users get a community forum, while professional services and partners are offered separately. If you need those capabilities, you either buy them, build them or accept their absence. Identity can be handled without a paid product, because the Flowable docs describe replacing the identity service and provide an LDAP implementation as a reference. Confirm which of those capabilities your operating model needs before you decide.

How DeployOpen scopes BPM engine selection and implementation

DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For BPM engine work, that means starting from a written scope that fixes which engine, which process models and which systems are in play before any build begins.

How we scope

  • Written scope agreed before work starts, covering engine choice, process inventory and target runtime
  • Review of existing BPMN, CMMN and DMN assets to confirm what can move and what must be rebuilt
  • Confirmation of identity, database and hosting requirements inside your cloud, data center or air-gapped network
  • Quote derived from the written scope, since DeployOpen does not publish a price list

How we build

  • Embedding or service deployment of the chosen engine, configured for your relational database and runtime
  • Integration with your identity source and the Java or REST APIs your applications call
  • Security testing of the engine, its APIs and the processes that expose them before go-live
  • Compliance readiness work that prepares systems and evidence, without issuing any audit report or certification

How we hand over

  • Documentation of deployment, configuration, upgrade steps and process model ownership
  • Backup and restore procedures tested against the engine's database and persisted process instances
  • Knowledge transfer sessions with the engineers who will operate and change the workflows
  • Handover record listing open items, versions in use and the support window for each component

How we support

  • Ongoing support, upgrades and continuous testing available as a retainer after handover
  • Upgrade planning that tracks the vendor's support window and any required framework changes
  • Periodic retesting of the engine and integrations as your process estate grows
  • Clear boundaries on which tasks sit under the retainer and which need a new fixed-scope engagement

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.