Onboarding / offboarding
HR signal → identity provisioning → device assignment → access request approvals → asset register update → A.6.1 (employment terms) + A.5.16 (identity) evidence.
Pillar · Workflows
A workflow engine for the work you actually do.
Orchestrate the boring stuff: approvals, escalations, evidence collection, ticket routing, runbook execution. Trigger from anything in the platform — a control failure, an incident, a stage gate, a schedule, a webhook.
34 built-in activities 5 language SDKs BPMN 2.0 Saga + retries + idempotency Approval gates
Built-in activities
Composable steps you wire together with a visual designer or YAML. All activities support retries, timeouts, idempotency keys, structured errors, and OpenTelemetry tracing.
Connectivity
- HTTP / GraphQL
- SSH / shell exec
- LDAP
- Database (Postgres, MySQL, MSSQL)
- Webhooks (in/out)
Communications
- Email (SMTP + 18 providers)
- SMS (19 providers)
- Slack / Teams
- WhatsApp (Twilio + Meta Cloud)
- Push notifications
Documents + data
- CSV / XML / JSON transform
- Markdown / HTML extract
- PDF extract
- OCR
- Compress / encrypt
Control flow
- Conditional / loop
- Wait / polling
- Cron schedules
- Parallel + fan-out / fan-in
- Saga compensations
Human-in-the-loop
- User task / approval
- Multi-step review (CAB style)
- Escalation timers
- E-signature
- Callback
Platform
- Entity CRUD
- Notification (email + in-app)
- Audit / evidence emit
- Terraform run
- Translate / geocoding
Polyglot SDKs
Write activities in the language your team actually ships in.
TypeScript
~56 activities
Kotlin / Ktor
~37 modules
Go
~38 activities
Rust / Axum
58 activities
Python
~36 activities
All SDKs share the same wire protocol, the same retry semantics, the same idempotency stores (in-memory / Redis / Postgres), and the same OpenTelemetry instrumentation. Resilience is a decorator, not a node.
Common workflows
Vendor risk review
New supplier → questionnaire → SOC 2 + ISO 27001 doc collection → risk score → DPA generation → quarterly review schedule. Maps to A.5.19–A.5.22.
Access recertification
Quarterly campaign → manager review → revoke uncertified access → exception log → A.5.18 evidence pack.
AI model deployment
Model registered → impact assessment → bias / safety tests → human-oversight plan → release gate → ISO 42001 A.6 lifecycle evidence + EU AI Act conformity record.
Incident response
Alert → triage → containment playbook → comms → post-incident review → CAPA. Maps to A.5.24–A.5.30.
Continuity exercise
Schedule → tabletop or live → outcome capture → action plan → A.5.29–A.5.30 evidence.
Stop wiring Zapier, Make, and a half-broken Jira automation together.
One engine. One log. Activities that already know about your services, your CIs, your controls, and your people.