Turn processes into progress.
Open-source business process management for modeling, automating, governing and improving workflows,
where the approved SOP is the running process.

---

Status: pre-release. Procera 0.1 is being polished: the governed-document loop below works end to end in the browser and is covered by end-to-end tests, but there is no packaged release yet. Build from source to try it. Website: https://casualoffice.github.io/Procera/

What works today (0.1)

Write a policy or SOP → review (separation of duties) → approve → publish → everyone acknowledges → audit

• Library: policies and SOPs with a block editor, versions with word-level compare, review cycles, collections, applicability, starter template packs, Word/HTML/Markdown export.

• Review and publish: reviewers never approve their own work, step-up for controlled documents, scheduled go-live, reason for change.

• Acknowledgements: campaigns bound to the exact version, reminders and manager escalation, new joiners included, evidence export; announcements with confirm-by dates.

• Audit: every change in a tamper-evident hash chain, an audit explorer with filters, timelines and exports.

• Running a workspace: guided setup, people, departments and groups, roles (built-in, custom and job presets), settings by category, branding, encryption keys, retention; leaving the organisation hands documents and reports over and closes their acknowledgements as "left".

• Files: attachments with malware scanning, in-app preview of PDF, Word and spreadsheet files.

• Accounts: passwords with reset links, two-step verification (authenticator apps, passkeys), admin account controls; invitation links can be copied when email isn't set up.

• Self-hosting: Docker Compose stack and guides, email (SMTP) set up from the system console, many workspaces on one server, PostgreSQL row-level isolation per workspace.

• Works on phones: a bottom bar for the everyday pages.

• Requests and approvals (0.2, first slice): leave, expense, purchase and access requests with forms; approvals routed to the requester's manager, finance, the CFO or IT; a My Work inbox to approve, reject or send back; a request page with steps and timeline. Designing your own workflows, e-signing and cases are planned, not built yet.

• Decide several at once (0.2): in My work, filter approvals, tasks and acknowledgements, then approve or reject several plain approvals together after a preview; each one is decided on its own, so anything decided elsewhere meanwhile is reported, never overwritten.

• Delegate and send back (0.2): hand a step you hold to a colleague with a note, or send a request back to an earlier approver (finance back to the manager) instead of all the way to the requester; separation of duties still applies.

• Request conversation (0.2): comment on any request you can see, write internal notes the requester never sees, @mention colleagues (only people who can see the request) and watch a request to follow it; everyone involved is told in-app and by email.

• Operations (0.2): Admin › Operations separates technical incidents (a step that couldn't run, a reminder that kept failing) from business exceptions (steps with nobody, overdue, people away holding work); incidents are retried or dismissed with a reason, and both are audited.

• Team workload (0.2): managers get a Team page (their reporting line from the directory): open, overdue and due-this-week steps per person, who is away holding work, and bulk reassign within the team; admins see everyone under Requests oversight › Workload.

• Out of office and request settings (0.2): set an out-of-office with a delegate from the account menu (your avatar shows it, and colleagues see it on hover cards and Members) (or an admin or manager sets it for you); new approvals go to the delegate, who can also decide what's already waiting, recorded "on behalf of". Admins choose which request types are offered, who can ask for each, and the currency amounts are in.

• Why this route (0.2): every request page explains in plain words why it went where it went ("Sent to Finance approval because the amount 640.00 EUR is over 500") and why each person decides; approvers see why a step is theirs.

• Who approves, attachments and policy (0.2): the request form says who will approve before you send ("Olivia Owner (your manager), then Finance if the amount is over 500 EUR"); every request type takes files (receipts, quotes, certificates, photos), scanned and previewable by the people on the request, and approvers can attach files with their decision; a request type can link its governing policy, and each decision records the version the approver saw.

• Employee onboarding (0.2): HR or a manager starts onboarding for a new member; IT, Facilities and the new member's manager each get their task at the same time, in any order, and the request page shows them side by side; when all three are done the new member confirms they have their equipment and have read the handbook, and the request ends "Onboarded".

• Reminders and escalations (0.2): approvers are reminded before and at the due date; an overdue manager approval moves up to the next manager; admins see unassigned and overdue steps under Admin › Requests oversight and reassign them with a reason.

Evidence, not just status: everything above is covered by automated end-to-end tests that run on every full test pass; nothing has been validated in a pilot with outside users yet. The tracker shows status and evidence separately.

Try it

Needs Rust (see rust-toolchain.toml), Node 20+ and PostgreSQL 16 binaries on your PATH.

./scripts/demo.sh        # throwaway database + API + web app, seeded "Acme" workspace; prints sign-in details
./scripts/test-all.sh    # the full gate: fmt, clippy, Rust tests, web checks, browser end-to-end tests

Self-hosting

Run Procera on your own server with Docker Compose (PostgreSQL 16, the server and the web app; Valkey, ClamAV and a test mail inbox are optional). Files are stored on local disk today; S3-compatible storage is not built yet.

cp deploy/.env.example deploy/.env      # fill in the passwords and the master key
docker compose -f deploy/compose.yml up -d --build
docker compose -f deploy/compose.yml logs procera | grep bootstrap_token   # then open /setup

• Install with Docker Compose: prerequisites, HTTPS, backups, upgrades, troubleshooting
• First-time setup: from the setup token to your first published policy
• Configuration: every server option, settings in the app, security notes

What is Procera?

Procera is a modern, open-source business process management platform. It helps organizations design, automate, govern and continuously improve their business processes, end to end. It is built for any size, from a 10-person startup to a multinational, and for every department.

Design	Execute	Govern	Improve
Model and document processes, SOPs and policies	Automate work across people and systems	Ensure compliance, control and visibility	Gain insights and continuously optimize

In one place, Procera brings together:

• Policies & SOPs on a governed lifecycle (draft → review → approved → scheduled → published → retired), with segregation of duties, version diffs, review dates and PDF export.
• Workflows without code. A step builder, typed forms, approvals (sequential, parallel, quorum, approval-limit matrices), SLAs on business calendars, delegation and out-of-office, recall and send-back.
• Employee document signing. Bulk send to groups, accessible signing on any device, and a certificate of completion.
• Announcements & acknowledgements. Targeted, scheduled, mandatory reads with reminders and manager escalation.
• Cases & investigations. Flexible cases, restricted HR cases, evidence chain of custody, legal hold.
• Admin control centre. Dashboards, and every list as a sortable, filterable data grid with saved views and export.
• Complete audit trail. Every action and every sensitive read is recorded in a tamper-evident hash chain, with an audit explorer and verifiable evidence exports.
• Industry-standard templates. About 55 ready-made processes across HR, Finance, IT, GRC, Quality, Legal and Operations, plus industry packs.

Procera is standalone. It needs only PostgreSQL, S3-compatible storage and SMTP. Integrations (SSO/SCIM, webhooks, chat platforms, HRIS, ERP, qualified e-signatures) are optional layers added later.

Why Procera

• Governance and execution live in separate tools today. Process documentation suites don't run the work, and workflow tools don't govern it. Procera does both, in the open.
• The open-source BPM field has emptied. Major OSS engines have gone end-of-life or source-available, and the remaining ones ship without a business UI (analysis).
• Self-hosting and sovereignty. Apache-2.0, workspace-level isolation and encryption keys, air-gapped installs, and no telemetry by default.

Design highlights

Area	Approach
Multi-tenancy	Workspace = tenant, with a System Admin console over all workspaces. Isolation is enforced in the app, by PostgreSQL row-level security and by per-workspace encryption keys.
Access control	A permission catalogue, built-in role templates and custom roles per workspace, scoped to departments or collections, evaluated with Cedar policies
Runtime	A versioned workflow IR, pinned release bundles, a transactional outbox, idempotent commands and leased timers. Deterministic and conformance-tested.
Data	PostgreSQL 16+ is the only system of record (why not MariaDB). Valkey/Redis is a cache only. Any S3-compatible object store.
Security	OWASP ASVS 5.0 L2 (L3 for auth, sessions and crypto), MFA/passkeys, step-up auth, Standard Webhooks, an SSRF egress proxy, malware scanning, signed releases with SBOMs
UX	Easy for everyone, powerful for owners. WCAG 2.2 AA design tokens, configurable branding with contrast enforcement, a calm editorial look (no generic "AI-SaaS" styling).
Quality	Unit, property, conformance and chaos tests, plus end-to-end test packs that gate every release

Roadmap

Version	What it adds
0.1 (done)	The governed-document loop above, polished for small companies
0.2	Requests and approvals: built-in leave, expense, purchase, access and employee onboarding requests, reminders, escalations, out of office and request settings are in
0.3 (now)	Guided Studio: design a process from a template or blank (form fields, approval and task steps, who, deadlines and reminders, conditions), validate it, test-run it with sample answers, and publish it — it then appears under New request. The form builder adds help, defaults, ranges, longest answers, “show only when” questions and data classification, with a desktop/phone preview; the server enforces the same rules. Release bundles pin every published version. A flow canvas draws the process as a diagram, and each step shows who it will go to today.
0.4 (started)	Automation and integrations: SSO/SCIM, webhooks and API, email approvals, e-signing. In: approving or rejecting from the email (single-use links to a confirm page), webhooks (signed events to your systems, with retries and a delivery log), e-signing (send a PDF to people in order or at once, click-to-place fields, a guided signing page with typed or drawn signatures, a signed copy with a certificate of completion), personal API tokens (Account › API tokens), scoped to permissions you pick, revocable, never approving or signing, and single sign-on with OpenID Connect (Admin › Single sign-on: trusted email domains, optionally required, owners keep a break-glass sign-in)
0.5 (started)	HR time and attendance (docs/25). In: holidays and work locations, leave types and policies with balances you can explain, and requesting time off against them (held while decided, taken on approval), a team calendar (colleagues see only "Out") and an org chart. Next: shifts and rosters, clock-in attendance, regularization, monthly attendance reports
0.6	Analytics and improvement: reports, process insights, cases and investigations
Later	Payroll calculation and releasing documents to people (payslips, letters)
1.0	Hardened, audited, multi-language

Live progress: the tracker dashboard and the website roadmap. Each release is gated by its end-to-end pack.

Documentation

Start at docs/00-INDEX.md.

For self-hosting, configuration and the HTTP API (with an API reference generated from the router and an OpenAPI document), see the developer docs.

Topic	Docs
Product	PRD · Feature catalogue · Templates · Competitive analysis
System design	HLD · LLD · Workflow IR · Access model · API · ADRs
Security & compliance	Security & operations · Data governance & compliance · AI assistance
UX	UX & design system · Workspace configuration
Self-hosting	Install with Docker Compose · First-time setup · Configuration
Delivery	Tracker dashboard · Roadmap · Tracker detail (xlsx) · Test strategy · E2E plan · Open questions
Ways of working	Engineering rules · Contributing · Governance

Repository layout

apps/procera/   the server binary: API, worker, scheduler, admin CLI
crates/         Rust crates: access, audit, identity, members, library, campaigns, announcements,
                files, keys, crypto, notify, search, settings, platform, db, cache, engine, runtime, ir, expr
migrations/     PostgreSQL migrations (forced row-level security on every workspace table)
web/            React + TypeScript app (React Aria)
e2e/            Playwright end-to-end packs (API and browser)
conformance/    workflow runtime conformance fixtures
deploy/         Docker Compose (self-hosting and E2E), web/proxy image, SQL roles
site/           the website (static, generated from tracker data)
docs/           design pack (00–24) and ADRs
assets/brand/   logos and brand guide (not Apache-licensed)
scripts/        demo, full test gate, tracker generator
trackers/       generated delivery tracker (do not hand-edit)

Contributing

Contributions are welcome, from humans and from AI-assisted workflows. Please read:

• CONTRIBUTING.md
• the binding engineering rules
• the Code of Conduct

Every commit is DCO signed-off. Security issues go privately via SECURITY.md.

License

Procera's source code is licensed under the Apache License 2.0. See NOTICE. The Procera name, logo and brand assets in assets/brand/ are trademarks of CasualOffice and are not covered by the Apache licence (governance).