Full audit history
The engine records every step of a process: who did what, when, and with which data. That record is the basis for traceability in financial services, and the reason for the name.
Coming soonOpen-source BPM for regulated industries
Every step, on record.
Fasti BPM is a business process management platform built on Camunda 7 CE. It runs your BPMN and DMN, keeps a full audit history, and adds the tooling the Community Edition never shipped.
Not released publicly yet. Source code and downloads will be published on this site.
Illustration of a recorded process instance, not a product screenshot.
- Base engine
- Camunda 7 CE 7.24.0
- Runtime
- Java 21 · Spring Boot
- Database
- PostgreSQL · H2
- License
- Apache License 2.0
Product
A process platform you can run, read and audit
One distribution with the process engine, a REST API and operations web apps, packaged as a single JAR. Everything Fasti adds lives in its own modules, separate from the base engine.
BPMN and DMN execution
Run BPMN processes and DMN decision tables on an engine proven over many years, with the namespace and APIs you already know.
REST API
Start processes, work on tasks and query state over REST at /engine-rest.
Operations web apps
Process monitoring, a task list and user administration ship with the distribution.
PostgreSQL or H2
Use H2 to try it in minutes; switch to PostgreSQL with one configuration profile.
Open source, Apache 2.0
To be released under the Apache License 2.0. At launch you can read the code, build it yourself and run it on your own infrastructure.
How it works
From model to record
-
1
Model
Describe the process in BPMN and the business rules in DMN, using the standard namespace.
-
2
Run
Deploy to the engine and drive it through the REST API or the web apps. Data lives in PostgreSQL.
-
3
Record
Each activity, decision and variable change is written to history as it happens, ready to be reviewed.
Architecture
- fasti-app
- The runnable distribution: engine, REST API and operations web apps.
- fasti-engine
- Fasti plugins and auto-configuration that attach to the process engine.
- Base engine
- Camunda 7 CE 7.24.0, the final Community Edition release.
Who it is for
Built for places where processes must be traceable
Banks and financial institutions
Regulated organisations that need every approval, every decision and every data change to leave a trail that can be reviewed later.
Teams running Camunda 7 CE
7.24.0 is the final Community Edition release. Fasti keeps the org.camunda.* packages, the BPMN namespace and the camunda.bpm.* configuration prefix, aiming to stay compatible with existing processes and integration code.
Development and operations teams
Java 21, Spring Boot, Maven and a REST API: integrate with what you have and extend through plugins instead of patching the engine.
The Fasti-maintained engine
What Fasti adds on top of the base engine
The Community Edition stopped at 7.24.0. Fasti maintains its own engine build based on that release to keep fixing bugs and upgrading libraries. The changes below are already in the main branch of the Fasti engine; the Fasti BPM distribution will move to this engine as part of the roadmap.
- Security fixes
- 5
- Stability bugs fixed
- 4
- Libraries upgraded
- 14
- Minimum Java (was 11)
- 17
| Component | Camunda 7 CE 7.24.0 | Fasti engine |
|---|---|---|
| Minimum Java | 11 | 17 |
| Spring Boot | 3.5.5 | 4.1.2 |
| GraalJS | 21.3.12 | 25.0.5.0.3 |
| Bouncy Castle | 1.47 | 1.87 |
| Jackson | 2.15.2 | 2.19.4 |
| SLF4J | 1.7.36 | 2.0.20 |
| Logback | 1.2.13 | 1.6.6 |
Security fixes included
AuthorizationPermission checks in the monitoring app
With any entry in disabledPermissions, monitoring queries skipped the read-permission check. The comparison is corrected so permissions are enforced as configured.
ExpressionsExpressions in task or-queries
Expressions nested in an or-query bypassed the engine's query validator. Every or-query is now validated with the same validator as the main query.
AuthorizationTask attachments and comments
Four REST endpoints that read, download or delete a single attachment or comment did not check permissions on the task. They now check them like the list endpoints do.
AdministrationFirst-time setup page
The page that creates the first administrator stayed open when administrators were configured outside the default group. It now closes for every way the engine defines an administrator.
RedirectsOpen redirect in a path filter
The filter that appends a trailing slash could send users to another host. It now redirects only for internal paths.
HardeningJavaScript engine options
Process variables whose names start with polyglot.js. are skipped when loaded into the script engine, so they cannot act as GraalJS configuration options.
Stability fixes
MemoryGraalJS context leak in BPMN scripts
Each JavaScript execution left contexts that were never closed. Each run now uses a single context and closes it when done.
MemoryGraalJS context leak in DMN expressions
The same problem in decision tables that use JavaScript expressions, fixed the same way.
ResourcesHTTP connector responses
Responses are always closed, including when there is no body or when output mapping fails.
FunctionScript results that are objects or arrays
A JavaScript script task whose resultVariable received an object or array always failed. The result is now stored as a Java collection.
Scope and limits. The comparison is with Camunda 7 CE 7.24.0 only. The bugs listed above were confirmed with regression tests against the source of that release. We do not attach CVE identifiers to these items and have not published performance or memory measurements. The Fasti engine requires Java 17 or later.
Roadmap
What we are working on and what comes next
Items labelled “Planned” have not been released; scope and order may change.
-
Phase 0In progress
Foundations
- A runnable distribution on H2 and PostgreSQL, with a sample process and tests
- Dockerfile and Maven Wrapper
- Public release of the source code and artifacts
-
Phase 1Planned
Operations and observability
- SSO/OIDC sign-in (Keycloak, Azure AD)
- Prometheus metrics and OpenTelemetry tracing for processes and jobs
- Helm chart for Kubernetes
-
Phase 2Planned
Audit for financial services
- Immutable audit trail: append-only, signed or hashed
- Audit reports per case and per customer
- Multi-tenant administration UI
-
Phase 3Planned
User experience
- Modern task list and form builder
- Web modeler
- Vietnamese user interface
-
Phase 4Planned
Extensions
- Caching and structured logs for ELK
- MCP server for the engine
- AI steps in processes (AI task)
- Connectors for Vietnamese banking systems: eKYC, core banking, digital signatures
-
Phase 5In progress
The Fasti-maintained engine
- Library upgrades and security fixes (see Engine)
- Advanced operations features, written independently
- A new user interface replacing the current web apps
FAQ
Questions, answered plainly
Is Fasti BPM available today?
Not yet. Fasti BPM is in active development and has not been released publicly. Leave us a note and we will tell you when it launches.
How does Fasti BPM relate to Camunda?
Fasti BPM is built on Camunda 7 Community Edition 7.24.0, the final Community Edition release. It is an independent project and is not affiliated with or endorsed by Camunda Services GmbH.
Will existing Camunda 7 processes keep working?
Compatibility is a design goal. Fasti keeps the org.camunda.* packages, the BPMN extension namespace and the camunda.bpm.* configuration prefix. The Fasti engine does raise the minimum Java version to 17.
What license will it use?
The Apache License 2.0.
Do the security fixes have CVE identifiers?
We do not attach CVE identifiers to the items on this page. They are described by what was wrong and what changed, and compared with Camunda 7 CE 7.24.0 only.
Be the first to know
Running processes on Camunda 7 CE, or looking for a traceable BPM platform for your organisation? Tell us what you need to solve and we will let you know when Fasti BPM launches.
Email us
contact@fasti.dev