Data breaches and operational downtime cost millions. See how COWE protects your organization with bring-your-own-key encryption, isolated script execution, and guaranteed transaction safety.
Unlike platforms that store tenant credentials and operational payloads in plaintext, COWE uses an envelope encryption architecture. Each tenant organization has a unique Data Encryption Key (DEK). When you enable an external KMS (AWS KMS, Azure Key Vault, or HashiCorp Vault), that DEK is wrapped by a Key Encryption Key that COWE never stores; deployments without an external KMS use a platform-managed key instead.
Data at rest is encrypted with AesGcm 256-bit Galois/Counter Mode, and secrets are decrypted only in volatile memory during step execution. Organizations using their own KMS can invoke crypto-shredding — revoking the wrapped DEK so encrypted historical records can no longer be decrypted.
To solve business logic extensibility without compromising tenant isolation, COWE provides dual execution tiers. Trusted internal script transformations evaluate in-process using optimized Roslyn AST compilation with infinite-loop cancellation token injection.
For untrusted or third-party logic, COWE runs scripts in on-demand, out-of-process Docker containers with no network access (--network none) and CPU/memory limits. In production, container isolation is required — an API node refuses to start if untrusted scripts would otherwise run in-process.
Workflows execute on a pull-based worker model over RabbitMQ, so throughput scales horizontally by adding worker nodes. Every state transition is persisted to PostgreSQL via EF Core, and a transactional outbox guarantees that a workflow's state change and the message that advances it commit atomically — no dropped or duplicated side effects if a node dies mid-step.
Long-running processes are dehydrated to the database while they wait (timers, human approvals, external webhooks) and rehydrated on wake-up, so a workflow can pause for seconds or months without holding a thread. Postgres advisory locks and optimistic concurrency keep a single instance consistent even when multiple workers compete for it.
COWE models the hard parts of real business processes natively. BPMN compensation lets a failed multi-step transaction unwind through explicitly modelled rollback steps in reverse order — reservation released, invoice voided — rather than leaving half-finished state. Steps can declare native retries with backoff for transient failures, and a dead-letter worker captures anything that exhausts its attempts for inspection and replay.
Triggers accept an idempotency key, so a retried "start workflow" call returns the existing run instead of creating a duplicate — safe to call from webhooks and at-least-once message sources.
Every tenant's workflows, definitions, secrets and audit logs are partitioned by organization and enforced with database-level query filters, so one organization can never read or act on another's data. Execution runs in a per-request/per-message scope bound to the owning organization, and connector credentials are decrypted only in volatile memory for the duration of a single step.
Authentication runs on ZITADEL with Enterprise SSO (SAML 2.0 / OIDC), so employees sign in with your corporate identity. On the Enterprise plan, SCIM 2.0 connects directly to Okta, Microsoft Entra ID and other providers to automatically provision and deprovision users. When someone leaves your directory, their COWE access is revoked the same minute — at both the application and identity-provider layers — so off-boarding is never a manual step you can forget.
The engine emits OpenTelemetry traces per workflow and per step, Prometheus metrics (active workflows, step latency, outbox throughput, worker health), and structured JSON logs correlated by instance ID. A visual replay tool lets operators step through any run, inspect variables at each node, and retry or resume from the point of failure — turning production incidents into a few clicks rather than a database surgery.
High-throughput operations leverage Redis 7 via IRedisCacheService. Organization plan features and entitlement metadata are cached with sub-millisecond lookups, while concurrent worker nodes acquire atomic distributed locks (SET key token NX PX 30000) released atomically via Lua scripts.
RabbitMQ consumers enforce message idempotency using Redis keys (cowe:idem:msg:{id}), ensuring zero duplicate executions even during network retries. If Redis is unconfigured, the system gracefully degrades to direct PostgreSQL queries.
Container health checks expose an explicit git-SHA build stamp via X-Build-Sha headers, validating live container image provenance before deployment.
Authorization rules (RequireOwner, RequireAdmin, RequireBuilder) are centralized in CowePolicies.cs in Cowe.Shared, consumed identically by the API host, Blazor WASM client, and integration tests to guarantee zero authorization drift.
All 144 production connectors — across Productivity, ITSM, Developer Tools, CRM, Marketing, Accounting, Logistics and Fintech — conform to a unified 3-pattern execution contract: