Overview

Shuffle was created to address automation needs in the CERT/SIRT community, with an aim of helping security operations centers share processes, automations, and detections. Its visual workflow designer is paired with a no-code app creator that can generate integrations from Swagger/OpenAPI specifications or API documentation URLs. That gives teams a way to bridge APIs beyond the ready-made catalog, although custom Python apps are not yet easy to create for Shuffle Cloud; on-premises instances support local app hotloading.

Deployment is unusually flexible for a security automation platform: teams can choose self-hosted open source, self-hosted licensed, Shuffle Cloud SaaS, or a documented hybrid arrangement. Runtime guidance covers Docker Compose, distributed Docker Swarm, a cloud-hybrid setup with a local Orborus runner, and Kubernetes through Helm charts. This breadth is useful for organizations with established infrastructure preferences, but it also means buyers should match the deployment model to their operational capacity rather than assume every option has the same management burden.

Key features

The public app catalog lists more than 2,500 integrations, including Slack, Gmail, MISP, Wazuh, Splunk, and Jira. That range can help security teams connect alerts, case-related tools, and communications without building every connection from scratch. The no-code app creator adds flexibility for API-based integrations, but cloud teams that require custom Python app development face a meaningful limitation.

Workflows can begin with webhooks, schedules, subflows, or user input; extensions add triggers for AWS Lambda, AWS S3, Kafka, and Pub/Sub. Shuffle also supports approval steps, scheduled runs, event triggers, incident integrations, and audit logs. In practice, that combination accommodates both automated event response and processes that need a human checkpoint or traceable activity.

Shuffle describes its API as API-first and documents Bearer-token authentication for cloud and on-premises installations. Its architecture documentation says passwords are bcrypt-hashed and app authentication, protected datastore keys, and files are AES-256 encrypted. Tenant-controlled SAML/SSO and MFA are documented, with Okta, Auth0, PingID, and AzureAD named as supported platforms. For AI requests, Shuffle says cloud traffic is routed to regional model endpoints with tenant contexts isolated; on-premises installations can use local models without external requests.

Pricing

Scale: Free, billed monthly. It includes 2k App Runs, 3 tenants, 1 location, and 98.2% feature coverage. The 2,000 monthly runs are a hard cap, making Scale useful for evaluation or smaller workloads but a poor fit for automations that cannot pause or exceed quota. No support or onboarding is included.

Business: custom pricing, with App Runs starting at 300k under a soft limit. It includes unlimited tenants, locations, and branding, 100% feature coverage, onboarding and setup, and coverage for 3 use cases. SLA and email support are included. This is the more appropriate tier for organizations with substantial volume and a defined set of supported use cases.

Enterprise: custom pricing, also starting at 300k App Runs under a soft limit. It includes unlimited tenants, locations, branding, and use cases, plus 100% feature coverage, professional services, onboarding and setup, and SLA, email, on-call, and alert-mechanism support. It is aimed at larger or more demanding deployments that need broader service coverage than Business provides.

Platforms

Shuffle supports API, Linux, self-hosted, and web environments. The choice between SaaS, self-hosting, and hybrid deployment lets teams align execution with their infrastructure and data-handling needs, while Kubernetes and distributed Docker options support more involved runtime arrangements.

Who it's for

Shuffle is a strong fit for security operations centers and CERT/SIRT teams that need to connect a varied security stack, standardize response processes, and retain control over deployment. It is also worth considering for teams that need approval steps, audit logs, and SSO or MFA options. Teams seeking a generous free cloud allowance or easy custom Python app creation in the cloud should look elsewhere or plan around those constraints.

Pros and cons

Broad integration reach: More than 2,500 apps and API-spec-based app generation can connect established security and collaboration tools.
Flexible deployment: Cloud, self-hosted, and hybrid options suit organizations with differing infrastructure requirements.
Security workflow controls: Approvals, audit logs, SSO/MFA, and documented encryption support workflows with oversight requirements.
Free-plan ceiling: Scale stops at 2,000 App Runs per month, a hard limit that can constrain active production workloads.
Cloud app-building gap: Custom Python apps are not yet easy to create on Shuffle Cloud, though on-premises hotloading is supported.
Paid-tier price uncertainty: Business and Enterprise require custom pricing, so organizations must obtain a quote to compare costs.

Alternatives

Consider Rundeck if you want a freemium automation option with a free Community plan and support across Linux, macOS, Windows, web, API, and self-hosted environments. Parachute may suit teams that prefer published per-month tiers, including a Starter plan at 49.00 USD per month with 3 users, 15 runbooks, and 30-day evidence retention. For a free and open-source project with Linux and self-hosted support and no paid products, StackStorm is another option. Tracecat is worth comparing if self-hosting and an open-source plan with unlimited workflows, cases, and agents are the priority. Azure Automation is an alternative for Windows and Linux environments, with process-automation job runtime including 500 minutes per month. HCL BigFix may fit buyers seeking a paid product with a free trial, while Tanium Deploy is for organizations that already have a Tanium license covering Deploy and the Tanium Core Platform servers. Tines is another freemium option, with its Free edition capped at 3 live workflows.

Browse the Runbook Automation Software directory to compare more tools in the category.

Verdict

Choose Shuffle if a security operations team needs broad integrations, workflow controls, and the freedom to run cloud, self-hosted, or hybrid. The main reason to choose it is that combination of security-oriented automation and deployment flexibility. Look elsewhere if a small free-plan quota, cloud custom-app constraint, or custom pricing for paid tiers conflicts with your expected scale or buying process.

	Shuffle	Tines
Free plan	Yes	Yes
Paid from	Free	Free
Platforms	api, Linux, self-hosted, Web	api, self-hosted, Web
Free plan	Yes	Yes
Approval steps	Yes
Scheduled runs	Yes
Event triggers	Yes
Incident integrations	Yes
Audit logs	Yes
Self-hosted option	Yes
Runs included	2,000 /mo
Multi-step workflows		Yes
Conditional logic		Yes
Webhook triggers		Yes

Shuffle vs Tines

Shuffle

Tines