Digital Sovereignty Starts with Open Source

For European public administrations and companies, digital sovereignty is becoming a strategic question. OOP 2027 in Munich dedicates a whole track to the topic, in which Operaton co-founder Tim Zöller talks about why we forked a process engine and why open source doesn’t protect against vendor lock-in.

What sovereignty means to me

To me, digital sovereignty mainly means vendor independence. With Europe in mind, there’s a second point: core technologies should be developed substantially here, by people and organisations that don’t depend on the strategic decisions of a single corporation.

Open source is a key factor. At the level of foundational technology, developers collaborate openly across company and national borders. Anyone can read, review and extend the code, and nobody can take it back afterwards.

Open source isn’t automatically independent

That said, open source doesn’t equal vendor independence. In many projects, a single company dominates development. If it decides to stop maintaining the software or to change its licence, users are trapped. There have been plenty of examples in recent years:

MinIO moved from Apache 2.0 to the AGPL in 2021, removed the admin console from the Community Edition in 2025 and put that edition into maintenance mode at the end of 2025.
MySQL ended up with Oracle through the acquisition of Sun, after which MySQL co-founder Michael Widenius started the MariaDB fork.
Terraform was switched to the Business Source License by HashiCorp in 2023; the community responded with OpenTofu under the Linux Foundation.
And Camunda: the Camunda 7 Community Edition has reached end-of-life, and its successor Camunda 8 is no longer freely licensed for production use.

The pattern is always similar: as long as one vendor controls the brand, the roadmap and most of the committers, the software’s future depends on that vendor’s business model.

Why itemis supports Operaton

BPMN and process automation aren’t side issues for many companies; business-critical operations run on them. That’s why we at itemis support Operaton, the free successor to the Camunda 7 engine that emerged after the end of the Community Edition.

The project has set itself a clear goal: the software is free, stays free and isn’t steered by the interests of any single company. To secure that legally as well, an association is currently being founded. It will hold the rights to the Operaton name and be responsible for developing the engine sustainably.

That the topic is landing in practice is shown by a large public research institution in Germany that has explicitly aligned its internal IT strategy with digital sovereignty. We can’t share details, but the Operaton committers are in contact with the people responsible there. Where Operaton already runs in public administration is the subject of our article Operaton in the Public Sector.

Sustainability has a price

Sustainability is hard for free software, though. Open source and free of licence costs doesn’t mean development is free. Anyone running Operaton or another open-source project in production should invest in its future, in their own interest. That doesn’t even have to be money; development capacity helps just as much, and so does public visibility. The more people know a product runs successfully in a given industry, the more readily others will adopt it.

In the age of AI, this becomes even more pressing. A BPMN engine that runs business-critical processes and has many users needs regular updates; AI tools now find vulnerabilities at a pace that keeps up with the speed of software development itself. Then there’s the foundation underneath: an engine like Operaton depends on a sizeable stack of libraries that ships new releases almost daily. Someone has to integrate, test and ship every one of them.

Operaton plans for this explicitly: the roadmap includes feature releases every six months and monthly patch releases, and nightly integration builds deliver critical security patches even faster when needed. To our knowledge, Operaton is the only Camunda 7 fork that publishes security updates at this frequency openly and for free. That should be a given, but it isn’t: some forks ship security updates only in their paid edition. A community edition without timely security updates is incompatible with most organisations’ security policies, which makes it effectively unusable in production.

Digital sovereignty therefore means two things: relying on open source, and making sure that software can keep evolving independently and sustainably. Nobody has to carry that alone. It’s enough for every user to contribute their share of the development costs, through support contracts, contributions or direct funding.

At itemis, we understand that open source also means responsibility, and we actively take part in projects like Operaton. How do you handle open source?

Custom software at itemis — From Camunda 7 migration to production-grade BPMN platforms built on Operaton: Custom Software →