FTAPI SecuFlows Advanced

Version v.2026.8.4

Released on 7 September 2026

New

Forms

• Folder upload with preserved structure: In upload fields of SecuFlows forms, users can now select entire folders including subfolders or drag and drop them into the field. The folder is stored as a ZIP archive, which preserves the folder structure. A folder counts as one upload unit: the field options "Multiple files allowed" and "Max. files" limit the number of units. The combined maximum size is checked twice, once before packing against the source files and once afterwards against the archive size, while the maximum and minimum size per upload unit apply to the finished archive. If a folder contains a file that does not match the accepted file types, the entire folder is skipped. For fields intended for folder uploads, it is therefore advisable to set "All files" as the accepted file type in the configuration. Empty subfolders are not included in the archive, and image compression and image-to-PDF conversion do not apply to files inside a folder.

Integrations

• SharePoint integration uploads files to a configurable target path: The SharePoint integration has a new action that lets you store one or more files in SharePoint directly from a workflow. Site and target path are configured in the action, and large files are transferred in chunks. For a single file the target path can be a directory or a file name, for multiple files it must be a directory. Without a target path, the name of the input file is used. If a file with the same name already exists at the target path, it is overwritten, so repeated runs do not create duplicates. Each operation allows a maximum of 500 files and a maximum of 5 GB per file. The action returns name, file ID and web URL for every file. The site is resolved by its display name: if several sites share the same display name, the upload fails. The integration's existing OAuth2 configuration is reused, no additional authentication method is required.

Administration

• Default role on first login: Users signing in to SecuFlows Advanced for the first time through the harmonised SecuTransfer login are automatically assigned the "Viewer" role and therefore have read access immediately, instead of waiting for permissions to be granted manually. Existing accounts are not affected.

Improved

Forms

• Uploads larger than 100 MiB arrive complete: Files uploaded through a form were truncated at 100 MiB. The upload reported success, but the remainder of the file was missing on download, with no error message indicating the problem. Files are now stored and served at full size.
• Empty optional upload fields no longer stop the process: If an optional file field was left empty, the process failed at the following activity and the submission was lost. All activities with file input were affected, meaning the built-in mail activity as well as the SecuMails and SecuRooms integrations. Processes now complete even without an uploaded file, and the mail is sent without an attachment.
• Category titles in the stepper stay readable: In forms with a categorisation element, the titles in the header overlapped as soon as the number or length of the labels exceeded the available width. This occurred at regular desktop widths and affected extensive forms with many categories in particular. The titles are now displayed so that the current step and the navigation remain recognisable.

Processes

• Start webhooks return the correct status again: Webhook calls starting a workflow responded with HTTP 500 even though the request was valid and the workflow started and completed correctly. Calling systems treated this as a failure and triggered retries. The state was caused by a single very large call, after which all subsequent webhook requests were affected. Webhook calls now return HTTP 200 again.

Integrations

• Configure integrations with expressions without the configuration breaking: When expressions such as {{value("...")}} were used in an integration's action configuration, validation failed, the configuration crashed and disappeared. This surfaced when setting up the SecuMails integration with attachments, among others. The configuration now persists. Action required: two fields were removed as part of the fix. Please review integrations that are already set up and reconfigure them where necessary.

Administration and security

• Two-factor authentication is enforced again: In tenants without "Force MFA" enabled, the second factor could be bypassed: after entering the password, the two-factor dialogue could be cancelled and the application opened directly, with the user signed in. The cause was a vulnerability in the identity component in use (GHSA-9993-rfwp-rhwf), resolved by updating to an unaffected version. Cancelling the second factor now returns the user to the sign-in page. Tenants with "Force MFA" enabled were not affected. Sign-ins were briefly unavailable during the update.
• User creation in the Admin Panel works again: Creating new users in the Admin Panel failed consistently, while creating and deleting tenants continued to work. Users can be created again.
• Roles are displayed correctly in the user overview: The "Roles" column in the Admin Panel showed "none" for all users in all tenants, regardless of the actual assignment. Assigned roles are now visible. In addition, assigning the same role to a user more than once no longer produces an error message.

Version v.2026.7.4

Released on 25 August 2026

New

Integrations

• Send SecuMails directly from a process: A new integration sends SecuMails from a SecuFlows process, without anyone writing the mail manually or operating another tool. In the integration you configure the SecuTransfer server and the sender's credentials, one server and sender combination per integration. Recipients, subject, message, attachments, expiry period and security level come from the workflow, for example from form data or a previous process step. A maximum of 20 MB across all attachments and a maximum of 100 files apply, and the message is transferred as plain text. The integration reports success or failure along with the mail ID, the time of dispatch and details of the attachments. Security levels 1 and 2 are available.
• Store files from a process in SecuRooms: A new integration uploads files from a SecuFlows process into an existing SecuRoom. Server and credentials are configured in the integration, the SecuRoom and target path are set in the workflow editor. Folders that do not yet exist in the target path are created. Each upload allows a maximum of 500 files and a maximum of 5 GB per file. If a file cannot be transferred or authentication fails, the workflow stops, and the time and the server's message are logged. Encrypted SecuRooms are not supported.

Processes

• Process lists without a loop: If an activity uses a field that is part of a list, the activity runs automatically for every element. Building a loop in the model is no longer necessary, the setting is made directly in the activity. You choose between sequential and parallel processing, and parallel processing uses the maximum concurrency permitted for the tenant by default. An icon on the canvas indicates that an element runs more than once, and whether it does so sequentially or in parallel. This keeps the model readable for business users as well.
• Set workflow variables within a process: A new built-in action writes workflow variables inside a process. The action that sets the variables can be configured at any point in the process. These global variables can then be referenced at any other process step, which makes logic across steps possible. A corresponding action for reading variables is not part of this version.

Improved

Forms

• Mandatory fields are clearly marked: Mandatory fields are marked consistently across all field types and form layouts. Submitting a form with empty mandatory fields shows a summary of the missing fields, and a corresponding note appears next to the submit button. Optional fields remain unmarked and do not appear in the summary. Fewer submissions are therefore left incomplete, and downstream process steps run into fewer gaps.
• Mandatory field validation also when jumping via the step numbers: In forms with a stepper and categorisation, mandatory fields were only validated when clicking "Next". Switching between pages using the numbered buttons in the header bypassed the check. Validation now applies in both cases.
• Page changes start at the top: In multi-page forms, the scroll position of the previous page was retained when paging, leaving the first fields of the new page outside the visible area. Paging forwards and backwards now jumps to the top of the page.
• Forms on narrow screens: Forms containing a repeatable file upload field extended beyond the edge of the screen at phone widths, cutting off the upload fields and the submit button and making them unreachable. The layout now adapts at small screen widths too.
• Newly created forms are retained: Creating a form and returning to the overview via the toolbar before saving left the form missing from the list, and the work was lost. Newly created forms now remain in the sidebar.

Processes and modelling

• Boundary events stay attached to their element: After a process was saved, a boundary event occasionally detached from the task it was attached to. Moving the task left the symbol behind, and data from preceding steps was no longer available in the following activity, which broke the process. The link now survives saving.
• A newly started workflow instance appears immediately: When restarting a failed workflow, the address changed to the new instance, but the sidebar only showed it after a manual reload. The new instance is now opened directly.
• Data type in the condition editor at a glance: In a gateway's condition editor, the selected data type of the comparison value only became visible after a click, and the display appeared broken with multi-line input fields. An icon now shows directly whether text, number or boolean is selected, and the dropdown carries the same icons. Misconfigurations surface earlier as a result.
• View conditions of paths that were not taken: In the workflow view of a gateway, the configuration of a path that was not taken in a given run could not be opened. It is now accessible, which makes it possible to trace why the gateway decided as it did.
• Gateway condition readable in the workflow view: The expression stored as a branch condition was barely visible in the workflow view. It is now displayed legibly. Evaluation behaviour is unchanged.
• Multi-line expressions fully visible in the form builder: With a selection field using the "expression" mapping type, a longer multi-line expression was not fully visible in the input field. The complete expression is now readable.
• Tasks without an assignment go to all users again: If an assignment that had been configured was deleted again, the task remained in a state without recipients and was no longer triggered at all. The only way out was to create the task again. Deleting an assignment now returns the task to its default behaviour and it goes to all users.
• Files from a call activity accessible via both paths: A file object passed to a child process through a call activity could not be resolved via the .payload path. Instead of the file, only a few bytes of technical data were transferred, so the service receiving it rejected the document as empty. Only the .value path worked. Both paths now resolve the file correctly.
• Date columns stay dates on CSV import: When importing a CSV file into a table, date columns were converted into numbers regardless of the date format used, which made the imported data unusable. Date values are now recognised and imported as dates.

Integrations

• Input in the integration editor is no longer lost: When editing a saved integration, the cursor jumped to the end while typing in the multi-line request body field, and individual characters were lost in other input fields. This led to faulty configurations. Input is now applied reliably.

Administration

• Consistent mail server configuration with explicit transport encryption: The settings for task notifications at tenant level and for process emails in the integrations now use the same interface, so you find the same options in both places. Transport encryption is selected with a switch rather than checkboxes: "SSL/TLS" encrypts the connection from the start and is the default, "Mandatory STARTTLS" enforces the upgrade to TLS and fails if the server does not offer it. An unencrypted option is not available.

Version v.2026.6.1

New

Workflow View

• Execution status per step visible at a glance: The Workflow View now shows the current execution status of each step. You can immediately see which steps completed successfully, where an error occurred, and what is still pending.
• Input and output data per step accessible: The input data used and the output data produced by each step can be viewed directly in the Workflow View. Output values can be toggled between a field list and the underlying JSON expression, making it easier to work with nested JSON values.
• Used input data highlighted: Data fields that a step pulls from previous steps are visually highlighted in the Workflow View. This makes data flows and dependencies between steps easy to trace.
• Expressions per step visible: The full expressions used in a workflow step are now visible in the Workflow View, making it easier to debug complex calculations and data assignments.
• Step logs accessible in the Workflow View: Execution logs for each step can be accessed directly in the Workflow View, without switching to a separate log view.
• Step configuration viewable directly in the Workflow View: The configuration of each workflow step can now be opened directly in the Workflow View, without switching to the Workflow Builder. The view is read-only and displays gateways, table components, and form fields in the same layout as the modeling view. The activity icon is shown next to the step name.
• Restart a running workflow instance from any step: In an active workflow instance, the process can now be restarted from any chosen step or from the beginning. The restart carries over the data of the respective token and launches a new instance from that point. This allows incidents such as a temporarily unavailable third-party system to be resolved directly in the tool, without support intervention.

Workflow Builder

• Save process models despite modeling errors: Process models can now be saved even when BPMN rules are violated. Modeling errors no longer block the save action, which makes iterative work on complex models easier.
• Show step IDs in the Workflow Builder: The internal ID of each workflow step can now be displayed in the Workflow Builder. This is useful when working with expressions that reference specific steps.
• Elements can be configured immediately after being placed on the canvas: When an element is dragged onto the canvas, the configuration panel opens immediately. The extra click to select the element after dropping it is no longer needed.
• Events: "None" available as default type and selectable in the dropdown: "None" is now available as the default type for events and can be set in the dropdown. This simplifies the configuration of events that do not require a specific type.
• Start events: "Loop" and "Subprocess" types removed, schema editor added: The "Loop" and "Subprocess" types for start events have been removed, as they provide no practical value in this context. A schema editor is now available at the start event instead.
• Loops can define output data: Output data can now be defined for BPMN 2.0 loop activities. The results produced in each iteration can be collected and used further along in the workflow.

Workflow Engine

• Minimum interval for timer start events is now enforced: Timer start events now enforce the configured minimum interval of 15 minutes. An empty interval is no longer automatically set to 1 minute, preventing unintended execution cycles.

Tables

• Table filtering with expanded capabilities: Table filtering has been enhanced in several areas. Filter criteria now apply to the full dataset, not just the rows already loaded in the client. Columns with an active filter are immediately visible in the overview. All active filters can be cleared in a single action.

Improved

Workflow Engine

• Expressions with empty string values are handled correctly: An expression of the form value("") previously caused the workflow to fail. Empty strings as expression arguments are now processed correctly.
• Workflows no longer get stuck in "Running" status after pausing and resuming: Under certain conditions, a workflow would remain permanently in "Running" status after being paused and resumed. This behavior has been fixed.
• Workflow logs no longer contain data from other tenants: Execution logs occasionally included entries from workflows belonging to other tenants. Logging is now tenant-isolated and shows only data from the current tenant.

Integrations

• SMTP integration: Configuration fields fully visible again: Following the introduction of the new activity configuration, the SMTP integration's configurable fields (recipient, subject, message body) were no longer displayed. All fields are now visible and editable again.
• "Request Name" dropdown appears reliably when selecting an integration for the first time: When an integration was selected for a newly added activity for the first time, the "Request Name" dropdown did not appear. This has been fixed.
• Mail intermediate event: Correlation key works reliably again: The correlation key for the mail intermediate event was broken, preventing processes from correctly waiting for incoming emails. The behavior has been restored.

Forms

• Image-to-PDF conversion in form file fields works again: When a file field had the "Convert to PDF" option enabled, the conversion of uploaded images failed. Conversion now works reliably again.
• Form Editor: Significantly faster response times for complex forms: The Form Editor now performs considerably more smoothly with large form structures. The slowdown had increasingly been affecting forms of regular size and has been resolved.

Tables

• CSV import: Umlauts and special characters are imported correctly: When importing CSV files, umlauts and special characters were displayed incorrectly — for example as boxes or Chinese characters. The import now handles character encoding correctly.
• Table rows linked to SharePoint can be edited again: Table rows linked to a SharePoint list could not be saved after initial creation. Saving changes to such rows now works correctly.
• "Find Row" activity returns results for empty field values: The activity returned no results when searching for rows with an empty field value. The search now returns all matching rows.

Rule Editor

• Expressions in configuration fields are displayed in full: When opening a rule in the configuration fields, the expression text was frequently cut off. The display issue has been fixed and the full expression is now readable.

General

• White-labeling: Task emails now use the configured tenant identity: Notifications for new, due, and overdue tasks contained the name, logo, and links of FTAPI instead of the configured white-label identity. This has been corrected.
• Design fixes in the Workflow Builder: Letters with descenders (e.g., "g" or "q") were clipped at the bottom in the input/output side panels. Additionally, the margin on the "Interrupting" toggle for boundary events was missing. Both display issues have been fixed.
• "File to Base64" action revised: The usability of the "File to Base64" action has been improved. The toggle for the Data URL option is now more clearly visible and better labeled.

SecuFlows Advanced Version v.2026.4.1

New

Focus on essential work steps with guided process configuration

The cluttered process configuration in the sidebar is replaced by a new modal window: you can now configure tasks, integrations, and actions step-by-step in a clear modal window. The following applies to the modal window: 

• You can now move data fields simply via drag & drop. 
• Enter expressions easily in the new input configurator. 
• Configure multi-level AND/OR conditions directly in the modal window. 
• Configure gateway paths directly in the new modal window.