GoRules
GoRules is a business rules management system and decision engine. Teams model pricing, eligibility and risk logic as readable decision tables and visual flows, test and version them, then change rules without redeploying the surrounding application.
What is GoRules?
GoRules is a business rules management system (BRMS) and decision engine published by GORULES TECHNOLOGIES DOO, a bootstrapped company founded in 2023 in Cacak, Serbia. It presents itself as the decision layer for products and agents: the place where the logic that changes most often, such as pricing, eligibility, risk scoring, fraud rules or commission calculation, lives outside the application code that surrounds it.
Rules are modeled as decision tables, decision graphs and expressions on a single canvas, where inputs, tables and routing read like a flowchart. Conditions appear as business sentences, and the developer view of the same rule is one toggle away, so the two never diverge. GoRules calls the result an executable document in which prose, data model and decision tables sit together: the spec is the implementation. The editor validates, suggests and simulates while a rule is still a draft, and scenario suites are replayed on every change, with coverage measured across decision paths rather than lines of code.
The AI layer reads the PDFs, spreadsheets and free text that policies already live in, structures them into tables and graphs, allows cell-by-cell editing in conversation and generates test suites. Its boundary is stated explicitly: the AI produces reviewable drafts and never deploys, so releases stay with human reviewers. An MCP server exposes the same capabilities to Claude, Cursor, Codex and any MCP client.
Governance is built in: branches, commits, visual diffs, multi-step approval workflows, a full audit log with SIEM export, immutable releases promoted from development through staging to production, and one-click rollback. Execution runs on ZEN, an MIT-licensed Rust engine embedded in-process in under a millisecond for a complete decision model, or on Agent, a headless Rust service exposing POST /evaluate with hot reload. For large volumes the engine can be embedded in Spark or batch pipelines: GoRules contrasts 10 million rows taking 28 hours through per-row API calls with 4 minutes embedded.
The publisher reports more than 700K monthly package downloads, more than 570K Docker pulls and SOC 2 Type II attestation, with a public trust portal. Industries listed run from financial services and insurance to healthcare, aviation, telco, logistics, retail and government.
What it does
- Model a business policy as decision tables, decision graphs and expressions on a single visual canvas
- Turn a policy PDF, a spreadsheet or plain-text rules into executable decision logic with the AI copilot
- Generate and replay scenario test suites on every change, with coverage measured across decision paths
- Route each change through review and multi-step approval before it reaches production
- Promote immutable releases from development to staging to production without modifying them
- Evaluate rules through a REST API, an embedded native SDK or an in-process batch job
- Roll back to a previous release in one click and trace who changed what, and when
When to use GoRules / When not to
A quick filter to help you decide if GoRules is the right fit.
When to use GoRules
- Product and engineering teams whose pricing, eligibility or risk logic changes far more often than the application code around it
- Regulated organizations in banking, insurance, healthcare and the public sector that need an audit trail showing who changed which rule and when
- Business analysts and operations managers who want to edit decision tables directly, with the developer view of the same rule one toggle away
- Teams evaluating rules at very high throughput or in batch, embedding the MIT-licensed ZEN engine in-process or in PySpark instead of calling an API row by row
- AI and platform teams that need a deterministic decision layer underneath an agent, and organizations whose sovereignty constraints require self-hosting or the EU data region
When not to use GoRules
- Consumers and individual users: there is no mobile application and nothing aimed at personal use, the product is sold to engineering and operations teams
- Anyone looking for a content generator or a general-purpose AI model, since the AI layer here only drafts and tests business rules and never deploys them
- Small teams hoping to run production on the Free plan, which is capped at 2 users, 1 project, 10 decision models and no deployment environment at all
- Buyers who need a contractual uptime commitment: the 99.9% SLA covers Enterprise customers on Managed Cloud only, and never the AI features
- Non-technical teams working without developer support, because putting rules into production still requires embedding an SDK or running the Agent service on your own infrastructure
How to use GoRules
A typical end-to-end flow, from setup to results.
- Create a managed cloud account from the Get started button on the site (us1.gorules.io), or ask for a demo through the contact form
- For an enterprise evaluation, describe your use case, stack and scale, take a 30-minute call with an engineer, then receive a tailored walkthrough and a trial key to test on your own infrastructure
- Model your first policy in the BRMS as decision tables, decision graphs and expressions, with the editor validating, suggesting and simulating as you go
- Or let the AI do the first pass: drop in a policy PDF, paste a spreadsheet or describe the rules in plain text, then refine them cell by cell in conversation
- Generate and run scenario suites, then check coverage across decision paths before publishing anything
- Move the change through draft, review, approval and release, with every step recorded in the audit log
- Promote the immutable release from development to staging and then to production, unchanged
- Consume the rules from your application: install a native SDK (npm install @gorules/zen-engine, pip install zen-engine, go get, cargo add) or run the Agent container behind POST /evaluate
- Point Agent at S3, Google Cloud Storage, the local filesystem or a custom storage provider, and it hot-reloads new releases without a restart
- If you are moving off another engine, follow the matching migration guide: export, construct-by-construct mapping, AI-assisted conversion, parallel run, then cutover; the reference documentation and changelog live on docs.gorules.io
Pros & Cons
Pros
- The execution engine is open source under the MIT license (ZEN, written in Rust): no licensing negotiation to adopt it, and the rules keep running even without the vendor
- One engine everywhere, with eight native SDKs covering managed cloud, self-hosted, edge and on-device, and a claimed sub-millisecond evaluation for a complete decision model
- Governance is native rather than bolted on: branches, reviews, approvals, audit log, immutable releases and one-click rollback
- The AI is deliberately fenced in, producing reviewable drafts and generated tests but never an automatic deployment
- SOC 2 Type II attested, with a public trust portal and a data region chosen at subscription (EU1 or US1) that data does not leave
- AI inference is not retained once the response is delivered and is not used to train or fine-tune any model
- Ten step-by-step migration guides from competing engines with AI-assisted conversion, and a bootstrapped, cash-positive publisher with no fund on the cap table (self-reported)
Cons
- A steep step between tiers: the Free plan costs nothing and the first paid tier is 167 USD per month, billed annually at 2,000 USD
- The displayed price is the annual-commitment rate; the month-to-month toggle and the Self-hosted tab are rendered in JavaScript and could not be read, so a monthly subscription is probably more expensive
- AI credits are billed by consumption on top of the subscription, at 1.5x the Bedrock model cost plus a 1.1x AWS regional inference premium, and they are non-refundable, non-transferable and lost when the deployment mode changes
- The 99.9% uptime SLA is reserved for Enterprise customers on Managed Cloud, and no uptime, latency or availability commitment covers the AI features at any tier
- Audit log is absent from the Free and Pro tiers, while the release workflow and release comparison are reserved for the top tiers and OIDC SSO for Enterprise
- The trust portal listing the subprocessors is JavaScript-rendered and cannot be read without a browser
- No interface language other than English is announced (the 9 languages headline refers to programming languages), and the publisher is a small Serbia-based company with no Article 27 EU representative designated
Pricing & Plans
A permanent free plan is available at no cost, including 10 USD of AI credits per month but no deployment environment. The lowest paid entry point is the Pro tier at 167 USD per month, displayed on annual commitment (2,000 USD per year); Business is 500 USD per month (6,000 USD per year) and Enterprise is priced on request. All prices are stated in USD and exclude VAT and sales tax, which are calculated at checkout based on the billing country. AI usage beyond the credits included in each tier is billed per token at 1.5 times the underlying Amazon Bedrock model cost, plus a 1.1x AWS regional inference premium: 8.25 USD input and 41.25 USD output per million tokens for GoRules AI Advanced (Claude Opus), 4.95 USD and 24.75 USD for GoRules AI Fast (Claude Sonnet). Integration and custom solution services are quoted separately. The ZEN engine itself is free under the MIT license.
- 0 USD per month
- 2 users
- 1 project
- no deployment environment
- 10 decision models per project
- unlimited evaluations
- change requests
- GitSync and 10 USD of AI credits per month
- 167 USD per month on annual commitment (2
- 000 USD per year
- Save 17%)
- 5 users
- 1 environment
- 2 projects per environment
- 20 to 25 decision models per project and 70 USD of AI credits per month
- 500 USD per month on annual commitment (6
- 000 USD per year
- Save 17%)
- 20 users
- 2 environments
- 20 projects per environment
- 50 decision models per project
- 200 USD of AI credits per month
- priced on request
- with custom limits and AI credits
- release workflow and release comparison
- OIDC SSO
- webhooks and global roles
- the Enterprise SLA
- and a dedicated support engineer and business analyst as options
- Unlimited evaluations per second through the ZEN engine or Agent on all four tiers
- The pricing page toggles between Cloud and Self-hosted
- but the self-hosted rates are not rendered in the static HTML and could not be read
- the Pro tier card announces 20 decision models per project while the comparison table announces 25
Data, GDPR & hosting
A consolidated view of how GoRules handles your data.
GDPR overview
GoRules never states in so many words that it is GDPR compliant, but the privacy policy in force since 5 August 2026 carries concrete commitments. The applicable Data Protection Law is defined as Serbian law (Sl. glasnik RS 87/2018) and/or Regulation (EU) 2016/679. As a processor, GoRules signs a Data Protection Addendum with each controller; for customers assigned the EU1 region that addendum includes the applicable standard contractual clauses and the technical and organizational measures GDPR requires. Transfers go to the EEA, to countries offering adequate protection, or under appropriate safeguards. Section 9 details data subject rights, answered within 30 days and extendable for complex requests. The supervisory authority named is the Serbian Commissioner for Information of Public Importance and Personal Data Protection, in Belgrade. Privacy requests go to legal@gorules.io. No Article 27 EU representative and no data protection officer are named.
Who owns the data?
The terms of service state plainly that the User retains ownership of User Data. Customers are solely responsible for the content they upload and warrant that they hold the rights to it, and they are expected to keep their own backups despite the redundancy measures GoRules applies. GoRules acts as controller for account, contact and analytics data, and as processor for data handled through the platform on a customer's behalf; in self-hosted deployments it states it never sees business data at all. The only right customers grant in return is a non-exclusive, royalty-free and revocable license to use their logo promotionally, with no transfer of ownership.
Reuse rights
Customers keep ownership of their rules, documents and outputs and may reuse them freely; GoRules claims no rights over them beyond what running the service requires. Under the privacy policy in force since 5 August 2026, inputs submitted to the AI features are passed to Anthropic through AWS Bedrock for the sole purpose of producing the requested output. They are not kept once that output has been delivered and, in the publisher's words, are not used to train, fine-tune, or otherwise improve any AI model. For customers assigned the EU1 region, inference is processed inside the European Union and inputs do not travel to the United States. Account data is limited to first and last name, business email, country of establishment (used to assign the data region) and subscription details; telemetry and Real User Monitoring are processed and stored in Datadog's Europe region whatever the customer's own region. Paddle acts as authorized reseller and merchant of record, handling payment data independently rather than on GoRules' behalf. Legal bases and purposes are set out in the table in section 3.1 of the privacy policy.
Data retention & training
Hosting summary
On Managed Cloud, data is stored and processed exclusively in the data region assigned to the organization at subscription: the EU region runs on AWS inside the European Union, the US region on AWS in the United States. No transfer outside the assigned region takes place, except where legally required. One exception is stated explicitly: telemetry and Real User Monitoring are processed and stored in Datadog's Europe region whatever the customer's region. The legacy Demo Cloud sits on Microsoft Azure servers in the European Union. In self-hosted deployments the data stays on the customer's own servers, and only administrative licensing data (first name, last name and business email of the designated representatives) passes through the GoRules licensing portal, hosted on Microsoft Azure in the EU. For AI inference, EU1 customers are processed within the Union and their inputs do not travel to the United States. The subprocessor list is published at trust.gorules.io/subprocessors, a portal that is JavaScript-rendered and could not be read. Stated security measures include AES-256 at rest, TLS 1.3 between components, sandboxed evaluation with no filesystem or network access, third-party penetration tests and SOC 2 Type II attestation.
Things to keep in mind
Risks and trade-offs to weigh before adopting GoRules.
- The adoption figures (more than 700K monthly package downloads, more than 570K Docker pulls, Fortune 100 users) are publisher claims: the package and container counts can be cross-checked in public repositories, the customer base cannot, since no customer is named and no logo is displayed
- The AI credits included in each tier (10, 70 or 200 USD per month) are allocations, not a spending cap: consumption beyond them is billed per token, so an unattended AI-heavy workflow can quietly run up a bill
- GoRules reserves the right to suspend the AI features in case of abnormal consumption or risk to other users, which is a real dependency to weigh before building a workflow around them
- The AI features rely on a third party, Anthropic Claude through AWS Bedrock, whose availability conditions the service while no uptime or latency commitment covers it
- Convenience can erode scrutiny: because the AI turns a policy PDF into decision tables in minutes, a plausible but wrong rule can pass review if the generated tests are trusted without being read, and a wrong rule here decides loans, claims or prices
- The publisher is established in Serbia, outside the European Union, so GDPR applies through standard contractual clauses and the data protection addendum rather than through an EU establishment, and disputes go to arbitration under ICC rules seated in Belgrade, in English
- Users who signed up before 5 August 2026 remain under the previous terms until the end of their billing period, and in self-hosted deployments the compliance posture depends on the customer's own infrastructure rather than on GoRules
Setup & Integrations
Technical difficulty
Getting started in the cloud is immediate: an account on us1.gorules.io, and the Free plan needs no deployment. Rule editing targets business users, with version control described as working without git. Production is another matter: a native SDK (npm, pip, go get, cargo) embedded in the calling service, or the Agent container backed by S3, GCS or filesystem storage. Self-hosting means Docker or Kubernetes on your servers, VPC or cluster, and OIDC SSO configured with your identity provider. Documentation, migration guides and paid integration services help. Easy for rule authors, moderate to advanced for the team wiring it in.
Deployment
Integrations
Behind GoRules
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement GoRules.
Frequently asked questions
What exactly is GoRules?
Is there a free plan?
How much does the first paid tier cost?
Can GoRules be self-hosted?
Is there an API?
Is my data used to train AI models?
Where is the data hosted?
What certifications and service commitments exist?
Can I migrate from another rules engine?
Which AI model powers the copilot, and is there a mobile app?
Should you pick GoRules?
GoRules addresses a narrow but genuine problem: business logic that changes far more often than the software around it. Its answer is coherent. Rules are authored as decision tables and visual flows readable by the people who own the policy, every change goes through branches, reviews, approvals and an audit log, releases are immutable and promoted from development to production, and execution happens on ZEN, an MIT-licensed Rust engine that runs in-process, behind a REST service or inside a batch pipeline. The AI layer is unusually well fenced: it drafts rules from policy PDFs and spreadsheets and generates the tests, but it never deploys, and inference is neither retained nor used for training.
The reservations are just as concrete. The Free plan carries no deployment environment and stops at 2 users, so real use starts at 167 USD per month on annual commitment. AI credits are allocations rather than spending caps, with consumption billed per token above them. The 99.9% uptime SLA belongs to Enterprise customers on Managed Cloud alone, nothing at all is committed on the AI features, and OIDC SSO sits behind the same tier. The publisher is young, small and established in Serbia, outside the European Union, with no Article 27 representative designated, although it is SOC 2 Type II attested and publishes a trust portal.
The tool is clearest for regulated teams in banking, insurance, healthcare and the public sector, and for product teams whose rules move constantly. The decision comes down to one trade: accepting a real technical integration, through the Agent service or an embedded SDK, in exchange for rule changes that no longer wait for a deployment. Should the vendor disappear, the MIT engine keeps the rules running, which is not a small reassurance.
- Choosing a selection results in a full page refresh.
- Opens in a new window.