n8n
Automation · n8n.io · last read 2026-11-09
At a glance
- Is n8n GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what n8n itself publishes, each answer linked to its source and the date we read it.
- Does n8n have a data processing agreement (DPA)?
- Yes. n8n publishes a data processing agreement at n8niostorageaccount.blob.core.windows.net. It describes how a new subprocessor is announced but states no notice period. It commits to telling you of a personal data breach within 72 hours. Source and date
- Does n8n have a SOC 2 report?
- n8n says a SOC 2 report is available on request (no type given). In n8n's words: “Our SOC 2 report is available to enterprise customers. Others can refer to our SOC 3 report.” n8n also publishes a SOC 3 report. We read this on 2026-10-29. Source and date
- Where is n8n's trust center?
- n8n publishes a page it calls “Trust Center” at trust.n8n.io. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Source and date
- Does n8n use your data to train AI models?
- For every plan (n8n AI features (Assistant)): Workflow context sent to the AI services is not used to train their models. For business plans (n8n AI Features): Customer Content and Output not used to train ML models; n8n may use aggregated, de-identified Usage Data and prompts to improve AI Services. Source and date
- What is n8n's data retention for AI prompts and outputs?
- For business plans (n8n AI Features): Customer Content not retained beyond the time required for AI processing and delivery of Output. Source and date
- How does n8n transfer personal data out of the EU?
- n8n's agreement relies on the EU standard contractual clauses and the UK transfer addendum. We found no entry for n8n on the official Data Privacy Framework List. Source and date
- Does n8n offer EU data residency?
- The EU is the default region for this vendor. Source and date
- Who are n8n's subprocessors?
- n8n lists 17 third-party subprocessors; 12 of them name at least one processing country outside the EEA. We last read the list on 2026-10-29. Source and date
- How do you report a security vulnerability to n8n?
- n8n publishes a security.txt at n8n.io naming https://n8n.io/report-a-vulnerability/. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | n8n GmbH |
|---|---|
| HQ | DE |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | n8n.io · 2026-10-29 |
n8n data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | n8n.io | 2026-10-29 |
EU: n8n cloud is hosted on Microsoft Azure, and the platform's data is currently hosted in the European Union. The customer does not have to choose this, and no plan or price is attached to it.
The same question for every vendor: where SaaS vendors store EU data.
n8n's subprocessor list names Microsoft for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
17 third parties · 2 of the vendor's own group companies · 12 with a country outside the EEA · all read 2026-10-29
| Subprocessor | Country | Purpose |
|---|---|---|
| Alibaba (Qwen) | EU | AI provider |
| Anthropic | US | AI provider |
| Baseten Labs, Inc. | EU | Inference infrastructure provider |
| Brave Software, Inc. | US | Web search provider |
| Browserbase, Inc. | US | Headless browser and web scraping provider |
| Daytona | US | Sandbox provider (AI Assistant) |
| Firecrawl (SideGuide Technologies, Inc.) | US | Web search, scraping and headless browser provider |
| Google Enterprise Agent Platform | EU, US | AI provider |
| Hetzner Online | DE | Hosting provider (Community Forum only) |
| LangChain | US | AI provider |
| LlamaIndex, Inc. | EU | Document extraction and OCR provider |
| Microsoft Azure | EU | Cloud service provider |
| Modal Labs, Inc. | US | AI inference provider |
| Moonshot AI | SG | AI provider |
| Nanonoble Pte. Ltd. | US | AI provider |
| OpenAI | US | AI provider |
| PDF.co (Artifex Software, Inc.) | US | Document conversion and extraction provider |
n8n's own group companies listed as subprocessors (2)
| Company | Country | Purpose |
|---|---|---|
| n8n UK Ltd. | GB | Customer support and service operations |
| n8n US Inc. | US | Customer support and service operations |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-29 · n8niostorageaccount.blob.core.windows.net
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | Updates on sub-processors available by subscribing via a form; notice period not stated |
| Notice of new subprocessors | n8n informs the customer of intended additions or replacements of subcontractors, giving the opportunity to object; no notice period or method stated |
| If you object to one | Customer may terminate its account on the Platform or, where possible, agree with n8n to terminate access to the affected part of the Service; this is the sole and exclusive remedy |
| Obligations passed to subprocessors | written contract with each subcontractor containing terms similar to this Agreement, in particular requiring appropriate technical and organisational data security measures; copies provided to the Customer on written request at the Customer's expense |
| Breach notification | without undue delay and, where feasible, no later than 72 hours after becoming aware |
| Deletion when the service ends | on termination or expiry, promptly and securely delete or destroy Personal Data (or return it if directed in writing); backups that are not reasonably accessible are excepted until they become accessible, and data that law requires n8n to retain is excepted |
| Getting your data back | at Customer's request, a copy of or access to all or part of its Personal Data in a commonly accessible electronic format chosen by n8n; on termination, return if directed in writing |
| Requests from data subjects | reasonably assists the Customer with compliance obligations, including in relation to Data Subject rights; no handling of requests sent directly to the vendor is stated |
| Audit | Once per 12 months, on customer request n8n carries out an audit (itself or via third-party representatives) and provides results; customer may submit compliance questions in advance; n8n exercises audit rights over subcontractors at customer's request and cost |
| Processing on your instructions | only as necessary for the Business Purposes in accordance with Customer's written instructions from Authorised Persons; will notify Customer immediately if an instruction would breach data protection law |
| Confidentiality of staff | all employees are informed of the confidential nature of the personal data and bound by confidentiality obligations and use restrictions |
| Security measures | appropriate technical and organisational measures at all times, including the security measures set out in Annex II; documented in writing and reviewed at least annually |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
AI and your data
What n8n's own pages state about the data you send its AI products, plan by plan. Compared with other vendors on AI vendors and your data.
| Plans | Term | What the page says | Source | Observed |
|---|---|---|---|---|
| All plans n8n AI features (Assistant) | Training on your data | Not used Workflow context sent to the AI services is not used to train their models | docs.n8n.io | 2026-10-29 |
| Business n8n AI Features | Training on your data | Not used Customer Content and Output not used to train ML models; n8n may use aggregated, de-identified Usage Data and prompts to improve AI Services | n8n.io | 2026-10-29 |
| Business n8n AI Features | Data retention | Not stored Customer Content not retained beyond the time required for AI processing and delivery of Output | n8n.io | 2026-10-29 |
Assurance
Does n8n have a SOC 2 report?
n8n says a SOC 2 report is available on request (no type given). n8n also publishes a SOC 3 report. We read this on 2026-10-29.
- Available on request “Our SOC 2 report is available to enterprise customers. Others can refer to our SOC 3 report”
Source: n8n.io, 2026-10-29
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| GDPR | Claimed | — | n8n.io | 2026-10-29 |
| SOC 2 · SOC2 | Available on request | — | n8n.io | 2026-10-29 |
| SOC 3 · SOC3 | Certificate published | — | n8n.io | 2026-10-29 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under n8n; n8n GmbH
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under n8n; n8n GmbH
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under n8n; n8n GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under n8n; n8n GmbH
- Data Privacy Framework List (US): checked 2026-11-09, no entry under n8n; n8n GmbH
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under n8n; n8n GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under n8n; n8n GmbH
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under n8n; n8n GmbH
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under n8n; n8n GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under n8n; n8n GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: n8n.io (security.txt, expires 2027-12-31; read 2026-10-29)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is n8n's trust center?
n8n publishes a page it calls “Trust Center” at trust.n8n.io. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, a penetration test, subprocessors, security questionnaires and a DPA. We read it on 2026-11-03. Open trust.n8n.io
- Name “n8n Trust Center”
- Request step “Welcome to n8n's n8n Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this n8n Trust Center to learn about our security posture and request access to our security documentation.”
Source: trust.n8n.io, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| ai | Public | full | 200 | 2026-10-29 |
| ai-2 | Public | full | 200 | 2026-10-29 |
| certifications | Public | full | 200 | 2026-10-29 |
| dpa | Public | full | 200 | 2026-10-29 |
| residency | Public | full | 200 | 2026-10-29 |
| subprocessors | Public | full | 200 | 2026-10-29 |
History
Nothing has moved since we started watching this vendor on 2026-10-29. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.