Security

See llms.txt for all machine-readable content.
Sign up to receive regular security updates
Based in Berlin, prioritizing security and privacy is baked into our culture. Many of the world's most well-known Enterprises trust n8n with their data – we don’t take that lightly. Here are some of the measures, systems, and controls we’ve put in place – both at product and company level – to ensure security always underpins everything we do.
n8n aligns its security program to SOC 2, a standard framework for security compliance. That means we have implemented processes and follow procedures that uphold high standards of security for our customers' data. We undergo continuous evaluation and annual audits by an independent auditor as part of ongoing compliance with this standard.
Our SOC 2 report is available to enterprise customers. Others can refer to our SOC 3 report and the details about our security program below.
You can download our SOC 3 report here. The report contains the auditor’s opinion, management assertion, and system description.
For more details about privacy, security and how we comply with GDPR at n8n, please visit our docs.
When you sign up for an n8n cloud account, you create an account directly with n8n. When you create an account on n8n.cloud with a username and password, n8n implements best practices for account management. For example, n8n salts and hashes your password, then stores the hashed password in a database that’s encrypted at rest.
n8n salts and hashes the passwords of self-hosted users on account creation. However, encrypting other data at rest is the responsibility of the user. Refer to Data Encryption | Self-hosted n8n for more information.
n8n supports custom session timeouts on self-hosted.
A key part of n8n's functionality is linking third-party services. When you link an account from a third-party application, you may need to either authorize n8n OAuth application access to your account, or provide an API key or other credentials.
n8n recommends using OAuth for third-party applications that support it. The OAuth protocol allows n8n to request scoped access to specific resources in your third-party account without you having to provide long-term credentials directly. n8n must request short-term access tokens at regular intervals, and most applications provide a way to revoke n8n's access to your account at any time.
Some third-party applications don't provide an OAuth interface. To access these services, you must provide the required authorization mechanism (often an API key). As a best practice, if your application provides such functionality, n8n recommends limiting that API key's access to only the resources you need to access within n8n.
When you use credentials in a workflow, n8n loads them into the execution environment of your n8n instance. For n8n Cloud, customer instances are logically isolated from one another. n8n doesn't log or export credentials by default. If you log their values you can always delete the data for that execution. The platform deletes execution data automatically based on your account’s retention settings.
You can delete your OAuth grants or key-based credentials at any time. Deleting OAuth grants within n8n doesn't revoke n8n’s access to your account. You must revoke that access wherever you manage OAuth grants in your third-party application.
A username and password are required to authenticate into the app, with MFA optional for external uses. SSO, SAML, and LDAP are available with n8n’s Enterprise plan.
Advanced RBAC permissions are available on all paid plans to ensure governance, including designating super admin user roles.
n8n cloud uses Microsoft Azure for hosting. The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union. Microsoft controls and secures this location. We’re preparing to host in additional locations too. You can read more about Azure’s security practices and compliance certifications.
n8n further secures access to Azure resources through a series of controls, including:
n8n stores all OAuth tokens, key-based credentials, and the rest of your Cloud instance's database on a disk that's encrypted at rest using Azure server side encryption (at the time of writing, using AES256 and a FIPS-140-2 compliant implementation). For n8n cloud, this database also resides in a private network. Backups of that database are also encrypted.
When you use the n8n web application, it encrypts traffic between your client and n8n services in transit. The same applies for traffic related to the public API or webhook trigger nodes. n8n uses Cloudflare to manage and renew SSL certificates.
Data encryption at rest: n8n encrypts customer data at rest in your instance's mounted volume. n8n uses Azure Storage server-side encryption (using AES256 and a FIPS-140-2 compliant implementation). Azure Storage has achieved a wide range of compliance certifications. Refer to Azure Storage compliance offerings for more information.
An operational audit system constantly monitors n8n's cloud infrastructure and sends alerts to appropriate personnel when necessary. We only use configurations that implement approved networking ports and protocols, including firewalls. For example, we maintain a Web Application Firewall to protect n8n’s web application from malicious traffic and outside threats. And an Intrusion Detection System to detect potential intrusions.
n8n collects and stores all your server logs in a central location. Authorized users can query the log info as necessary to trace actions to individual users. We keep audit log history and historical activity records for at least 12 months, with at least the last three months immediately available for analysis.
n8n uses a version control system to manage source code, documentation, release labeling, and other change management tasks. Any employee must get their access approved by a system admin to make code changes.
When n8n's applicatio