When you use n8n Cloud, n8n is the processor and you're the controller. When you self-host, n8n supplies software and you're both operator and controller, with no processor relationship to n8n at all. [Activepieces](https://www.activepieces.com), whose core is MIT-licensed and can be self-hosted, sits on the same split, so the useful question is "which control does this setup satisfy, and who answers for the rest?" ### Requirement, n8n offer, plan and cost at a glance Read the table below as a map of where responsibility moves. For each n8n option, it shows where data sits, whether a DPA exists, which access and audit controls come with it, and who carries the controller duties. | Option | Hosting region | DPA | SSO / RBAC / audit log streaming | Who holds controller duties | |---|---|---|---|---| | Community self-hosted | Wherever you deploy it | None needed from n8n; it does not process your data | Not included in the free edition | You, entirely | | Starter | n8n Cloud, n8n-operated | DPA with n8n as processor | Not included | You as controller; n8n as processor | | Pro | n8n Cloud, n8n-operated | DPA with n8n as processor | Project-level roles only; no SSO or log streaming | You as controller; n8n as processor | | Enterprise | n8n Cloud or self-hosted under license | DPA for the cloud option | SSO, advanced RBAC and log streaming | You as controller; n8n as processor on cloud | Pay for any tier and the duties are still yours. What the paid ones add is a processor contract and, at the top, the access and audit controls Article 32 expects you to be able to show. ### What stays your responsibility whatever n8n provides You still need a lawful basis for each workflow that touches personal data, and an entry in your Article 30 records of processing. You must also honor erasure and access requests, which means knowing which workflow executions store personal data and for how long. You must assess any sub-processors and international transfers behind the services your workflows call. On self-hosted, you also carry security patching, backups and breach detection. If the vendor's cloud goes down, you wait; if yours does, you answer for it. ## Five Stages to a Defensible n8n GDPR Setup Choose hosting, sign the data processing agreement, lock access, limit stored data, then test erasure on a test subject. Each stage assumes you've finished the one before it. Because erasure is the only stage that proves the other four worked, it comes last. The numbered sequence below sets that order. Stage 1 decides how much of the remaining work lands on you. Six times the price buys twenty times the allowance. At Stage 1, n8n Cloud costs 20 € per month for Starter at 2.5K executions, 50 € for Pro-1 at 10K, and 120 € for Pro-2 at 50K. Volume, not compliance, drives the bill.  On paper, self-hosting in the EU is cheaper. A [Hetzner](https://dev.to/syednoor760dev/how-to-self-host-n8n-on-hetzner-for-under-20month-noorflows-11d6) CX21 is 4.2 € per month, a CX22 is 4.51 €, and a CX23 is 5.49 €. Adding a Storage Box brings the CX22 to 7.71 €, and Borg backup brings it to 8.32 €. The author's full production setup is 18 €. Even at 18 €, the server is the small line item: patching, backups and the controller duties are yours.   ### Signing, access, retention and erasure Stage 2: request the agreement, then read its sub-processor list before signing. Every processor named there is a party that can touch your personal data. Self-hosting removes n8n from that chain but not your database host or backup provider, so those need agreements too. Stage 3: check which plan includes SSO and roles before you buy, because n8n gates access control by tier. Give each workflow its own credentials, scoped to the narrowest permission the node needs. A leaked token then exposes one system, not all of them. Stage 4: execution logs hold the personal data your workflows processed. Set `EXECUTIONS_DATA_PRUNE=true` and set `EXECUTIONS_DATA_MAX_AGE`, which is counted in hours. Pick a value you can defend as your retention period, since anything older is data you no longer have a purpose for.  Stage 5: create a test subject, push them through a live workflow, then erase them. Search executions, credentials, backups and downstream tools for any trace. Backups are the usual survivor, and finding one now is cheaper than finding it in a regulator's request. ## Common n8n GDPR Mistakes and Their Published Cost Match the list below to your own setup, because it names each mistake and the Article it breaks. Four recur in n8n deployments, and two of them sit in the higher fine tier of Article 83(5). Forgotten backups are one way personal data outlives its purpose. - **Execution logs that keep personal data indefinitely**, against the storage limitation in Article 5(1)(e). - Shared credentials that hide who accessed what, a weakness under the security duty in Article 32. - AI nodes and connected apps that send personal data to providers outside the EU, which engages the transfer rules from Article 44. - Treating an EU hosting region as compliance, when it satisfies no control by itself. Each follows. Check the regulation text and n8n's current documentation before relying on any of them, because I haven't attached publication dates to them here. When n8n stores an execution, it stores the payloads that passed through it, and Article 5(1)(e), the storage limitation, applies. It requires data "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed." Although pruning can be enabled through the execution-data environment variables, **you must set the retention period yourself**. Leave it unset and the logs grow, and so does the personal data inside them. ### Transfers, regions and self-hosting **An EU-hosted workflow that calls a US-based AI provider or SaaS app transfers personal data at that step.** The node doesn't warn you. Chapter V governs the transfer, and you need a documented basis for each one. Inventory every node that calls an external service and record where that service processes data. Name the specific control a region satisfies, and you'll find it covers one line of your records, not the register. A region fixes where n8n's own servers sit. It says nothing about retention, access control, or the apps you connect. If n8n's cloud goes down, that's the vendor's incident; if your server is unpatched or its backups are unencrypted, it's yours. **Self-hosting moves the Article 32 duty to you**. Assign an owner for updates, restore tests, and credential rotation, and write the name down. ## Where Activepieces Fits for GDPR-Bound Teams Move to Activepieces and the owner you just named carries the same duties. Activepieces gives that person more vendor-side controls to work with: SOC 2 Type II, SSO and SCIM, custom RBAC, audit logs, an EU or US cloud region, and a self-host option. n8n's enough if you already run it and those duties are covered. ### Controls to compare side by side Read the n8n columns of the table below as a prompt to verify against its current plan page, because a feature sold on one tier is not a feature of the product everywhere. It shows which of these controls each option supplies. | Control | n8n Community | n8n Cloud | Activepieces | |---|---|---|---| | SOC 2 Type II | No vendor attestation covers your instance | Confirm with n8n's trust documents | Yes | | SSO and SCIM | Confirm; not assumed in the free edition | Confirm by plan | Yes | | Custom RBAC | Confirm | Confirm by plan | Yes | | Audit logs | Confirm | Confirm by plan | Yes | | EU or US cloud region | Not applicable; you choose the host | Confirm region options | Yes, managed cloud | | Self-host and air-gap | Self-host; network isolation is your build | Not applicable | Yes | Whether your workflows have a lawful basis, a retention limit or a deletion path is something a SOC 2 Type II report never says; it attests to a service provider's controls over a period. Those stay with you, and no row above transfers them. ### When to self-host so data never leaves your network Self-host when a regulator, contract or internal policy says personal data may not sit on a vendor's infrastructure. The usual catch is that the self-hosted build is the stripped one, with the controls held back for the hosted tier. Activepieces doesn't split its product that way: the air-gapped edition ships single sign-on, SCIM provisioning, custom roles, audit logs, release management and secret manager integration just as the managed cloud does, and regulated and public-sector organisations run it in production today. Keeping the data inside your perimeter costs you none of the access and audit controls that Article 32 asks you to show. Put the air-gapped docs next to the managed cloud's, with its EU or US region and SOC 2 Type II, and the control list doesn't change. MoneyGram, Moneypenny, Alan and FundingSocieties run Activepieces in production, and I make no HIPAA or ISO claim for it here, because the facts I can point to don't state one. If the vendor's cloud goes down, yours doesn't, but if your host fails, nobody else restores it. Self-hosting also moves patching, backups, and credential rotation onto the owner you named. Before you sign, ask in the security review: 1. Which SOC 2 Type II report period applies, and does it cover the cloud region I would use? 2. Are SSO, SCIM, custom RBAC and audit logs included in the plan I am quoted? 3. Where is data processed and stored in the EU or US region, and who are the sub-processors? 4. What does the data processing agreement say about deletion on termination? Activepieces Cloud's free plan costs $0 and includes unlimited flows and up to 5 users, Plus is $20 a month and Team is $200, and Ultimate is quoted through Activepieces sales, meaning teams of five users or fewer can use the platform at no cost.  ## n8n GDPR Security Review Questions for Vendors Once the security documents arrive, the questions below test whether they answer your controller duties or only describe the vendor's own. Ask for every answer in writing, and quote it back in your records. - Will you sign a data processing agreement, and does it bind you to process only on our documented instructions? - Which sub-processors touch our data, and how much notice do we get before you add one? - In which region is workflow data stored and executed, and does support access from outside it? - How long are execution logs and payloads retained, and can we set that period ourselves? - Do audit logs record who changed a workflow or credential, and can we export them? - How quickly will you notify us of a breach, and what will the notice contain? - When we delete a workflow or leave, what is erased, from which systems, and how do you evidence it? Add one more, which an auditor asks of any hosted service: what happens to our processes when your cloud is unavailable, and what happens to ours when it isn't? Obtain the [security documents and enterprise pricing](https://www.activepieces.com/sales) in the same exchange, so the answers sit beside the cost. Run a one-hour audit on the n8n instance you already operate, whether Cloud or self-hosted. Each step produces the record the next one needs, so keep the order. 1. List every active workflow. Ignore drafts and archived ones; only what runs on a trigger is processing data today. 2. Open the nodes in each and mark any that handle personal data: names, emails, phone numbers, IP addresses, free-text fields, or anything keyed to an individual. 3. Check execution retention. Find out whether successful and failed runs are saved, for how long, and whether payloads containing those fields sit in the execution history. 4. Note every third-party node and every AI node. Each is a recipient of the data, and each needs to appear on your sub-processor list with its own agreement. 5. Record an owner and a lawful basis for each workflow that touches personal data. A workflow without a named person and a stated basis has no one accountable for it. What comes out is a short register. Every blank in it is either a decision for your team or a question for the vendor, and the list above tells you which. ## Frequently asked questions Is n8n GDPR compliant out of the box? No. **No workflow tool is compliant as a switch**. Compliance is a property of how you process personal data. n8n supplies a hosting region and a data processing agreement on its cloud product. Lawful basis, retention, access control and erasure remain your duties as controller. Does self-hosted n8n need a data processing agreement? Not with n8n for the software itself, because on your own infrastructure n8n the company doesn't process your data. You still need agreements with everyone who does: your hosting provider, your backup provider, and any service your workflows send personal data to. The agreement moves; it doesn't disappear. Can n8n keep data in the EU if I use AI nodes? Only if the model provider you connect keeps it there. An AI node sends data to whichever provider you configure, so n8n's hosting region doesn't govern where the prompt is processed. Check the provider's regional options, its agreement and its sub-processors, and confirm that your credentials point at the regional endpoint. ### Edition limits and keeping documents current Is n8n's free community edition enough for GDPR? It can be, but only because you build the controls yourself. The edition gives you software and no assurances: you secure the server, encrypt and back up, restrict access, set execution-log retention and handle erasure. Before relying on the edition you run, confirm that the access-management features you need are in it, because some sit in paid tiers. If your team lacks the capacity to operate those controls, the edition isn't enough, whatever the licence allows. How often should I recheck n8n's compliance documents? On a schedule you set in advance, and whenever something changes. The triggers are a revised agreement, a change to the vendor's sub-processor list, a new region, a new AI provider, or a workflow that starts handling a new category of personal data. Keep a dated record of what you read and what you concluded. Show that record to a regulator. ## Related reading - [GDPR Compliant workflow automation](https://www.activepieces.com/blog/gdpr-compliant-workflow-automation) - [Is Zapier GDPR Compliant? What to Check Before Buying](https://www.activepieces.com/blog/is-zapier-gdpr-compliant-what-to-check-before-buying) - [Self-Hosted vs Cloud Security Automation for 2026](https://www.activepieces.com/blog/self-hosted-vs-cloud-security-automation-for-2026) ## References - [dev.to (syednoor760dev)](https://dev.to/syednoor760dev/how-to-self-host-n8n-on-hetzner-for-under-20month-noorflows-11d6) - [n8n](https://n8n.io/pricing/)Strictly, "GDPR compliant" isn't a property a tool can hold. The regulation assigns duties to roles.