Node-RED Enterprise Edition? What to Buy or Build
Oct 27, 202613 min read
Node-RED Enterprise isn't an official edition. Node-RED's free, open-source software, and any enterprise layer around it's either sold by a third party or built by your own team.
The 02:14 Failure and What Node-RED Enterprise Means
Node-RED Enterprise refers to the set of access control, audit, support, and safe-deployment capabilities that organizations add around the free, open-source Node-RED runtime, which they either buy from a third-party vendor or build themselves, much as teams using other open-source automation tools such as Activepieces layer their own governance on top.
Is there a Node-RED Enterprise Edition?
The ledger line is simple:
- There's no licence to buy.
- There's no enterprise plan to upgrade to.
- There's no vendor from whom the project itself sells you support.
- The runtime costs nothing.
- Everything an enterprise buyer expects to see attached to it (access control, an audit trail, a support contract, a controlled path from edit to production) you must source separately or build, and then maintain.
Who edited the Node-RED instance during the failure
Consider the incident as an auditor would, starting with the approval step that didn't exist. One self-hosted Node-RED editor ran on a single server. An operator opened it overnight and edited the live flow canvas directly.
The edit went out on deploy, and the flow running beside it broke at 02:14.
Illustrative: a single self-hosted editor, an operator editing the live canvas, and the deployed flow showing a broken link at 02:14.
With the failure in view, the next question is what the team believed they had bought. They assumed four things, and each one was an unverified claim until someone asked for the evidence.
- Access control. They assumed the editor restricted and recorded who could edit a flow. On a default self-hosted editor, that's something you configure or add, not something you inherit.
- Audit. They assumed there was a record of who changed what and when. Without one, the question "who edited it at 02:14" has no answer you can hand to a reviewer.
- Support. They assumed a contract bound someone to answer at that hour. With a free runtime, nobody is bound, unless you've bought that from a third party.
- Safe deployment. They assumed a staged path from change to production. A single server with a live canvas has no such path.
Teams comparing workflow tools should ask for that evidence line by line rather than accept the word "enterprise" as covering it.
Everything below works on Activepieces' free plan. Start without code or a credit card.
Downtime and data costs of a Node-RED failure
Afterwards the team could count three things the 02:14 failure had cost it: the hours the flows were down, the records they dropped or posted twice, and the staff hours the team spent reconstructing who changed what.
To see how the scenario prices them, read the table below. Every scenario figure is illustrative, built for this account, so take the rows as the structure of the bill and not as a measurement.
| Measure | What it counts | Status |
|---|---|---|
| Hours down | Time the affected flows processed nothing | Illustrative scenario figure |
| Records dropped | Messages that arrived and were never written downstream | Illustrative scenario figure |
| Records duplicated | Messages written more than once after a restart | Illustrative scenario figure |
| Staff hours reconstructing | Time spent establishing which change caused it | Illustrative scenario figure |
Node-RED downtime cost per hour
Aberdeen's widely cited estimate of $260,000 an hour and Splunk and Cisco's $900,000 an hour both describe downtime across whole organisations, making downtime an unaffordable cost for any organization.
Put the two figures side by side and the gap shows that what an hour costs depends on what the business routes through it. Use your own cost per hour, not either benchmark.
When a record is dropped, revenue or an obligation never reaches its ledger. A duplicated one is an overstatement that someone must find and reverse. Neither shows up in an uptime figure, so the count has to come from comparing source and destination.
Ask the runtime for the staff-hours line and it has nothing to give. With no audit trail of edits and deployments, the team rebuilt the sequence from memory and chat history.
Who controls the Node-RED runtime governance
No named approver, no record of who made the change: Node-RED core permits both. It supplies a runtime and an editor, and leaves control over who changes what to you.
What the open-source licence gives you
You can run it, modify it and embed it without a licence fee, because Apache 2.0 covers Node-RED, according to nodered.org. So there's no vendor to ask for an enterprise edition.
The same fact cuts the other way: no one owes you support, an SLA or a roadmap commitment.
Alongside that, core ships the browser editor, admin authentication for that editor, and Git-backed projects for versioning flows.
Enterprise features Node-RED core leaves out
In the table, the first three rows and Git projects come with core, while roles, audit and staged deployment don't, so those are what you must buy or build.
| Capability | Provided by Node-RED core | Left to you |
|---|---|---|
| Licence | Yes (Apache 2.0) | |
| Editor | Yes | |
| Admin authentication | Yes | |
| Git projects | Yes | |
| Per-user roles | Yes | |
| Audit trail | Yes | |
| Staged deployment | Yes |
Who may log in is all that authentication tells the editor. It doesn't tell you what each person could do, or what they did. The three empty cells on the left are the ones an auditor asks about first.
Who may log in is all that authentication tells the editor. It doesn't tell you what each person could do, or what they did.
Four mistakes made 02:14 possible:
- The team treated "free" and "enterprise-ready" as one claim, and never checked what the project itself said it included.
- Everyone with editor access could change anything, because nothing in core separates a reviewer from an author.
- No audit trail existed, so the team had to answer the question of who deployed the change from memory and chat history.
- Edits went from the editor straight to the live runtime, with no staging step to catch the error before it mattered.
Enterprise pricing and licensing for Node-RED
Because Node-RED itself costs nothing, every enterprise control is a priced layer around it, and the cheapest hosted entry points start near $2.46 a month without any of those controls. The figures below date from 27 October 2026.
Under the Apache 2.0 open-source licence, the core runtime is free. Single sign-on, role separation, audit logging and support aren't bundled, so your team builds and evidences each one itself. That's free in licence terms and costly in review time.
FlowFuse and commercial Node-RED hosting options
At the bottom end, hosting is cheap. According to Stackhero's pricing comparison, GetWebup charges $5.45 a month and AIHostBox $5.99, so at that price you're renting a server, not buying governance.
Prices rise from there. Per Stackhero, Elestio is $11, OVHcloud $12.32 and RAD Platform $31. That's a spread of several times for the same runtime, so you're paying for the wrapper, not for Node-RED.
Tier names mislead. On DeviceCask, Starter is $19 a month, Business $39 and Enterprise $99, so cost is not a barrier to adoption.
Enterprise there is simply the top paid plan, a subscription you can start on a card, not a separate product with its own assurance.
In the table, no row lets you assume SSO or audit is included. Read the SSO column before the price column.
| Option | Licence | Hosting | SSO plan | Price | Limits |
|---|---|---|---|---|---|
| Node-RED core | Apache 2.0 | Self-hosted | Build it yourself | Free | Your own staff time |
| FlowFuse Starter | not published | Hosted | not published | $15/month | not published |
| FlowFuse Pro | not published | not published | not published | not published | not published |
| FlowFuse Teams | not published | not published | not published | not published | not published |
Easier to see it running than to read about it: set it up free, no card.
Where Activepieces Fits for Business Workflows
If your flows move records between SaaS applications, such as an approved invoice going from a form to the ledger, Activepieces fits, with 744 integrations counted from its open source monorepo. It doesn't replace Node-RED for devices, protocols or edge hardware.
When the task is business app automation
Two routes are open on Activepieces: a self-hosted Community Edition, the automation core under the MIT licence, and cloud plans.
That split matters for the 02:14 problem: you can run it inside your own boundary or let the vendor run it, and the pricing page says which controls sit on which plan.
On the pricing page the self-serve tiers are Free at $0 a month, Plus at $20 and Team at $200, with Ultimate and self-hosted enterprise control on quoted terms.
Before anyone signs a contract, a team can price a pilot. Team includes SSO and standard roles, while Ultimate, which goes through sales, adds SCIM, custom RBAC, audit logs and git sync, so the controls you need to audit are likely to be negotiated there.
Read each tier's feature list against your own checklist: SSO, permissions, support, and how many users and active flows are included. Take the answer from the page, not from this article.
Where a control isn't listed for a tier, treat it as absent until the vendor confirms it in writing. The same rule applied to the "not published" cells earlier.
When Node-RED is still the right tool
When a flow starts at a machine rather than an application, Node-RED remains the better fit.
A flow that reads a sensor over a serial line, speaks a fieldbus or industrial protocol, or runs on a gateway with an intermittent network link is the work it was built for.
For the business-app flows, the gaps behind 02:14 (who may edit, who did, what reached production) sit inside a single product at Activepieces: agents, integrations, automation, shared data and approvals under custom RBAC, SSO, SCIM, audit logs, log and event streaming, environments, release management and git sync, on cloud or self-hosted.
MoneyGram and Moneypenny run Activepieces in production. Rebuild that span from point tools and the question "who edited it at 02:14" goes to several vendors, each holding a different fragment of the answer.
Divide the estate by workload, not by preference. Business-app flows can go to Activepieces if its plan covers your access and audit requirements: SSO and standard roles start on Team at $200 a month, and audit logs sit on Ultimate.
Device and edge flows stay in Node-RED, with the access control, audit and safe-deployment work still yours to buy or build.
Moving the SaaS flows doesn't remove that work. It only shrinks the part of the estate where it applies.
Six Node-RED production rules for enterprise teams
Wherever controls cover only part of the estate, the rest stays exactly where it stood at 02:14, so these six apply to every instance, in this order.
Five need no licence; the sixth costs a named person's hours.
- Stop editing production. Nobody changes a live flow directly, so a hotfix can no longer be an unrecorded change.
- Git projects with review. Every deployed flow traces to a commit and an approver.
- Individual logins and roles. Shared credentials go, so an edit has a name against it.
- Nightly export of flows and credentials. Recovery becomes a restore from last night, not a reconstruction from memory.
- Pin node versions. An unattended update can no longer change behaviour between two deployments.
- A named owner and an alert. Someone is accountable, and a failed run reaches them before a customer does.
None of this needs a vendor: each control is a configuration choice in the open-source runtime, but each requires someone to check it's still working.
When to pay for Node-RED enterprise support
Pay when you can't staff the checking, not when the runtime seems inadequate.
Entry-level hosting is cheap: FlowFuse's starter-tier comparison lists MassiveGRID at $2.46 a month, AIHostBox at $5.99, Elestio at $11, OVHcloud at $12.32, and Kaa and Stackhero at $15 each, which means the choice between them rests on capability rather than budget.
FlowFuse asserts that MassiveGRID's $2.46 is a hosting bill, not a control, and a low price tells you nothing about audit or access, so you must evaluate these requirements independently of cost.
What really costs money is the labour behind controls three to six. If your team can't name an owner or test a restore each quarter, a managed layer is worth buying. If it can, the money is better spent on that person's time.
Enterprise licensing for Node-RED
On a purchasing checklist these are separate line items, so each gets a short answer and a named source.
For commercial use, Node-RED is free: the runtime uses the Apache 2.0 licence, which permits it, and the project's own site, nodered.org, lists no paid edition.
Zero is therefore the licence line on your budget, but the lines for access control, audit, support and safe deployment aren't, and each must be bought or built separately.
Does Node-RED have built-in SSO?
No, not in the core runtime. The documentation on nodered.org describes editor authentication through a configurable security setting that supports local users or a custom login strategy you wire up yourself.
So you implement and maintain single sign-on yourself, or a commercial platform layered on top supplies it. Ask whoever signs off on access reviews which of those they're accepting.
Who owns Node-RED and who offers paid support?
There's no one to call when a flow fails, because the project sits under the OpenJS Foundation, a neutral body, rather than a single vendor.
For paid support, look outside the project. FlowFuse, a company founded by people closely involved in Node-RED, sells a managed platform and support, and its pricing page is the place to confirm current plans and terms.
Treat any support claim as unverified until you've got the contract wording.
Can I self-host an enterprise setup?
Yes. The runtime is built to be self-hosted, and FlowFuse documents a self-hosted option on its own site as well as a cloud one.
Check the plan terms for what self-hosted use includes. Whether team roles or deployment pipelines are covered depends on the plan, so read the plan page rather than relying on a sales call.
Likewise, whether it can run in the cloud is a hosting decision, not a product limit.
When flows move off Node-RED, they go as JSON exports, so the definitions leave with you. What doesn't travel is the logic inside function nodes and any third-party nodes, which a different tool won't interpret.
Plan for a rebuild of that logic, and keep the exported files in version control so the record of what ran is intact.
