As soon as a company automates workflows with customer, employee or contract data, the question inevitably arises where this data is physically stored and who can technically access it. With a cloud automation platform, the answer is often unsatisfactory: servers abroad, several subprocessors, unclear deletion periods. This article shows what n8n self-hosted means in practice, how it can be classified legally and which hosting options are realistic for Swiss companies.

Where data flows to with cloud automation

When a workflow runs on a cloud automation platform, the data typically passes through several stations: it is routed through the provider's infrastructure, cached there for execution, written to logs and partly processed further by subprocessors (for example cloud providers or monitoring services). Each of these stations is an additional point where personal data leaves your own company and may end up in a country whose level of data protection is not automatically considered equivalent.

For an HR form, an invoice approval or a customer service workflow with names, addresses or contract details, this is not inadmissible per se, but it requires a sound legal basis and full transparency about who has access where. That transparency is often hard to establish with heavily nested cloud chains.

‍

‍

FADP and GDPR: what applies to data processing by third parties

The revised Swiss Federal Act on Data Protection (revFADP, German: revDSG), in force since September 2023, is closely modelled on the GDPR, but is stricter on transfers abroad in one respect: anyone transferring personal data abroad must be able to state which countries the data flows to and which safeguards ensure that the level of protection is maintained. With an automation platform that uses several foreign subprocessors, this duty of proof quickly becomes laborious.

For data processing by a third party (that is, when someone processes data on behalf of the company), the revFADP requires a contract that regulates the purpose, scope and security measures of the processing. Companies without a registered office in Switzerland must additionally appoint a representative. The GDPR has a comparable construct in the data processing agreement under Art. 28.

Self-hosted n8n fundamentally changes this starting position: there is no longer a processor for the workflow execution, because the platform runs on your own or deliberately chosen infrastructure. What remains are only the individual, deliberately configured API calls to target systems, for example a CRM or a shipping service, for which a separate contract with the respective provider exists anyway. The chain becomes shorter and easier to control.

What self-hosted means in practice

n8n self-hosted means: the n8n instance runs on a server that the company operates itself or rents from a provider of its own choice, not on n8n Cloud. All workflow data, credentials and execution logs stay on infrastructure that you control. Technically, a production-ready setup consists of several building blocks:

• Docker containers for the n8n application itself, usually orchestrated with Docker Compose so that updates and restarts remain reproducible.
• PostgreSQL database for workflows, execution data and credentials, instead of the bundled SQLite database, which is not suitable for production use.
• Queue mode with Redis, as soon as several workflows are to run in parallel or at high frequency: a main process receives triggers and distributes execution to several worker processes that carry the actual load.
• Reverse proxy (for example Traefik or Nginx) for TLS termination, so that the webhook endpoints and the editor interface are only reachable over an encrypted connection.

This setup can run on a single virtual server for smaller loads or scale across several worker nodes when many workflows run at the same time.

Hosting options compared

Not every company has to run the infrastructure itself. The following table compares the three common models:

‍

‍

For most Swiss SMEs and large companies with sensitive personal data, the middle column is the practical compromise: full control over the application, without having to build your own data centre infrastructure.

Self-hosting: which licence tier do you need?

Self-hosting does not automatically mean “free”. For self-managed operation, n8n distinguishes three licence tiers with different feature sets. According to the official pricing page (n8n.io/pricing, as of September 2026), the structure looks like this:

‍

‍

The exact prices and execution quotas change regularly and are tiered by monthly workflow executions at n8n, not as a flat rate per server instance. For a binding figure, it is always worth checking n8n.io/pricing or talking to n8n sales before budget planning.

Community, Business or Enterprise: when is what enough?

Community is enough as long as a single team or a manageable number of workflows is being automated and access to the editor is limited to a few trusted people anyway. For many SME use cases, this is the right starting point.

Business is the right step up as soon as several teams or departments work with n8n and you need central login through your existing identity provider (SSO/SAML), a clean separation of test and production environments or traceable versioning through Git, without needing the full Enterprise package. In practice, this is the fitting tier for many Swiss companies with self-hosted n8n.

Enterprise only becomes necessary when compliance or audit requirements call for external secret stores, log streaming into a central SIEM system or contractually guaranteed support response times, as is the case in heavily regulated industries or large corporations.

Licence note: Sustainable Use License

n8n is released under the Sustainable Use License, not a classic open-source licence. For the free Community Edition, this means: internal use within your own company, as well as customer projects where automation runs on the customer's own infrastructure, is possible free of charge. What is not allowed is reselling n8n as your own commercial hosting offering, that is, running it under your own name as SaaS for several customers and charging fees for it. For Business and Enterprise, the licence works technically through a licence key that regularly checks in with the n8n licence server. As the licence model and feature set keep evolving, it is worth checking n8n's current licence and pricing page before making a final decision, as of September 2026.

Security basics for self-hosting

Self-hosting brings control, but also responsibility. A production-ready setup should cover at least the following points:

• Credentials encryption: n8n encrypts stored credentials and API keys in the database by default. The encryption key has to be kept separately and securely.
• RBAC (role-based access control): Role and permission concepts, so that not everyone with access to the editor can also change production workflows or view credentials. Extended RBAC features with projects are reserved for the paid editions as of September 2026, you can find the current feature set on n8n's official pricing page.
• Audit log: Traceability of who made which change to a workflow and when is central, especially for corporate governance requirements.
• Backups: Regular, tested backups of the database and workflow definitions, ideally with a copy outside the production environment.
• Updates: n8n develops quickly. A patch rhythm for security updates is part of operations, as is testing updates in a separate environment before the production rollout.

The operational effort that really comes on top

Self-hosting is not “set up once and forget”. Anyone calculating honestly has to plan for the following ongoing tasks: server patches and operating system updates, n8n version updates including compatibility checks of existing workflows, monitoring of resource usage and queues in queue mode, backup monitoring and occasional restore tests, and the ability to respond to outages outside office hours if critical processes run automatically. For a company without its own DevOps capacity, this is real extra effort compared with a managed cloud solution, and it should not be played down. You can either carry this effort yourself or hand it over to a partner like Blinno.

Worked example: automation with personal data in a large company

In an automation programme for a German car manufacturer that Blinno supported, the separation of business data and personal data was a central governance element: personal data was masked in logs, retention periods were kept short, and business data stayed as far as possible in the source systems instead of in the automation platform itself. These basic principles can be transferred to any self-hosted n8n setup regardless of company size: clear responsibility for the infrastructure, clean separation of environments and a deliberate approach to what ends up in logs in the first place.

✨ AI generated content