
n8n
GDPR CompliantBerlin workflow automation platform, self-hostable, with cloud hosting on Microsoft Azure inside the European Union.
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Freemium
GDPR Compliance Data
Not independently verified| GDPR Status | GDPR Compliant |
| HQ Country | Germany |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | European Union"n8n cloud uses Microsoft Azure for hosting" and "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union". Source: n8n.io/legal/security (read 2026-08-24). |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Last Verified | 24 August 2026 |
How we reached this
n8n GmbH, registered HRB 212509 B, Novalisstr. 10, 10115 Berlin, per the privacy policy. EU-owned with no foreign parent. Cloud hosting is stated as Microsoft Azure with hardware and stored data in the European Union. Exposure is US_CLOUD_ACT not because n8n is American but because Microsoft is: a US provider can be compelled to produce data it holds in an EU data centre, and the vendor cannot prevent that. Self-hosting on European infrastructure removes the exposure, and is a supported deployment rather than an enterprise-only option, which is why Schrems II risk is MEDIUM rather than HIGH. A DPA, a sub-processor list and a security page are all published. Licensed under a Sustainable Use Licence, which is source-available rather than OSI open source, so isOpenSource is false.
About n8n
Automation You Can Host Yourself
n8n connects APIs together on a canvas: trigger, transform, branch, call, repeat. Where most automation tools stop at the visual layer, n8n lets you write JavaScript or Python in a node when the visual approach stops being the shortest path, which is why it tends to survive contact with real marketing operations work that Zapier-style tools cannot express.
For marketing teams it covers lead routing, enrichment, CRM synchronisation, campaign triggers and the long tail of internal glue that would otherwise be someone's manual Monday morning.
Self-Host or EU Cloud
The reason n8n appears in sovereignty conversations is that self-hosting is a first-class option rather than an enterprise upsell. Run it in your own EU data centre and the data question is entirely yours to answer.
For the managed service, n8n's security page is specific: "n8n cloud uses Microsoft Azure for hosting" and "the physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union".
That is a good answer with one caveat this directory exists to make visible. Azure is Microsoft, an American company, and under the CLOUD Act a US provider can be compelled to produce data it holds anywhere, including in Frankfurt. n8n GmbH itself has no US parent and cannot be compelled that way, but its host can. Self-hosting on a European provider removes that exposure entirely, which is the choice on offer here and not on offer from most competitors.
Licence, Not Open Source
n8n uses a Sustainable Use Licence rather than an OSI-approved open source licence. The source is public and self-hosting is permitted for internal business purposes, but reselling it as a service is not. Worth knowing if a procurement checklist has an open source box on it.
n8n GmbH is registered in Berlin under HRB 212509 B and publishes a data processing agreement, a sub-processor list and a security page.
More in marketing automation.
Key Features
Pros & Cons
Categories
n8n GDPR & data protection: common questions
Is n8n GDPR compliant?
Yes. On the evidence we checked, n8n meets the requirements European businesses usually need. n8n is a European company headquartered in Germany, data is hosted within the European Union, and a Data Processing Agreement is published.
Where does n8n store data?
n8n states: ""n8n cloud uses Microsoft Azure for hosting" and "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union". Source: n8n.io/legal/security (read 2026-08-24).". Data is hosted within the European Union.
Does n8n offer a Data Processing Agreement (DPA)?
Yes. n8n publishes a DPA at https://n8n.io/legal/data-processing-agreement/. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is n8n a European company?
Yes. n8n is headquartered in Germany and, as far as we can establish, European-owned.
Is n8n subject to the US CLOUD Act?
Indirectly. n8n itself is European-owned and headquartered in Germany, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is.
Schrems II compliance checklist →Related Tools

Brevo
All-in-one marketing platform with email, SMS, CRM, and automation. French company, EU data hosting.

GetResponse
All-in-one email marketing and automation platform from Poland.

Omnisend
E-commerce email and SMS marketing automation from Lithuania.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at n8n and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.