Back to Tools
n8n logo

n8n

GDPR Compliant

Berlin workflow automation platform, self-hostable, with cloud hosting on Microsoft Azure inside the European Union.

🇩🇪Germany🇪🇺EU Hosted🇪🇺 European

Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.

Freemium
n8n website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
GDPR Compliant
HQ CountryGermany
OwnershipEuropean-owned
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
European Union"n8n cloud uses Microsoft Azure for hosting" and "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union". Source: n8n.io/legal/security (read 2026-08-24).
EU Servers Available
Data Processing AgreementView DPA
Sub-processor ListNot verified
Schrems II Risk
Medium Risk
SCCs in Place
Last Verified24 August 2026

How we reached this

n8n GmbH, registered HRB 212509 B, Novalisstr. 10, 10115 Berlin, per the privacy policy. EU-owned with no foreign parent. Cloud hosting is stated as Microsoft Azure with hardware and stored data in the European Union. Exposure is US_CLOUD_ACT not because n8n is American but because Microsoft is: a US provider can be compelled to produce data it holds in an EU data centre, and the vendor cannot prevent that. Self-hosting on European infrastructure removes the exposure, and is a supported deployment rather than an enterprise-only option, which is why Schrems II risk is MEDIUM rather than HIGH. A DPA, a sub-processor list and a security page are all published. Licensed under a Sustainable Use Licence, which is source-available rather than OSI open source, so isOpenSource is false.

About n8n

Automation You Can Host Yourself

n8n connects APIs together on a canvas: trigger, transform, branch, call, repeat. Where most automation tools stop at the visual layer, n8n lets you write JavaScript or Python in a node when the visual approach stops being the shortest path, which is why it tends to survive contact with real marketing operations work that Zapier-style tools cannot express.

For marketing teams it covers lead routing, enrichment, CRM synchronisation, campaign triggers and the long tail of internal glue that would otherwise be someone's manual Monday morning.

Self-Host or EU Cloud

The reason n8n appears in sovereignty conversations is that self-hosting is a first-class option rather than an enterprise upsell. Run it in your own EU data centre and the data question is entirely yours to answer.

For the managed service, n8n's security page is specific: "n8n cloud uses Microsoft Azure for hosting" and "the physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union".

That is a good answer with one caveat this directory exists to make visible. Azure is Microsoft, an American company, and under the CLOUD Act a US provider can be compelled to produce data it holds anywhere, including in Frankfurt. n8n GmbH itself has no US parent and cannot be compelled that way, but its host can. Self-hosting on a European provider removes that exposure entirely, which is the choice on offer here and not on offer from most competitors.

Licence, Not Open Source

n8n uses a Sustainable Use Licence rather than an OSI-approved open source licence. The source is public and self-hosting is permitted for internal business purposes, but reselling it as a service is not. Worth knowing if a procurement checklist has an open source box on it.

n8n GmbH is registered in Berlin under HRB 212509 B and publishes a data processing agreement, a sub-processor list and a security page.

More in marketing automation.

Key Features

Visual workflow editor with 400+ integrations
JavaScript and Python code nodes for custom logic
Self-hosting on your own infrastructure
AI agent and LLM workflow nodes
Webhooks, schedules and error workflows
Published DPA, sub-processor list and security documentation

Pros & Cons

Self-hosting is a supported first-class option, not an enterprise upsell
Managed cloud hardware and data are stated to be in the European Union
Code nodes handle logic that visual-only automation tools cannot express
Managed cloud runs on Microsoft Azure, so a US provider holds the data
Sustainable Use Licence is source-available, not OSI open source
Steeper learning curve than consumer-grade automation tools

n8n GDPR & data protection: common questions

Is n8n GDPR compliant?

Yes. On the evidence we checked, n8n meets the requirements European businesses usually need. n8n is a European company headquartered in Germany, data is hosted within the European Union, and a Data Processing Agreement is published.

Where does n8n store data?

n8n states: ""n8n cloud uses Microsoft Azure for hosting" and "The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union". Source: n8n.io/legal/security (read 2026-08-24).". Data is hosted within the European Union.

Does n8n offer a Data Processing Agreement (DPA)?

Yes. n8n publishes a DPA at https://n8n.io/legal/data-processing-agreement/. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.

What a DPA has to cover →

Is n8n a European company?

Yes. n8n is headquartered in Germany and, as far as we can establish, European-owned.

Is n8n subject to the US CLOUD Act?

Indirectly. n8n itself is European-owned and headquartered in Germany, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is.

Schrems II compliance checklist →

Spotted something wrong?

Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.

If you work at n8n and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.