Security, privacy and data
How data moves through the workflows we build, who can access what, and the practices that protect it. Specific controls are agreed in writing for each project.
Where your data goes
01
Data stays in systems you own.
A typical workflow: your systems, your n8n instance in the middle, an AI model only where it adds something, and a person wherever a decision matters.
Your systems
- CRM, email, accounting
- Your existing permissions
Your n8n instance
- In your account or n8n Cloud
- Encrypted credentials
- Execution logs you control
- Error alerts to a named owner
AI model, only where useful
- No training on your data
- Personal data redacted if agreed
A person, where it matters
- Approvals and exceptions
- Every decision logged
Practices
02
What we do on every project.
Your account, your instance
Workflows run in an n8n instance you own, cloud or self-hosted. We work through access you grant and can revoke.
Encrypted credentials
API keys and passwords live in n8n's encrypted credential store, never in workflow code or shared documents.
Least privilege
Each connection gets only the permissions it needs: read-only where possible, scoped tokens everywhere.
Data location
Self-hosted instances run in the region you choose, for example within the EU, alongside your other systems.
AI data settings
We use AI provider settings that do not train on your data by default, and can redact personal data before it reaches a model.
Logs and retention
Execution logs help trace problems; retention periods are set to what you need, then data is pruned.
Incident response
Errors alert a named person. On a support plan, incidents are handled within agreed response times and reported.
Agreements
A data processing agreement is available for any project that touches personal data.
Principles
03
Agreed before anything is built.
- 01
Authorised, limited access
Access to client systems should be authorised and limited to the work required.
- 02
Agreed sources and permissions
Data sources and permissions are agreed before implementation begins.
- 03
Sensitive information
Sensitive information is handled according to the agreed project requirements.
- 04
Assessed AI and third-party services
AI services and third-party integrations are assessed for suitability before they are used.
- 05
Human review where it matters
Human review is included wherever the consequences of an error warrant it.
- 06
Logging, retention, and monitoring
Logging, error handling, data retention, and monitoring are considered during design, not after.
- 07
Ownership in writing
Data ownership, access, licensing, and ongoing responsibilities are agreed in writing.
Next step
Have specific requirements?
If your project involves sensitive data, regulated information, or particular access rules, raise them early. They shape the design from the start.