n8n

n8n GmbH is registered at Novalisstr. 10, 10115 Berlin, Germany (Amtsgericht Charlottenburg HRB 212509 B, VAT DE327574983) with founder Jan Oberhauser as sole Geschäftsführer. The privacy policy and Master Enterprise Terms both name n8n GmbH as the data controller and contracting party. Customer agreements (both Self-Serve Terms and Master Enterprise Terms) however use English & Welsh governing law with London as the exclusive jurisdiction -- this is a forum-selection choice, not a data-protection law applicability change. EU personal data remains subject to GDPR. There is no US subsidiary or US filing entity disclosed in the imprint, sub-processor list or terms.

Exposure is classified as "partial-via-subprocessors". The corporate stack itself is fully EU -- n8n GmbH (Berlin) contracts directly with customers and there is no US subsidiary. Exposure enters through the subprocessor chain: customer workflow data is processed on Microsoft Azure (US parent; EU regions in Frankfurt and Sweden), traffic is fronted by Cloudflare (US), application telemetry is reported to Sentry (US, o1420875.ingest.us.sentry.io), and AI integrations -- when enabled by the customer -- send prompt and completion data to OpenAI (US), Anthropic (contracted via Anthropic Ireland Ltd; inference US-region), Google Vertex AI (EU/US) and LangChain (US). International transfers are documented under the EU-U.S. Data Privacy Framework plus Standard Contractual Clauses per Articles 44 et seq. GDPR. A self-hosted Community Edition deployment removes the SaaS subprocessor chain entirely -- the customer chooses their own hosting and AI providers.

n8n is source-available but NOT OSI-approved open source. The repository n8n-io/n8n is governed by a custom Sustainable Use License v1.0 plus a separate Enterprise Edition carve-out -- GitHub's license metadata correctly returns Other rather than a recognised OSI license. Verbatim limitations from the license: "You may use or modify the software only for your own internal business purposes or for non-commercial or personal use. You may distribute the software or provide it to others only if you do so free of charge for non-commercial purposes." Source code files containing .ee. in their filename or .ee in their dirname are excluded from the Sustainable Use License and require a separate Enterprise License. The repo migrated from Apache 2.0 + Commons Clause to the Sustainable Use License in March 2022.

n8n Cloud is hosted on Microsoft Azure in the European Union -- the pricing page states EU-hosted plans store data in Frankfurt, Germany, and the security page notes additional regions are being prepared. Encryption at rest is Azure server-side AES-256 (FIPS 140-2); encryption in transit is TLS through Cloudflare (Frankfurt edge PoP observed in cf-ray headers). The full sub-processor list (https://n8n.io/legal/sub-processors/) names six authorised processors: Microsoft Azure (US parent, EU residency), Hetzner Online (Germany), OpenAI (US), Anthropic (Ireland), Google Vertex AI (EU/US) and LangChain (US). Customer workflow data is deleted within roughly six months of account deactivation unless legally required otherwise. Self-hosted Community and Business deployments keep all customer data within the customer's chosen infrastructure.

No. The AI Terms at https://n8n.io/legal/ai-terms/ state two binding prohibitions verbatim: "n8n will not: Use Customer Data to train any AI models operated by n8n" and "n8n will not use AI Output to train AI models operated by n8n". The privacy policy reiterates: "No personal data used for AI/ML model training". The AI architecture is also straightforward by design -- n8n does not operate LLM services itself; instead the AI Terms state "Customer configures LLM providers (OpenAI, Anthropic, Google, etc.) using Customer's own API credentials", which means the customer's relationship with the LLM provider is direct, and each provider's data-handling policies apply at that layer. The Customer Acceptable Use Policy (effective March 2026) also explicitly prohibits "Using AI components to train competing models".