Directory › Workflow automation › n8n
Is n8n UK GDPR compliant?
In plain English
n8n is a Berlin-based workflow and AI-agent automation tool. Its cloud plans store data in Frankfurt (EU), it can be fully self-hosted, and its standard DPA explicitly brings in the UK Addendum for UK GDPR transfers. Built-in AI features use US-based model providers, so check which AI nodes you switch on.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | EU region (no UK) Hosted plans store data in the EU, on Azure servers in Frankfurt, Germany. No UK region is published. Self-hosted instances live wherever you run them. | n8n.io/pricing/ |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA A DPA with SCCs forms part of the standard terms. Clause 7.1: for transfers subject to UK GDPR, the parties incorporate the ICO's UK Addendum to the SCCs. | n8niostorageaccount.blob.core.windows.net/n8nio-strapi-blobs… |
| SOC 2 | Yes Security programme audited annually against SOC 2 by an independent auditor. SOC 2 report available to Enterprise customers; SOC 3 report is public. | n8n.io/legal/security/ |
| ISO 27001 | Not published No ISO 27001 certification is mentioned on the security page. | n8n.io/legal/security/ |
| Self-hostable | Yes Community Edition is self-hosted from GitHub; Business plan is self-hosted only; Enterprise can be hosted by n8n or self-hosted. | n8n.io/pricing/ |
| Sub-processor list | Public Public list with processing locations, including US-based AI providers. View list | n8n.io/legal/sub-processors/ |
| AI model providers | OpenAI, Anthropic, Google, LangChain, Modal, Baseten Listed as AI sub-processors; OpenAI, Anthropic and LangChain process in the US. | n8n.io/legal/sub-processors/ |
| Customer data used for training? | Partly / conditional n8n says data sent to its AI Assistant is not used to train the AI services' models. No broader statement covering all workflow data was found. | docs.n8n.io/privacy-and-security/privacy/ |
Questions UK buyers ask
Is n8n UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, n8n offers EU (but not UK) data residency; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Not published. AgentSafe UK readiness score: 72/100 (Good).
Does n8n store data in the UK?
Hosted plans store data in the EU, on Azure servers in Frankfurt, Germany. No UK region is published. Self-hosted instances live wherever you run them.
Does n8n use my data to train AI models?
n8n says data sent to its AI Assistant is not used to train the AI services' models. No broader statement covering all workflow data was found.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.