Self-hosting n8n: what you need to run it safely

What do you need to self-host n8n safely?

A secured server behind HTTPS, a proper database such as PostgreSQL, a backed-up encryption key, scheduled backups, a planned update routine, monitoring, and queue mode with workers once volume grows, all used within the terms of n8n's licence. Getting n8n running takes minutes. Running it reliably for workflows your business depends on takes a short checklist of operations work that is easy to skip and expensive to miss.

This is the setup we use when we deploy n8n for clients as part of our workflow automation service.

Where should n8n run?

You can use n8n's own cloud service or host it yourself, usually with Docker on a virtual server or a managed container platform. Self-hosting gives you control over data location, network access and costs at volume. In return you own security, uptime, backups and updates. Put n8n behind a reverse proxy with HTTPS, restrict the editor to your team, and keep webhook URLs as the only public entry points.

Which database should you use?

A fresh n8n install can store everything in SQLite, which is fine for testing. For production, use PostgreSQL. n8n's queue mode needs a shared database that every instance can reach, and its documentation states that running a distributed setup over SQLite is not supported (n8n docs: queue mode). Starting on PostgreSQL avoids a migration later, and it is easier to back up and monitor.

Why is the encryption key so important?

n8n encrypts the credentials you save, such as API keys and passwords for connected apps, before writing them to the database. On first launch it generates a random key and stores it in the ~/.n8n folder, or you can set your own with the N8N_ENCRYPTION_KEY environment variable (n8n docs: encryption key).

Treat this key like the master password. Set it explicitly, store it in your secrets manager, and back it up separately from the server. A database backup without the matching key gives you workflows whose credentials cannot be decrypted.

How should access to n8n be secured?

The n8n editor can read every credential and change every workflow, so treat access to it like access to your bank account. Turn on user management with individual accounts instead of one shared login, require strong passwords and two-factor authentication where your setup supports it, and remove people when they leave. Restrict the editor to your office network or a VPN where possible, keep the server's firewall closed except for HTTPS, and give each connected app credentials with only the permissions the workflow needs, not full admin access.

What should you back up, and how often?

• The database, daily at least, with backups stored off the server and a restore tested every few months.
• The encryption key and your environment configuration.
• Workflow exports kept in version control, so changes can be reviewed and rolled back.

Also prune old execution data on a schedule, so the database does not grow without limit and slow everything down.

How should updates be handled?

n8n releases updates often, with new nodes, fixes and occasionally breaking changes. Pin the version you run, read the release notes before updating, back up first, and test critical workflows after each update. A staging copy pays for itself once you have workflows that handle orders, invoices or customer data.

When do you need queue mode?

A single instance runs triggers, the editor and executions together. When executions start waiting, or one heavy workflow slows everything else, switch to queue mode. It splits n8n into a main instance that receives triggers and webhooks, Redis as the message broker holding pending executions, and workers that pull and run them, with results written to the database (n8n docs: queue mode). Every worker needs the same encryption key set as an environment variable (n8n docs: encryption key). Our cloud and DevOps team sets up the containers, Redis and monitoring for this.

What should you monitor?

• Uptime of the editor and of your webhook URLs.
• Failed executions, with an error workflow that alerts your team by email or Slack.
• CPU, memory and disk on the server, plus database size.
• Queue length and worker health in queue mode.

What does the licence allow?

n8n is distributed under its Sustainable Use License. It allows you to use or modify the software for your own internal business purposes or for non-commercial or personal use, and to distribute or provide it to others only free of charge for non-commercial purposes (n8n licence). Running your own company's automations is covered. Hosting n8n as a paid service for clients is not, so check the terms with n8n before building that kind of offer.

Can self-hosted n8n run AI workflows?

Yes. n8n can call OpenAI, Anthropic and other model APIs inside workflows to classify, summarize or draft. Keep API keys in n8n's credential store, limit the data each step sends, and log what the AI produced. Our AI automation service designs these steps with review points where mistakes would be costly.

Frequently asked questions

Last updated November 1, 2026