n8n Self-Hosted in 2026: Cost, Security and v3

Radiatus Engineering DevOps Published 31 Oct 2026 14 min read

If you run n8n self hosted, the end of 2026 forces some decisions. n8n 3.0 entered beta on 27 October and supports Docker only. Support for the 1.x line ends on 31 December. The past year also brought a string of critical vulnerabilities, one of them exploited in the wild. This guide is for Indian SMEs and engineering teams who run n8n or are about to. It covers real costs, the licence, DPDP, a production Docker setup and a safe upgrade path.

Key dates for self-hosted n8n

Sources: n8n’s 3.0 announcement of 23 October 2026, the GitHub releases and NVD, as of October 2026.

n8n self-hosted vs Cloud: which one fits

The real question is who carries the operational risk. On n8n Cloud, n8n handles patching, backups and uptime. Self-hosting gives you control over location, network access and cost per execution, and makes those jobs yours.

Choose Cloud when your volume fits a plan, nobody wants to own a Linux server and EU hosting is acceptable. Choose self-hosting when data must stay in India, when workflows must reach private systems, or when volume makes per-execution pricing hurt. There is no separate n8n pricing for India: Cloud is priced in euros, so the rupee cost moves with the exchange rate. Volume grows fast. By n8n’s own arithmetic, one workflow on a five-minute schedule runs about 8,600–8,900 times a month, nearly the whole Pro allowance.

Where your data lives under DPDP

n8n says Cloud data is currently hosted in the European Union. That is not automatically a DPDP breach. The Act lets the government restrict transfers to countries it notifies, and keeps stricter sector laws in force. But many Indian contracts and customer questionnaires expect personal data in India. n8n execution logs hold full payloads: names, phone numbers, invoice amounts.

For n8n hosting in India, use an Indian region: AWS Mumbai or Hyderabad, Azure South India (Chennai), or Google Cloud Mumbai or Delhi. That keeps the database, execution history and credentials in India. Two caveats. Nodes that call external APIs, such as an AI model or Google Sheets, still send data to wherever that API runs. And for self-hosted workflow data, n8n is neither controller nor processor, so retention and breach response fall to you. By default, n8n prunes execution data after 14 days or 10,000 executions. Set that to match your retention policy. Our DPDP Rules checklist covers the rest.

What self-hosting n8n really costs

The licence is free; running it is not. A working formula:

Monthly cost = compute + database + backups + monitoring + (engineer hours × loaded hourly cost) + any n8n licence

• Compute. To start, one small general-purpose VM with a couple of vCPUs and a few gigabytes of memory can run n8n, a runner sidecar and Postgres. Large payloads and binary files usually exhaust memory before CPU.
• Database. Postgres on the same VM is cheapest. Managed Postgres such as Amazon RDS, Azure Database for PostgreSQL or Cloud SQL costs more, but adds point-in-time recovery. n8n supports PostgreSQL 16 to 18 as of July 2026. It treats Aurora as experimental and does not support AlloyDB.
• Backups. Nightly dumps and the .n8n volume, copied to object storage in the same region. The cost is small, and you cannot skip it.
• Monitoring. Uptime checks on /healthz, Prometheus metrics from /metrics (N8N_METRICS=true), disk alerts and failed-workflow alerts.
• Engineer hours. This is the line people forget. n8n ships a minor version most weeks and recommends updating at least monthly. On top of that come restore tests, the occasional 2 a.m. failure and a yearly major-version migration.
• Licence. Nothing on Community. If you need SSO, Git or shared credentials, Business becomes a real line item.

If nobody owns patching and restores, self-hosting is not cheaper than Cloud. The cost is only postponed, and it arrives later as an outage or a breach. Self-hosting wins clearly on high volume, private-network access and India-only data.

The licence: what “internal business use” allows

Self-hosted n8n is not OSI open source. Its Sustainable Use License allows use “only for your own internal business purposes or for non-commercial or personal use”. n8n’s licence FAQ makes the test clear: what matters is who controls the workflow logic, not whose credentials are used.

Allowed free:

• Running your own business processes, on any number of instances
• Running automations for clients on your instance, if clients cannot create or edit workflows
• Charging for workflow building, maintenance, training and consulting
• Installing and managing n8n on a client’s own server, if you are not also hosting it for them
• Using n8n behind your product, where users trigger workflows you built

Needs a commercial licence:

• Hosting n8n as a service where clients build workflows
• Letting end users configure workflows through your product, whether by UI, API, MCP or AI agent
• White-labelling or forking n8n into your own automation product

For Indian agencies the line is clear. Running client automations on your instance is fine. Selling “n8n hosting” that clients log in to and edit is not. For grey cases, such as n8n shipped inside an on-premises product, n8n asks you to check with its licensing team first. This is our reading of n8n’s guidance, not legal advice.

A production n8n self-hosted Docker setup

n8n’s Docker Compose guide uses SQLite, which suits a trial. For production we would make four changes: Postgres, task runners in external mode, pinned versions and your own encryption key. The example expects a .env file with POSTGRES_PASSWORD, N8N_ENCRYPTION_KEY and RUNNERS_AUTH_TOKEN. Generate each one with openssl rand -hex 32.

services:
  postgres:
    image: postgres:17
    restart: unless-stopped
    environment:
      POSTGRES_DB: n8n
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n -d n8n"]
      interval: 10s
      retries: 5

  n8n:
    image: n8nio/n8n:2.45.7
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      N8N_HOST: n8n.example.in
      N8N_PROTOCOL: https
      N8N_PROXY_HOPS: "1"
      N8N_WEBHOOK_URL: https://n8n.example.in/
      GENERIC_TIMEZONE: Asia/Kolkata
      TZ: Asia/Kolkata
      N8N_RUNNERS_MODE: external
      N8N_RUNNERS_BROKER_LISTEN_ADDRESS: 0.0.0.0
      N8N_RUNNERS_AUTH_TOKEN: ${RUNNERS_AUTH_TOKEN}
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

  runners:
    image: n8nio/runners:2.45.7
    restart: unless-stopped
    environment:
      N8N_RUNNERS_TASK_BROKER_URI: http://n8n:5679
      N8N_RUNNERS_AUTH_TOKEN: ${RUNNERS_AUTH_TOKEN}
    depends_on:
      - n8n

volumes:
  pg_data:
  n8n_data:

• Versions. 2.45.7 was the stable release on 30 October 2026. The runners tag must match the n8n tag, so change both together.
• Reverse proxy. The file publishes n8n only on 127.0.0.1, so put Caddy, Nginx or Traefik in front to terminate TLS. The editor uses WebSockets, so the proxy must pass upgrade requests through; on Nginx, set the Upgrade and Connection headers. Set N8N_PROXY_HOPS to the number of proxies.
• Encryption key. It encrypts every stored credential. Without it, a restored database is useless. Keep a copy in your secrets manager, apart from the backups.
• Backups. Dump Postgres nightly and back up the n8n_data volume. n8n’s backup guide warns that CLI exports alone cannot restore an instance. Test a restore monthly.
• Older versions. Before 2.30.0, use WEBHOOK_URL instead of N8N_WEBHOOK_URL.

Queue mode: when to add Redis and workers

A single instance runs the editor, the triggers and every execution in one process. In queue mode, the main instance puts executions on a Redis queue, and workers run them and write results to Postgres. Add it when heavy workflows slow the editor, or when webhooks wait behind long jobs. Do not add it for appearance: Redis is one more service to patch and monitor. It needs:

• EXECUTIONS_MODE=queue on the main instance and on every worker
• Redis, set with QUEUE_BULL_REDIS_HOST, protected by a password
• Postgres, because queue mode on SQLite is unsupported
• The same N8N_ENCRYPTION_KEY everywhere, or workers cannot read credentials
• Workers started with the worker command. Concurrency defaults to 10, and n8n advises at least 5 to protect the database’s connection pool.
• One runner sidecar per worker
• A binary data plan. Queue mode cannot use filesystem storage, and S3 storage is a paid feature, so on Community binary data lands in Postgres.

The editions page confirms that queue mode is in the free Community edition, though the pricing page lists it under Business. Multi-main high availability is Enterprise-only. From 3.0, manual executions always run on workers, so size worker memory for test runs too.

n8n security hardening checklist

n8n holds keys to your CRM, mailbox, payment gateway and databases. The record on n8n security vulnerabilities is sobering. Between December 2025 and September 2026, NVD published more than two dozen critical-rated n8n CVEs. The table lists the ones to know.

The pattern matters more than any single CVE. Most need only an account that can edit workflows, so treat every editor account as near-shell access to the host.

• Patch on a schedule. Watch n8n’s security advisories and apply critical fixes within days.
• Keep the editor private. Put it behind a VPN or Zero Trust proxy, and expose only the webhook and form paths your workflows need. Public forms are attack surface too, as CVE-2026-21858 showed.
• Limit who can edit workflows, and require MFA.
• Harden the task runners following n8n’s hardening guide: external mode, the distroless image, a non-root user and a read-only filesystem.
• Keep dangerous nodes off. Leave Execute Command and Local File Trigger in NODES_EXCLUDE, confine files with N8N_RESTRICT_FILE_ACCESS_TO, and set N8N_BLOCK_ENV_ACCESS_IN_NODE=true.
• Turn on SSRF protection with N8N_SSRF_PROTECTION_ENABLED=true. It is off by default and blocks private, loopback and metadata addresses.
• Disable unused surface: the public API (N8N_PUBLIC_API_DISABLED=true), unverified community nodes and, if your policy requires it, telemetry (N8N_DIAGNOSTICS_ENABLED=false).
• Run n8n audit monthly, and commission a penetration test of the instance, the proxy and the webhooks.

Upgrading safely: v1 to v2 to v3

There is no direct path from 1.x to 3.x, and moving to 3.x is one-way. These are the changes that most often break self-hosted instances (full lists for 2.0 and 3.0):

The n8n upgrade itself on Docker is simple: change the pinned tag, run docker compose pull, then docker compose up -d. The preparation is what takes the time:

1. On 1.x: update to the latest 1.x and clear Settings > Migration Report, which lists what 2.0 breaks. Move MySQL to Postgres, and move npm installs to Docker now.
2. Back up Postgres and the .n8n volume, including the encryption key. Upgrade staging to the latest 2.x, run your critical workflows, then upgrade production.
3. On 2.39 or later, the 3.0 Migration Report ranks issues from “Upgrade blocked” down, and can fix many automatically as new workflow versions for you to review.
4. Wait for 3.x stable, then back up and upgrade staging before production. Keep the last 2.x backup for a few weeks.

On timing: if you are on 1.x, reach 2.x before 31 December. If you are on 2.x, you can wait. Security and critical fixes continue for 12 months after 3.x stable, and a planned move in early 2027 beats a rushed one in December.

Five n8n workflows Indian SMEs actually run

These are illustrative patterns, not client work. Each fits n8n well: several systems, simple logic and a clear trigger.

1. WhatsApp leads into a CRM

This is the classic n8n WhatsApp automation. A WhatsApp Trigger receives Cloud API messages. The workflow normalises the phone number, de-duplicates the contact, and creates the lead in Zoho CRM, HubSpot or a sheet with an owner assigned. Replies after the 24-hour customer-service window need an approved template. See our guide to WhatsApp chatbot rules and costs in India and our WhatsApp Business API page.

2. Payment reminders

Each morning a Schedule Trigger pulls overdue invoices. An HTTP Request node creates a payment link through the gateway’s API, and the reminder goes out by WhatsApp template or email. The gateway’s payment webhook stops further reminders. Cap reminders per invoice and respect quiet hours.

3. Appointment reminders

Clinics and salons send day-before reminders and handle confirm or reschedule replies. An off-the-shelf tool often costs less than owning this workflow. Our Appointment Reminder App sends WhatsApp and SMS reminders through Meta’s Cloud API using approved templates, handles replies and keeps consent records.

4. AI inbox triage

A Gmail or IMAP trigger feeds new mail to a Text Classifier or AI Agent node backed by Claude, GPT or an open-weight model. The workflow labels each message, routes it to the right person and drafts a reply for a human to approve. Never auto-send, and remember that customer emails are personal data. More on AI automation.

5. Daily operations report

At 8 a.m. IST a Schedule Trigger queries yesterday’s orders, dispatches and collections and emails a short summary, or posts it to Slack or Teams. It makes a good first workflow, because it replaces someone copying numbers by hand.

For Tamil Nadu businesses, see AI automation in Tamil Nadu.

When to bring in help

If nobody can own Linux updates, Postgres backups and an on-call phone, use n8n Cloud, unless your data must stay in India. Outside help pays off in four places:

• The first production build
• A 1.x to 3.x migration with many workflows
• Adding queue mode
• A security review

Git version control inside n8n is a paid feature. On Community, export workflows with n8n export:workflow --backup and commit them from a CI/CD pipeline.

Radiatus is an independent engineering studio. We run containerised systems with Postgres, backups and monitoring in production. For n8n, that work comes under n8n automation, DevOps & automation, cloud infrastructure and managed services, with 24/7 support for managed-service clients under agreed SLAs. The first consultation is free, and after a short discovery you get a written proposal with scope, milestones and price.

Frequently asked questions

Is n8n free to self-host?

Yes, for internal business use. The Community edition has no licence fee and no execution limit. You still pay for servers, backups, monitoring and engineer time, and SSO, Git and credential sharing need a paid plan.

What is the n8n 3.0 release date?

The 3.0.0 beta shipped on 27 October 2026, and n8n planned the stable 3.x release for early December 2026; check the GitHub releases page for the current stable version. Whatever the date, keep production on 2.x until 3.x stable passes your staging tests.

Can I still install n8n with npm?

Not from 3.0, which supports Docker only. npm installs still work on 2.x, and Kubernetes and Helm setups are unaffected. Move to Docker Compose before you upgrade.

Can we self-host n8n for clients?

You can run client automations on your own instance if clients cannot edit workflows. You can also manage n8n on a client’s own server if you do not host it for them. Hosting n8n where clients build workflows needs a commercial licence.

Does self-hosting n8n in India make us DPDP compliant?

No. It settles where the data is stored, nothing more. Consent, retention, security and breach notification duties still apply, and nodes that call external APIs can still send personal data abroad.

Can we upgrade straight from n8n 1.x to 3.0?

No. Upgrade to 2.x first, clear the Migration Report, then move to 3.x from 2.39 or later. Support for 1.x ends on 31 December 2026.