What is n8n? What it does, whether it’s free, and who keeps it updated

The short version

• It’s a workflow automation tool. You build a workflow of steps, and n8n runs it every time its trigger happens. It’s made by n8n GmbH, a company in Berlin.
• It’s free if you host it yourself. The self-hosted Community edition costs nothing and, in n8n’s words, comes “with almost the complete feature set”.
• n8n Cloud isn’t free. After a 14-day free trial, plans start at €20 a month, billed annually, for 2,500 workflow runs a month.
• Free comes with a condition. The licence lets you use n8n for your own business, but not offer it to your customers as a service. That’s why n8n doesn’t call itself open source.
• If you host it, you update it. n8n published 223 security advisories in 2026 up to 28 October, 19 of them rated critical. Its own guide says to update “at least once a month”.
• On n8n Cloud, n8n does the updating. It says it upgrades every Cloud instance at least every two weeks.

What is n8n?

n8n’s documentation describes it as “a fair-code licensed workflow automation tool that combines AI features with business process automation.” In plainer words: it joins up the software you already use, such as email, spreadsheets, your online shop, your accounts and your chat tool, and moves information between them by itself.

Each automation is called a workflow. A workflow starts with a trigger, something that happens, and then runs a series of steps; n8n calls the building blocks nodes. The n8n home page gives this example: “When a refund request comes in, look up the order. Then ask me in Slack whether to refund it or open a ticket.” Once it’s built, that runs every time a refund request arrives, without anyone copying details from one screen to another.

The company behind it is n8n GmbH, based in Berlin, according to the imprint on its website. Lately it has been pitching itself for AI agents as well: the same home page calls n8n “the platform for agents and workflows you can follow.” If you’re wondering what an agent could do for a small business, our post on what an AI agent can actually do has the list.

n8n comes in two forms, and the answer to “is n8n free?” depends on which one you mean: n8n Cloud, which n8n runs for you and you use in a web browser, or a self-hosted copy that you install on a server of your own.

Is n8n free?

n8n Cloud is paid. The pricing page says “Pricing is based on monthly workflow executions, regardless of complexity.” When we read it on 29 October 2026, Starter was €20 a month and Pro €50 a month, both billed annually, for 2,500 and 10,000 workflow executions a month. Prices are shown in euros. Paying month by month costs more: the page says annual billing saves 17%, and its own pricing data puts the monthly prices at €24 and €60. There’s a 14-day free trial, and n8n says “No credit card is required for the n8n Cloud trial.” The trial is limited to 1,000 executions.

An execution is one complete run of a workflow. In n8n’s words: “An execution is a single run of your entire workflow.” Its own examples: a workflow that runs once a day uses 30 or 31 executions a month, and one that runs every five minutes uses about 8,600 to 8,900. So Starter’s 2,500 covers a handful of daily jobs comfortably, but not one job that checks something every five minutes.

One thing we noticed: the pricing page’s code also holds a plan called “Free”, with 50 executions a month, marked as an experiment. It wasn’t on the page as we saw it. If you’re shown it, 50 runs a month is enough to try n8n out, not enough to run a business process on.

Self-hosted is free. n8n’s hosting guide says: “Without a license key, n8n runs as the free Community edition.” Its comparison of editions says the Community edition “includes almost the complete feature set of n8n”. The gaps that matter most to a small team: workflows and logins can’t be shared, because “Only the instance owner and the user who creates them can access workflows and credentials”, and there are no environments, the separate test copy that n8n’s own update guide suggests trying updates on first. The paid self-hosted Business plan, which adds those, was €667 a month billed annually, aimed at companies with fewer than 100 employees.

Free, but not open source: the licence

n8n’s code is public on GitHub, but it isn’t open source in the usual sense, and n8n says so: under the Open Source Initiative’s definition, open source licences can’t limit how software is used, “so we do not call ourselves open source.” n8n calls its model “fair-code”. Its own Sustainable Use License says: “You may use or modify the software only for your own internal business purposes or for non-commercial or personal use.”

For most small businesses that’s fine. n8n’s licence FAQ draws the line here: “Provided you are using n8n for internal business purposes, and not making n8n available to your customers for them to connect their accounts and build workflows, you should be able to use n8n.” Paying a freelancer or an agency to build your workflows is allowed too: n8n says people are “free to offer commercial consulting or support services (e.g. building n8n workflows) without the need for a separate license agreement with us.”

Where it gets awkward is selling something built on n8n to your own customers, such as a portal where each customer connects their own accounts. For that, n8n says you need a separate commercial agreement with it.

The catch with running it yourself: updates

Running n8n yourself means someone has to look after it. n8n’s own guide to choosing is blunt: for self-hosted, maintenance is “Your responsibility”, and for anyone who doesn’t have technical expertise it recommends n8n Cloud. Its update guide says: “Try to update at least once a month.” And its security page lists what self-hosters must do themselves, starting with: “Ensure data is encrypted in transit by setting up a reverse proxy in front of the n8n instance to handle TLS.” In plain English: put it behind a properly secured web address, and encrypt the disk it keeps its data on.

Here’s why the updates matter. n8n lists its security advisories publicly on GitHub, the site that holds its code. We read all 237 of them through GitHub’s own interface on 29 October 2026 and counted them by the severity and date each one carries:

The worst this year, CVE-2026-21858, scored the maximum 10.0. n8n’s advisory says: “A vulnerable workflow could grant access to an unauthenticated remote attacker.” In other words, someone with no login at all could read files on the server through certain form-based workflows. It affected versions from 1.65.0 onwards and was fixed in 1.121.0. For anyone who couldn’t update straight away, n8n’s suggested stopgap was to “restrict or disable publicly accessible webhook and form endpoints until upgrading.”

The newest batch came out on Wednesday 28 October: 12 advisories, three of them rated high. One says: “An authenticated user with permission to create or modify workflows could escape the isolation applied to workflow expression evaluation and execute arbitrary code on the n8n host”. That means someone who can build workflows could take over the server n8n runs on. It was fixed in four versions at once, 1.123.89, 2.45.5, 2.46.1 and 3.0.1, so n8n is patching older versions alongside the newest. On 30 October it released 2.45.7, its latest stable version on its releases page, a day after 2.45.6; version 3.0 is out as a pre-release.

There’s a rhythm to it. Since June, n8n has published its advisories in batches every second Wednesday: 11 batches from 10 June to 28 October, with a single advisory out of step on 3 September. n8n hasn’t promised that pattern, but if it holds, the next batch is due on Wednesday 11 November. Whoever looks after your copy should check the list the day after each batch.

What argues the other way

• A long list is partly a good sign. It means n8n looks for problems and tells people when it finds them. A tool that publishes nothing isn’t necessarily safer; you just can’t see. Our count isn’t a ranking against any other product.
• Most need a login. By n8n’s own scoring, 172 of the 223 advisories this year need the attacker to be logged in to n8n already, 50 don’t, and one isn’t scored. Of the 19 critical ones, 18 need a login. Keeping the list of people with logins short does a lot of the work.
• The critical ones have stopped, for now. None of the 19 critical advisories this year was published after 13 May.
• Self-hosting has real upsides. You choose where the data lives, including on a server in the UK, and n8n doesn’t handle your customers’ data. For some businesses that’s the whole point.
• We have an interest to declare. We set up automations for businesses, so we gain if you decide you’d rather someone else looked after it. The checklist further down works whoever you ask.

Your data: n8n Cloud or your own server

On n8n Cloud, n8n’s security page says: “n8n cloud uses Microsoft Azure for hosting. The physical hardware powering n8n, and the data stored by the platform, is currently hosted in the European Union.” Its privacy and security documentation says a Data Processing Agreement is part of its standard terms.

On your own server, n8n stays out of it: “For self-hosted versions, n8n is neither a Controller nor a Processor, as we don't manage your data.” So the customer details your workflows handle are yours to protect, and so are the logins n8n keeps for every app it connects to. One more thing to know: “Telemetry is on by default.” A self-hosted copy sends n8n usage and diagnostic data, which n8n says it keeps pseudonymous wherever possible, and turning it off is a setting on the server itself: “There is no switch inside the n8n interface.”

What to ask whoever set it up

If someone has already installed n8n for your business, these questions will tell you quickly whether anyone is looking after it:

1. Which version are we on, and when was it last updated? Compare it with the latest on n8n’s releases page.
2. Who hears when n8n publishes a security fix, and how quickly do they apply it?
3. Can it be reached from the internet? Forms and webhooks usually mean yes, and that’s how this year’s 10.0 flaw could be reached.
4. Who has a login? Remove anyone who no longer needs one.
5. Which accounts does it hold the keys to? Email, accounts software, your shop: n8n stores the logins for everything it connects.
6. Where is the data, is it backed up, and is the disk encrypted?
7. Are we using it only for our own business? If you’ve built something your customers log in to, check the licence.

If the honest answer to the first two is “nobody”, either move to n8n Cloud, where n8n does the updating, or make it one named person’s job.

n8n, Power Automate, or something else?

If your business already runs on Microsoft 365, look at what you have before adding anything. Our post on what Power Automate is found that, according to Microsoft’s own licensing guide, Business Basic and Business Standard include limited rights to cloud flows, and Business Premium adds desktop flows.

n8n suits workflows that cross lots of different apps, or need custom steps and code, and it charges by the run rather than by the step. Its pricing page says its executions are “much more powerful than the ‘operations’ or ‘tasks’ that you’re billed on in other products.” That’s n8n’s claim about its own pricing, so compare like with like on your own workflows before you count the savings.

And before any of it, pick the first thing to automate. n8n’s own example is a customer’s refund request, and customer service is where automation most easily annoys people. Our post on how to automate customer service without annoying your customers covers what to hand to a machine and what to keep human.

Should a small business use n8n?

Our view, with the interest declared above: n8n is a capable tool, and the Community edition really is free for your own business. The risk isn’t the software; it’s an installation nobody owns. If you have someone who will update it every month and read the advisories, running it yourself is reasonable. If you don’t, n8n Cloud does that part for you, from €20 a month. The option to avoid is a copy installed once on a cheap server, connected to your email and accounts, and then forgotten.

Sources, and what we checked

• n8n documentation: home, Choose how to use n8n, Host n8n, Compare editions, Update n8n, Update your version (n8n Cloud), Privacy and security and the n8n Community license page (licence FAQ).
• n8n.io: Plans and Pricing (annual billing is shown by default; the monthly prices and the “Free” plan come from the page’s own pricing data), Security, Imprint and the home page.
• The LICENSE.md file in n8n’s GitHub repository.
• n8n’s security advisories on GitHub: all 237, read through GitHub’s API. Counts use each advisory’s own severity and publication date; the login figures use each advisory’s CVSS “privileges required” score. Releases from n8n’s GitHub releases list.
• All of the pages above were read on 29 October 2026, and again on 31 October 2026, the morning we published.