n8n in a company isn't n8n on your laptop
n8n started as the favorite tool of whoever wants control: open source, self-hostable, no charge per step. All of that is still true, but in a company the game changes. On your laptop, a flow that runs on its own and does its job is a win. In production, the same flow has to survive a deploy, the server going down on a Tuesday, new people who didn't build it, and a security committee that wants to know who touches what. This guide is about that distance: taking n8n from "works on my machine" to "works in the company and holds up".
This isn't a comparison — if you're torn between the two big ones, you have it in Make vs n8n — nor the map of criteria to choose an automation tool. Here you've already chosen n8n; the question is how you operate it seriously. Four fronts: the data and GDPR, the real cost, governance and who sustains it.
Self-hosting and GDPR: the argument that puts n8n on the table
The number-one reason a company chooses n8n is rarely price: it's data control. Self-hosting n8n means the data flowing through your workflows — customer emails, invoices, personal data — stays inside your perimeter, on your server or your cloud, without traveling through a third party's infrastructure. When GDPR, your sector or your security committee require being able to say "this doesn't leave here", that fact stops being a technical preference and becomes the requirement that vetoes closed clouds however convenient they are.
The honest nuance: self-hosting doesn't make you GDPR-compliant by magic. It gives you the ability to control where the data lives, but you still have to configure access, encrypt what needs it, decide how much you retain in the execution history and isolate the server. Control is the lever; using it well is work. If your flows mix personal data with calls to third-party models, that boundary — what gets sent out and what doesn't — is exactly the delicate point of integrating AI with your systems.
Real cost: the license is free, the operation isn't
n8n charges per execution, not per operation: one full run counts as one, whether it has 5 steps or 50. And if you self-host, the community-edition software is free. That's where the easy headline comes from — "n8n is free" — which is half true and expensive by year's end. What isn't free is everything around the flow: the server it lives on, the time of whoever maintains it, the enterprise version if you need SSO or per-team permissions, and the bill for the AI models you call inside (paid separately, wherever the flow runs).
| Line item | What it includes | When it weighs |
|---|---|---|
| Server / infrastructure | The machine n8n runs on, backups, availability | Always when self-hosting |
| Enterprise version | SSO, per-team permissions, environments, support | When there are several teams or audit |
| Model cost | Tokens of the AI you call inside the flow | Scales with volume, not with n8n |
| Human maintenance | Update, watch, fix when something changes | Month six, always |
The discipline is the same as calculating the ROI of an automation: cost it at the volume you expect a year out, operation included, not at the first test flow. "Free" that needs a server and a person isn't free; it's a control decision paid in operation instead of license. For many companies it's worth it — the control earns it — for others, the closed cloud is cheaper in total time.
Governance: permissions, secrets, versioning and audit
This is where n8n in a company parts ways with hobbyist n8n, and where the most projects go sideways. A flow in production touches credentials (your CRM's, your email's, your data store's) and decisions that affect customers. That asks for a minimum of governance almost nobody sets up at first: secrets stored as secrets and not pasted into a node, permissions over who can edit what, separate environments to test before touching production, and a record of what ran, when and with what result. Without that, any change is a roulette and a leak is a matter of time.
The short rule: if a flow can send money, delete data or write to a customer, not just anyone should be able to edit it without leaving a trace. This is governance and control of automation applied to n8n: not bureaucracy, but what separates a powerful tool from an incident waiting to happen. n8n's enterprise version helps with permissions and environments; the judgement of what to protect is yours.
Who maintains it in month six (and what happens if nobody does)
n8n is powerful because it doesn't leave you stranded: when the pre-built block falls short, you drop code into a node and solve it. The price of that power is that someone has to understand what's been built. An ownerless n8n flow degrades in silence like any other — an external service changes its API, a credential expires, volume grows and the server falls short — but here the fix asks for a technical profile, not a click in a managed cloud. Choosing n8n is half the decision; the other half is who sustains it.
That's why the pattern that works in a company is rarely "an intern built some flows and left". It's someone — internal or external — with a name, who watches, updates and answers when something drifts; exactly what the maintenance of automations guide covers. The most powerful tool in nobody's hands loses to the humblest one with a clear owner.
When n8n fits your company (and when it doesn't)
n8n fits when data control is a real requirement, when your flows are long or high-volume (where "per execution" wins), and when you have — or can hire — someone who knows how to sustain it. It doesn't fit when your flows are simple, your volume is low and you have no technical profile: there a closed cloud gives you the same with one less server to look after, and n8n adds an operation you don't need. Neither better nor worse: fit.