Security and Compliance Questions for Self-Hosted n8n Deployment

[Eunjung_Yi]

Hello,

Our company is planning to deploy a self-hosted instance of n8n on a company-managed laptop as part of an internal AI agent project. Our security team is conducting a vendor risk assessment (VRA), and we need to clarify several points before we can proceed. I’ve reviewed the documentation and existing forum posts, but I couldn’t find complete answers to the following:

1. SOC 2 Report

   • Is there a SOC 2 report available that applies to self-hosted environments (even partially), or is it exclusively for n8n Cloud?

2. Latest Penetration Test Report

   • Is there a recent penetration test report or a public summary available for review?

3. Default Outbound Endpoints

   • For a self-hosted deployment, what is the default outbound endpoint list?

   • If “Isolate n8n” is enabled, does it completely block all external communications?

4. Credential Encryption and Key Management

   • How are credentials encrypted in a self-hosted environment?

   • Any recommendations for encryption key management and backup best practices?

5. Community Node Security Process

   • What is the vetting and signing process for community nodes?

   • What is the recommended enterprise policy — default block or allowlist?

In our case, full telemetry disablement will be required. Please confirm if this is possible for self-hosted instances and how to configure it.

If anyone has links to official documentation, prior forum threads, or direct experience with these requirements, that would be greatly appreciated.

Thank you!

[hubschrauber]

1. SOC 2 Report
   Probably best to contact [email protected]
2. Latest Penetration Test Report
   Same as 1.
3. Default Outbound Endpoints
   Would recommend monitoring traffic via outbound proxy, and/or running self-hosted in an outbound whitelisted-only environment to assure connections are only permitted to approved endpoints. Also be aware that the editor (UI app) may connect directly from the browser to some external endpoints for oauth sequences, test requests, node setup, etc.
4. Credential Encryption and Key Management
   Credentials are encrypted by a generated key that is in {data-volume/root-dir}/config by default but can be supplied in env var: N8N_ENCRYPTION_KEY see docs
   Credentials can be exported/imported, encrypted or --decrypted form via CLI functions which provides some options for encryption-key rotation or backup.
5. Community Node Security Process
   see docs

Telemetry
see docs