Hello guys,
We are a SaaS staffing solution and we would like to offer an integration service to our clients through a self hosted N8N env. (by integration I mean workflows between different tools like Salesforce, hubspot, etc… and our solution).
The main question here is that we don’t know what would be the best solution on how to handle the self hosted N8N environment:
Do we like host only one environment and give only access to each client to their own workflow, is it doable ? (how ?)
Do we have to create a new self hosted N8N env. for each client ? But is it not too complicate to maintain then ? (updates, etc..)
We are a little bit lost here if some of you guys have ideas or the experience on this topic to guide us toward the best solution possible.
Thank you in advance for any help you could provide !
Hi @Frederic_Buchot Welcome!
You should consider a single multi tenant n8n instance using Projects + RBAC under an appropriate commercial/embed license (enterprise level). But if you are talking about using free and no commercial licensing whatsoever just let each client have their own self hosted instance like now it takes 1-3 clicks to create a self hosted container so it is a better take to just use this and let each new client have their own instance with their own setup of credentials.
This is actually a paid feature which comes under enterprise level license which is the Projects feature and this allows almost all of the configs you are looking for.
NO! It is really not , it is actually the opposite, having each n8n instance per client would be really better than having projects or just duplicating instance, just have a fresh self hosted instance for a client with all the credentials you set for them.
Now my personal take as an AI Automation Specialist. Just ask clients if they can host it for you else host n8n on hostinger per client and ask for credentials like their gmail and all, and by working with them if that is a long ticket then just have projects although this is really not needed, also make sure that each new client you onboard gets a proper credential requirement form , personal n8n form you would curate per client with your needs, and there you will collect credentials about their systems like servers, databases, gmail… i used to do that. (If using Hostinger always go with KVM2 or higher plans) n8n looks small but in even a little large scale you will always feel the need of more ram/cpu.
Separate instance per client, no question. n8n doesn’t really do multi-tenancy natively and trying to fake it on a single instance is asking for trouble when you’re handling different clients’ Salesforce/HubSpot credentials. Spin up a docker container per client, use a shared docker-compose or a simple script to roll updates across all of them at once, it’s way less painful than it sounds and you get proper data isolation out of the box.
Regarding the “Projects” feature, we are not against taking a licence if it cover our needs but does this feature is secured enough tho ? Are credentials separated by project?
Hello @achamm, thank you for your answer ! We though about the docker solution but we are looking for any possibility as we are not sure what could be the best solution for our need: simplest, cost efficient, secure.
Worth clarifying the licensing options here since there’s a specific product for your exact use case:
n8n Embed license — this is what you’d want if you’re a SaaS company embedding n8n as part of your product offering. It’s different from the standard enterprise plan. It covers the white-labeling, multi-tenant Projects feature with isolated credentials per project, and the ability to offer it commercially to your clients.
The standard community license does have Projects, but credential isolation between projects is the paid feature — so on free self-hosted, different client credentials aren’t properly sandboxed from each other.
Your two realistic options:
Separate instance per client (achamm’s suggestion) — operationally simpler to start, each client is completely isolated. Downside: update management across 50+ clients gets annoying fast.
n8n Embed — single instance, proper tenant isolation, n8n handles the auth/credential separation. Designed exactly for the Salesforce/HubSpot integration-as-a-service scenario.
Contact n8n sales about the Embed license specifically. It’s a different conversation than the standard enterprise quote.
In the MSP world, we always want each client to have their own instance. Not only is it more secure, but it also allows for better permission management (tech1 can access client A, B, C, but tech 2 only works with client C, etc.). If you part ways, handing over the keys would be easier as well. As others have mentioned, the credential separation will save headaches as well.