n8n On-Premise for Companies: Office Server, Own Data Centre or a Private VPS?

Yes, a company can run n8n on premise, and for most internal use it costs nothing in licence fees. The self-hosted Community Edition is free for your own internal business purposes under n8n's Sustainable Use License, and it works with no internet at all: we loaded n8n 2.43.5 and PostgreSQL from saved image files on a machine cut off from the internet and ran workflows on it. The real decisions are elsewhere. Do you need paid features like SSO or Git environments, which bring a licence key that checks in with n8n? And should the server sit in your office, in your own rack, or on a private VPS in an EU data centre reached over a VPN?

Key facts, checked on 14 October 2026:

• The current stable release is n8n 2.43.5, published on 14 October 2026 (n8n releases on GitHub).
• The Community Edition may be used "for your own internal business purposes or for non-commercial or personal use", in the words of the Sustainable Use License page.
• The free edition leaves out SSO (SAML, LDAP), projects, workflow and credential sharing, environments, Git version control, external secrets, log streaming, custom variables and multi-main mode. Queue mode is included (n8n edition comparison).
• The self-hosted Business plan costs €667 a month billed annually and includes 40,000 executions. n8n Cloud starts at €20 (Starter, 2,500 executions) and €50 (Pro, 10,000 executions) a month billed annually, and Cloud data is stored on servers in Frankfurt (n8n pricing).
• In our offline lab, n8n used 347 MiB of RAM and PostgreSQL 33 MiB at idle, and n8n reached 525 MiB after 500 webhook runs.

What "on premise" means for n8n, and what the licence allows

On premise means software that runs on servers you control instead of the vendor's cloud. For n8n that can be a machine in your office, your own rack, or a virtual server you rent and administer yourself; the software is the same in all three.

n8n is "fair-code", not open source in the strict sense. Its licence FAQ puts the rule plainly: if only you and people in your organisation create or edit the workflows, the free licence covers you. In practice that means you may:

• run your own business processes on it, from invoices to CRM syncs;
• run several instances, for example one per department;
• build automations for clients on your instance, as long as the clients cannot create or edit them;
• charge for building workflows, setup, maintenance, training and consulting;
• use n8n quietly behind your own product, where users trigger automations you built.

You may not host n8n as a service where customers build their own workflows, let outside users configure workflows through your product (by custom UI, API, MCP or an AI agent), fork n8n into your own automation product, white-label it, or use features that ask for a licence key without paying for them. Source files with .ee. in their name fall under the separate n8n Enterprise License. If your case sits in the grey zone, n8n asks you to write to license@n8n.io before you build.

Which features need a paid licence when you self-host

Every self-hosted install is the same software. A licence key switches extra features on. There are three levels: plain Community, "Registered Community" (free, unlocked by entering an email address and activating the key it sends), and the paid Business and Enterprise plans.

Sources: the edition comparison and the pricing page, both checked on 14 October 2026. n8n says the pricing page is the source of truth when the two differ.

The sharing limit surprises teams most: on the free edition a colleague cannot open a workflow you built. Fine for a two-person IT team; for ten people in three departments, it is usually what leads to the Business plan.

Licence keys and air-gapped networks

"Air-gapped" means a network with no connection to the internet at all, common in factories, hospitals and some government offices. The free edition needs no key, so it runs air-gapped without any special step. Our lab below shows it.

Paid plans are different. According to n8n's licence documentation, a normal licence key is activated against n8n's licence server at license.n8n.io, which is hosted on Cloudflare, so your firewall has to allow Cloudflare's address ranges. Auto-renewal is on by default. If you turn it off, you must renew by hand every 10 days, and if renewal fails, all licensed features are switched off (licence variables). n8n's privacy page adds that a paid instance keeps reporting usage counts and its licence ID even when telemetry is off.

For networks that can never reach the internet, n8n can issue a licence certificate instead of a key. You set it in N8N_LICENSE_CERT, never together with N8N_LICENSE_ACTIVATION_KEY. The documentation names air-gapped environments as the use case, but you have to ask n8n for the certificate, so plan for that conversation with sales before the project starts. We did not test a paid key or certificate.

Four homes for n8n compared

We host servers, so weigh this accordingly, but n8n Cloud is the right answer for many teams: if nobody wants to read a Docker log, Starter or Pro costs less than the hours spent on updates. It stops fitting at large volumes, when data must stay on infrastructure you control, or when telemetry is unacceptable.

The office server wins when the systems it automates are offline too. Otherwise a box under a desk hangs on one power socket and one internet line, and every SaaS webhook fails when either drops. A private server in a data centre, joined to the office by a VPN, gives the same control with better power and network. That is what our n8n hosting page is built around.

Our lab: n8n on premise with no internet

We tested on a Debian 13 container on one of our Amsterdam servers, limited to 2 CPU cores and 3 GiB of RAM, with Docker 26.1.5 and Docker Compose 2.26.1 from Debian's own packages. We installed n8n with PostgreSQL online, saved the images to one file, deleted them, cut the machine off, loaded the file and ran n8n. That is the procedure for an air-gapped site: prepare the file on a connected machine and carry it in. We ran every command below; the output shown is what we saw.

Step 1: Docker and a user for n8n

# as root
apt-get update
apt-get install -y docker.io docker-compose curl
adduser --disabled-password --gecos "" n8nadmin
usermod -aG docker n8nadmin
docker --version

Expected: Docker version 26.1.5+dfsg1. The install took 16 seconds. Membership of the docker group is effectively root access, so give it only to the account that runs n8n. Our Docker on a VPS guide explains the alternatives.

Step 2: secrets and the Compose file

# as the n8nadmin user (su - n8nadmin)
mkdir -p ~/n8n && cd ~/n8n
umask 077
printf "POSTGRES_PASSWORD=%s\nN8N_ENCRYPTION_KEY=%s\n" "$(openssl rand -hex 16)" "$(openssl rand -hex 24)" > .env

Keep a copy of N8N_ENCRYPTION_KEY somewhere safe. n8n encrypts every saved credential with it, and a restore without it gives you workflows whose passwords cannot be read. Now create ~/n8n/compose.yaml:

# as the n8nadmin user: contents of ~/n8n/compose.yaml
services:
  postgres:
    image: postgres:17
    restart: unless-stopped
    environment:
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: n8n
    volumes:
      - pg_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U n8n -d n8n"]
      interval: 5s
      retries: 10

  n8n:
    image: docker.n8n.io/n8nio/n8n:2.43.5
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
      N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
      GENERIC_TIMEZONE: Europe/Amsterdam
      # no calls home to n8n's servers
      N8N_DIAGNOSTICS_ENABLED: "false"
      N8N_VERSION_NOTIFICATIONS_ENABLED: "false"
      N8N_TEMPLATES_ENABLED: "false"
      N8N_PERSONALIZATION_ENABLED: "false"
      N8N_COMMUNITY_PACKAGES_ENABLED: "false"
      N8N_DISABLED_MODULES: "mcp-registry"
      EXTERNAL_FRONTEND_HOOKS_URLS: ""
      N8N_DIAGNOSTICS_CONFIG_FRONTEND: ""
      N8N_DIAGNOSTICS_CONFIG_BACKEND: ""
    volumes:
      - n8n_data:/home/node/.n8n
    depends_on:
      postgres:
        condition: service_healthy

volumes:
  pg_data:
  n8n_data:

The first three switches and the three empty diagnostics values are the official recipe from n8n's Isolate n8n page. They stop anonymous telemetry, the version check and the templates. Without them, n8n sends most telemetry events as they happen, plus execution counts and an instance pulse every six hours, according to its privacy page. N8N_PERSONALIZATION_ENABLED skips the sign-up questionnaire and N8N_COMMUNITY_PACKAGES_ENABLED stops community node installs from npm. N8N_DISABLED_MODULES is our own addition, explained below. The port listens on 127.0.0.1 only, so n8n is reached through a reverse proxy or a VPN.

Step 3: pull the images and pack them into one file

# as the n8nadmin user, on a machine with internet
cd ~/n8n
docker compose pull -q
docker save -o ~/n8n-images.tar docker.n8n.io/n8nio/n8n:2.43.5 postgres:17
ls -lh ~/n8n-images.tar

The pull took 60 seconds and the save 33 seconds. The n8n image is 1.06 GB, PostgreSQL 17 is 454 MB, and the tar file came to 1.6 GB. On a real project, record a checksum of the file (the standard sha256sum tool does this) and compare it on the air-gapped side before loading; our lab skipped that step because the file never left the machine. Move the file by USB disk or over your internal network. We then removed both images with docker image rm, so nothing could come from a cache.

Step 4: cut the internet (lab only)

# as root, inside the lab machine only (never on a production host)
ip route del default
ip -6 route del default
systemctl stop systemd-networkd.socket systemd-networkd
curl -sS -m 5 https://api.n8n.io/ -o /dev/null

Expected: curl: (6) Could not resolve host: api.n8n.io. A lesson from the lab: deleting the IPv6 default route was not enough, because systemd-networkd re-added it from router announcements. Stopping networkd left no route out at all. On a real site your firewall does this job; test it the same way, by trying a public address from the n8n host.

Step 5: load the images and start n8n offline

# as the n8nadmin user, with no internet
cd ~/n8n
docker load -i ~/n8n-images.tar
docker compose up -d
curl -s http://127.0.0.1:5678/healthz
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:5678/healthz/readiness

Expected: Loaded image: docker.n8n.io/n8nio/n8n:2.43.5 and Loaded image: postgres:17 (57 seconds), then {"status":"ok"} and 200. The log line "Editor is now accessible" appeared 17 to 23 seconds after start, and the editor page answered with HTTP 200. The log also confirmed that a free instance does not contact the licence server: [license SDK] Skipping renewal on init: license cert is not initialized.

Step 6: run real workflows with no internet

We imported a two-node workflow (a manual trigger and a Code node that calculates VAT) and ran it from the command line. This command writes it to ~/n8n/offline-test.json:

# as the n8nadmin user
cat > ~/n8n/offline-test.json <<'EOF'
{
  "id": "offlineTest001",
  "name": "Offline test",
  "nodes": [
    {"parameters": {}, "id": "a1", "name": "Start", "type": "n8n-nodes-base.manualTrigger", "typeVersion": 1, "position": [0, 0]},
    {"parameters": {"jsCode": "return [{json: {invoice: 'INV-1001', net: 250, vat: 250 * 0.18, host: 'offline'}}];"}, "id": "a2", "name": "Calculate VAT", "type": "n8n-nodes-base.code", "typeVersion": 2, "position": [220, 0]}
  ],
  "connections": {"Start": {"main": [[{"node": "Calculate VAT", "type": "main", "index": 0}]]}},
  "settings": {}
}
EOF

# as the n8nadmin user
cd ~/n8n
docker compose cp offline-test.json n8n:/tmp/offline-test.json
docker compose exec -T n8n n8n import:workflow --input=/tmp/offline-test.json
docker compose exec -T -e N8N_RUNNERS_BROKER_PORT=5690 n8n n8n execute --id=offlineTest001

Expected: Successfully imported 1 workflow., then Execution was successful: with "vat": 45 and "status": "success". The extra N8N_RUNNERS_BROKER_PORT matters: without it the command stopped with "n8n Task Broker's port 5679 is already in use", because the running n8n already holds that port.

Next we tested the way internal systems usually talk to n8n: a webhook. We imported a workflow with a Webhook node on the path stock-check and a Code node that answers with stock status, published it with n8n publish:workflow --id=offlineHook001, restarted n8n (the command itself says changes need a restart) and called it:

# as the n8nadmin user
curl -s "http://127.0.0.1:5678/webhook/stock-check?sku=A-100"

Expected: {"sku":"A-100","inStock":true,"checkedAt":"2026-10-14T13:57:29.575Z"}. An ERP, a PLC gateway or a script on your LAN can trigger n8n this way with no internet involved. We then sent 500 of these calls, 10 at a time: all 500 returned HTTP 200 in 58 seconds on 2 cores.

What failed offline, and one call the docs do not mention

• An HTTP Request node calling a public API failed with "The DNS server returned an error, perhaps the server is offline". Expected: workflows that call SaaS APIs need internet.
• With every documented isolation variable set, n8n 2.43.5 still tried to fetch https://api.n8n.io/api/mcp-servers at start and logged "A system task run failed". The call comes from the mcp-registry module, which refreshes every 8 hours. N8N_DISABLED_MODULES=mcp-registry stopped it; after a restart the log showed no failed connections. The variable is documented, but the isolation page does not list this module, so recheck after upgrades.
• Templates come from api.n8n.io and are gone offline, unless N8N_TEMPLATES_HOST points at your own library.
• Community nodes install from npm. Offline, build them into your own image or run a private registry, which n8n's docs mark as licence-only.
• The Python task runner did not start because the image has no Python 3. JavaScript Code nodes worked; Python needs the separate runner image.
• AI features call outside services by design; offline, only a model on your own network works.

Measured resources

These numbers are for a light workload. For sizing under heavy load, see our n8n VPS requirements load test. For the everyday online install with a domain and HTTPS, follow self-hosting n8n on a VPS and our reverse proxy guide. If you would rather not do any of this yourself, our n8n hosting page lists the plans that fit.

Reaching the ERP in your office from a VPS

The usual objection to a VPS: n8n has to reach the SQL server and the ERP in the office. A VPN tunnel between the VPS and an office router or small Linux box solves it. n8n reaches 10.0.0.15 in the office as if it were on the same LAN, and nothing in the office is opened to the internet.

• WireGuard is the lean option: one small config file on each side and no third party in the path. Our WireGuard VPN server guide covers it step by step.
• Tailscale is easier when several offices or laptops need access, since it handles keys and NAT for you. See Tailscale on a VPS, and Headscale or NetBird if the coordination server must also be your own.

Latency through the tunnel is roughly the ping between your office and the data centre. In our own ping.pe test on 6 October 2026, probes in Frankfurt and London reached our Amsterdam server in about 7 ms and Paris in 9.3 ms, while our Prishtina server answered Vienna in 18.6 ms and Skopje in 3 ms on our own network. A few queries per run will not notice it; a loop of thousands of small queries should be batched.

The tunnel also solves webhooks: SaaS tools such as Stripe or HubSpot call the VPS's public address, and n8n passes the data into the office. Every n8n hosting plan has its own IPv4 and IPv6 address for this.

Which plan and which city for your company

For the city: Amsterdam suits most of mainland Europe and gives each server its own /48 of IPv6, Dublin suits teams in Ireland and the UK, and Prishtina sits closest to offices in Kosovo and the wider Balkans. In all three you decide what is stored, and availability by city is on the plans page. You can move to a bigger plan later from the client area with a short reboot, so you do not have to size for next year on day one.

If the honest answer is that nobody in your company should run servers, n8n Cloud is the better buy. If you want your own server but not the setup work, we quote installation per job: tell us on Telegram what you need (n8n, PostgreSQL, the VPN to your office) and you get a fixed quote. Compare the full plan list on the n8n hosting page, and if you are still weighing n8n against other tools, read n8n vs Zapier vs Make on cost.

Frequently asked questions

Is n8n free for on-premise use in a company?

Yes. The self-hosted Community Edition is free under n8n's Sustainable Use License for your own internal business purposes, as long as only people in your organisation create or edit workflows. Hosting it for customers who build their own workflows is not allowed. SSO, projects and Git environments need a paid plan; self-hosted Business costs €667 a month billed annually (checked 14 October 2026).

Can n8n run in an air-gapped network?

Yes. In our lab, n8n 2.43.5 with PostgreSQL 17, loaded from a saved image file with no route to the internet, passed its health check and ran Code node and webhook workflows. Templates, community node installs and public API calls fail offline. A paid plan needs a licence certificate from n8n (N8N_LICENSE_CERT) instead of an online licence key.

Does self-hosted n8n send data to n8n?

By default it sends anonymous telemetry, checks for new versions and loads templates from n8n's servers. Setting N8N_DIAGNOSTICS_ENABLED, N8N_VERSION_NOTIFICATIONS_ENABLED and N8N_TEMPLATES_ENABLED to false and emptying the diagnostics settings stops this. In version 2.43.5 we also had to set N8N_DISABLED_MODULES=mcp-registry. Paid licences keep reporting usage counts and the licence ID even with telemetry switched off, according to n8n's privacy documentation.

Which n8n features need an enterprise licence?

Without a licence you lose SSO with SAML or LDAP, projects and role-based access, sharing of workflows and credentials, environments, Git version control, external secrets, log streaming, custom variables and multi-main mode. Queue mode with workers is free. n8n's pricing page lists external secrets and log streaming under Enterprise and SSO, environments and Git under Business.

How much RAM does n8n need on premise?

In our lab, n8n used 347 MiB and PostgreSQL 33 MiB at idle, and n8n rose to 525 MiB after 500 webhook runs. The first start with database migrations briefly used 847 MiB. A server with 4 GB of RAM, such as a VPS Mini, runs a small company's n8n with PostgreSQL and a VPN comfortably; queue mode with workers is better on 8 GB.

Is a private VPS the same as on premise?

Not strictly, because the provider owns the hardware. In practice it gives the control most companies want from on premise: you choose the country, hold root access, decide what n8n stores and can turn off every call to n8n's servers. You hand over power, cooling and network, usually the weakest part of an office server.

Your own n8n, without the server room

Start with the free Community Edition, switch off the calls home with the variables above, and put it where your data rules and your uptime needs point. For most companies that is a private server in an EU data centre with a VPN to the office: a VPS Mini to begin with, a VDS Small or VDS Medium when you move to queue mode. See the plans on our n8n hosting page or the full list on VPS and VDS plans, and send setup questions to us on Telegram.

← All articles