Self-Hosting n8n in the EU: A GDPR-Conscious Setup Guide

By the BMaiKR team · Updated 2026-10-10

This guide is for teams that want n8n workflows running on infrastructure they control in Europe. It covers n8n itself. It does not make the services your workflows call any more European, which is why the last step is a data-flow check.

Prerequisites

• A Linux server in an EU data centre with Docker Engine and Docker Compose installed.
• A domain or subdomain whose DNS A record points to the server.
• A password manager for the encryption key and server credentials.

1. Follow the official Docker Compose layout

n8n recommends a project directory with a .env file, a compose.yaml and a local-files folder shared with the container. Its documented setup runs Traefik as a second container to handle TLS certificates and routing, and publishes the n8n port only on 127.0.0.1 so traffic must go through the proxy.

The documented .env variables are DOMAIN_NAME, SUBDOMAIN, GENERIC_TIMEZONE and SSL_EMAIL. Use the official compose file as your base and add the privacy settings below.

2. Add the privacy and retention settings

This trimmed example shows the n8n service only. Pin an exact image version instead of a floating tag, and check the official compose file for the current image name and variable names. From n8n 2.30.0 the documentation uses N8N_WEBHOOK_URL; earlier versions use WEBHOOK_URL.

services:
  n8n:
    image: docker.n8n.io/n8nio/n8n:<pinned-version>
    restart: unless-stopped
    ports:
      - "127.0.0.1:5678:5678"
    environment:
      - N8N_HOST=n8n.example.com
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://n8n.example.com/
      - GENERIC_TIMEZONE=Europe/Brussels
      - N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}
      - N8N_DIAGNOSTICS_ENABLED=false
      - N8N_VERSION_NOTIFICATIONS_ENABLED=false
      - N8N_TEMPLATES_ENABLED=false
      - N8N_PERSONALIZATION_ENABLED=false
      - EXECUTIONS_DATA_PRUNE=true
      - EXECUTIONS_DATA_MAX_AGE=168
    volumes:
      - n8n_data:/home/node/.n8n
volumes:
  n8n_data:

3. Set and protect the encryption key

n8n uses N8N_ENCRYPTION_KEY to encrypt credentials before saving them to the database. If you do not set one, n8n generates a random key on first launch and stores it in the ~/.n8n folder, which is the n8n_data volume in this setup. Set the key yourself, store it in your password manager, and in queue mode set it on every worker.

n8n documents what the key does but not how to recover from losing it. Treat it like a root password and back it up.

4. Decide what execution data you keep

By default n8n saves execution data for both successful and failed runs, prunes it after 336 hours and keeps at most 10,000 executions. Execution data can contain the personal data your workflows process. For sensitive workflows, shorten EXECUTIONS_DATA_MAX_AGE and consider setting EXECUTIONS_DATA_SAVE_ON_SUCCESS to none.

5. Back up the data volume

The n8n_data volume holds n8n's SQLite database and the encryption key. Back it up to a second EU location and test a restore. If you move to PostgreSQL, back up the database as well.

6. Map where data really goes

Self-hosting keeps n8n's own data on your server. Every node that calls an outside service sends data to that service, wherever it is hosted. List each workflow, the services it calls and the personal data it passes, then check the provider's location and contract.

Your hosting provider and any API provider act on your behalf when they process personal data. Ask your data protection officer which processor agreements you need.

Common mistakes

• Using a floating image tag so an update changes behavior unannounced.
• Leaving the encryption key only inside the container volume.
• Keeping execution history forever.
• Assuming an EU server makes every connected API an EU service.