GDPR does not say which country customer data must sit in. It regulates transfers outside the European Economic Area (the EU plus Iceland, Liechtenstein and Norway) in Chapter V, and requires a contract with anyone who processes the data for you (Article 28). Where the data lives depends on your setup: your own or a contractor’s server, n8n cloud, Make or Zapier.
Self-hosting settles where data is stored and who controls retention and telemetry. It does not settle where workflows send that data, the question GDPR asks first.
Sending data from your server to other services is not forbidden, and the section on self-hosting covers the conditions the law attaches to it. This article maps each setup by the vendors’ own documents, shows what a server of your own leaves open and lists what to ask your contractor. GDPR also applies to a US business that offers goods or services to people in the EU or monitors their behavior there (Article 3(2)). Everything here is general information about EU GDPR as of October 18, 2026, and no substitute for legal advice.
Where your data lives in self-hosted n8n, n8n cloud, Make and Zapier
According to each vendor’s documents as of October 18, 2026, self-hosted n8n keeps data wherever the instance runs, and n8n cloud stores it in the EU, on servers in Frankfurt. Make keeps data in the US or EU region chosen when the organization is created, and Zapier hosts it on AWS servers in the United States.
The table draws only on the vendors’ own pages and shows each setup’s data location and who plays which role. In the “Who is who” column, a controller decides why customer data is used, and a processor handles it on the controller’s instructions. DPA stands for data processing agreement and SCCs for standard contractual clauses, and both are explained further down. Where a document is silent, the cell says so. Features and pricing belong to a separate question: how n8n, Zapier and Make compare beyond where data lives.
| Setup | Where workflow data is stored (vendor’s words) | Infrastructure | EU only / changing the region | Backups | AI and other subprocessors | Who is who | Documents, date checked |
|---|---|---|---|---|---|---|---|
| Self-hosted n8n (your server or your contractor’s) | Wherever the instance is deployed: “wherever you decide to host n8n” | The server chosen by whoever deploys n8n. The hosting provider is another company holding the data, a processor under GDPR (or a subprocessor of your contractor) | Chosen at deployment, by you or your contractor | Where the person running the server puts them. Encrypting other data at rest is “the responsibility of the user” | No n8n subprocessors for workflow data. The data goes to the services each workflow calls. n8n receives telemetry (on by default) and, from licensed instances, a usage report | n8n is “neither a Controller nor a Processor” for this data | n8n Plans and Pricing FAQ, Docs “Privacy and security”, Legal “Security”, checked October 18, 2026 |
| n8n cloud | “For hosted plans, data is stored within the EU, on servers located in Frankfurt, Germany.” | Microsoft Azure in the EU | EU is the current setup. n8n says: “We’re preparing to host in additional locations too” | “a separate region in the same country” | AI providers on n8n’s subprocessor list process data mostly in the US | n8n is “both a Controller and a Processor”. Its DPA includes SCCs | n8n Plans and Pricing FAQ, Legal “Security”, Legal “Sub-processors” (last updated September 22, 2026), Docs “Privacy and security”, checked October 18, 2026 |
| Make | US or EU, chosen when the organization is created: “You cannot change the location of the data center after you create the organization.” | AWS: “United States, Germany (enterprise), Ireland (others)” | EU available at creation. No change afterwards | Not named in the documents checked | AI providers on Make’s list mostly in the US | Make’s data processing agreement: not checked | Make Help Center “Organizations”, “Make Sub-Processors, November 2025”, checked October 18, 2026 |
| Zapier | “Zapier hosts data in AWS servers located in the United States” | AWS, United States | Asked about EU-only storage: “Zapier does not support this option.” For Zapier MCP (the way AI tools connect to apps through Zapier), another region only “unless otherwise agreed” | Not named separately in the documents checked | Infrastructure subprocessors in the US | The customer is the “data controller”, Zapier the “data processor”. DPA with SCCs. Zapier states that it is certified under the EU-US Data Privacy Framework | Zapier “Data Privacy Overview”, “Security & compliance”, “Subprocessors”, Docs “Zapier MCP security”, checked October 18, 2026 |
Decide before data flows
It cannot be changed afterwards, so the region has to be chosen before customer data goes into the organization (Make Help Center, “Organizations,” checked October 18, 2026).
Does GDPR require storing data in the EU?
GDPR has no general rule that personal data must be stored in the EU, and Chapter V (Articles 44–46) regulates transfers to countries outside the European Economic Area (EEA). For US vendors the transfer can rest on standard contractual clauses or, as of October 18, 2026, on the EU-US Data Privacy Framework for companies on its list. Article 44 opens Chapter V with this rule:
Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor…
Regulation (EU) 2016/679, Article 44 View source
The clause “subject to the other provisions of this Regulation” means Chapter V adds conditions on top of the rest of GDPR. Meeting them does not by itself make a data flow lawful.
Two routes make a transfer possible. Under Article 45, the European Commission can adopt an adequacy decision, a finding that a country, or a group of its companies, protects personal data well enough. Under Article 46, the transfer can rely on appropriate safeguards, and one of them is standard contractual clauses (SCCs, Article 46(2)(c)): model contract terms approved by the Commission. Article 49 adds narrow exceptions for specific situations.
For the US, the Commission adopted an adequacy decision on July 10, 2023, and it covers US organizations that take part in the EU-US Data Privacy Framework (DPF). As of October 18, 2026, that decision is in force. A transfer to a US company that is not in the program rests on SCCs.
A vendor’s DPF certification is a basis for transferring data to that company while it stays on the DPF List, and only for the data its certification covers. It says nothing about where the data is stored, which is the question people raise in discussions when they ask whether the framework covers storage too. So a “United States” cell in the map is a prompt to check two things: the contract that covers the service and the transfer basis it relies on.
When the location itself is the requirement. Sometimes the rule comes from your own customer: a contract or procurement questionnaire asks for a specific country or EU-only hosting. In discussions, data residency is described as a stumbling point in procurement calls.
Such a requirement covers copies too: backups, snapshots and replicas have to sit in the required place. The map then works as a filter. Zapier’s documents offer no EU-only storage option, and a Make organization gets its region once, at creation, so the choice comes before any customer data flows into it.
Does self-hosting make your automation GDPR compliant?
Self-hosting pins down where workflow data is stored and processed and gives the server’s administrator control over retention and telemetry. It leaves open every service a workflow step sends data to, such as a CRM or an AI model, and each of those flows has its own location and its own legal conditions. Whether your business complies depends on the whole processing, these flows included, and that is for you and your lawyer to judge.
On a self-hosted n8n instance, data stays and workflows run wherever the instance is deployed. Whoever runs the server decides how long execution history (the log of each workflow run) and backups are kept, and can switch telemetry off. That switch is a server setting, made outside the workflow editor.
Every outside service a workflow step calls receives the data and processes it wherever that service runs. A booking form processed on your EU server can still hand the booking details to a CRM in another region and then to an AI model. Where those two process the data is set by their vendors, and your server has no say in it.
Telemetry, the usage data a program sends back to its developer, is the second channel. Self-hosted n8n sends it to n8n by default, and n8n’s documentation warns that error messages can carry text from your workflows. A licensed instance also reports usage counts and its license identifier to n8n, and n8n says that reporting cannot be disabled.
Error messages can sometimes include text drawn from your workflow … Telemetry is on by default.
n8n Docs, Privacy and security View source
Backups sit wherever they were configured, which can be a different place from the server itself. Execution history keeps the data from every step until a retention setting deletes it, and on self-hosted n8n you or your contractor set that period.
Security duties under Article 32 apply to the controller and the processor wherever the server stands, and n8n’s documentation leaves encryption of other data at rest to the instance owner. The hosting provider that runs your server, and any contractor with access to it, are also companies that hold your data. When they process it on your behalf or on your contractor’s, GDPR treats them as processors or subprocessors (Article 4(8)), and Article 28 applies to them: a contract, and permission before one processor brings in another.
None of these flows is forbidden. With a service that processes data for you, the law requires a data processing contract (Article 28(3)), and if the data leaves the EEA, also a transfer basis under Chapter V, such as an adequacy decision, SCCs or the DPF as of the date you check. These are necessary conditions, and they do not make a flow lawful on their own: as the Article 44 wording above says, the rest of GDPR applies too.
An AI step is the same kind of flow, because the model receives whatever text the step sends it. Before such a step touches customer data, three things have to be in place: you know where the model runs (the provider’s region or a model of your own), there is a contract with the provider, and the step sends only the fields the task needs. As with the contract and the transfer basis, these are minimum conditions, and GDPR’s other rules still apply. If customers write about their health in a free-text message, that is a special category of personal data and a separate question for your lawyer.
Your server decides where workflow data is stored. Every outside service a workflow calls decides where that data goes next, and each such flow needs its own contract and, if data leaves the EEA, a transfer basis, with the rest of GDPR still applying.
Controller, processor, DPA and subprocessors: what to ask for
You are the controller: you decide why customer data is collected and how it is used, a vendor or contractor handling it for you is a processor, and the companies it brings in for that work are subprocessors. Under Article 28, a processor works under a data processing agreement (DPA) and brings in another processor only with your written permission.
That permission can be specific or general, which is why vendors publish lists of their subprocessors. The law requires a contract with a processor (Article 28(3)), and how that applies to your business is a question for your lawyer. The roles each vendor claims for itself differ, as the map shows: n8n calls itself both controller and processor for n8n cloud and neither for self-hosted n8n.
From a vendor or contractor, ask for the DPA, with SCCs attached if data leaves the EEA, and for the subprocessor list showing where each one processes data. Add the retention periods and the deletion procedure, and ask where backups are kept. For a self-hosted setup, three more facts belong on the list: who runs the server, where it stands and whether telemetry is on. A “GDPR compliant” badge on a vendor’s site is the vendor’s statement about itself, and the answer comes from the documents.
What each workflow calls is visible only inside the workflows, which is why the request goes to whoever built them. For a booking workflow, one row could read: form step, CRM, the region the CRM vendor names, the vendor page, the date.
What to ask for
- Ask
- A list of every service each of our workflows sends customer data to, one row per step: the step, the service, where that service processes the data, the vendor page that says so, and the date it was checked.
- Caveat
- Locations in the list are the vendors’ own statements on the date checked, and the list describes where data goes, which is a separate matter from whether your setup complies with GDPR.
- Check
- Every row links to a vendor page and carries a date. A row without a document stays an open question until someone finds the page.
Keep the answer with your contracts, dated, since every later check compares against it. If the same contractor is also quoting new work, read what else to describe before you ask for an estimate.
When to check again. A list of flows is accurate on the day it was made. Check it again when a workflow gets a new service or an AI step, when a vendor updates its subprocessor list, when the DPF adequacy decision changes, when your setup gains or changes regions, and when you move to another plan or platform. The date in each row tells you how old that answer is.
Where our workflows run
Our team at IntegroFlow works in all four setups, with self-hosted n8n on our own server in the EU as the core, and workflow executions on that core run there. We choose among the core, n8n cloud, Make, Zapier and custom code per task and budget, and since the stack is public, another contractor could support the workflows.
The n8n telemetry that self-hosted instances send by default is switched off on that core. The services and AI models a workflow calls still receive data where they run, on our core as on any other server, so for us the question is the same one: which services a workflow calls and under which contract. Our automation page covers what we automate and where our workflows run.
FAQ
Not by itself. An AI step sends text to a model, so it is one more outside flow. Check where the model runs, whether you have a contract with its provider and which fields the step sends. Those checks are required, and the rest of GDPR still applies to the processing. What the model receives follows the provider’s terms.
It depends on where each copy sits. As of October 18, 2026, Zapier says it keeps workflow content and run history for 29 to 69 days, and n8n says that a deleted n8n cloud account is removed the same day and from backups within 90 days. Data sent to an AI tool follows the provider’s terms.
No. A “GDPR compliant” label is a claim the vendor makes about itself, while compliance depends on how your business processes the data. The answer sits in documents: the data processing agreement, the subprocessor list with locations, and the retention and deletion terms.
Yes, if the business offers goods or services to people in the EU, whether or not they pay, or monitors their behavior while they are in the EU (Article 3(2)). Whether either case describes your business is a question for your lawyer.
Where to start
Take one workflow that handles customer data and ask whoever set it up for the list of flows described above, with a document and a date in every row. If you would rather go through this with us, ask for a free look at your workflows and where their data runs.
Sources and dates
- Regulation (EU) 2016/679 (GDPR), Articles 3, 4, 28, 32, 44–46 and 49, EUR-Lex, consolidated version of May 4, 2016, checked October 18, 2026: eur-lex.europa.eu
- European Commission, “Adequacy decisions,” including the adequacy decision for the EU-US Data Privacy Framework of July 10, 2023 (Commission Implementing Decision (EU) 2023/1795), checked October 18, 2026: commission.europa.eu
- n8n: Plans and Pricing FAQ, Legal: Security, Legal: Sub-processors (last updated September 22, 2026), Docs: Privacy and security, checked October 18, 2026
- Zapier: Data Privacy Overview, Security & compliance, Subprocessors, Docs: Zapier MCP security, checked October 18, 2026
- Make: Help Center: Organizations, “Make Sub-Processors, November 2025,” linked from Make’s terms and conditions, checked October 18, 2026
- About this article: written by the IntegroFlow team, a web development and automation studio. The authors are not lawyers. It is general information about EU GDPR as of October 18, 2026, and no substitute for legal advice.