n8n Self Hosted Setup: A 24-Point Checklist Before You Hire Help

Hiring someone to set up and run n8n on your own server? Score them on 24 checks across ownership, backups, updates, security, capacity and monitoring.

By Carlos Familia, CRM & AI automation expert. Updated October 17, 2026. 6 min.

Before I built a single node for a distressed-property buyer in New Mexico, I settled one question: where would the four workflows run? Not on a server of mine. They went into the buyer's own n8n Cloud account, in the buyer's name.

Even there, "on" did not mean live. Switching the workflows on through the Cloud public API left their triggers unregistered, so the active flag proved nothing by itself.

That job needed no server. If yours does, because the data must stay on a machine you control or the volume is high, someone has to operate it, and that person is the hire. For comparison, n8n's Cloud Starter plan is €20 a month on annual billing with 2,500 executions, and n8n bills one execution per full workflow run, no matter how many steps (October 2026). Self-hosting makes sense when you want that control and have someone to do the 24 jobs below.

Score each check 0 if there is no answer, 1 if the answer has no evidence behind it and 2 if they showed you. A total of 40 or more out of 48 is a hire.

Ownership and license

• 1. The accounts are in your name. The hosting account, the domain and the server's admin login belong to you, and the person you hire gets a user. Same principle as the Cloud account above: whoever leaves, the workflows stay.
• 2. The license fits the arrangement. n8n's license FAQ says someone may install and maintain n8n on a client's own server, provided they are not also hosting it for that client, since that would compete with n8n Cloud. Running workflows for clients on the builder's own instance is allowed only while the clients cannot build or edit them. If you want to log in and change workflows yourself, the server should be yours.
• 3. The edition matches the need. n8n's edition comparison leaves Git version control, projects, sharing, SSO, environments and external secrets out of the free edition and offers them on paid self-hosted plans. If the plan is to stay free, ask how workflows are versioned.
• 4. There is an exit plan on paper. Who runs the export of workflows and credentials, where the files go, and who deletes the plain-text copies. I would not hire anyone who cannot describe moving you elsewhere.

Data and backups

• 5. The database was chosen on purpose. Self-hosted n8n uses SQLite by default and can run on PostgreSQL. Ask which one you have, why, and where its file or server lives.
• 6. The encryption key is saved apart from the database backup. n8n encrypts credentials with a key it creates on first launch and keeps in its data folder, unless you set your own. The docs I read do not say what happens if the key is lost, so I treat a backup without the key as incomplete.
• 7. A restore has been done, not promised. Ask to see a restore onto a spare machine, then open a credential to prove it decrypts.
• 8. Retention is set on purpose. n8n prunes old executions by default. A test of mine that ran every few seconds filled one instance's log until only about two days of runs remained, so decide how long failed runs stay.

Updates

• 9. There is a named cadence. n8n's update page asks for frequent updates, at least monthly, and points to the release notes for breaking changes. Ask who is on the hook and when.
• 10. Someone reads the release notes first. The 2.0.0 notes (December 2025) list task runners on by default, environment variable access blocked from Code nodes by default, and two nodes disabled by default. A Code node that read an environment variable breaks on an update like that.
• 11. Updates run on a copy first. n8n suggests a test environment, which is a paid feature. On the free edition that means a second container loaded with exported workflows. Ask to see it.
• 12. Rollback is possible. The image is pinned to a version number, the previous one is kept, and the data volume survives the swap.

Security and exposure

• 13. HTTPS sits in front. Ask who issues the certificate and who gets the alert before it expires.
• 14. The risky switches were decided. n8n's security docs list disabling the public API, blocking specific nodes and SSRF protection among the options. Ask which are on and why.
• 15. Traffic goes where it should. On a fuel distributor's voice agent build the proxy routed to the wrong network, and on an English academy's classifier, n8n inside Docker could not reach the model on localhost. Ask for one request through the proxy and one call from n8n to every connected service.
• 16. Database roles were reviewed. If the same server holds a database for bot state, ask who can reach client data and with which key. My rule is to grant client schemas to the service role only.

Capacity and location

• 17. The size comes from numbers. Runs per day, the peak, and memory per workflow. My own VPS carries n8n, a database stack of 11 containers, a WhatsApp gateway and some bridges behind one proxy, so every addition changes the arithmetic.
• 18. CPU steal is watched. My provider throttled that server, and CPU steal reached 87 to 90 percent. The database stack added to it by checking its own health every 5 seconds.
• 19. The region matches the contract. On the fuel distributor's build the contract required EU data residency while the server sat in the US, and that had to be fixed.
• 20. Queue mode has a reason. It needs Redis, a database and separate workers that share the instance's encryption key. Ask for the run counts that justify the extra machinery.

Monitoring and handover

• 21. A published error workflow covers every active workflow. I count active workflows and covered ones, then break one on purpose and receive the alert.
• 22. The server alerts too. Disk, memory, containers that are down and certificates. The watchdog I built for a med spa in Pennsylvania alerts only on evidence, and that is how it spotted a VPS CPU throttling outage with nobody prompting it.
• 23. There is a runbook. Where it runs, how to restart it, which people hold logins and how to stop everything at once. A kill switch beats a phone call at midnight.
• 24. A cost sheet exists. Server, domain, backup storage, and who pays each. Add the hours spent on updates and monitoring.

What does your total mean?

Treat a 0 on item 1, 4 or 7 as a pass whatever the total. Those three decide whether you can ever leave.

A high score tells you the person can describe the work. The paid test proves it: a fresh server, a deliberate breakage, a restore and an update, all in front of you. Put what you agree in an n8n project scope of work.

Server and builder prices sit in my guide to how much an n8n developer costs. The interview that sits above this checklist is in my n8n developer questions, and the marketplace risks of letting a freelancer run things on their own server are in the n8n freelancer red flags. When the box is already slow or failing, start with n8n workflow not working, and for the support that follows setup, see n8n maintenance. Or book a call and I will score your current setup with you.

About the author

Carlos Familia, CRM & AI automation expert. GoHighLevel, n8n, AI agents, servers. Full-stack developer.

I build CRM systems in GoHighLevel, n8n automations on my own servers and AI voice and chat agents for service businesses. Full-stack developer: I write the workflow, the API integration, the database and the server it runs on, and I test every build with real journeys before handoff.