Who owns your SOC 2 report when you self-host n8n?

A security reviewer asks for your SOC 2 report. Or your customer’s procurement team sends over a questionnaire with a line item for SOC 1. Or your own compliance lead wants an audit trail they can hand to an auditor without a caveat attached.

If your n8n instance is self-hosted, the answer to “who produces that” is you.

What compliance actually asks for

A SOC 1 or SOC 2 report isn’t a badge. It’s the output of a third-party audit of your actual controls: access management, change management, monitoring, incident response, and how you handle the data flowing through the system. ISO 27001 asks a version of the same question with a different framework.

For a workflow automation platform specifically, the controls a reviewer wants to see usually come down to a short list: who can access what (RBAC), how access is granted and revoked (SSO/SAML provisioning), what happened and when (audit logging you can hand over, not just a database you’d have to query), and where the data physically sits (residency).

None of that is unusual. It’s the standard bar for any system that touches production data. The question is whether the platform already clears it, or whether clearing it is a project your team owns.

What self-hosting puts on you

Self-hosted, RBAC, SSO/SAML, and audit-log streaming sit behind n8n’s Enterprise license tier. Below that, you’re building your own access controls and your own record of who did what.

Even at the Enterprise tier, self-hosting doesn’t produce a report. A license turns the features on. Someone still has to configure them correctly, keep the evidence current, and stand behind it when an auditor asks. That’s a recurring job, not a one-time setup, and it’s usually the job of whoever built the automation in the first place, not a dedicated compliance function.

This is why compliance and security sign-off end up being the moment a proven n8n pilot stalls. The workflow itself works. The problem is that going to production means someone can now point to a report and say the controls are real, and self-hosted, that report doesn’t exist yet.

What a managed, audited platform changes

Tray is SOC 1 Type 2 and SOC 2 Type 2 audited every year, with HIPAA and GDPR/CCPA coverage and regional data residency across the US, EU, and APAC. RBAC, SSO, and audit-log streaming are standard on the platform, not a feature you configure once you clear a pricing tier.

That changes what a review actually requires from your team. Instead of building the controls and producing your own evidence, you’re handing over a report that already exists and already gets renewed annually. The audit trail streams to your SIEM by default, so “what happened and when” is answered before the question gets asked.

The same standard extends to AI agents and MCP calls, not just workflows. As automation increasingly means an agent calling into a CRM or a finance system, the audit trail needs to cover that too. On Tray, every agent and MCP call is governed and logged the same way a workflow is, so extending automation into agents doesn’t mean rebuilding your evidence story from scratch.

The regulatory floor is rising outside SOC 2 too. The EU AI Act’s fines reach €35 million or 7% of global turnover for its most serious violations, above GDPR’s ceiling, and already apply to any organization whose AI systems touch EU users. Colorado’s AI law adds comparable high-risk obligations in the US in 2026, and ISO 42001 and the NIST AI RMF are becoming the procurement baseline regardless of which law applies.

None of this means a platform is “compliant” with any of them. It means the audit trail and governance question above extends well beyond a SOC 2 review.

Control area	Self-hosted n8n	Tray
RBAC and SSO	Enterprise tier	Standard, included
Audit logging	You build it	Standard, streamed
SOC 1 / SOC 2	Self-described only	Type 2, audited
HIPAA and GDPR	On you to prove	Covered standard
Incident response	DIY support	SLA included

That gap between self-hosted and audited is exactly where a production review stalls. If you’re not sure where your own setup lands, it’s worth finding out before a reviewer does.