The n8n production readiness checklist

Security and patching

5 questions

Someone specific is responsible for updating n8n quickly (within hours) when a serious security flaw (a CVE) is found.Your n8n isn't exposed on the open internet. It sits behind a login (single sign-on) and a firewall.Before installing a community-built add-on (a "node"), you check it first, because these can read your passwords, files, and saved credentials.You have a plan for what to do if the n8n platform itself is attacked or goes down, not just the individual workflows.If a security reviewer asked "who updates this, and how fast?", you'd have a clear answer.

Compliance and certification

5 questions

You can show an auditor formal security certification (like SOC 1 and SOC 2) for the system running your automations.Access controls are switched on today: people only get the permissions their role needs, and everyone logs in through your company's single sign-on. (Actually in place, not planned.)A record of every action is automatically sent to your security monitoring system and kept for as long as your policy requires.You're not forced onto an expensive higher tier just to get the basic controls an auditor expects.Your data is stored in the specific regions you're required to keep it in.

Governance of AI agents

4 questions

There's one place that controls which AI agents, and the tools they call, are allowed to touch which systems.Every action an AI agent takes is recorded: what it did, and who or what set it off.You can limit or switch off an agent's access without having to rebuild the workflow.A team member can't connect an AI agent to your live systems without oversight.

Reliability and scale

5 questions

When a workflow splits into branches and recombines, it never silently loses records.Combining and reshaping large amounts of data is built in, so you're not writing custom workarounds.The database that stores run history is kept in check, so it doesn't fill up and force an emergency fix.You've tested well beyond today's volume, and it keeps up without having to be rebuilt.A platform update won't break what's running in production, and you can see what a new version does before it reaches you. (One team had an update spike their Redis (queue) load roughly sixfold, and spent roughly six months stabilizing it.)

Cost and operations

4 questions

Your bill is predictable as you grow, with no surprise usage charges partway through the month.Your engineers spend their time building, not hours each week patching, backing up, and maintaining servers.You're not paying usage fees to run the software on hardware you already own.The features you'll need next (single sign-on, audit logs, separate test and live environments) aren't locked behind a big jump to a higher price tier.

Support and an SLA

2 questions

If something breaks at any time, you have a real support contact and a written response guarantee (an SLA).When something critical fails, your fallback isn't searching a community forum for the answer.

The n8n production readiness checklist

Security and patching

Compliance and certification

Governance of AI agents

Reliability and scale

Cost and operations

Support and an SLA

Migration has never been easier with our n8n → Tray Migration Kit