Most managed hosting providers tell you their platform is secure. We tested ours, and we're publishing exactly what we found — the same way a technical evaluator would expect a rigorous security assessment to be documented.
This is a summary of our full Security Assessment Report for n8n for Business. The complete report, including methodology and detailed findings, is available as a downloadable PDF.
Network Architecture
Customer instances have no publicly routable network address. The only path to a customer's instance runs through a dedicated traffic inspection and routing layer, which enforces authenticated, encrypted access. Each instance runs on its own dedicated virtual machine, isolated on a private network segment that's unreachable not only from the internet but from other internal servers outside its permitted access list — confirmed through direct, layer-by-layer configuration review.
Perimeter Security
All customer-bound traffic passes through a global edge network before reaching a carrier-grade, next-generation firewall pairing, configured for high availability. Two independent layers of denial-of-service protection are in place: edge-level scrubbing ahead of the platform, plus dedicated perimeter-level protection with automated rate-limiting. Administrative SSH access is restricted at the firewall level to defined internal management subnets only — never reachable from the customer-facing network path — with repeated failed authentication attempts automatically rate-limited and blocked. All external traffic is encrypted via TLS, with HTTP Strict Transport Security enforced to prevent downgrade to an unencrypted connection.
Third-Party Platform Vulnerability Exposure
n8n is third-party, open-source software — CloudAcropolis doesn't maintain or modify its source code, so a static code audit isn't the applicable control here. Instead, every CVE publicly disclosed against n8n with an available automated verification template was tested directly against a live instance using Nuclei, the industry-standard exploit-verification framework — including a full, authenticated exploitation attempt (genuine credentials, live session, crafted exploit payload) against CVE-2025-68613, a CISA Known Exploited Vulnerability rated critical.
The live editor interface and REST API were additionally tested using OWASP ZAP, the industry-standard open-source dynamic application security testing tool, combining API-focused scanning with AJAX-spider crawling suited to n8n's single-page application architecture. Testing covered SQL injection across multiple database engines, multiple classes of cross-site scripting, remote code execution classes including Log4Shell and Spring4Shell, server-side template injection, XML external entity injection, and path traversal, across a combined 170 or more distinct checks.
Platform Configuration
The deployed platform configuration — operating system patch level, container runtime, network firewall enforcement, and application-level settings — was assessed through direct manual review across five layers, then corrected at its root cause in the automated provisioning process rather than on individual instances. The corrected provisioning process was independently validated by provisioning a new instance and confirming every control applied automatically, with no manual intervention required.
Data Protection
Platform and workflow credentials are encrypted at rest using an explicitly configured, instance-specific encryption key. All external traffic is encrypted via TLS. Customer instances are backed up and patched on a defined monthly cadence, with operating-system security updates and the container runtime additionally refreshed daily from CloudAcropolis's own internally-maintained package cache — so new instances provision from current software, not a stale image.
An Ongoing Practice
Security assessment of the n8n for Business platform is continuous, not a one-time exercise. Platform configuration and known-vulnerability exposure are re-verified on a recurring basis, and following any change to the provisioning process, using the same methodology and tooling described here.
Read the full report
This post summarizes our published Security Assessment Report. For full methodology, scope, and detailed findings:
Download the Full Report (PDF)