Data Processing Agreement
A summary of the DPA that governs how we process the personal data inside your n8n instance on your behalf. The signed DPA is the binding document.
Last updated: 2026
This page summarises the Data Processing Agreement (DPA) between you and Cloudmesh Systems Private Limited. It is a summary for clarity; the signed DPA is the binding document. Request a copy at privacy@n8nhosting.cloud.
Controller and processor roles
For the personal data contained in your n8n instance — in your workflows, credentials and execution data — you are the data controller and we are the data processor. For your account and billing data we are the controller; see the Privacy Policy.
Scope and instructions
We process instance personal data only to provide, operate, secure, back up and support the service, and on your documented instructions. We will tell you if an instruction appears to breach data-protection law.
Confidentiality
Personnel authorised to process personal data are bound by appropriate confidentiality obligations.
Security measures
Our technical and organisational measures are described on the Security page and include: single-tenant isolation with a separate instance, database and encryption key per customer; CPU, memory and network-egress limits; Cloudflare edge protection; restricted OS privileges; daily encrypted off-site backups with monthly restore tests; and monitoring. Encryption keys are stored separately from the data they protect.
Sub-processors
We use the sub-processors listed in the Privacy Policy. We impose data-protection obligations on each of them and give notice of material changes so you can object.
International transfers
Where personal data is transferred outside your chosen region, we rely on appropriate safeguards such as Standard Contractual Clauses.
Data-subject requests
If an individual whose data is in your instance contacts us directly, we will refer them to you. We assist you in responding to data-subject requests with appropriate technical and organisational measures, taking into account the nature of the processing.
Personal-data breaches
We will notify you without undue delay after becoming aware of a personal-data breach affecting instance data, with the information you need to meet your own notification obligations.
Audits
We make available the information needed to demonstrate compliance with the DPA and allow for audits in line with the signed agreement.
Return and deletion of data
On termination you can export your data. We then delete instance data and backups in line with the data-deletion policy, unless retention is required by law.
Requesting a signed copy
Email privacy@n8nhosting.cloud and we will send the current DPA for signature.