n8n for enterprise: SSO, permissions and an audit trail, or the open-source system you self-host

What an enterprise buyer checks

The person choosing what a whole company runs is usually a security, IT or platform lead, and the checklist is short: single sign-on, per-resource permissions, an audit trail, a self-host path, and source they can read. n8n and Kortix answer it differently, and the difference is where the controls sit.

What n8n's paid plans gate

n8n's own edition comparison is explicit (n8n docs). The free Community edition does not include log streaming, multi-main mode, or sharing workflows and credentials. The same page says the Business and Enterprise plans unlock the paid features the Community edition leaves out, such as SSO, environments, external secrets, and log streaming, and that a team subscribes when it needs paid features such as SSO, environments, projects, or external secrets. Git-based environments need a paid plan too: n8n uses Git-based source control to support environments (n8n docs). On n8n Cloud the free path is a 14-day trial, and the Business plan is self-hosted only (n8n pricing, checked October 2026).

So the controls a company reaches for as it grows sit behind the paid line. That is a legitimate way to sell a product, and it is the first thing a buyer should price, because the bill appears exactly when the team standardizes.

The governance picture in Kortix

Kortix's documentation describes the same controls: SAML 2.0 single sign-on and SCIM 2.0 for identity, and per-resource permissions for people and agents, with roles, groups, and an audit trail (Read the docs). Groups map from the identity provider on every SSO sign-in, and a person can be narrowed to named agents and skills inside a project, so narrowing access is a deliberate step rather than a cleanup.

Agent access is governed as files. An agent is agents/<name>.md for behavior plus an agents.<name> block in kortix.yaml for governance, and the grants are deny-by-default: an agent with no connectors, secrets or permissions key gets none of them. Every action is recorded, and reading, exporting and streaming the audit log depend on the plan. Secrets are encrypted at rest with a key per project, and connector credentials are brokered server-side and never enter the machine.

On compliance, the honest line is narrow: SOC 2 Type I is held, and SOC 2 Type II is in progress. Kortix holds neither ISO 27001 nor HIPAA, and its security page says so.

What self-hosting changes

Self-hosting runs the full platform on a server you control: one Docker Compose stack with the frontend, the API, the LLM gateway and the Supabase distribution, and your database and files on disk you own. Agent sessions run on a separate sandbox provider, so the instance stays reachable. The self-hosting guide covers install, DNS, backups and the evaluation mode, and it states the one limit: the instance needs the internet, because kortix self-host start pulls its images, and isolated topologies are scoped with the team.

The four things a reviewer asks for on a self-hosted instance are the same four here: single sign-on, per-resource permissions, audit, and deployment inside your own network. On a self-hosted instance the Enterprise plan turns on all five account entitlements, SSO, SCIM, custom roles, audit access and branding, for every account.

Where Kortix fits, and where n8n still does

Kortix is open source, so the code is yours to read, fork and audit, and the repo is yours to keep (Kortix on GitHub). Agents, skills, memory, connectors and triggers are files in that repo, which means the setup a company builds stays with the company. For a buyer who has to keep the data on their own disk and pass a review, that ownership is the point.

n8n remains a good fit for the fixed flows a team already runs, and its paid plans are a fair way to buy the team controls. The enterprise question is what the whole company runs on, and whether the source and the data stay with you. The is n8n free page prices n8n's free and paid line, the n8n vs Kortix comparison is the head-to-head, and the open-source n8n alternative covers the self-hosting path.