# n8n for enterprise: SSO, permissions and an audit trail, or the open-source system you self-host

> Kortix is the open-source system a company can run itself: SAML 2.0 single sign-on, per-resource permissions for people and agents, an audit trail, and a self-host path for your own VPC or on-prem network. n8n puts SSO, projects and external secrets behind its paid plans, and its Business plan is self-hosted only.

URL: https://n8n-alternative.com/n8n-for-enterprise

_Compare_

## Kortix vs n8n for enterprise governance

Every n8n cell states only what n8n documents on its own site; every Kortix cell quotes the Kortix docs.

| | Kortix (recommended) | n8n |
| --- | --- | --- |
| Open source | Yes. Read it, fork it, audit it. | No. Its docs call it fair-code, not open source. |
| What it is | Open-source AI Operating System; an agent finishes the work. | A workflow automation tool; you build each flow on a canvas. |
| SSO | SAML 2.0 single sign-on and SCIM 2.0. | SSO is a paid Business or Enterprise feature. |
| Permissions and roles | Per-resource permissions for people and agents. Roles, groups, and an audit trail. | Projects, admin roles and sharing need a paid plan. |
| Audit and log streaming | Every action is recorded; reading and exporting depend on the plan. | Execution logs are kept; log streaming needs a paid plan. |
| Secrets | Secrets are encrypted at rest with a key per project. | External secrets need a Business or Enterprise plan. |
| Git and environments | Agents, skills and memory are files in one git repo. | Git-based environments need a paid plan. |
| Where it runs | Kortix Cloud, your VPC, or on-prem. Self-host is free. | Self-hosted on your infrastructure, or on n8n Cloud. |

_In the repo_

## What an agent may reach is a file you review

Grants are deny-by-default, and governance lives in `kortix.yaml`.

`kortix.yaml`

```yaml
# kortix.yaml
kortix_version: 2
default_agent: support
agents:
  support:
    file: agents/support.md
    connectors: [helpdesk]
    secrets: [HELPDESK_API_KEY]
    skills: [kortix-cli, triage]
    kortix_permissions: [project.session.read, project.review.submit]
```

Source: https://kortix.com/docs/project/agents

From the agents reference: this agent reaches one connector, one secret and two skills, and holds two project permissions.

## What an enterprise buyer checks

The person choosing what a whole company runs is usually a security, IT or platform lead, and the checklist is short: single sign-on, per-resource permissions, an audit trail, a self-host path, and source they can read. n8n and Kortix answer it differently, and the difference is where the controls sit.

## What n8n's paid plans gate

n8n's own edition comparison is explicit ([n8n docs](https://docs.n8n.io/deploy/host-n8n/community-edition-features)). The free Community edition does not include log streaming, multi-main mode, or sharing workflows and credentials. The same page says the Business and Enterprise plans unlock the paid features the Community edition leaves out, such as SSO, environments, external secrets, and log streaming, and that a team subscribes when it needs paid features such as SSO, environments, projects, or external secrets. Git-based environments need a paid plan too: n8n uses Git-based source control to support environments ([n8n docs](https://docs.n8n.io/administer/use-source-control-and-environments)). On n8n Cloud the free path is a 14-day trial, and the Business plan is self-hosted only ([n8n pricing](https://n8n.io/pricing/), checked October 2026).

So the controls a company reaches for as it grows sit behind the paid line. That is a legitimate way to sell a product, and it is the first thing a buyer should price, because the bill appears exactly when the team standardizes.

## The governance picture in Kortix

Kortix's documentation describes the same controls: SAML 2.0 single sign-on and SCIM 2.0 for identity, and per-resource permissions for people and agents, with roles, groups, and an audit trail ([Read the docs](https://kortix.com/docs)). Groups map from the identity provider on every SSO sign-in, and a person can be narrowed to named agents and skills inside a project, so narrowing access is a deliberate step rather than a cleanup.

Agent access is governed as files. An agent is `agents/<name>.md` for behavior plus an `agents.<name>` block in `kortix.yaml` for governance, and the grants are deny-by-default: an agent with no connectors, secrets or permissions key gets none of them. Every action is recorded, and reading, exporting and streaming the audit log depend on the plan. Secrets are encrypted at rest with a key per project, and connector credentials are brokered server-side and never enter the machine.

On compliance, the honest line is narrow: SOC 2 Type I is held, and SOC 2 Type II is in progress. Kortix holds neither ISO 27001 nor HIPAA, and its security page says so.

## What self-hosting changes

Self-hosting runs the full platform on a server you control: one Docker Compose stack with the frontend, the API, the LLM gateway and the Supabase distribution, and your database and files on disk you own. Agent sessions run on a separate sandbox provider, so the instance stays reachable. The self-hosting guide covers install, DNS, backups and the evaluation mode, and it states the one limit: the instance needs the internet, because `kortix self-host start` pulls its images, and isolated topologies are scoped with the team.

The four things a reviewer asks for on a self-hosted instance are the same four here: single sign-on, per-resource permissions, audit, and deployment inside your own network. On a self-hosted instance the Enterprise plan turns on all five account entitlements, SSO, SCIM, custom roles, audit access and branding, for every account.

## Where Kortix fits, and where n8n still does

Kortix is open source, so the code is yours to read, fork and audit, and the repo is yours to keep ([Kortix on GitHub](https://github.com/kortix-ai/suna)). Agents, skills, memory, connectors and triggers are files in that repo, which means the setup a company builds stays with the company. For a buyer who has to keep the data on their own disk and pass a review, that ownership is the point.

n8n remains a good fit for the fixed flows a team already runs, and its paid plans are a fair way to buy the team controls. The enterprise question is what the whole company runs on, and whether the source and the data stay with you. The [is n8n free](/is-n8n-free) page prices n8n's free and paid line, the [n8n vs Kortix comparison](/n8n-vs-kortix) is the head-to-head, and the [open-source n8n alternative](/open-source-n8n-alternative) covers the self-hosting path.

_FAQ_

## n8n for enterprise questions

What a buyer asks before a security review.

### Is n8n enterprise-ready?

Yes, with paid plans. n8n's docs say the Business and Enterprise plans unlock SSO, environments, external secrets and log streaming, and that projects, admin roles and sharing need a paid plan.

### Does Kortix support SSO and SCIM?

Yes. Kortix documents SAML 2.0 single sign-on and SCIM 2.0. Groups sync from the identity provider on every SSO sign-in, and the Enterprise plan carries the identity entitlements.

### Can we self-host Kortix, and where?

Yes. Kortix runs on Kortix Cloud, in your VPC, or on your own on-prem network, and self-host is free. The self-hosting docs cover the install, DNS and backups.

### Is Kortix open source?

Yes. Read it, fork it, audit it. The source is on [Kortix on GitHub](https://github.com/kortix-ai/suna).

### What does the audit log cover?

Every action is recorded, on every plan. Reading, exporting and streaming the audit log depend on the plan.

## Run the whole company on a system you own

Kortix is open source and self-hostable, with the enterprise controls in its docs.

[Try Kortix](https://kortix.com) · [Compare n8n and Kortix](https://n8n-alternative.com/n8n-vs-kortix)

Open source · Any model, your keys · Self-host, VPC, or on-prem