Does n8n Cloud sign a BAA?
Not confirmed
n8n's trust center, legal terms and AI terms do not mention HIPAA or BAAs, so it is unknown whether n8n will sign one for its cloud service. Self-hosting is a separate deployment that is not assessed here.
- Business associate
- n8n
- Tool
- n8n Cloud
- Plans with a BAA
- Not stated
- Checked
Not confirmed
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| n8n Cloud (Starter, Pro, Business, Enterprise) | Not confirmed | Not stated | The trust center lists GDPR, SOC 2 Type 2 and SOC 3 only. The Self-Serve Terms, Master Enterprise Terms and Acceptable Use Policy do not mention HIPAA, PHI or BAAs. They only require a lawful basis for personal data and ban high-risk uses such as medical life-support.[1],[2],[3],[4] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what n8n says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| n8n AI features (AI Workflow Builder, AI Agent nodes, BYO LLM) | Not stated | The AI Terms say customer data may go to third-party LLM providers that the customer configures, and the customer must review those providers' terms. HIPAA is not mentioned.[5] |
Workspace and collaboration AI that offer a BAA
- Adobe Acrobat AI AssistantBAA on: Acrobat Studio for enterprise: Analyzer in Acrobat, Acrobat Studio for enterprise: Knowledge Base in AcrobatSome plans only
- Airtable AIBAA on: Enterprise ScaleSome plans only
- Asana AIBAA on: AsanaGov, Enterprise+Some plans only
- Atlassian Rovo / Atlassian Intelligence (Confluence, Jira)BAA on: Enterprise, Standard / Premium (Jira, Jira Service Management, Jira Product Discovery, Confluence)Some plans only
- Box AIBAA on: Enterprise / Enterprise Plus / Enterprise AdvancedSome plans only
- ClickUp BrainBAA on: EnterpriseSome plans only
All BAA-ready alternatives to n8n Cloud
Sources
- n8n Trust Center
- n8n Self-Serve Terms
- n8n Master Enterprise Terms
- n8n Customer Acceptable Use Policy
- n8n AI Terms
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.