Do you run n8n or Node-RED, or are you planning an automation platform? On the pages for n8n and Node-RED we describe hosting, operations and workflow development. We classify the licence situation with you in advance. View the n8n page · Book an intro call (free and non-binding)
Anyone looking for an n8n alternative finds many tool lists. In operation these questions usually arise: What does the licence allow, what does running it cost, and what happens to the existing workflows? This article compares n8n with Activepieces and Node-RED on these criteria and relies on licence texts, vendor documentation and the GitHub API. As of 5 November 2026.
The focus is on licence, operations and migration. For a comparison of n8n with Dify, Flowise and Langflow for AI applications, see the article Dify, Flowise, Langflow and n8n compared. The licence is repeated here only as far as the comparison needs it. This article is not legal advice.
Table of contents
- In brief
- When is an n8n alternative worth considering
- What the n8n licence allows
- How the three licences differ
- What n8n, Activepieces and Node-RED are suited for
- What is free and what costs money
- Which role, SSO and audit features exist without a licence
- How much operations the three tools need
- What the security advisories show
- Can an n8n system be migrated
- What this means when a service provider is involved
- Common misconceptions
- Status and methodology
- Our approach at WZ-IT
- Further guides
- Sources
In brief
| Question | Answer |
|---|---|
| Is n8n open source? | No, according to the vendor. Licence: Sustainable Use License 1.0 (fair-code) |
| When is the n8n licence a reason for an alternative? | When hosting an instance on which customers build workflows themselves, and when embedding it in a product in which end users configure workflows |
| Internal use, contract work, installation at the client | Allowed according to the licence FAQ |
| Direct alternative | Activepieces: MIT core, enterprise features in ee directories under a commercial licence |
| Different tool | Node-RED: Apache 2.0, event-driven flows for devices, protocols and edge |
| SSO without a licence | Node-RED through your own configuration without a licence surcharge; n8n from Business, Activepieces from Team |
| Security advisories 5 May to 5 Nov 2026 | Activepieces 8, Node-RED 0; n8n considerably more, total not verified (not directly comparable) |
| Migration | According to our research no official importer found; flows are rebuilt, credentials created in the target |
When is an n8n alternative worth considering
In our assessment the licence alone is no reason to switch for companies running n8n for their own processes. Anyone running n8n for their own processes uses it, according to the vendor, "for your own internal business purposes", and that is explicitly allowed. An alternative is worth examining in these cases:
- Customers are to build workflows themselves. Anyone who hosts n8n and gives customers the editor is, according to the FAQ, not covered without an agreement (the FAQ names exceptions for time-limited training and workshop settings).
- End users are to configure workflows in your own product. The FAQ also excludes this for a custom UI, the API, MCP or an AI agent.
- Roles, SSO or versioning are needed without buying a licence key. With Activepieces large parts of this are also paid. Node-RED brings user permissions, Git projects and, through configuration, SSO, but no role model like the enterprise tiers (see below).
- The task is a different one. Anyone connecting devices, sensors or protocols is often closer to the task with Node-RED than with a tool for SaaS processes.
In our assessment a wish for "more open source" as an end in itself does not belong here. Which operational features are free differs per tool and is listed in the section on roles, SSO and audit.
What the n8n licence allows
The vendor's licence FAQ states the principle: "If workflows are only created or modified by you or people in your organization, you can use n8n under the Community license for free." The core text of the Sustainable Use License limits use to "your own internal business purposes or for non-commercial or personal use". Files with .ee. in the name or .ee in the directory name are under the n8n Enterprise License and may be used in production only with a valid licence.
The licence FAQ lists the following:
| Allowed (wording of the FAQ) | Not allowed (wording of the FAQ) |
|---|---|
| "Use n8n community version to help run your business" | "Host n8n as a service and allow your clients to build workflows" |
| "Build automations for your clients on your instance, as long as your clients do not have the possibility to create or edit them." | "Allow external end users to build or configure their own workflows through your product, whether via a custom UI, our API, MCP, or an AI agent acting on the user's behalf." |
| "Charge your customers for workflow creation, setup, and maintenance services." | "Fork n8n's code to launch your own automation product" |
| "Charge your customers for training and consultancy services" | "White-label n8n by removing our branding and offering n8n as is." |
| "Use n8n behind the scenes in your own product, where users can use and trigger the automations you built, and even connect their own accounts to them." | "Use enterprise features that ask for a license key without an Enterprise license." |
| "Run several instances of n8n community version" |
For service providers the FAQ section "Consulting and agency use" matters most. Consulting and automation services are explicitly permitted there if n8n remains the internal tool and clients receive outputs, not access. Operating it as a managed service is possible "provided clients do not access your n8n instance directly". The number of clients is not limited; access is the deciding factor. Installing on a client's own server is allowed "provided that you are not also hosting for them".
How typical constellations relate to the FAQ:
| Constellation | Situation according to the wording of the FAQ |
|---|---|
| Own instance, provider builds the workflows, client receives results | Allowed, also for a fee |
| Installation and maintenance on the client's server, without hosting by the provider | Allowed |
| Dedicated instance per client, hosted by the provider, client with viewer or trigger access, provider builds the workflows | Not clearly regulated: "clients do not have the possibility to create or edit them" concerns only building, while the agency section also requires that clients do not access the instance directly. Whether a separate instance per client still counts as an internal tool is not regulated by the FAQ |
| Client builds workflows themselves on a hosted instance | Not allowed |
| Using SSO, Git, Environments or external secrets | Only with a Business or Enterprise licence key |
For constellations with several client environments the FAQ refers to [email protected] and describes a partner programme for managing multiple instances as in development. The vendor also states there that the test is not UI visibility but who controls the workflow logic and whose commercial interests are served. A different usage model requires a separate agreement according to the Community licence page.
How the three licences differ
| n8n | Node-RED | Activepieces | |
|---|---|---|---|
| Core licence | Sustainable Use License 1.0 (fair-code) | Apache 2.0 | MIT (community part) |
| Paid area in the repository | Files and folders with .ee (n8n Enterprise License) |
None in the core | packages/ee and packages/server/api/src/app/ee (Enterprise licence, per user seat) |
| Rights holder per licence text | n8n GmbH | OpenJS Foundation | Activepieces Inc. |
| Open source by OSI | No (statement of the vendor) | Yes | Community part yes (MIT) |
| Hosting for third parties, customers build themselves | Not allowed without an agreement | Allowed | Allowed for the MIT part |
| Internal use | Allowed | Allowed | Allowed |
n8n. The licence limits use and redistribution. The vendor acknowledges that it therefore does not call itself open source (Community licence). The contributor agreement and the licence history are covered in the article Dify, Flowise, Langflow and n8n compared.
Node-RED. The LICENSE file carries "Copyright OpenJS Foundation and other contributors" and the text of the Apache License 2.0. Use, hosting and embedding are allowed; conditions include keeping the licence text, notices (NOTICE where applicable) and marking changes. The "Node-RED" trademark belongs to the OpenJS Foundation. Add-on products such as FlowFuse have their own terms: the FlowFuse repository is under Apache 2.0, except the directory forge/ee/ with its own licence.
Activepieces. The LICENSE separates: content under packages/ee/ and packages/server/api/src/app/ee is under the licence in packages/ee/LICENSE, everything else under MIT, except third-party components that keep their own licences. The enterprise licence permits production use only with agreement to the Subscription Terms or another agreement and "a valid Activepieces Enterprise license for the correct number of user seats". The licence page of the documentation confirms: the core is MIT, and enterprise features of a self-hosted instance require a licence. GitHub shows the repository licence as NOASSERTION or Other, presumably because of this mix.
What n8n, Activepieces and Node-RED are suited for
Versions as of 5 November 2026: n8n 2.46.6 (released 4 November), Activepieces 0.92.3-hotfix.2 (28 October), Node-RED 5.0.9 (21 October; version 5.0.0 appeared on 9 June). GitHub stars, rounded: n8n 209,600, Activepieces 25,400, Node-RED 23,800.
| Criterion | n8n | Activepieces | Node-RED |
|---|---|---|---|
| Visual editor | Yes | Yes (flows, agents, tables) | Yes, browser-based flow editor |
| Integrations according to the vendor | 2,622 integrations (the page says "2,000+" at the top, the counting rule is not explained) | 775 open-source pieces | Flow library: 6,360 recent nodes, plus flows and collections |
| Code | Code node with JavaScript and Python | Code step, pieces in TypeScript | Function node (JavaScript), custom nodes as npm modules |
| AI and agents | AI agent node, MCP server trigger, MCP client | Agents, chat, knowledge, MCP server | No dedicated AI core feature; integration through community nodes or the HTTP request and function nodes |
| Strength | Process and SaaS integration | Process and SaaS integration | IoT, edge, protocols (MQTT; Modbus and OPC UA through community nodes) |
| Projects and access separation | Projects: cloud from Starter (one shared project), self-hosted from Business according to the pricing page; the documentation assigns projects and RBAC differently | Projects in the paid plans from Team | Not built in, FlowFuse as a separate product |
The numbers count different things: n8n counts integrations by an unexplained rule, Activepieces pieces, the Node-RED library individual nodes. They are not suitable as a ranking.
Classification by task:
| Task | Better suited | To note |
|---|---|---|
| Process automation between many SaaS systems, with execution history and credential management | n8n or Activepieces | Team features (roles, SSO, Git) are paid in both |
| Wish for an MIT-licensed core in process automation | Activepieces | ee features remain paid |
| Sensors, machine data, MQTT, dashboards, edge devices | Node-RED | Editor is open without configuration, securing it is up to you |
| Letting customers build workflows themselves | Activepieces (MIT core) or Node-RED, not n8n without an agreement | Clarify rights and tenant separation yourself |
| Keep running existing n8n workflows unchanged | n8n | Check licence scope if third parties get access |
Node-RED processes message objects (msg) in event-driven flows, n8n works with items and expressions, Activepieces with step references. In our assessment (not a comparative test), introducing Node-RED as a 1:1 replacement for n8n leads to a different task than the one Node-RED was originally aimed at.
What is free and what costs money
When self-operated, no licence fee applies to the community core in any of the three cases as long as the terms are met and no enterprise features are used. The vendors additionally offer cloud and licence tiers (pricing pages, retrieved on 5 November 2026):
| Tool | Tier | Price according to the vendor page | Included according to the vendor page |
|---|---|---|---|
| n8n | Starter | EUR 20 per month, billed annually | 2,500 executions, 1 shared project |
| n8n | Pro | EUR 50 per month, billed annually | 10,000 executions, 3 projects, admin roles, workflow history |
| n8n | Business | EUR 667 per month, billed annually | 40,000 executions, self-hosted only, SSO and LDAP, Git, Environments, 6 projects |
| n8n | Enterprise | Individual | External secret stores, log streaming, audit logging, SLA |
| Activepieces | Free | USD 0 | 1,000 credits per month, up to 5 users |
| Activepieces | Plus | USD 20 per month | 10,000 credits, up to 5 users |
| Activepieces | Team | USD 200 per month | 50,000 credits, 25 users, unlimited projects, SSO, standard roles |
| Activepieces | Ultimate | Individual | SCIM, custom RBAC, audit logs, secret manager, releases and Git sync |
| Node-RED | Open source | No vendor prices | No paid area in the core; FlowFuse has its own pricing page |
n8n bills by executions, not by steps or users; whether the amounts are net or gross the page does not say. Activepieces bills in the cloud by credits: a run costs 1 credit regardless of the number of steps, AI steps with vendor-paid models cost 2, 10 or 20 credits depending on the model (with your own keys, according to the pricing FAQ, 1 credit per AI step plus model costs), additional agentic actions are counted separately, and overage on Plus and Team is USD 0.007 per credit. The vendor's install page says every plan on the pricing page is also available self-hosted. Whether and how the user limits and the credit model apply to a self-hosted community instance we have not verified.
For n8n, the pricing page lists queue mode under Business, while the documentation on community features states it is included in the Community Edition and multi-main is not. This is not necessarily a contradiction; we follow the documentation. For registered community users (free by email) n8n additionally unlocks folders, debugging in the editor and custom execution data. Business and Enterprise licence keys must, according to n8n, reach the licence server daily.
Which role, SSO and audit features exist without a licence
| Feature | n8n | Activepieces | Node-RED |
|---|---|---|---|
| Users and roles | Community: instance roles owner and member; cloud Starter already includes one shared project and credential sharing; admin roles from Pro (cloud), for self-hosted the pricing page says Business and the roles documentation says Enterprise; custom roles Enterprise | Standard roles from Team | adminAuth with user list, permission * or read; no role model like enterprise RBAC |
| SSO | SSO and LDAP from Business (pricing page), OIDC only Enterprise according to the guide | From Team | OAuth and OpenID through Passport strategies, configured yourself |
| Git and versioning | Git and Environments only in Business and Enterprise | Version history (draft and published); releases and Git sync only Ultimate | Projects with Git, to be enabled in settings.js |
| External secret stores | Enterprise only | Secret manager only Ultimate | No central secret manager documented in the core |
| Audit logs | Enterprise only | Ultimate only | Admin API access can be logged through logging.console.audit (logging); no audit log like in the enterprise tiers |
| Projects and access separation | See above (pricing page: self-hosted from Business) | Projects from Team | Not built in |
Node-RED has one peculiarity: without configuration, anyone who can reach the IP address can use the editor and deploy flows. The documentation considers this state suitable only for a trusted network. Operation for several parties needs upstream protection or separate instances.
How much operations the three tools need
| Aspect | n8n | Activepieces | Node-RED |
|---|---|---|---|
| Installation | Docker, Docker Compose, npm | Docker Compose, Helm | npm, Docker, also Raspberry Pi |
| Database | SQLite (default) or PostgreSQL (16, 17, 18 according to the documentation) | PostgreSQL | File-based (flows.json), no mandatory database |
| Further components | Redis for queue mode; task runner for code nodes | Redis; S3 storage in the production setup | None |
| Runtime | Node.js (included in the container) | Container | Node.js 22.9 or newer from version 5.0 |
| Scaling | Queue mode in the Community Edition, multi-main paid | Worker model | Several instances, split by flow set (our architecture suggestion, not described in the documentation) |
For n8n a vendor benchmark exists: up to 220 executions per second for a webhook with an Edit Fields step on an AWS c5a.large with 4 GB RAM and PostgreSQL. For Activepieces the production setup documentation recommends as starting values one worker per concurrent flow (0.5 vCPU, 1 GB), one app instance with 1 vCPU and 1 GB per ten workers, PostgreSQL with 2 vCPU and 4 GB, Redis and S3. Both are vendor scenarios or recommendations, not general capacity promises or minimum requirements.
Version jumps. For version 3.0 (status "early access") n8n announces changes: self-hosting only with Docker, no more npm or npx. A migration report under settings shows the impact in five levels (from "Upgrade blocked" to "Capability removed"), see the pages on breaking changes and the migration report. The Activepieces documentation lists versions with restructuring (for example 0.87.0 with changed billing and 0.91.0 with changed provider validation, see breaking changes) and describes a rollback. For Node-RED, version 5.0 requires at least Node.js 22.9 and recommends Node.js 24; older hosts need a runtime update first. An n8n installation running on Ubuntu with Caddy therefore belongs on the checklist before a version jump.
What the security advisories show
The basis is the published GitHub Security Advisories of the repositories in the period 5 May to 5 November 2026, evaluated by us on 5 November 2026. The count is a snapshot; GitHub lists change, and we could not reproduce the n8n total and severity distribution and therefore do not state them. Ratings follow GitHub ("moderate").
| Tool | Published advisories | Distribution by severity | Source |
|---|---|---|---|
| n8n | Total not verified, see source list | Three rated critical, see below | List |
| Activepieces | 8 | 1 critical, 3 high, 4 moderate | List |
| Node-RED | 0 | 2 advisories in the repository overall, both from 19 February 2021 | List |
The three n8n advisories rated critical, published on GitHub on 13 May 2026 (the CVE records partly followed later), concern CVE-2026-44791 (prototype pollution bypass in the XML node), CVE-2026-44789 (prototype pollution in the pagination of the HTTP Request node up to remote code execution) and CVE-2026-44790 (arbitrary file read through the Git node); the fixes are in versions 2.22.1, 2.20.7 and 1.123.43. Examples rated high are GHSA-6h4x-896x-fw5m (remote code execution in the main process through path traversal when loading the MCP node schema, 5 August; requires authenticated member access) and GHSA-6xcw-7xm6-48c6 or CVE-2026-86083 (expression sandbox escape, 2 September; affects the legacy expression engine). The developments since September are covered in the article n8n security update September 2026.
For Activepieces, the critical advisory GHSA-m992-8rcw-vmrx was a queue dashboard (Bull-Board) reachable without authentication (9 August, affected 0.80.0 to 0.84.0 with the dashboard enabled, fixed in 0.84.1). Rated high (by GitHub; the CNA record of CVE-2026-48499 says critical) are CVE-2026-48499 (access to data of other tenants and code injection through the sandbox cache of code pieces, before 0.84.0), CVE-2026-73081 (command injection in the name of a code step, fixed in 0.80.0) and CVE-2026-73083 (V8 isolate sandbox escape, 0.80.0).
Assessment. The numbers are not comparable without reference to size, attack surface and reporting culture, and 0 advisories for Node-RED does not mean Node-RED installations are secure: there, security depends on the secured editor and the community nodes in use. In the n8n and Activepieces examples named, two patterns recur: sandbox escapes in code execution and permission problems between projects or tenants (not a full frequency analysis). In our assessment a defined update procedure matters for operation, regardless of the tool.
Can an n8n system be migrated
According to our research on 5 November 2026 we found no official importer from n8n to Activepieces or Node-RED; Activepieces itself states that it does not import or convert n8n workflows. Node-RED imports its own flow JSON files. We have not examined third-party converters and do not recommend them.
What, according to our research, does not transfer automatically:
- the workflow logic, because data model and expressions differ (n8n items and
{{ $json... }}, Activepieces step references, Node-REDmsgobjects) - credentials: n8n can also export them decrypted via the CLI (plain text, handle with care); an automatic import into the target tool is not documented, and the target configuration must be adapted
- execution history, trigger states, variables, roles, projects and community nodes: we are not aware of a documented standard transfer
- webhook URLs: callers usually have to be switched over unless forwarding keeps the old URLs
A practical path in six steps:
- Inventory the workflows: triggers, connected systems, data volumes, code nodes, community nodes.
- Map each n8n node to an Activepieces piece or Node-RED node; missing integrations can often, but not always (protocol, authentication), be covered through the HTTP piece or the HTTP request node respectively.
- Secure the n8n export (workflow JSON via CLI or API) as documentation of the logic.
- Rebuild the flows in the target tool and create the credentials there.
- Run in parallel with webhook forwarding until the results match.
- Archive execution data if it is needed, because a documented standard import into the target tool is missing.
Anyone switching only for licence reasons should first check whether a clarification with the vendor or an adjustment of the operating model (for example installation on the client's server) makes the switch unnecessary.
What this means when a service provider is involved
Anyone having an automation platform operated by a service provider should clarify three questions in advance:
- Who builds workflows? If only the provider and your own employees do, that speaks for use within the scope of the FAQ; infrastructure, contractual relationship and client access also matter. If external parties are to use the editor, this is generally not covered (the FAQ names exceptions for time-limited training).
- Where does the instance run? On your infrastructure or on the provider's. The licence FAQ distinguishes between installation at the client and hosting.
- Which features are needed? SSO, Git, Environments and external secrets require a licence key with n8n, which comes in addition to the operating costs.
The dedicated instance per client that a service provider hosts is, as described above, a borderline case that the FAQ does not clearly regulate. The vendor names a partner programme in development and [email protected] as the contact. We derive no statement from this. For Activepieces and Node-RED this question does not arise for the respective community core; for Activepieces it remains for the ee features.
Common misconceptions
- "n8n is open source." No, the vendor does not call itself that. The source code is viewable, and use is limited by the Sustainable Use License.
- "Self-hosted means free for everything." No. Features with
.ee(n8n) or in theeedirectory (Activepieces) need a licence, and with n8n limits apply to hosting for third parties. - "Activepieces is entirely MIT." Only the community part. The enterprise directories are under a commercial licence.
- "Node-RED replaces n8n 1:1." No, the tasks differ: device and protocol flows versus process and SaaS integration.
- "Workflows can be exported and imported." According to our research not automatically between the tools. The export documents the logic, and the rebuild starts from scratch.
- "No advisories means secure." No. Node-RED published none in the period, yet security depends on editor access and community nodes.
Status and methodology
As of 5 November 2026. The data basis is the LICENSE files of the three repositories, the licence FAQ and Community licence page of n8n, the documentation and pricing pages of the vendors, the GitHub API (releases, stars, published security advisories in the period 5 May to 5 November 2026) and the integration directories of the vendors. Licence texts are quoted verbatim; the classification is not legal advice. Where we did not verify something, the text says so: the user limits and credit model of Activepieces when self-hosted, and third-party converters. The pricing page and documentation of n8n differ on projects, roles and admin rights; we follow the documentation and name the differences. Both pages present queue mode in different places (pricing page under Business, documentation in the Community Edition); this is a different presentation that we do not treat as a contradiction. Statements introduced with "in our assessment" are our own evaluations, not vendor statements. Stars change daily. Prices are vendor statements, for n8n without a statement on net or gross.
Our approach at WZ-IT
For n8n we offer installation, configuration, workflow development, backups and ongoing operation, within the licence and operating scope agreed in each case. For managed hosting, enterprise features or deviating usage models we check the required vendor agreement and include it in the offer on request. For Node-RED we offer installation, managed hosting and operation as well as flow and node development. Activepieces is not part of our offering.
For an enquiry about a switch we proceed as follows:
- Clarify the goal: process automation or device and protocol flows, who builds workflows, who gets access.
- Classify the licence situation: hold the wording of the vendor licence against the operating model, name borderline cases and clarify them with the vendor. We do not provide legal advice.
- Record the inventory: workflows, triggers, systems, code and community nodes.
- Plan operation: database, queue, secrets, updates, backups and securing the editor.
- Support the switchover: rebuild, parallel operation, shutdown of the old instance.
Monitoring runs 24/7, and the response to P1 incidents follows the service level. More on operations: Managed operations support.
Unsure whether your operating model fits the n8n licence or whether an alternative is the better choice? We classify purpose, licence situation and operations with you. View the n8n page · Book an intro call (free and non-binding)
Further guides
- Node-RED editor without adminAuth: CVE-2026-58115 (Siemens IoT2050) - why the Node-RED editor without login is being attacked
- Dify, Flowise, Langflow and n8n compared
- n8n security update September 2026
- n8n installation on Ubuntu 24.04 with Caddy
- n8n hosting and operations
- Node-RED hosting and operations
Sources
- n8n: LICENSE.md (Sustainable Use License 1.0)
- n8n: LICENSE_EE.md (Enterprise License)
- n8n Docs: Community License
- n8n Docs: License FAQ
- n8n: Pricing
- n8n: Integrations
- n8n Docs: Community Edition features
- n8n Docs: Choose your database
- n8n Docs: Breaking changes in version 3.0
- n8n Docs: Migration report for version 3.0
- n8n: Security advisories
- n8n: Releases
- n8n Docs: Command line (export)
- n8n Docs: Measure performance (benchmark)
- Node-RED: LICENSE
- Node-RED: package.json
- Node-RED Docs: Getting started
- Node-RED Docs: Securing Node-RED
- Node-RED Docs: Projects
- Node-RED Docs: Logging
- Node-RED: Flow library
- Node-RED: Releases
- Node-RED: Security advisories
- FlowFuse: LICENSE
- FlowFuse: Pricing
- Activepieces: LICENSE
- Activepieces: Enterprise licence (packages/ee/LICENSE)
- Activepieces Docs: License
- Activepieces: Pricing
- Activepieces: Pieces
- Activepieces: Security advisories
- Activepieces: Releases
- Activepieces: Production setup
- Activepieces: Breaking changes
- Activepieces Docs: Rollback
- Activepieces blog: n8n free plan, Community Edition and cloud













