> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/deploy/host-n8n/configure-n8n/security.md).

# Security

You can secure a self-hosted n8n instance to protect credentials and workflow data: run a security audit, set up SSL and SSO, restrict nodes and the public API, and redact execution data.

Securing your n8n instance can take several forms.

## In this section

* [Manage security policies](/deploy/host-n8n/configure-n8n/security/manage-security-policies.md): manage instance-wide security policies including MFA enforcement and personal space controls.
* [Run security audits](/deploy/host-n8n/configure-n8n/security/run-security-audits.md): run a security audit to identify security risks.
* [Set up SSL](/deploy/host-n8n/configure-n8n/security/set-up-ssl.md): enforce secure connections.
* [Configure SSO](/deploy/host-n8n/configure-n8n/security/configure-sso.md): set up SAML or OIDC Single Sign-On.
* [Rotate encryption keys](/deploy/host-n8n/configure-n8n/security/rotate-encryption-keys.md): periodically replace the key that encrypts credentials and other sensitive data.
* [Decrypt OAuth 2.0 tokens with JWE](/deploy/host-n8n/configure-n8n/security/decrypt-oauth-20-tokens-with-jwe.md): let your identity provider encrypt access and ID tokens that only your instance can decrypt.
* [Harden task runners](/deploy/host-n8n/configure-n8n/security/harden-task-runners.md): better isolation for Code node executions.
* [Redact execution data](/deploy/host-n8n/configure-n8n/security/redact-execution-data.md): hide input and output data from workflow executions.
* [Disable the public API](/deploy/host-n8n/configure-n8n/security/disable-the-public-api.md): prevent others from using the n8n public REST API.
* [Control telemetry](/deploy/host-n8n/configure-n8n/security/control-telemetry.md): opt out of the anonymous data n8n collects automatically.
* [Block specific nodes](/deploy/host-n8n/configure-n8n/security/block-specific-nodes.md): prevent your n8n users from accessing specific nodes.
* [Enable SSRF protection](/deploy/host-n8n/configure-n8n/security/enable-ssrf-protection.md): control which hosts and IP ranges workflow nodes can connect to.
* [Verify user emails](/deploy/host-n8n/configure-n8n/security/verify-user-emails.md): restrict account registration to email-verified users.

## Related resources

* [Configure n8n](/deploy/host-n8n/configure-n8n.md)
* [Set up token exchange](/deploy/host-n8n/deploy-as-an-oem-integration/set-up-token-exchange.md): authenticate users from your own identity provider when embedding n8n.
* [Require two-factor auth](/administer/manage-users-and-access/verify-user-identity/require-two-factor-auth.md): enable 2FA for your users.