Where your data is stored
🎯You'll be able to
Find out where a platform stores and processes data, for how long, and who can access it, and say whether it fits a client's rules.
🏠The everyday picture
When you leave your scooter at a paid parking lot, you hand over the key. You want to know where the lot is, who can use the key, and how long they keep the car if you forget to collect it.
📘What it really is
- Automation platforms handle the data passing through them: names, phone numbers, orders, sometimes payment references.
- Questions to ask about any platform:
- Where is data processed and stored (which country or region)?
- How long are run histories and logs kept, and can you shorten that?
- Who at the provider can access it, and is it encrypted?
-
What happens to the data if you cancel your account?
-
India's Digital Personal Data Protection Act, 2023 (DPDP Act) expects businesses to collect personal data for a clear purpose, protect it with reasonable safeguards and delete it when it's no longer needed. Your automation choices are part of meeting that.
-
Minimise what flows through: send only the fields a step needs. A courier needs an address, not the customer's purchase history.
-
Self-hosting gives the most control over location, but only if the server itself is secured and backed up.
📝A worked example
Sharma Textiles checked their order workflow against the questions:
| Question | Finding | Action |
|---|---|---|
| Where is data stored? | n8n on their own VPS in Mumbai | Recorded in their privacy notes |
| How long are executions kept? | Default setting kept a lot of history | Set to keep 14 days |
| What fields flow through? | Full order, including notes | Pass only name, phone, address and items to the courier step |
| Who can log in? | Three staff shared one login | Separate accounts, owner role for one person |
🌍Where it's used
- Healthcare, finance and education handle sensitive data and face stricter questions.
- Vendor reviews: larger clients send security questionnaires before approving a tool.
- Privacy notices: businesses list the services that process customer data.
- Audits: run histories can show what data was sent where.
📝Case scenario
A school asks you to automate sending report-card PDFs to parents. Report cards include children's marks and personal details. You recommend a set-up where files stay in the school's storage, the workflow sends parents a secure link rather than attaching files to many systems, run history is kept for only a short time, and only two staff can access the workflow.
🖱️Try it
For one workflow, answer the four "where, how long, who, what happens" questions for the platform you'd use, using its documentation. List every personal data field that passes through, and cross out any a step doesn't need.
⚠️Common mistakes
- Keeping full run histories forever. Sign: months of customer data sit in execution logs. Fix: shorten execution retention and avoid saving sensitive fields.
- Assuming the region. Sign: no one checked where data is processed. Fix: read the provider's documentation and record it in the data map.
🛠️For your project
Your capstone data map records where each personal data field goes. Start it here for the contacts used in Project 3.
✅Quick check
What does "minimise the data" mean in a workflow?
Show the answer
Pass each step only the fields it actually needs, so less personal data is copied and stored.
Why shorten how long execution history is kept?
Show the answer
Old executions can hold personal data; keeping them only as long as needed reduces risk and follows the DPDP Act's expectations.