Client Handoff Checklist

Copy this into each client project and tick it off before you invoice the final milestone.

Access and ownership

• The server / n8n Cloud account is in the client's name and billing, not yours
• Client has an n8n owner account; you have a separate admin/member account
• All credentials (Google, OpenAI, Slack…) are connected with client-owned accounts
• API keys have spending limits or alerts set (OpenAI usage limits, etc.)
• N8N_ENCRYPTION_KEY and database password are stored in the client's password manager
• DNS is in the client's registrar account

Reliability

• Every production workflow has an Error Workflow set, and the error workflow is published (Module 04)
• Error alerts go to someone on the client side, not only to you
• Uptime Monitor (this module) checks the instance and any critical endpoints
• backup.sh runs nightly via cron and archives are copied off the server
• A restore has been tested once (restore the dump into a test stack)
• n8n version is pinned in .env; upgrade procedure documented

Documentation (give the client a single page)

• What each workflow does, its trigger, and who to contact when it fails
• Where data goes (sheets, CRMs, AI providers) and what personal data is processed
• How to pause a workflow (unpublish) in an emergency
• Monthly running costs: server, API usage estimates

Security

• n8n is only reachable via HTTPS (Caddy); port 5678 not exposed publicly
• Owner account uses a strong password + MFA
• Public webhooks that change data are authenticated (header auth / secret token)
• Server: SSH keys only, firewall allows 22/80/443, automatic security updates on

Commercials

• Final walkthrough call recorded and shared
• Support/maintenance terms agreed (retainer or per-incident)
• Your access level after handoff agreed in writing (keep admin for the retainer, or remove)