Media Express LLC logoAIAgents.onlby Media Express773-800-1520Free estimate
Menu

AI automation agency

AI automation agency for Chicago businesses

An AI automation agency maps a repetitive process, builds it as a workflow on a platform such as n8n, Make or Zapier, and adds an AI agent only where judgment is needed. A good one runs everything on accounts you own, logs each run, asks a person to approve risky steps, monitors failures, and hands you a pack so you can switch it off or take it over.

  • Since 1995Chicago-area agency in Mount Prospect, Illinois, founded April 1, 1995.
  • Your accountsAgents run on accounts you own, with logs, approvals and an off switch.
  • 773-800-1520Mon-Fri 9-5, Sat 10-2 Central. English and Polish.
Get a free estimate Call 773-800-1520

By Media Express LLC · Updated 2026-10-13 · Chicago, Illinois

What an AI automation agency actually does

An AI automation agency takes a process your team repeats by hand, such as moving a web form entry into a CRM, chasing a missing document or routing an invoice, and turns it into a system that runs by itself. The work has five parts: mapping the process, deciding which steps are fixed rules and which need AI, building it on an orchestration platform, watching it run, and handing it over so you are never locked in. People search for this as AI automation or AI workflow automation, but most of it is ordinary workflow automation with AI added only at the steps that need judgment.

The first part is where mistakes are cheapest to fix. A written map of who does what, with which data and which tool, shows which steps are plain rules and which need judgment. Rules are cheaper to run and easier to test, so they should do as much of the work as they can.

  • Process map

    Who does what, with which data and tool, and what the exceptions are. Written before anything is built.

  • Build

    Triggers, rules, AI steps and approvals on an orchestration platform and the apps you already pay for.

  • Connect

    Native integrations first, then webhooks and APIs, then MCP where an agent must pick its own tools.

  • Monitor

    Logs, retries and alerts that reach a named person.

  • Hand over

    Exports, a credential inventory, a runbook and an off switch, so you can take over or change vendors.

You are not behind if you have not started. The Census Bureau's Business Trends and Outlook Survey put AI use at 19.8% of US firms as of May 3, 2026, and fewer than 20% of firms with four or fewer employees reported using it. Census changed the question in November 2025 to cover AI use in any business function, so older figures are not comparable.[28]

Automation moves errors rather than removing them. A 2012 peer-reviewed study of questionnaire data entry found 0.046 errors per 1,000 check-box fields for both automated processing and double manual entry, against 0.370 for single manual entry. For handwriting-recognized fields the figures were 10.101 automated, 6.734 single manual and 3.367 double manual, with wide confidence intervals and no statistically significant differences. It was a small health study, not a benchmark for your office, but the lesson holds: structured input automates well, messy input needs checks and a person.[29]

Workflow or AI agent: which one fits

Anthropic's engineering team draws a useful line. In a workflow, models and tools are orchestrated through predefined code paths. In an agent, the model dynamically directs its own process and tool use. Its advice is to find the simplest solution possible and add complexity only when needed, because agentic systems often trade latency and cost for better task performance.[33]

Choosing between a rules-based workflow, a workflow with an AI step, and an agent
The work looks likeUsually the better fitWhy
Same steps every time, structured fields: a form entry into the CRMRules-based workflowPredictable, cheap to run, easy to test and to explain to an auditor.
Free text in, a fixed decision out: sort an inbound email into quote request, support or spamWorkflow with one AI stepThe path stays fixed. The model does one bounded job and a rule decides what happens next.
The next step depends on what was found: research a supplier, then choose an actionAI agent with a short tool listNeeds model-driven decisions, so it needs stopping conditions, logging and approval points.
Anything that moves money, messages many customers, deletes records or makes a promiseA person approves, whatever the designHigh-impact actions need a human decision before they run.

Sources: [33],[32]

OWASP's guidance on excessive agency works as a checklist for agents: only the tools they need, least privilege downstream, human approval for high-impact actions, and authorization enforced in the downstream systems instead of trusting the model to decide what is allowed.[32]

What runs alone and what waits for a person. We set this line step by step in the written scope.

  • Runs alone: read-only lookups, classifying and tagging, drafting text nobody has seen yet, filling internal fields, creating internal tasks, and alerts to your staff.
  • Waits for approval: the first message to a customer, anything that sends money or changes a price, refunds and credits, deleting or merging records, and any promise made on your behalf.
  • Not automated: decisions you must make yourself, or would not want to explain to a customer or a regulator.

One fictional example shows how the pieces fit: rules do the predictable parts, an AI step does one bounded job, and a person approves the message that goes out.

Fictional example: a new quote request arrives
  1. SystemA web form on the fictional site of Example Heating and Cooling posts a quote request to a webhook. The workflow checks the shared secret in the header. A wrong secret stops the run.
  2. SystemRule step: are name, phone and message present, and is the lead already in the CRM? Missing fields go to a person. A duplicate is merged, not created.
  3. AI agentAI step, one bounded job: read the message and return a category (quote request, service call or spam), an urgency label and a one line summary. It cannot send or change anything.
  4. SystemRule step: the service area is checked against the shop's own zip code list, not by the model. Spam ends the run and is logged.
  5. AI agentDraft reply written from the shop's approved template and the lead's message. Status: draft. Nothing has been sent.
  6. SystemApproval step: the office manager receives the lead, the category and the draft in one message.
  7. StaffEdit one sentence in the draft and press Approve.
  8. SystemSend step: the reply goes from the shop's own mailbox and a CRM record is created with source, category, approver and time. If the CRM call fails, the run retries, then alerts the office manager and keeps the draft.

Browser simulation with fictional data and fixed rules. Not a live AI run and not a customer result.

n8n, Make and Zapier compared from their own pages

This comparison uses only what each vendor publishes, read on 2026-10-12. It does not rank the platforms, because the right one depends on your volume, your data rules and who will maintain the workflows.[1],[11],[19]

How each platform meters usage and where it runs (vendor pages read on 2026-10-12)
PlatformWhat usage is counted inWhere it runsEntry numbers shown
n8nExecutions. One execution is a single run of the entire workflow, whatever its step count or data volume.Hosted by n8n or self-hosted. A standard self-hosted version is on GitHub. The Business plan is currently self-hosted only.Starter: €20 a month billed annually, 2,500 executions. Pro: €50 a month billed annually, 10,000. Community Edition: no price listed.
MakeCredits. Each module action consumes credits: most use one, some AI features more. Error handler modules and the Router are not counted.No self-hosted edition is described on the pages read. An on-premise agent (Enterprise) lets scenarios reach apps and databases on your own network.Free: 1,000 credits a month. Paid prices were not shown on the page read.
ZapierTasks. A task is a successfully completed unit of work. Triggers, filters, paths and failed steps do not count. An MCP tool call counts as two tasks.Describes its own service as fully managed cloud infrastructure. No self-hosted edition is listed on the pages read.Free: 100 tasks a month. Professional: from $19.99 a month billed annually ($29.99 monthly) at 750 tasks.

Sources: [1],[11],[17],[19],[20],[24]

The same process is counted three ways. A run is one execution on n8n however many steps it has. On Make, each module action consumes credits. On Zapier, each successful action step is a task. A ten step process can therefore produce very different usage numbers on each platform. Ask any agency to estimate monthly usage on the platform it proposes, at your real volumes, and to say what happens when you go over.[1],[11],[20]

How each platform handles failures, incoming webhooks and request limits
PlatformFailure handling and retriesWebhook and request limits
n8nPer node: Retry On Fail with Max Tries and Wait Between Tries, plus On Error choices (stop, continue, or continue with an error output). A separate error workflow starts with an Error Trigger and can send email or Slack alerts.A production webhook registers when you publish. Authentication: Basic, Header, JWT or none, plus an optional IP allowlist. Maximum payload 16 MB (changeable when self-hosted). No request-rate figure found.
MakeRollback is the default. The Retry handler stores incomplete executions and retries by the attempts and interval you set (the help page's example: three attempts, every 15 minutes). Connection and rate limit errors retry automatically when incomplete executions are on. Three consecutive errors disable a scenario by default, and webhook-triggered scenarios are disabled immediately.Webhooks: up to 300 requests per 10 seconds, then HTTP 429. Each queue holds 667 items per 10,000 licensed credits (maximum 10,000), and a full queue rejects new data. Make API: 60 requests a minute on Core, 120 on Pro, 240 on Teams, 1,000 on Enterprise.
ZapierAutoreplay (Professional, Team and Enterprise plans) retries a failed step up to five times, waiting 5 minutes, 30 minutes, 1 hour, 3 hours, then 6 hours: about 10 hours 35 minutes after the first error. Filter and Paths steps are never replayed. Replay window: 60 days. Replaying a whole run is a new run, and its successful steps count as tasks again.Webhooks by Zapier: 20,000 requests per 5 minutes per user, and 1,000 per 5 minutes per Zap on legacy routes, then HTTP 429. In busy periods Zapier may return 200 but delay processing by several minutes. Other API limits not compared.

Sources: [4],[5],[6],[7],[12],[13],[14],[18],[21],[22]

Licensing is part of the comparison. n8n's repository uses the Sustainable Use License: use or modification for your own internal business operations or non-commercial or personal use, distribution only free of charge and non-commercial, and enterprise files under a separate license. The free Community Edition omits some features, including Git version control, projects, SSO and external secrets, which matter at handover. If an agency proposes to host n8n for you, ask how its license covers that. We do not interpret licenses: read the text or ask the vendor.[2],[3]

How automations connect to your tools

There are three routes, and an agency should choose the plainest one that does the job. Native integrations are prebuilt app connections that you authorize once. Webhooks and APIs let one system push or pull data from another when no native connection exists. MCP lets an AI application discover and call tools through one standard interface.

The Model Context Protocol describes itself as an open-source standard for connecting AI applications to external systems. Its specification is blunt about risk: tools represent arbitrary code execution, hosts must get explicit user consent before invoking any tool, and descriptions of tool behavior are untrusted unless they come from a trusted server.[25],[26]

Authorization is optional in the specification. For HTTP based transports it builds on OAuth 2.1, and access tokens must not be placed in the URI query string. For local STDIO servers it says to take credentials from the environment instead. Ask which transport is used, where the token lives and which scopes it carries.[27]

  • n8n: the MCP Server Trigger node lets n8n act as an MCP server so clients can call its tools and workflows. It supports Server-Sent Events and streamable HTTP, not standard input and output, and authentication can be None, Bearer or Header.
  • Make: the Make MCP server lets clients such as Claude and ChatGPT use scenarios as tools. Scenarios must be active with on-demand scheduling, and MCP toolboxes limit which scenarios a client can use.
  • Zapier: each successful MCP tool call counts as two tasks, and failed tool calls do not count.[8],[16],[20]

Our default is plain workflows and native integrations first, webhooks and APIs next, and MCP only where an agent genuinely has to choose among tools. Each agent gets its own service account with least-privilege access.

Monitoring, error handling, ownership and handover

Building is the smaller part. Automations fail for ordinary reasons: a token expires, an app changes a field, a service is rate limited, a webhook is delivered twice. Four things decide whether that is a non-event or an outage.

  1. Retries for temporary failures. n8n's documentation reads a 429 response as a rate limit hit and suggests batching or Retry On Fail. Make retries connection and rate limit errors automatically when incomplete executions are on, and Zapier's Autoreplay retries failed steps on a schedule. Retries fix temporary problems only: bad data needs a rule or a person.
  2. An alert that reaches a named person. An n8n error workflow can send an email or Slack alert. Make disables a scenario after repeated consecutive errors by default, so ask what alert fires when that happens.
  3. No duplicates. Webhooks can be delivered twice and runs can be replayed. OWASP advises persisting processed event IDs, skipping repeats and making side effects such as emails and database writes idempotent. A whole-run replay on Zapier counts its successful steps as tasks again.
  4. Logs that last as long as you need them. On self-hosted n8n, execution data is pruned on a rolling basis by default, with a default maximum age of 336 hours. If you need a longer audit trail, say so in the scope and export the logs.[4],[5],[9],[13],[21],[31]

Who owns the accounts? This decides whether you can leave an agency. If a Zapier account owner leaves, Zapier cannot transfer the account or update its connected apps, although on Team and Enterprise plans an admin can move a departed member's Zaps and connections. In Make, scenarios, connections and webhooks each belong to exactly one team and cannot be moved to another. n8n encrypts stored credentials with a key it generates on first launch and saves in its own folder, unless you set your own. So create the platform accounts in your company's name, with your own admin login, before anyone builds.[10],[15],[23]

Credentials. OWASP's secrets management guidance is a fair standard for an agency: centralize storage, rotation and auditing of secrets, apply least privilege so no one person or service can read them all, rotate regularly so stolen credentials stop working, never hardcode them, and keep production and development secrets separate. Ask for a credential inventory that lists names, owners and rotation dates, never the values.[30]

Handover. Ask for a pack that lets a competent stranger take over: the process map, an export of every workflow, the credential inventory, alert contacts, a short runbook for common failures, a usage estimate and the steps to switch each automation off. Name these items in the written scope. Whoever builds yours, you should be able to leave.

Illinois and US rules that touch automations

Illinois breach notice. The Illinois Attorney General's business guidance, citing the Illinois Personal Information Protection Act, says any entity that does business in Illinois and handles nonpublic personal information must disclose a data security breach concerning Illinois residents in the most expedient time possible and without unreasonable delay. Every platform, log and AI service in an automation is another place personal data can sit, so list which systems hold which data before you build.[34]

FTC Safeguards Rule. It applies to financial institutions under FTC jurisdiction, defined by activity, not by what a company calls itself. The FTC's guide lists thirteen example types, including mortgage lenders and tax preparation firms. A covered firm needs a written security program with nine elements, including service provider oversight: choose providers with the skills to maintain safeguards and spell out security expectations in contracts. An automation agency that touches your customers' financial information is such a provider. If your business might be covered, ask counsel before you automate.[35]

CAN-SPAM for automated follow-up. A commercial email to a lead must say it is an advertisement, carry a valid physical postal address, explain how to opt out and honor opt-outs within 10 business days. Each separate violating email can carry penalties of up to $53,088. Transactional or relationship messages are largely exempt, but those categories are defined narrowly.[36]

AI claims. In September 2024 the FTC announced Operation AI Comply, enforcement actions against deceptive AI claims, and said there is no AI exemption from the laws on the books. As a buyer, ask an agency to substantiate what its automation will do, and keep your own claims about AI features to what you can show.[37]

Calls, voice and chat bring consent and recording rules of their own, covered on AI voice agents and AI customer service.

How to choose and evaluate an AI automation agency

Ask for answers in writing, and ask for redacted documentation from a past workflow rather than a demo. These are the questions we would put to any agency, including us.

  1. Whose accounts will the workflows run in, and who holds the admin login for each platform on day one?
  2. Which platform do you propose and why? What is the monthly usage estimate at my real volumes, in that platform's own unit (executions, credits or tasks), and what happens when I go over?
  3. For each step, is it a fixed rule or an AI decision, and why?
  4. Which steps need a person's approval before they run, who approves, and what do they see?
  5. What happens when a step fails at night: which retries run, who is alerted, what is logged and for how long?
  6. How do you prevent duplicates when a run is replayed or a webhook is delivered twice?
  7. Where do credentials live, who can read them, how are they rotated, and who holds the encryption key or secret store?
  8. Which of my data goes to which AI model provider, under what terms, and can the workflow run on a self-hosted model if I need that?
  9. How do you test before go-live, and what result moves a pilot to full use?
  10. What is in the handover pack, and can I switch every automation off myself?
  11. Who maintains it after launch, what does that cover (platform, API and model changes), and how is it priced?
  12. If you propose to host a self-hosted tool for me, under which license and on whose infrastructure?

Red flags: the agency wants to hold the only admin login, will not create accounts in your name, cannot say what a run costs on its chosen platform, has no alert or log story, calls a design fully autonomous with no approval step, or cannot explain how to switch it off.

How an engagement works with us, and what to prepare

  1. Request

    You tell us the process and the pain, by form or phone.

  2. Short call

    We ask who does the work today, what tools are involved, how often it runs, and what must never be automated.

  3. Written scope

    Goal, tools, approvals and success measure on paper. Nothing is built before this exists.

  4. Pilot

    One process, approvals on, logging on, running on accounts you own.

  5. Review and rollout

    We compare the pilot with the success measure, then widen the rollout or change course.

  6. Run and hand over

    Monitoring and fixes after launch, or a handover pack so your team can take it from there. Each agent can be switched off.

Shapes the written scope can take: a pilot on one process; build and hand over; build and keep it running. Self-hosted models are possible when privacy requires it.

What to prepare:

  • A plain description of the process: trigger, steps, who does them, and what done looks like.
  • A handful of real examples, including the awkward ones (anonymize anything sensitive).
  • Rough volumes per week and your busiest periods.
  • The apps involved and who holds admin rights in each.
  • Who approves risky steps and who gets the alert when a run fails.
  • What must never be automated, and what data must not leave your systems.
  • How you measure the work today: time spent, errors, response time.

If you need strategy first, start with AI consulting. If you need a custom product rather than process automation, see AI development company. You can also start with the AI readiness audit.

When this is not a good fit

  • The process changes every week. Settle the process first: automating a moving target costs more than it saves.
  • The volume is tiny. A task done a few times a month can cost more to build and maintain than to do by hand.
  • The input is messy and a wrong answer is expensive. The error study above found its highest figure for automated handwriting processing, though not a statistically significant difference. Keep people in the loop.[29]
  • The decision carries legal or safety weight. Hiring, credit and medical decisions need an accountable person. Automation can prepare the file, not decide.
  • Nobody inside your company will own it. Every automation needs an owner who reads the alerts and approves changes.
  • You need custom software or a strategy first. See AI development company or AI consulting.
  • You expect set and forget. Platforms change prices, limits and APIs, and models change behavior, so plan for maintenance.
  • Your data cannot go to a platform or model vendor. A self-hosted route is possible but changes the design, rules out some platforms and adds work for whoever runs the servers.

Questions answered

What does an AI automation agency do?
It maps a repetitive process, builds it as a workflow, adds AI only where judgment is needed, and then monitors and maintains it. The deliverables should be a written process map, working automations on accounts you own, alerts and logs, and a handover pack. Strategy work belongs to consulting and custom software to a development company.
How much does AI automation cost?
It depends on the process, the volume and the platform, and we do not quote prices before a written scope exists. There are two cost lines: the build and the monthly run. On the run side n8n counts executions, Make counts credits and Zapier counts tasks, so the same process produces different usage numbers on each. Ask for an estimate at your real volumes.[1],[11],[20]
What is the difference between AI automation and an AI agent?
Automation follows a path someone designed, while an agent chooses its own next step. Anthropic's engineering team calls the first a workflow, where models and tools run through predefined code paths, and the second an agent, where the model directs its own process and tool use. Start with the simplest design that works and add agency only where fixed rules cannot cope.[33]
Should we use n8n, Make or Zapier?
There is no single right answer, and this page does not rank them. The choice follows your volume, your data rules and who will maintain the workflows. n8n counts executions per workflow run and can be self-hosted, Make counts credits per module action, and Zapier counts tasks per successful action step. Ask the agency to justify its pick against your numbers.[1],[11],[20]
Is n8n free, and can we self-host it?
A free, self-hosted Community Edition exists, but it comes with license terms and fewer features. n8n's pricing page says a standard self-hosted version is available on GitHub, and the repository's Sustainable Use License limits use to your own internal business operations or non-commercial use. The Community Edition lacks some features, including Git version control, SSO and external secrets.[1],[2],[3]
What is MCP, and do we need it?
MCP is an open standard that lets AI applications connect to external tools and data through one interface. You do not need it for a plain workflow. It matters when an AI agent has to discover and choose among tools. The specification says tools represent arbitrary code execution and hosts must obtain explicit user consent before invoking them, so scope every connection narrowly.[25],[26]
Who should own the accounts and credentials?
You should, from day one. Zapier's help center says it cannot transfer an owner's account or update its connected apps if the owner leaves, and Make items belong to exactly one team and cannot be moved. Create the platform accounts under your company, hold the admin login, and ask for a credential inventory that lists owners but never secret values.[23],[15],[30]
What happens when an automation fails?
It should retry temporary failures, alert a named person, and never fail silently. Each platform has its own mechanism: node level Retry On Fail and error workflows in n8n, a Retry handler and incomplete executions in Make, and Autoreplay on paid Zapier plans. Make also disables a scenario after repeated consecutive errors by default, so alerts matter.[4],[5],[12],[13],[21]
Is AI automation safe for customer data in Illinois?
It can be, if you control where the data goes and who can reach it, but no tool makes you compliant by itself. Illinois guidance says businesses that handle nonpublic personal information must disclose a breach concerning Illinois residents without unreasonable delay. Map every system that touches personal data, use least-privilege credentials, and ask counsel about sector rules such as the FTC Safeguards Rule. This is general information, not legal advice.[34],[35],[30]
How many businesses already use AI?
About one in five US firms did as of early May 2026. The Census Bureau's Business Trends and Outlook Survey put the national rate at 19.8% on May 3, 2026, with 32% for firms of 100 to 249 employees, 37% for 250 or more, and fewer than 20% for firms of four or fewer. The question was revised in November 2025 to cover any business function.[28]
Does automation reduce data entry errors?
It can for structured input, but it is not automatically more accurate. In a 2012 peer-reviewed questionnaire study, automated processing of check-box fields matched double manual entry at 0.046 errors per 1,000 fields. For handwriting-recognized fields the figures were 10.101 automated, 6.734 single manual and 3.367 double manual, with no statistically significant differences. Test on your own data and keep a review step where mistakes are costly.[29]
How long does an automation project take?
We do not promise a timeline before there is a written scope. Work starts with a request, a short call and a written scope covering the goal, tools, approvals and success measure, followed by a pilot on one process before wider rollout. Timing depends on the number of systems involved, the quality of the process map and how quickly approvers and account owners respond.
Can the work run without sending data to an outside AI model?
Sometimes, yes. Self-hosted models are possible when privacy requires it, and n8n can be self-hosted, which keeps the orchestration on infrastructure you control. The trade-off is that you or your agency must run the servers, and model quality and speed depend on the hardware. Tell us your data limits in the first call so they go into the written scope.[1]

Sources

  1. n8n pricing (n8n GmbH), accessed 2026-10-12. Execution definition, Starter and Pro entry plans, Community Edition on GitHub, Business plan self-hosted only.https://n8n.io/pricing/
  2. n8n Community Edition features (n8n documentation), accessed 2026-10-12. Features the free Community Edition lacks compared with paid plans.https://docs.n8n.io/hosting/community-edition-features/
  3. n8n license file (Sustainable Use License) (n8n GitHub repository), accessed 2026-10-12. Permitted purposes, distribution limits and enterprise file carve-out.https://github.com/n8n-io/n8n/blob/master/LICENSE.md
  4. n8n error handling (n8n documentation), accessed 2026-10-12. Error workflows and the Error Trigger node.https://docs.n8n.io/flow-logic/error-handling/
  5. n8n HTTP Request node common issues (n8n documentation), accessed 2026-10-12. Retry On Fail, Max Tries, Wait Between Tries and 429 handling.https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.httprequest/common-issues
  6. n8n work with nodes (n8n documentation), accessed 2026-10-12. On Error options: stop, continue, continue using error output.https://docs.n8n.io/build/understand-workflows/workflow-components/work-with-nodes
  7. n8n Webhook node (n8n documentation), accessed 2026-10-12. Production webhook registration, authentication options and maximum payload size.https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.webhook/
  8. n8n MCP Server Trigger node (n8n documentation), accessed 2026-10-12. n8n acting as an MCP server, transports and authentication choices.https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-langchain.mcptrigger/
  9. n8n execution environment variables (n8n documentation), accessed 2026-10-12. Default pruning and maximum age of execution data.https://docs.n8n.io/hosting/configuration/environment-variables/executions/
  10. n8n set a custom encryption key (n8n documentation), accessed 2026-10-12. Credential encryption key generated on first launch and where it is saved.https://docs.n8n.io/hosting/configuration/configuration-examples/encryption-key/
  11. Make pricing and credits (Make), accessed 2026-10-12. Credits as the billing unit, what consumes credits, Free plan allowance.https://www.make.com/en/pricing
  12. Make Retry error handler (Make Help Center), accessed 2026-10-12. Automatic retry, attempts and interval, incomplete executions requirement.https://help.make.com/retry-error-handler
  13. Make overview of error handling (Make Help Center), accessed 2026-10-12. Default rollback, incomplete executions, consecutive error threshold.https://help.make.com/Overview-of-error-handling
  14. Make webhooks (Make Help Center), accessed 2026-10-12. Webhook rate limit, queue size and behavior when the queue is full.https://help.make.com/webhooks
  15. Make teams (Make Help Center), accessed 2026-10-12. Items belong to one team and cannot be moved.https://help.make.com/teams
  16. Make MCP server (Make Help Center), accessed 2026-10-12. Scenarios as MCP tools, requirements and MCP toolboxes.https://help.make.com/make-mcp-server
  17. Make on-premise agent (Make Help Center), accessed 2026-10-12. On-premise agent availability and what it connects to.https://help.make.com/on-premise-agent
  18. Make API rate limiting (Make developer documentation), accessed 2026-10-12. Make API requests per minute by plan.https://developers.make.com/api-documentation/getting-started/rate-limiting
  19. Zapier pricing (Zapier), accessed 2026-10-12. Task definition, Free and Professional entry numbers.https://zapier.com/pricing
  20. Tasks in Zapier (Zapier Help Center), accessed 2026-10-12. What counts as a task, MCP tool call cost.https://help.zapier.com/hc/en-us/articles/8496196837261-Tasks-in-Zapier
  21. What is replay (Zapier) (Zapier Help Center), accessed 2026-10-12. Autoreplay plans, retry count and schedule, 60 day window, task usage on replay.https://help.zapier.com/hc/en-us/articles/19220226086797-What-is-replay
  22. Webhooks by Zapier rate limits (Zapier Help Center), accessed 2026-10-12. Webhook request limits, 429 behavior and retry guidance.https://help.zapier.com/hc/en-us/articles/29972220283789-Webhooks-by-Zapier-rate-limits
  23. How do I access an account after a user leaves (Zapier) (Zapier Help Center), accessed 2026-10-12. What can and cannot be transferred when an owner or member leaves.https://help.zapier.com/hc/en-us/articles/17416146912781-How-do-I-access-an-account-after-a-user-leaves
  24. Zapier vs n8n comparison (vendor article) (Zapier), accessed 2026-10-12. Zapier describing its own service as fully managed cloud infrastructure. Vendor authored, used only for that statement.https://zapier.com/blog/n8n-vs-zapier/
  25. What is the Model Context Protocol (Model Context Protocol project), accessed 2026-10-12. Definition of MCP as an open-source standard for connecting AI applications to external systems.https://modelcontextprotocol.io/docs/getting-started/intro
  26. Model Context Protocol specification (Model Context Protocol project), accessed 2026-10-12. Server features and the security principles on consent and tool safety.https://modelcontextprotocol.io/specification/latest
  27. Model Context Protocol authorization (Model Context Protocol project), accessed 2026-10-12. Authorization is optional, OAuth 2.1 basis for HTTP, STDIO credentials from the environment, tokens not in query strings.https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
  28. Large firms with at least 20 employees are the biggest AI users (US Census Bureau), accessed 2026-10-12. Share of US firms using AI as of May 3, 2026, by firm size, and the question wording change.https://census.gov/library/stories/2026/05/ai-use-businesses.html
  29. Quality of data entry using single entry, double entry and automated forms processing (PLOS ONE), accessed 2026-10-12. Error proportions per 1,000 fields for three data entry methods.https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0035087
  30. Secrets Management Cheat Sheet (OWASP Cheat Sheet Series), accessed 2026-10-12. Centralized secrets, least privilege, rotation, no hardcoding, separate environments.https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
  31. Webhook Security Cheat Sheet (OWASP Cheat Sheet Series), accessed 2026-10-12. Signature checks, replay protection, idempotent processing of webhook deliveries.https://cheatsheetseries.owasp.org/cheatsheets/Webhook_Security_Cheat_Sheet.html
  32. LLM06:2025 Excessive Agency (OWASP GenAI Security Project), accessed 2026-10-12. Minimize tools and permissions, human approval for high-impact actions, authorization in downstream systems.https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
  33. Building effective agents (Anthropic), accessed 2026-10-12. Definitions of workflows and agents, advice to use the simplest solution.https://www.anthropic.com/engineering/building-effective-agents
  34. Data breach (business guidance) (Illinois Attorney General), accessed 2026-10-12. Who must disclose a data security breach concerning Illinois residents and how fast.https://illinoisattorneygeneral.gov/consumer-protection/for-businesses/data-breach/
  35. FTC Safeguards Rule: What Your Business Needs to Know (Federal Trade Commission), accessed 2026-10-12. Who is covered, required program elements and service provider oversight.https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
  36. CAN-SPAM Act: A Compliance Guide for Business (Federal Trade Commission), accessed 2026-10-12. Requirements for commercial email, opt-out handling and penalty per email.https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business
  37. FTC announces crackdown on deceptive AI claims and schemes (Federal Trade Commission), accessed 2026-10-12. Operation AI Comply and the statement that there is no AI exemption from existing laws.https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes

How we checked this page

Last verified 2026-10-12 · Media Express LLC

What we checked

  • Opened and read vendor pricing and documentation pages for n8n, Make and Zapier: billing units, hosting options, license text, retries, webhook limits and the Make API limits.
  • Opened the Model Context Protocol introduction, the specification overview and the authorization section, and the n8n and Make pages on MCP and the Zapier task rule for MCP calls.
  • Read the US Census Bureau's May 2026 article on Business Trends and Outlook Survey AI use and the 2012 PLOS ONE data entry study.
  • Read OWASP guidance on secrets management, webhook security and excessive agency, and Anthropic's engineering article on workflows and agents.
  • Read the Illinois Attorney General's data breach guidance, the FTC Safeguards Rule guide, the FTC CAN-SPAM guide and the FTC's 2024 AI enforcement announcement.

What we could not verify

  • The statute text of Illinois Personal Information Protection Act Section 45 (reasonable security measures and contract terms for disclosures): the Illinois General Assembly site refused automated access, so this page does not describe that section.
  • Whether n8n's license permits an agency to host n8n for a paying client: the page summarizes the license and tells you to ask, but does not interpret it.
  • Self-hosting for Make and Zapier beyond what their own pages state (an on-premise agent for Make Enterprise; managed cloud for Zapier). Confirm with the vendor.
  • Request limits for your own calls to the n8n and Zapier APIs, and Make plan prices beyond the free tier. No figure was found on the pages read.
  • A search summary suggested that Zapier developer documentation states a different per-user webhook figure than the help center article we opened; the help center figure is used.
  • Any dollar cost of manual re-entry: no source with a stated figure was found, so none is given.
  • Plan prices and limits change often. The vendor tables are as displayed on 2026-10-12.
  • We give no client results, timelines or prices of our own, and none were verified for publication.

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Tell us which process eats your week

Send us the process, who does it today and the tools involved. We reply with a short call and a written scope before anything is built.

We never ask for passwords or API keys here. Your message goes to the Media Express team; see the privacy notice. You can also call 773-800-1520 or use the full request form.