Managed Authentik hosting
with SSO, MFA and application proxy.
Your own Authentik instance, operated rather than maintained by you. Single sign-on, MFA and user management for your applications, without anyone on your side looking after PostgreSQL, Redis and worker containers.
- Dedicated instance, not a shared tenant
- No per-user fees
- Data processing agreement included
- contract term according to proposal
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
What Authentik is built for
An identity provider is the place where your people sign in once and get into everything afterwards. Authentik is the open source version of that.
- 01
Instead of maintaining separate accounts in every application, there is one directory. Whoever is disabled there is locked out everywhere, immediately and verifiably. That is the point where identity management stops being a convenience topic and becomes a question of access control.
- 02
Authentik speaks the protocols that matter: OAuth2 and OpenID Connect for modern applications, SAML 2.0 for everything that grew historically inside companies, and an LDAP outpost for software that speaks neither. Through the application proxy, even applications without any login of their own can be protected.
- 03
With per-user billing, the invoice grows with the team. Authentik is open source under the MIT licence and requires no user licence. At authhost, the price is based on instance size and support tier.
What your instance can do
The full scope of the open source version. None of it is locked behind a plan with us.
Single sign-on
One login for every application, via OAuth2, OpenID Connect, SAML 2.0 or proxy-based authentication. Federation to Google, Entra ID or GitHub included.
Multi-factor authentication
TOTP, WebAuthn and passkeys, plus email OTP. Optionally SMS via Twilio and Duo. Passkeys are the move away from SMS that Microsoft is making as well.
LDAP outpost
A full LDAP server as an outpost. It connects legacy applications that speak neither OIDC nor SAML, without touching their code.
SCIM provisioning
Users are created, updated and deactivated automatically in connected systems. The lifecycle runs through one place instead of ten interfaces.
RADIUS outpost
Authentication for VPN, Wi-Fi and switches against the same directory. No second user base for the network layer.
Application proxy
Applications without their own login get authentication placed in front of them. Internal tools become publishable without being rebuilt.
Configurable flows
Login, registration and password reset are assembled as a flow rather than programmed. Conditions such as mandatory MFA for certain groups are part of it.
Audit logs
Every authentication event is logged and can be exported, for example into a SIEM. For evidence under ISO 27001 or NIS2 that is the basis.
Your own branding
Login pages with your logo, your colours and your wording. Configured in the interface, no code changes involved.
Transparent pricing. No surprises.
Instance and service level under WZ-IT terms. Germany is the standard location; other locations on request.
Select Region
Included in every tier
Features
- SSO via OIDC, OAuth2 and SAML 2.0
- MFA: TOTP, WebAuthn and passkeys, email OTP
- LDAP outpost for legacy applications
- RADIUS outpost for VPN, Wi-Fi and switches
- SCIM provisioning
- Application proxy for apps without their own login
- Remote access gateway for RDP, SSH and VNC
- Flows, policies and user directory
- Federation to Google, Entra ID and GitHub
The feature scope follows the respective open source project and can change with new releases. The official documentation is authoritative; all details without warranty: docs.goauthentik.io
Included in the hosting
- Dedicated instance, no shared hosting
- Users with no count limit
- Subdomain included (*.authhost.de)
- Your own domain possible
- PostgreSQL included
Operations
Operations, updates and backups within the agreed scope · 24/7 automated monitoring · Standard hosted-workload availability: 99.9% per month · Germany as the standard location · Data processing agreement · Setup and contract term defined in the proposal
Choose your support
Essential, Business and Priority apply during defined service windows. Production and Critical add round-the-clock response to P1 incidents. Business and higher levels include a monthly operations allowance for planned technical work.
Choose your instance size
The size determines compute and memory, not the feature scope. When a size stops being enough, we move you up during operation.
S
Instance sizeexcl. VAT · incl. support Essential
- 2 vCPU
- 4 GB RAM
- 80 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
M
Instance sizeexcl. VAT · incl. support Essential
- 4 vCPU
- 8 GB RAM
- 160 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
L
Instance sizeexcl. VAT · incl. support Essential
- 8 vCPU
- 16 GB RAM
- 240 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Compute and service level are selected independently. Actual resource requirements are assessed before quoting.
Hosting and additional project work are agreed separately. WZ-IT service levels and published support terms apply. Explore expert support
All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers.
Business, Priority, Production and Critical include the first covered workload in a customer environment. Further covered workloads cost 29.90 €, 49.90 €, 69.90 € and 99.90 € per month respectively.
The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
All WZ-IT service levels and incident rulesWhat operations include
Running Authentik yourself is doable. What costs time is not the installation, it is everything after it.
Updates across the stack
Authentik ships monthly. What gets patched is the application, PostgreSQL, Redis and the worker containers, not just the obvious piece.
Automatic backups
Backups run automatically and stay in the same region as the instance. An identity provider without a working restore is a single point of failure.
24/7 monitoring
Availability and system metrics are monitored continuously. When login fails, everything on your side stops, which makes this the most critical component in the house.
99.9 % SLA
Essential: Initial technical response to critical incidents (P1) by the end of the next business day, Mon-Fri, 08:00-17:00 CET/CEST · Business: Initial technical response to critical incidents (P1) within 4 service hours, Mon-Fri, 08:00-18:00 CET/CEST · Priority: Initial technical response to critical incidents (P1) within 1 service hour, Mon-Fri, 08:00-18:00 CET/CEST · Production: Initial technical response to critical incidents (P1) within 60 minutes, 24/7, P1 around the clock · Critical: Initial technical response to critical incidents (P1) within 30 minutes, 24/7, including callback, P1 around the clock. Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time. The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Your own domain and certificates
A subdomain under authhost.de is included, your own domain with your own certificate on request. The login page then carries your name.
No lock-in
Authentik is MIT licensed. A complete export including the database is available at any time, and the path back to self-operation stays open.
Data location and processing
Germany is the standard location. Other locations and their operating conditions are assessed on request before quoting. Location, backup destinations and responsibilities are documented.
An identity provider holds personal data by definition: names, email addresses, group memberships and the full login history. That makes you the controller and us the processor. A data processing agreement under Article 28 GDPR is part of every plan and also governs who can access your instance administratively, and under which conditions.
Inside the EU, Germany and the Netherlands avoid a third-country transfer entirely. Outside the EU the choice of region becomes a compliance decision, one we walk through with you before you start.
How you get to your instance
From signup to the first connected application it takes four steps.
- 1
Start the instance
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
- 2
Create or connect users
Create users manually, import them from an existing source, or federate to Entra ID, Google or an existing LDAP directory.
- 3
Connect the first application
Create a provider, put client ID and secret into the application, done. For applications without their own login, the application proxy takes over.
- 4
Hand over operations
After the trial the instance converts automatically to the selected plan. Updates, backups and monitoring are ours from then on.
Hosting by WZ-IT
One team for your hosting and everything running on it.
authhost is a hosting service by WZ-IT. We connect infrastructure, software and ongoing operations. Timo and Robin discuss your requirements and agree who is responsible for what.
- Directly with Timo and Robin - no sales handoff
- Operations and support under the agreed WZ-IT service levels
- Managed IAM hosting; IAM migration and application integrations are not included
A WZ-IT team consultation to get acquainted and discuss your requirements.
More about WZ-IT
Read on
Which identity provider fits?
Authentik, Authelia and Keycloak compared directly, with a decision matrix rather than a winner.
Managed Keycloak hosting
When you need SAML federation, realms as a tenant boundary, or deep AD integration.
Managed Zitadel hosting
For software vendors with a tenant structure: organizations, event log and API-first.
Frequently asked questions about managed Authentik hosting
What does managed Authentik hosting cost?+
Essential: Initial technical response to critical incidents (P1) by the end of the next business day, Mon-Fri, 08:00-17:00 CET/CEST · Business: Initial technical response to critical incidents (P1) within 4 service hours, Mon-Fri, 08:00-18:00 CET/CEST · Priority: Initial technical response to critical incidents (P1) within 1 service hour, Mon-Fri, 08:00-18:00 CET/CEST · Production: Initial technical response to critical incidents (P1) within 60 minutes, 24/7, P1 around the clock · Critical: Initial technical response to critical incidents (P1) within 30 minutes, 24/7, including callback, P1 around the clock. Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time. The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
How many users does a plan support?+
Authentik itself has no user limit; there is no licence counting seats. The constraint is how the instance is sized: CPU, memory and above all login volume. That is why the plans state the specification rather than a guessed user count. When a size stops carrying the load, we move you up during operation.
Do you offer IAM migrations?+
No. Our current offer is managed hosting for Authentik, Keycloak and Zitadel. Migrating existing users, permissions and application integrations is not part of our service.
Do I get a data processing agreement?+
WZ-IT agrees requirements and scope with you and provisions the instance after commissioning. Access and operations documentation are provided at handover.
Which applications can I connect?+
Anything speaking OAuth2, OpenID Connect or SAML 2.0, which covers the large majority of modern software. For legacy applications there is the LDAP outpost, for network gear the RADIUS outpost, and for applications with no login at all the application proxy. In practice, little is left that cannot be connected.
What happens if Authentik goes down?+
Then nobody gets into the connected applications, which is the uncomfortable truth about centralised login. That is why every size carries a 99.9 % availability commitment, plus 24/7 monitoring. For emergencies, keep a local break-glass administrator in your critical systems; we recommend that regardless of provider.
Where is the data stored?+
In the default configuration, Germany, in data centers with ISO 27001 and BSI C5. Seven further regions are available. This covers the instance itself, the PostgreSQL database holding users and login history, and the automatic backups.
How are a pilot and contract start agreed?+
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
Have Authentik operated for you
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.