Managed Zitadel Hosting
for SaaS and software vendors.
Your own Zitadel instance with organizations as tenant boundaries, an immutable audit log and API-first administration. authhost operates an unchanged upstream build with PostgreSQL in your selected region.
- Organizations as built-in tenant boundaries
- Dedicated instance, not a shared tenant
- Billing without counting users
- contract term according to proposal
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
What Zitadel is built for
Zitadel is aimed at software vendors and SaaS providers that need to separate identities for their own customers by tenant.
- 01
Zitadel is written in Go, requires PostgreSQL and has no further dependency. The architecture is based on event sourcing with projections. Organizations are built in as tenant boundaries, the audit log is complete and immutable, and every console function can also be automated.
- 02
Since version 3 on 31 March 2025, Zitadel has been AGPL-3.0 licensed, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes AGPL hosting permissible and does not trigger a disclosure obligation beyond the public upstream. White-labelling uses Zitadel's own branding settings and is configuration, not a code change.
- 03
Zitadel is intended for SaaS tenants, not primarily for conventional mid-sized companies. authhost also operates Authentik and Keycloak for those differing needs. If the requirement changes, switching the identity provider does not require switching the operations provider.
What your Zitadel instance can do
The focus is tenant separation, traceable changes and complete automation.
Organizations
Organizations are built in as tenant boundaries and structure the customers of a software vendor or SaaS provider.
Immutable audit log
Event sourcing creates a complete and immutable audit log.
API-first
Everything available in the console can also be carried out through automation.
Event sourcing with projections
Events and projections form the basis of Zitadel's architecture.
White-labelling by configuration
Zitadel's own branding settings enable white-labelling without changing the source code.
Unchanged upstream build
authhost operates the publicly available upstream builds without its own code changes.
Transparent pricing. No surprises.
Instance and service level under WZ-IT terms. Germany is the standard location; other locations on request.
Select Region
Included in every tier
Features
- SSO via OIDC and OAuth2
- Organizations with no count limit
- Complete audit log through event sourcing
- API-first: everything from the console, automated too
- Branding per organization
- Billing without counting active users
- MFA: TOTP, WebAuthn and passkeys
- SAML 2.0 as identity provider and for federation
- SCIM v2 for users (preview, without group provisioning)
The feature scope follows the respective open source project and can change with new releases. The official documentation is authoritative; all details without warranty: zitadel.com/docs
Included in the hosting
- Dedicated instance, no shared hosting
- Users with no count limit
- Subdomain included (*.authhost.de)
- Your own domain possible
- PostgreSQL included
Operations
Operations, updates and backups within the agreed scope · 24/7 automated monitoring · Standard hosted-workload availability: 99.9% per month · Germany as the standard location · Data processing agreement · Setup and contract term defined in the proposal
Choose your support
Essential, Business and Priority apply during defined service windows. Production and Critical add round-the-clock response to P1 incidents. Business and higher levels include a monthly operations allowance for planned technical work.
Choose your instance size
The size determines compute and memory, not the feature scope. When a size stops being enough, we move you up during operation.
S
Instance sizeexcl. VAT · incl. support Essential
- 2 vCPU
- 4 GB RAM
- 80 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
M
Instance sizeexcl. VAT · incl. support Essential
- 4 vCPU
- 8 GB RAM
- 160 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
L
Instance sizeexcl. VAT · incl. support Essential
- 8 vCPU
- 16 GB RAM
- 240 GB NVMe
- 5 TB Traffic
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Compute and service level are selected independently. Actual resource requirements are assessed before quoting.
Hosting and additional project work are agreed separately. WZ-IT service levels and published support terms apply. Explore expert support
All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers.
Business, Priority, Production and Critical include the first covered workload in a customer environment. Further covered workloads cost 29.90 €, 49.90 €, 69.90 € and 99.90 € per month respectively.
The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
All WZ-IT service levels and incident rulesWhat matters in Zitadel operations
Zitadel releases new versions more frequently than the other two products. Potential projection rebuilds also require ongoing attention.
Go and PostgreSQL
Zitadel is written in Go and requires PostgreSQL. No further dependencies are added for operating the application.
Regular minor releases
Minor releases arrive every two to four weeks. Updates therefore need regular assessment and planning.
Two active major branches
In July 2026, the v4.16.2 and v3.4.14 major branches were maintained in parallel.
Projection rebuilds
Upgrades can require projection rebuilds. On large instances, these processes can take time.
Backups and monitoring
Automatic backups stay in the same region as the instance. 24/7 monitoring watches ongoing operations.
Availability and support
Essential: Initial technical response to critical incidents (P1) by the end of the next business day, Mon-Fri, 08:00-17:00 CET/CEST · Business: Initial technical response to critical incidents (P1) within 4 service hours, Mon-Fri, 08:00-18:00 CET/CEST · Priority: Initial technical response to critical incidents (P1) within 1 service hour, Mon-Fri, 08:00-18:00 CET/CEST · Production: Initial technical response to critical incidents (P1) within 60 minutes, 24/7, P1 around the clock · Critical: Initial technical response to critical incidents (P1) within 30 minutes, 24/7, including callback, P1 around the clock. Production and Critical require technical acceptance. Critical is capacity-limited. Response targets apply to P1 incidents through the agreed ticket system, not to every request or a guaranteed resolution time. The flexible operations allowance applies to planned work during regular service hours and expires at month end. Operations, monitoring, backups, maintenance and updates within the agreed scope do not reduce it. Additional and incident work costs €120 net per hour in 6-minute increments during regular service hours and €240 net per started hour outside them.
Data location and processing
Germany is the standard location. Other locations and their operating conditions are assessed on request before quoting. Location, backup destinations and responsibilities are documented.
You can choose Germany, the Netherlands, the USA, Canada, Singapore, Japan, Australia or India. Every customer instance is dedicated and is not operated as a shared tenant.
The data processing agreement under Article 28 GDPR is included in every plan. Automatic backups remain in the same region as the Zitadel instance.
How you get to your Zitadel instance
From signup to the first connected application it takes four steps.
- 1
Start the instance
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
- 2
Create organizations
One organization per end customer, the way the product intends. The number is not capped, because the instance is yours alone.
- 3
Connect an application
Connect project and application via OIDC or OAuth2. Everything the console can do also works through the API, including creating organizations.
- 4
Hand over operations
After the trial the instance converts automatically to the selected plan. Updates, backups and monitoring are ours from then on.
Hosting by WZ-IT
One team for your hosting and everything running on it.
authhost is a hosting service by WZ-IT. We connect infrastructure, software and ongoing operations. Timo and Robin discuss your requirements and agree who is responsible for what.
- Directly with Timo and Robin - no sales handoff
- Operations and support under the agreed WZ-IT service levels
- Managed IAM hosting; IAM migration and application integrations are not included
A WZ-IT team consultation to get acquainted and discuss your requirements.
More about WZ-IT
Read on
Managed Authentik hosting
For conventional mid-sized companies that need central sign-in and a managed dedicated instance.
Managed Keycloak hosting
For SAML, eIDAS, AD federation and multi-tenant requirements.
Which identity provider fits?
Authentik, Authelia and Keycloak compared directly with a decision matrix.
Frequently asked questions about managed Zitadel hosting
What does managed Zitadel hosting cost?+
S: from 129.90 € · M: from 159.80 € · L: from 219.80 € net per month with Essential. Higher service levels follow WZ-IT terms and include the first registered workload. Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Who is Zitadel suitable for?+
Zitadel is aimed at software vendors and SaaS providers that need multi-tenancy for their own customers. Organizations are built in as the tenant boundary. Within the authhost portfolio, Authentik is intended for conventional mid-sized companies.
What are the effects of the AGPL-3.0 licence?+
Zitadel has been AGPL-3.0 licensed since version 3 on 31 March 2025, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes the hosting permissible and does not trigger a disclosure obligation beyond the public upstream.
Is white-labelling possible?+
Yes. Zitadel's own branding settings provide white-labelling as configuration. No code change is required.
What needs attention during Zitadel upgrades?+
Minor releases arrive every two to four weeks. In July 2026, v4.16.2 and v3.4.14 were maintained in parallel. Upgrades can require projection rebuilds that take time on large instances.
Where are data and backups stored?+
The default region is Germany, in data centers with ISO 27001 and BSI C5. Seven further regions are available. Automatic backups stay in the same region as the instance.
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.+
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
Have your Zitadel instance sized
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.