Managed Zitadel Hosting
for SaaS and software vendors.
Your own Zitadel instance with organizations as tenant boundaries, an immutable audit log and API-first administration. authhost operates an unchanged upstream build with PostgreSQL in your selected region.
- Organizations as built-in tenant boundaries
- Dedicated instance, not a shared tenant
- Billing without counting users
- Cancel monthly
Your instance is ready within 5 minutes of ordering in the portal.
7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.
What Zitadel is built for
Zitadel is aimed at software vendors and SaaS providers that need to separate identities for their own customers by tenant.
- 01
Zitadel is written in Go, requires PostgreSQL and has no further dependency. The architecture is based on event sourcing with projections. Organizations are built in as tenant boundaries, the audit log is complete and immutable, and every console function can also be automated.
- 02
Since version 3 on 31 March 2025, Zitadel has been AGPL-3.0 licensed, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes AGPL hosting permissible and does not trigger a disclosure obligation beyond the public upstream. White-labelling uses Zitadel's own branding settings and is configuration, not a code change.
- 03
Zitadel is intended for SaaS tenants, not primarily for conventional mid-sized companies. authhost also operates Authentik and Keycloak for those differing needs. If the requirement changes, switching the identity provider does not require switching the operations provider.
What your Zitadel instance can do
The focus is tenant separation, traceable changes and complete automation.
Organizations
Organizations are built in as tenant boundaries and structure the customers of a software vendor or SaaS provider.
Immutable audit log
Event sourcing creates a complete and immutable audit log.
API-first
Everything available in the console can also be carried out through automation.
Event sourcing with projections
Events and projections form the basis of Zitadel's architecture.
White-labelling by configuration
Zitadel's own branding settings enable white-labelling without changing the source code.
Unchanged upstream build
authhost operates the publicly available upstream builds without its own code changes.
Transparent pricing. No surprises.
Start your own instance in 5 minutes. No per-user fees in any plan.
Select Region
Included in every tier
Features
- SSO via OIDC and OAuth2
- Organizations with no count limit
- Complete audit log through event sourcing
- API-first: everything from the console, automated too
- Branding per organization
- Billing without counting active users
- MFA: TOTP, WebAuthn and passkeys
- SAML 2.0 as identity provider and for federation
- SCIM v2 for users (preview, without group provisioning)
The feature scope follows the respective open source project and can change with new releases. The official documentation is authoritative; all details without warranty: zitadel.com/docs
Included in the hosting
- Dedicated instance, no shared hosting
- Users with no count limit
- Subdomain included (*.authhost.de)
- Your own domain possible
- PostgreSQL included
Operations
Automatic backups and updates · 24/7 monitoring · 99.9 % availability commitment · Hosted in Germany · Data processing agreement included · No setup fee, cancel monthly
Choose your support
Everything above is included in every tier. You only decide how quickly we are available.
Choose your instance size
The size determines compute and memory, not the feature scope. When a size stops being enough, we move you up during operation.
S
Instance sizeexcl. VAT · incl. support Essential
- 2 vCPU
- 4 GB RAM
- 80 GB NVMe
- 20 TB traffic
Your instance is ready within 5 minutes of ordering in the portal.
7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.
M
Instance sizeexcl. VAT · incl. support Essential
- 4 vCPU
- 8 GB RAM
- 160 GB NVMe
- 20 TB traffic
Your instance is ready within 5 minutes of ordering in the portal.
7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.
L
Instance sizeexcl. VAT · incl. support Essential
- 8 vCPU
- 16 GB RAM
- 320 GB NVMe
- 20 TB traffic
Your instance is ready within 5 minutes of ordering in the portal.
7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.
Outside Germany, size L has 6 instead of 8 vCPU; the other specs are identical.
Hosting alone if that is all you need. Additional help from Timo and the WZ-IT expert network when needed, at reduced hourly and daily rates for hosting customers. Explore expert support
All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers.
What matters in Zitadel operations
Zitadel releases new versions more frequently than the other two products. Potential projection rebuilds also require ongoing attention.
Go and PostgreSQL
Zitadel is written in Go and requires PostgreSQL. No further dependencies are added for operating the application.
Regular minor releases
Minor releases arrive every two to four weeks. Updates therefore need regular assessment and planning.
Two active major branches
In July 2026, the v4.16.2 and v3.4.14 major branches were maintained in parallel.
Projection rebuilds
Upgrades can require projection rebuilds. On large instances, these processes can take time.
Backups and monitoring
Automatic backups stay in the same region as the instance. 24/7 monitoring watches ongoing operations.
Availability and support
The availability commitment is 99.9 % on every size. Support responds within 24 hours on Essential, 4 hours on Business, 1 hour on Priority or 60 minutes around the clock on Enterprise, depending on the tier.
Data location and processing
The German region runs in data centers with ISO 27001 and BSI C5. The other seven regions run in data centers with ISO 27001 and SOC 2 Type II. Germany is the default region.
You can choose Germany, the Netherlands, the USA, Canada, Singapore, Japan, Australia or India. Every customer instance is dedicated and is not operated as a shared tenant.
The data processing agreement under Article 28 GDPR is included in every plan. Automatic backups remain in the same region as the Zitadel instance.
How you get to your Zitadel instance
From signup to the first connected application it takes four steps.
- 1
Start the instance
Pick size, support tier and region, the instance is provisioned. The trial runs for 7 days and a credit card is required at signup.
- 2
Create organizations
One organization per end customer, the way the product intends. The number is not capped, because the instance is yours alone.
- 3
Connect an application
Connect project and application via OIDC or OAuth2. Everything the console can do also works through the API, including creating organizations.
- 4
Hand over operations
After the trial the instance converts automatically to the selected plan. Updates, backups and monitoring are ours from then on.
Managed hosting with direct access to expertise
IAM hosting with a direct point of contact.
Founder, merkaio
LinkedIn profileAt authhost, you book managed hosting for Authentik, Keycloak or Zitadel. Discuss instance sizing and operations directly with me, Timo Wevelsiep. We do not currently offer IAM migrations or the transfer of existing users or application integrations.
I have delivered hundreds of complex infrastructure, IoT and networking projects. As managing director of WZ-IT, I bring that experience to your project and can involve our expert network across infrastructure, cloud, IoT and networking.
A clear scope for your operations
We operate your dedicated instance. Your identity workflows, user directories and connected applications remain the responsibility of your team or implementation partner.
Hosting support is subject to the response times and service hours of your selected support tier.
Discuss hosting with TimoA 15-minute introductory call to discuss your requirements.
Read on
Managed Authentik hosting
For conventional mid-sized companies that need central sign-in and a managed dedicated instance.
Managed Keycloak hosting
For SAML, eIDAS, AD federation and multi-tenant requirements.
Which identity provider fits?
Authentik, Authelia and Keycloak compared directly with a decision matrix.
Frequently asked questions about managed Zitadel hosting
What does managed Zitadel hosting cost?+
Managed Zitadel hosting starts at €99.90 net per month in Germany with size S, and at €119.90 in the other regions. Billing does not count users, and you select the instance size and support tier to match your requirements. There is no setup fee, the subscription can be cancelled monthly, and the data processing agreement is included.
Who is Zitadel suitable for?+
Zitadel is aimed at software vendors and SaaS providers that need multi-tenancy for their own customers. Organizations are built in as the tenant boundary. Within the authhost portfolio, Authentik is intended for conventional mid-sized companies.
What are the effects of the AGPL-3.0 licence?+
Zitadel has been AGPL-3.0 licensed since version 3 on 31 March 2025, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes the hosting permissible and does not trigger a disclosure obligation beyond the public upstream.
Is white-labelling possible?+
Yes. Zitadel's own branding settings provide white-labelling as configuration. No code change is required.
What needs attention during Zitadel upgrades?+
Minor releases arrive every two to four weeks. In July 2026, v4.16.2 and v3.4.14 were maintained in parallel. Upgrades can require projection rebuilds that take time on large instances.
Where are data and backups stored?+
The default region is Germany, in data centers with ISO 27001 and BSI C5. Seven further regions are available. Automatic backups stay in the same region as the instance.
How does the 7-day period work?+
The trial runs for 7 days. A credit card is required at signup, and when the trial ends it converts automatically into the selected paid subscription. If you do not want to continue, cancel beforehand.
Have your Zitadel instance sized
Discuss organizations, region and availability requirements with us. The trial runs for 7 days, a credit card is required, and it then converts automatically into the selected paid subscription.
Your instance is ready within 5 minutes of ordering in the portal.
7-day trial. Credit card required. Automatically becomes a paid subscription unless you cancel beforehand. Cancel monthly.