Managed Zitadel Hosting
for SaaS and software vendors.
Your own Zitadel instance with organizations as tenant boundaries, an immutable audit log and API-first administration. authhost operates an unchanged upstream build with PostgreSQL in your selected region.
- Organizations as built-in tenant boundaries
- Dedicated instance, not a shared tenant
- Billing without counting users
- Cancel monthly
What Zitadel is built for
Zitadel is aimed at software vendors and SaaS providers that need to separate identities for their own customers by tenant.
- 01
Zitadel is written in Go, requires PostgreSQL and has no further dependency. The architecture is based on event sourcing with projections. Organizations are built in as tenant boundaries, the audit log is complete and immutable, and every console function can also be automated.
- 02
Since version 3 on 31 March 2025, Zitadel has been AGPL-3.0 licensed, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes AGPL hosting permissible and does not trigger a disclosure obligation beyond the public upstream. White-labelling uses Zitadel's own branding settings and is configuration, not a code change.
- 03
Zitadel is intended for SaaS tenants, not primarily for conventional mid-sized companies. authhost also operates Authentik and Keycloak for those differing needs. If the requirement changes, switching the identity provider does not require switching the operations provider.
What your Zitadel instance can do
The focus is tenant separation, traceable changes and complete automation.
Organizations
Organizations are built in as tenant boundaries and structure the customers of a software vendor or SaaS provider.
Immutable audit log
Event sourcing creates a complete and immutable audit log.
API-first
Everything available in the console can also be carried out through automation.
Event sourcing with projections
Events and projections form the basis of Zitadel's architecture.
White-labelling by configuration
Zitadel's own branding settings enable white-labelling without changing the source code.
Unchanged upstream build
authhost operates the publicly available upstream builds without its own code changes.
Transparent pricing. No surprises.
Start your own instance in 5 minutes. No per-user fees in any plan.
Select Region
Support
S
Instance sizeexcl. VAT
- 2 vCPU
- 4 GB RAM
- 80 GB NVMe
- 20 TB traffic
Support: Standard
- 24-hour response
- Mon to Fri, 08:00 to 17:00 CET/CEST
- Ticket system, intake by email
7-day trial. Credit card required, converts to a paid plan automatically, cancel monthly.
M
Instance sizeexcl. VAT
- 4 vCPU
- 8 GB RAM
- 160 GB NVMe
- 20 TB traffic
Support: Standard
- 24-hour response
- Mon to Fri, 08:00 to 17:00 CET/CEST
- Ticket system, intake by email
7-day trial. Credit card required, converts to a paid plan automatically, cancel monthly.
L
Instance sizeexcl. VAT
- 8 vCPU
- 16 GB RAM
- 320 GB NVMe
- 20 TB traffic
Support: Standard
- 24-hour response
- Mon to Fri, 08:00 to 17:00 CET/CEST
- Ticket system, intake by email
7-day trial. Credit card required, converts to a paid plan automatically, cancel monthly.
The instance is sized to your use case. When a size stops being enough, we move you up during operation. Outside Germany, size L has 6 instead of 8 vCPU; the other specs are identical.
Features
- SSO via OIDC and OAuth2
- Organizations with no count limit
- Complete audit log through event sourcing
- API-first: everything from the console, automated too
- Branding per organization
- Billing without counting active users
- MFA: TOTP, WebAuthn and passkeys
Included in every size
- Dedicated instance, no shared hosting
- Users with no count limit
- Subdomain included (*.authhost.de)
- Your own domain possible
- PostgreSQL included
- 99.9 % availability commitment
- Automatic backups and updates
- 24/7 monitoring
- Hosted in Germany
- Data processing agreement included
- No setup fee, cancel monthly
All prices are net, plus statutory VAT. This offer is directed exclusively at businesses within the meaning of § 14 German Civil Code, not at consumers.
What matters in Zitadel operations
Zitadel releases new versions more frequently than the other two products. Potential projection rebuilds also require ongoing attention.
Go and PostgreSQL
Zitadel is written in Go and requires PostgreSQL. No further dependencies are added for operating the application.
Regular minor releases
Minor releases arrive every two to four weeks. Updates therefore need regular assessment and planning.
Two active major branches
In July 2026, the v4.16.2 and v3.4.14 major branches were maintained in parallel.
Projection rebuilds
Upgrades can require projection rebuilds. On large instances, these processes can take time.
Backups and monitoring
Automatic backups stay in the same region as the instance. 24/7 monitoring watches ongoing operations.
Availability and support
The availability commitment is 99.9 % on every size. Support responds within 24 hours, 4 hours or 30 minutes, depending on the tier.
authhost and Zitadel Cloud compared
The vendor is both licensor and competitor. The difference lies in instance, billing and contracting party.
| authhost | Zitadel Cloud | |
|---|---|---|
| Instance | Dedicated | Shared tenant |
| Price | from 99.90 € net | Free up to 100 DAU, Pro 100 USD with 25,000 DAU |
| Billing | Per instance size | By monthly active users |
| Organizations | No count limit | Per plan |
| Data location | Germany, 7 further regions | EU, USA, Switzerland |
| Contracting party | German company, DPA in German | Swiss provider |
Zitadel Cloud figures per the vendor's public information, as of 2 August 2026. Honestly: below roughly 25,000 monthly active users, Zitadel Cloud is cheaper. Moving pays off when user numbers grow, when the instance should not be shared, or when a German processor is required.
Data location and processing
The German region runs in data centers with ISO 27001 and BSI C5. The other seven regions run in data centers with ISO 27001 and SOC 2 Type II. Germany is the default region.
You can choose Germany, the Netherlands, the USA, Canada, Singapore, Japan, Australia or India. Every customer instance is dedicated and is not operated as a shared tenant.
The data processing agreement under Article 28 GDPR is included in every plan. Automatic backups remain in the same region as the Zitadel instance.
How you get to your Zitadel instance
From signup to the first connected application it takes four steps.
- 1
Start the instance
Pick size, support tier and region, the instance is provisioned. The trial runs for 7 days and a credit card is required at signup.
- 2
Create organizations
One organization per end customer, the way the product intends. The number is not capped, because the instance is yours alone.
- 3
Connect an application
Connect project and application via OIDC or OAuth2. Everything the console can do also works through the API, including creating organizations.
- 4
Hand over operations
After the trial the instance converts automatically to the selected plan. Updates, backups and monitoring are ours from then on.
Read on
Managed Authentik hosting
For conventional mid-sized companies that need central sign-in and a managed dedicated instance.
Managed Keycloak hosting
For SAML, eIDAS, AD federation and multi-tenant requirements.
Which identity provider fits?
Authentik, Authelia and Keycloak compared directly with a decision matrix.
Frequently asked questions about managed Zitadel hosting
What does managed Zitadel hosting cost?+
The price is set after technical sizing of the dedicated instance and agreed through direct contact. Billing does not count users. There is no setup fee, the subscription can be cancelled monthly, and the data processing agreement is included.
Who is Zitadel suitable for?+
Zitadel is aimed at software vendors and SaaS providers that need multi-tenancy for their own customers. Organizations are built in as the tenant boundary. Within the authhost portfolio, Authentik is intended for conventional mid-sized companies.
What are the effects of the AGPL-3.0 licence?+
Zitadel has been AGPL-3.0 licensed since version 3 on 31 March 2025, after previously using Apache-2.0. authhost operates unchanged upstream builds exclusively. This makes the hosting permissible and does not trigger a disclosure obligation beyond the public upstream.
Is white-labelling possible?+
Yes. Zitadel's own branding settings provide white-labelling as configuration. No code change is required.
When is Zitadel Cloud less expensive?+
Below roughly 25,000 monthly active users, Zitadel Cloud is less expensive. Its Pro plan costs 100 USD per month and includes 25,000 DAU and a 99.95 % SLA. authhost differs through a dedicated instance, billing without counting users, and a German processor with a German-language data processing agreement.
What needs attention during Zitadel upgrades?+
Minor releases arrive every two to four weeks. In July 2026, v4.16.2 and v3.4.14 were maintained in parallel. Upgrades can require projection rebuilds that take time on large instances.
Where are data and backups stored?+
The default region is Germany, in data centers with ISO 27001 and BSI C5. Seven further regions are available. Automatic backups stay in the same region as the instance.
How does the 7-day period work?+
The trial runs for 7 days. A credit card is required at signup, and when the trial ends it converts automatically into the selected paid subscription. If you do not want to continue, cancel beforehand.
Have your Zitadel instance sized
Discuss organizations, region and availability requirements with us. The trial runs for 7 days, a credit card is required, and it then converts automatically into the selected paid subscription.