WZ-IT runs ZITADEL as a dedicated instance in data centres in Germany, Switzerland or Austria, with updates, daily backups, 24/7 monitoring and a personal contact. On request, we also install ZITADEL in your cloud or on premises.
ZITADEL is an open-source platform for identity and access management. It supports OpenID Connect, OAuth 2.0, SAML 2.0, SCIM, passkeys and multi-tenancy through organizations and virtual instances. State is kept as an event store in PostgreSQL, the server itself is stateless.
Operations come down to PostgreSQL (versions 14 to 18), HTTP/2 at the reverse proxy, the external domain, event store backups and controlled upgrades. When moving from version 3 to 4, OIDC web keys must be active beforehand, otherwise existing tokens become invalid.
The core has been under AGPL-3.0 since version 3, the Login V2 interface and the SDKs under MIT. We run the unmodified upstream.
OpenID Connect and OAuth 2.0
Certified OIDC plus device authorization, client credentials, JWT profile and token exchange for applications, APIs and machines.
SAML 2.0
ZITADEL provides SAML as an identity provider and connects external identity providers via OIDC or SAML.
SCIM 2.0
A SCIM interface for managing users. The documentation currently lists it as a preview.
Passkeys and MFA
Passkeys (WebAuthn/FIDO2), authenticator apps (TOTP), U2F and one-time codes by email or SMS.
Multi-tenancy
Organizations with their own branding, identity providers and administrators, plus fully separated virtual instances.
Event store and audit
Changes are stored as immutable events and can be queried through the events API or forwarded to a SIEM.
Actions
Custom logic via webhook or custom code, for example for token enrichment, validation or connecting business systems.
Login V2 and branding
The hosted login interface can be styled per organization. On existing instances, switching to Login V2 is optional.
Licence
License
The ZITADEL core has been under AGPL-3.0 since version 3 (May 2025), earlier versions under Apache-2.0. The vendor's LICENSING.md names no additional restriction for running the unmodified code. Anyone who modifies the code and offers the instance over a network must disclose the changes under the AGPL or buy a commercial license from the vendor.
Operations beyond installation
Operating ZITADEL as critical identity infrastructure
If login fails, every connected application is affected. That is why we treat ZITADEL, PostgreSQL, reverse proxy, domain and keys as one system.
Identity platform
ZITADEL, PostgreSQL and configuration are built reproducibly, with separate phases for init, setup and start.
Protocols and federation
OIDC, OAuth 2.0, SAML and external identity providers are integrated and tested in a controlled way.
Organizations and roles
Organizations, projects, roles, actions and MFA are agreed with the application teams.
Operations and recoverability
Monitoring, event store backups, upgrades with a pre-check and emergency access secure operations.
Area
Responsibility in the identity architecture
We run the platform and integrate systems; business roles and permissions stay with the customer.
Area
Responsibility
Scope and boundaries
Architecture and ZITADEL platform
WZ-IT
Sizing and operation of ZITADEL, PostgreSQL, reverse proxy and agreed cluster components.
Updates and monitoring
WZ-IT
Controlled version changes, technical monitoring and incident handling according to the service level.
Backups and recovery
WZ-IT
Backup of the database with the event store and the relevant keys, plus scheduled restore checks.
Applications and protocol integration
Shared
WZ-IT configures clients and flows, application teams test login, logout and error cases.
External identity providers and directories
Shared
Connection, attributes and groups are agreed together.
Role and permission model
Customer
The customer is responsible for business roles, approvals and the legitimacy of access.
Actions and custom development
Optional WZ-IT service
Custom actions, login adjustments and deep integrations can be developed and tested separately.
Infrastructure, integration and operations
ZITADEL as part of your infrastructure
We do more than provide an application. WZ-IT designs the technical architecture, integrates network and identity, operates the agreed scope and develops integrations when the standard product is not enough.
Architecture and migration
Sizing, target environment, data transfer, cutover and recovery are resolved before production operations.
On-Premise
In your data center: Installation on bare-metal, VM or Docker · Integration with existing Active Directory/LDAP
Installation in your cloud
In your own cloud account, for example with AWS, Azure, GCP or Hetzner · Terraform/IaC setup (optional) · Kubernetes or Docker Compose · Capacity and scaling design
Enterprise Setup
Advanced architecture after technical and licence assessment: HA and recovery design where supported by the application and edition · Logging according to feature set and edition · Custom security policies
Network and identity
SSO, secure access, internal systems and existing security components are integrated appropriately.
VPN Access
WireGuard, NetBird, Tailscale, Headscale, OpenVPN, Cloudflare Tunnel · Easy client setup for all devices
SSO Integration
Directly or through an upstream identity layer
Multi-Factor Auth
Depends on application, edition and identity provider
Firewall & Hardening
Fail2Ban, Rate Limiting, IP Whitelisting
Monitoring and service level
Updates, backups, technical monitoring and response paths follow a transparent operational scope.
24/7 proactive monitoring
Updates and patches
Regular updates, CVE monitoring and prioritised patches for critical vulnerabilities
Daily backup with 7-day retention
Personal technical contact
Integration and development
APIs, automation and custom extensions can be delivered beyond basic deployment.
Full-service installation with no hidden costs
What the ZITADEL setup includes
Complete installation & configuration
SSL certificate & reverse proxy setup
Backup strategy & disaster recovery
Performance optimization & tuning
Security hardening following OWASP
Monitoring & logging setup
Documentation & best practices
Administrator training (remote)
30 days email support included
Dedicated contact person
Optional integration: LDAP/AD, SSO, MFA
Update strategy & patch management setup
The exact scope depends on the application, edition, infrastructure and criticality. Vendor licences and non-standard components are quoted separately.
Use Cases
Using ZITADEL in your organisation
Tenants and customer organizations
Model customers or business units as separate organizations with their own branding, identity providers and administrators
Single sign-on for applications
Central login for business applications via OIDC or SAML with tested login, logout and error paths
Introduce passkeys and MFA
Passkeys, authenticator apps and one-time codes with agreed recovery and emergency procedures
Migration from Keycloak or Auth0
Import users from a realm export or Auth0 export as a test, check password hashes per method and reconnect applications
Connect external identity providers
Connect Microsoft Entra ID, Okta and other identity providers via OIDC or SAML, and LDAP directories as an external source
Machine accounts and APIs
Service users with JWT profile or personal access tokens for automation, CI/CD and service-to-service communication
Managed Hosting & Operations
How much does ZITADEL hosting cost?
Compute, applications, storage and response are shown separately. You can see what ongoing operations include and which requirements need a technical assessment.
The number of users says little. Login peaks, password hashing, the number of organizations and clients, token lifetimes and the required availability determine the architecture.
Starting-point guidance
Usage scenario
Technical starting point
Key factors
Internal SSO platform for a few applications
XS to M
Suitable for a manageable login load and a clearly limited set of clients.
Many organizations or applications
M or L, own database
Organizations, projects and peak load are measured or estimated. Password hashing causes CPU peaks.
Public logins or high authentication load
Custom architecture
Load tests, rate limits and protection against abuse are planned in.
Business-critical or highly available IAM
Custom architecture
Multiple ZITADEL instances, PostgreSQL, domain, keys and upstream identity providers must work together.
The calculator is a starting point for a standard instance. High availability, load tests, migration and multiple environments are planned individually.
Sizing and deployment
Deployment that matches the trust boundary
ZITADEL can run on WZ-IT infrastructure, in your cloud, on-premise or hybrid close to applications and directory services.
WZ-IT managed hosting
Operation in Germany with compute, backup, monitoring and a selectable service level.
Your own cloud account
Operation in your cloud with existing network, security and logging services.
On-premise
Integration into your data center, your virtualization and internal directory services.
Hybrid and multi-site
Secure connection to distributed applications, clouds and external identity providers.
Target architecture
Planning identity flows across applications and sites
ZITADEL connects users, organizations and applications. We document trust relationships, token flows, admin access and failure paths.
Users and applications
Browsers, mobile apps, APIs, machine accounts and administrative access.
Secure entry
TLS, reverse proxy with HTTP/2, rate limits and separate administration paths.
External identity providers
Entra ID, Okta, SAML and OIDC sources and LDAP directories as defined federation.
ZITADEL platform
Instances, organizations, projects, roles, MFA, actions and token issuance.
PostgreSQL and event store
Persistent state with backups, restore tests and agreed retention.
Clients and APIs
OIDC and SAML connections with tested login, logout and error paths.
Audit and monitoring
Metrics, health checks, events and logs with optional forwarding to a SIEM.
Identity is a shared dependency. Changes are therefore planned with staging, defined rollback steps and emergency access.
Role in the overall system
Related services for ZITADEL
This page covers installation and the agreed platform operations for ZITADEL. Custom code, the access layer and special confidentiality requirements remain clearly separated responsibilities that can be added when needed.
Frequently asked questions about ZITADEL managed hosting
Answers on migration, upgrades, license, high availability and operations.
ZITADEL Hosting with WZ-IT starts at €99.90 net per month. It includes a dedicated size XS instance (2 vCPU, 2 GB RAM, 40 GB NVMe SSD), updates, daily backups with 7 days of retention, 24/7 monitoring, 5 TB of outbound traffic and a first response to critical incidents by the end of the next business day. Larger instances and higher service levels cost extra; the configurator shows the total price.
The entry level is a dedicated size XS instance with 2 vCPU, 2 GB RAM, 40 GB NVMe SSD for €99.90; it suits lightweight applications as well as test and development environments. Size S with 2 vCPU, 4 GB RAM, 80 GB NVMe SSD costs €129.90. We check which size ZITADEL needs in production before provisioning. Size M (4 vCPU, 8 GB RAM, 80 GB NVMe SSD) costs an extra €29.90 excl. VAT, L (8 vCPU, 16 GB RAM, 80 GB NVMe SSD) an extra €89.90 excl. VAT and XL (16 vCPU, 32 GB RAM, 80 GB NVMe SSD) an extra €199.90 excl. VAT, each per month. Additional storage costs €4.99 excl. VAT per 50 GB and month.
No. WZ-IT does not limit the number of users. How many users can work smoothly at the same time depends on usage and the chosen instance size XS to XL.
ZITADEL Hosting can be cancelled monthly, with no minimum term and 30 days' notice to the end of the month.
Germany, Switzerland and Austria are available at the same prices. All three locations are ISO 27001 certified data centres without US clouds; in Germany we additionally operate with a German provider whose data centres are BSI C5 attested. A confidentiality agreement under Section 203 German Criminal Code (StGB) is also available for app hosting on request, at the German location only; the separate Section 203 Managed Cloud for professional-secrecy holders is available in Germany only.
Yes. Besides Germany, Switzerland and Austria are available as locations, at the same prices in euros. The operator of the data centre in Switzerland is certified to ISO 27001, ISO 9001, ISO 14001 and ISO 50001 and sources electricity from renewable sources; the data centre in Austria is ISO 27001 certified. State the preferred location in your request; it is recorded in the proposal.
We typically provide a production instance within a few business days after signing. For a trial, we set up a test instance, usually on the next business day; it runs free of charge for 7 days and without payment details.
Yes. One .de domain is included with every hosting plan. Alternatively, connect your own domain or subdomain with a CNAME record.
Yes. We check version, database, domain, organizations, actions and connected identity providers, then plan a test upgrade, backup, cutover and fallback option.
The vendor documents the path via a realm export and the zitadel-tools utility. We import as a test, check which password hashes can be carried over and reconnect the applications, because client IDs and client credentials cannot be imported. Passwords that are not carried over can be replaced by a reset or a parallel run.
From version 4, OIDC web keys are mandatory. The vendor therefore describes the path via the last 3.4.x release and waiting until older tokens have expired. Otherwise existing tokens become invalid and users must log in again. Beforehand we back up the database and test the critical flows.
PostgreSQL in versions 14 to 18. CockroachDB support was dropped in version 3. State is kept as an event store in the database, so the database backup is the central backup.
When several business-critical applications depend on login and the tolerable downtime is short. Then we treat ZITADEL, PostgreSQL, proxy and upstream identity providers as one chain. This is planned per use case and not assumed in the standard price.
The core has been under AGPL-3.0 since version 3, the Login V2 interface and the SDKs under MIT. We run the unmodified upstream. Your own code changes would have to be disclosed under the AGPL.
When you do not want to operate your own instance and the data locations of the cloud regions are sufficient. According to the vendor's pricing page (as of 29 October 2026), the Pro plan costs 100 US dollars per month with 25,000 daily active users. A dedicated instance in Germany with operations, backup and a service level is the alternative when location, control over the instance or integration into your infrastructure matter most.
Yes. Entra ID, Okta and other providers can be connected via OIDC or SAML, LDAP directories as an external identity provider. We agree attributes and groups with your team.
We back up the database with the event store as well as the relevant keys and configurations, and test recovery as planned before the instance goes live.
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbHView project
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
