🩺 Vitals
- 🟢 Last active: 2026-10-12
- 📦 Latest release: v4.19.4 (2026-10-01)
- 🐞 Open issues: 1277
- 🌟 Stars: 15.3k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: zitadel.com
- Source: github.com/zitadel/zitadel
- License: AGPL-3.0
- Deployment: Docker | Kubernetes
- Data Model: PostgreSQL / CockroachDB (Event-Sourced)
- Jurisdiction: USA 🇺🇸 (Zitadel, Inc.)
- Compliance (SaaS): SOC 2 Type II | ISO 27001 | GDPR Ready
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single Go binary plus one datastore (PostgreSQL, or CockroachDB for multi-region HA); no third co-deployed tier to run
- Maintenance: Low (2/5) - Periodic binary updates (schema migrations auto-applied on startup) and PostgreSQL backups; a CockroachDB HA cluster is optional and adds its own ops
- User Management: High (4/5) - SAML/OIDC SSO, delegated RBAC and a built-in immutable event-sourced audit trail, all free self-hosted; SCIM v2.0 is still preview, so it holds at the one-advanced-leg tier
1. The Executive Summary
What is it? ZITADEL is an open-source Identity and Access Management platform built in Go, from Zitadel, Inc., a US company with a Swiss affiliate, CAOS AG. It provides authentication and authorization infrastructure for multi-tenant B2B SaaS environments: OIDC, SAML, SCIM, MFA, FIDO2/Passkeys, and delegated role management are all included in the self-hosted Community Edition at no cost. Its event-sourcing architecture means every authentication and authorization state change is written to an immutable log, providing a built-in audit trail without additional tooling. ZITADEL Cloud (SaaS) carries verified SOC 2 Type II (January 2026) and ISO 27001:2022 (June 2024) certifications. The enterprise tax on the SaaS tier is primarily around scale (a low free-tier user cap), custom domains, geographic data residency selection, and SLA guarantees, none of which apply to self-hosted deployments.
The Strategic Verdict:
- 🔴 For Single-App Consumer Authentication: Overkill. ZITADEL's multi-tenancy, event-sourced data model, and B2B delegation primitives are architectural overhead for a single-tenant consumer application. A lighter OIDC library or hosted service is a more proportionate choice.
- 🟢 For Multi-Tenant B2B SaaS or Regulated Enterprise IAM: Strong Buy. Native organisation-level tenancy, SAML federation, and an immutable audit log are included in the self-hosted edition with no MAU paywall.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Auth0 (SaaS) | Zitadel (Self-Hosted) |
|---|---|---|
| MAU Fees | $0.07+/MAU overage | $0 (Unlimited MAU) |
| B2B Multi-Tenancy | Enterprise tier | Native (Included) |
| SSO / SAML | Enterprise tier | Included (Default) |
| Data Residency | Auth0-managed cloud | Operator-controlled (VPC) |
| Audit Trail | Paid log retention add-on | Event-sourced (Immutable, Default) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: ZITADEL ships as a single Go binary with Docker and Kubernetes Helm chart support. The event-sourcing data model requires PostgreSQL or CockroachDB as the backing store. CockroachDB is preferred for multi-region high availability but adds its own operational complexity. PostgreSQL is the simpler operational choice for single-region deployments. All database schema migrations are handled by the ZITADEL binary on startup.
- Architecture: The event-sourcing model means every state change (user creation, role assignment, permission grant) is appended as an immutable event rather than overwritten. This provides a built-in, tamper-evident audit history at no additional tooling cost, directly applicable to SOC 2 CC6.x access review requirements and GDPR Article 30 record-keeping obligations.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Geopolitics (USA 🇺🇸): The vendor's privacy policy names Zitadel, Inc., a US company, as the responsible party, with the Swiss CAOS AG as its affiliate. For self-hosted deployments, the operator's chosen hosting jurisdiction applies entirely, and the vendor holds no access to that identity data, so the CLOUD Act is moot. On ZITADEL Cloud, the provider is Zitadel, Inc.: as a US provider it is reachable under the CLOUD Act wherever the data sits.
- The Compliance Shift: ZITADEL Cloud holds verified SOC 2 Type II and ISO 27001:2022 certifications, verifiable at zitadel.com/trust. These certifications do not extend to self-hosted instances; operators assume full responsibility for infrastructure hardening, database encryption, network access controls, and key management. The event-sourcing architecture materially reduces audit preparation effort: every access event is logged immutably by default, producing the access review artifacts required by SOC 2 and ISO 27001 without additional SIEM configuration.
- License Risk (AGPL-3.0: Network Copyleft): AGPL-3.0 closes the SaaS loophole: any party operating a modified ZITADEL instance accessible over a network must release those source modifications. For standard enterprise IAM deployment (an organisation running ZITADEL as its internal identity provider), AGPL-3.0 is operationally neutral. The risk applies specifically to managed service providers or SaaS platforms wishing to offer ZITADEL-based authentication as a product; those operators must either open-source their modifications or negotiate a commercial licence with Zitadel.
4. Market Landscape
🏢 Proprietary Incumbents
- Auth0 (Okta): The dominant IDaaS platform, with mature developer experience and an extensive integration catalog, but MAU-based pricing ($0.07+/MAU) compounds rapidly at scale, B2B multi-tenancy requires the enterprise tier, and all identity data resides in Okta's US-managed cloud infrastructure.
- Firebase Authentication: Google's serverless authentication service, with low implementation friction for consumer apps, but zero data portability (vendor-managed identity store), no self-hosting option, and full US CLOUD Act exposure via Google's infrastructure make it unsuitable for regulated enterprise or sovereignty-sensitive deployments.
🤝 Open Source Ecosystem
- Keycloak: The Java-based enterprise IAM standard with the broadest protocol support and longest production track record, the incumbent for organizations already running JVM infrastructure or requiring deep Kerberos/legacy enterprise federation support.
- Authentik: The DevOps-oriented modern alternative: broader out-of-the-box proxy and outpost support, with a Python/Django stack that trades ZITADEL's Go performance profile for a more extensible policy engine.