Zitadel Self-Hosted vs. Cloud: Making the Right Choice

At Zitadel every customer is granted their own virtual instance with unlimited identities that allows them to fully configure their instance to their needs. This includes choosing a deployment option which is most suitable for the unique needs, security requirements, budget, and resources of each individual organization.

Unlike most Identity and Access Management (IAM) offerings available today (such as Auth0 by Okta, Keycloak, etc.) Zitadel officially offers flexible deployment options – to deploy in Zitadel Cloud or to self-host in your preferred location. In this article, we will discuss our Cloud and self-hosted options to help you find the right solution for your project or business.

Convenience and Speed-to-Market: Zitadel Cloud

Pros:

Our public cloud option is ideal for any user who is intrigued by the idea of a hosted deployment model that is ready-to-use the moment you obtain it. Unlike the self-hosted alternative, Zitadel Cloud is pre-configured and automated, saving you the time and money spent on implementing, managing, and maintaining your platform. A virtual instance will automatically upgrade with new product improvements and security fixes without your intervention.

You also do not have to worry about expanding your infrastructure when your service gains new customers or sees usage spikes. Zitadel Cloud can help scale and handle resource allocation for you. A notable benefit also lies in the possibility of choosing a region that works best for your project to stay close to your users. The Zitadel platform is built to manage traffic from a global audience or constrain data to only a certain location, depending on your organization's needs. Both scenarios are possible through Zitadel Cloud, while we optimize and guarantee low latencies and high availability.

With the Zitadel Cloud, you also benefit from the operational security aspects, such as Distributed Denial of Service (DDoS) attack protection and automated certificate management. Zitadel is an open source platform and has the same open source releases available to both our cloud and self hosted environments. We take security seriously and go above-and-beyond so we take pride in publishing the results of our penetration tests done by external auditors, as soon as we mitigate issues.

As a “cherry on top”, we offer a true pay-as-you-go subscription method to keep the total cost of ownership (TCO) affordable to even strict budgets.

Cons:

There are certain weaknesses relying on a Cloud deployment, which are easily outweighed by the convenience of a pay-as-you-go subscription for most customers. While most customers are satisfied with our infrastructure in terms of cloud provider and data location options, some want to choose their own infrastructure providers or data location. In this case self-hosting is the best option (we also partner with managed service providers in some areas if a dedicated instance of Zitadel is the preferred option). Both options are also viable in case a customer requires more flexibility of upgrade cycles or backup frequencies.

A common weakness in today's software is supply chain risk, where our open source model provides extraordinary transparency of code, dependencies, and processes, yet a customer relies on the quality of our technical and organizational measures to manage information security. We are continuously improving our information security and are ISO27001 certified. If your organization requires complete control over the technical and organizational measures, you should choose to self-host Zitadel.

Another challenge in a Cloud deployment lies in its less flexible options out of the box. While companies mostly offer a wide variety of templates to choose from, their number can't compete with the infinite customization possibilities that come with building your own platform. We do not recommend building your own identity management system, rather we promote our platform approach where customers can easily extend functionality of the platform by loosely coupling new components. This is supported by Zitadel’s API-first approach, SDK's in various languages, and programmatic extensibility through Zitadel Actions.

The summed-up benefits of Zitadel Cloud include:

• Receive a pre-configured and implemented platform – no need to bother with updates, backups, maintenance, and troubleshooting
• Operational security provided
• Automated backups and updates
• Availability guarantees and automatic scaling
• “Pay as you go” model with low total cost of ownership
• Choose the region that works best for you
• Technical support from the creators - we are here to help

Complete Control: Self-hosted

Pros:

Unlike Zitadel Cloud, the self-hosted version is hosted by you on your infrastructure. In the case of Zitadel, companies or individuals can deploy Zitadel on their preferred cloud provider or install it as an on-premise solution; Both of these options allow our customers to take full control over all aspects, instead of having to rely on our infrastructure and our technical and organizational processes. Zitadel is based on cloud-native principles and is designed to be deployed as containers, which makes it straightforward to run and operate on almost any platform.

Self-hosting is a great choice if you have the resources to set up and host your own Zitadel instances on custom infrastructure with your company's needs in mind. If implemented correctly, the features of a self-hosted platform even have the potential to surpass the security possibilities of Zitadel Cloud, making it an ideal alternative for firms working with sensitive data.

The key benefits of self-hosting include:

• Manage your platform with full control in your own cloud or hardware
• Be in control of your technical and organizational measures
• Fully customizable platform
• Self-hosting organizations can get commercial technical support with an SLA
• Highest possible security, if implemented accordingly

Cons:

The setup cost and maintenance are often downsides of self-hosting, we recommend choosing this solution if your company already possesses internal resources to handle the hosting and is ready to pay the investment and upkeep. While we at Zitadel are happy to help with any issues, “support” still needs to be considered especially around the technical aspects of self-hosting. The responsibility of adequately hosting the platform lies solely in the hands of the company.

We also tend to discourage self-hosting your identity platform without an in-depth IT-knowledge. As the security measures must be manually installed and maintained, mistakes in the implementation can potentially lead to inadequate protection from intruders.

Which option to choose?

While both deployment options have their respective advantages, the self-hosted alternative will most likely benefit companies that aim to fulfill some very specific requirements or compliance goals. If your organization lacks internal staff with in-depth IT knowledge, the serious dangers of faulty implementation are not worth risking. The advantages of Zitadel Cloud outweigh those of self-hosted options for most organizations and are therefore generally the recommended path to take. For easier decision-making, we created this simplistic chart as a guide:

Whether you choose to use Zitadel Cloud or host Zitadel yourself, Zitadel ensures the best possible deployment experience with its flexible pricing options, comprehensive set of features, guaranteed high security, and unlimited identities for all options. In the future, you can also decide to migrate from Zitadel Cloud to hosting it yourself.

Should you have questions regarding Zitadel Cloud, self-hosting, or any other related (or unrelated) topics, feel free to contact us anytime on our Zitadel Discord Server, our Bluesky, Twitter, Linkedin or GitHub pages, or on our Website.

As you find the project helpful, please be sure to give us a star over on GitHub.