Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

# Meet Gigi the Giraffe: The Towering Personality Behind Zitadel!
Ever spotted that long-necked charmer popping up throughout Zitadel’s [documentation](https://zitadel.com/docs)?  Wonder no more.  Today, we are diving into the delightful story of Gigi the Giraffe, Zitadel’s head-above-the-rest mascot, with none other than Florian Forster, Zitadel’s CEO and Co-Founder.

<div className="mt-8" style={{ marginBottom: '-3.5rem' }}>
  <YouTubeExtended
    videoId={"pCXXuYNUzvY"}
    containerClassName={"youtube-container"}
		stopList={[]}
  />
</div>

**Prefer skimming to streaming?** We got you covered!  Here is the transcribed version of the conversation for your reading pleasure.

### The Tall Tale of Gigi’s Beginnings
As it turns out, Gigi wasn’t born with mascot status!  Florian revealed that before Zitadel existed, the co-founders worked at another organization where they developed a rather elevated reward system—giraffe stickers for standout contributions!  Talk about reaching new heights of recognition!

The giraffe love reached spectacular proportions when Florian received a human-sized giraffe plushie for his birthday.  And just like that, Gigi was born!  The team has been neck-deep in giraffe appreciation ever since.  While Gigi typically lounges in Florian’s home office, our spotted friend is currently safely packed away for Florian’s move to the US—first-class accommodations, we presume!

### Standing Tall in Company Culture
With that famously long neck, Gigi naturally has quite the perspective on Zitadel’s future (someone’s always looking ahead!).  Florian shared how Gigi’s playful spirit reflects the team’s culture—proving that even serious security solutions can have a splash of fun. 

**Ready to join the herd?** Gallop over to our [Discord community](https://zitadel.com/chat) today and enjoy our collection of Gigi-themed emojis!  Because who says identity management cannot be both secure AND adorable? 



Find out more about Zitadel’s mascot, Gigi, the Giraffe, and where he came from!

Meet Gigi, Zitadel’s Mascot

Ever wonder who’s at the helm of your favorite open source Identity platform, Zitadel? I recently spent time talking with Florian Forster, CEO and recorded his insights on [Zitadel's YouTube channel](https://youtu.be/m-Tg-KRqYlA).

<div className="mt-8" style={{ marginBottom: '-3.5rem' }}>
  <YouTubeExtended
    videoId={"m-Tg-KRqYlA"}
    containerClassName={"youtube-container"}
		stopList={[]}
  />
</div>

Looking for a quick read instead? We also transcribed the conversation.
### Getting to know Florian 
Florian shares with us his technical background that has helped drive his entrepreneurial spirit as he operates as Zitadel’s CEO. His vision for Zitadel’s positive impact on organizations helps drive the future course of the company.

### Early Days: The Founding Story of Zitadel
Florian teamed up with Fabienne Buhler, Maximilian Panne, Stefan Benz, Silvan Reusser, Elio Bischof, Livio Armstutz, Max Peintner, and founded Zitadel in 2019. The idea came to fruition when this group was working at a public sector company in Switzerland. Identifying the market gap for a developer-focused identity solution that supports both self-hosting and multi-tenancy, they set out to create and deliver this tool to the community.

### Day in the life of the Zitadel CEO
Florian chuckles that his daily rhythm varies based on which global office he is working from. In Switzerland, his day unfolds at a measured pace, whereas starting in San Francisco means an immediate deluge of over 100 notifications. Despite his systematic approach to triage, priorities, and essential meetings, Florian always carves out time to engage with the Zitadel community and participate in GitHub discussions. He particularly values his diverse interactions with team members, customers, and the broader developer ecosystem. As a dedicated family man, Florian ensures that regardless of his professional commitments, he reserves quality time with his wife and young children before the day concludes.

### Key Identity Management Challenges That Organizations Should Navigate
Florian challenges the tendency to either oversimplify or overcomplicate identity management. Often dismissed as a simple login, he emphasizes how identity fundamentally shapes your entire software security posture. The true challenge lies in accurately assessing risks and implementing appropriate security measures that protect users without creating friction.. Custom-built or homegrown solutions often fall short — developing robust identity systems requires specialized expertise, not a quick implementation.  Engaging with industry experts and specialists provides invaluable peace of mind and enhances your organization’s security outcomes.

### Zitadel’s Market Advantage
Zitadel distinguishes itself with a developer-centric approach that addresses gaps left by the legacy identity solutions.  The platform offers exceptional flexibility, allowing it to adapt to your infrastructure requirements. This pairs well with Zitadel's modern self-hosting solution, which has seen an acceleration in adoption and growth over the recent years.

### Multi-tenancy in Practice
Florian shares how most systems across the internet are inherently multi-tenant. He illustrates this with an e-commerce example where customers and employees require  different roles and permissions.  This complexity, Florian notes, rapidly intensifies as organizations grow. When multi-tenancy is built into  the system’s foundational architecture, it provides sustainable scalability benefits  This intentional design allows administrators to implement distinct security policies — such as customized two-factor authentication requirements — for different groups across tenants.

### How Zitadel Enables Data Residency
Florian highlights two key dimensions of Zitadel’s approach to data residency:
The first addresses geographic hosting requirements through the strategic regional deployments of Zitadel Cloud across the United States, Australia, European Union, and Switzerland, allowing customers to meet their compliance needs.
The second offers complete flexibility through Zitadel’s self-hosting option, giving organizations complete control over database location, instance deployment, and access management according to their requirements.
 
### The Shift to Self-Hosting Solutions
Florian notes that historical data breaches from third-party suppliers have created lasting concern among organizations. A significant segment of customers now prioritizes maintaining complete control over their data, viewing access management as a critical defensive strategy. He also highlights that technical teams have regained confidence in managing essential workloads internally, largely due to operational enablement from technologies like Kubernetes. 

### Evolution of Zitadel’s Licensing Model
Zitadel initially launched under the Apache 2.0 license, which effectively supported its distribution and helped build the community. Florian explains that over the past 18 months, while usage increased significantly, there wasn’t a proportional reciprocity with meaningful contributions back to the community, whether in the form of code contributions or financial support.  The transition to the AGPL 3.0 license has enabled Zitadel to safeguard the substantial  investment made by the core team and the broader community. This strategic licensing shirt ensures Zitadel can maintain its fundamental commitment to open source principles.

*Note: Learn more about the AGPL 3.0 licensing change in [this blog post](https://zitadel.com/blog/zitadel-v3-announcement)*.

### Zitadel’s Strategic Vision for 2025 & Beyond
While Florian proudly acknowledges Zitadel’s exceptional login experience, he emphasizes that the company’s  mission extends far beyond authentication. 

He identifies three strategic pillars driving Zitadel’s future:
**1. Identity Transactions:** The authentication component of user login workflows represents Zitadel's foundational strength.  With over 80% market coverage in this area, Florian is confident in the substantial value this functionality delivers to organizations.
**2. Integrations and Workflows:** This growing focus area recognizes that while customers can already build plugins for third-party applications, Zitadel aims to significantly enhance this capability.  By expanding APIs and improving extensibility, Zitadel will provide developers with even greater flexibility and powerful incentives for adoption.
**3. Analytics and Intelligence:** This pillar, positioned to have the most transformative long-term impact, comprises three critical components:
	* Audit and Forensics Reporting: Enabling customers to comprehensively track and analyze user activities
	* Aggregation Reporting: Providing administrators with deeper insights into identity infrastructure performance through metrics on user behaviors, login failures, and other usage patterns
	* Threat Detection and Mitigation: Empowering security teams with advanced tools to better understand and rapidly respond to potential attacks

### Zitadel Establishes American Presence
Florian recounts that while Zitadel was born and initially flourished in Switzerland, maintaining strong Swiss heritage, the company's expanding footprint in the North American market naturally led to establishing a US headquarters. This strategic expansion positions Zitadel to better serve its growing American and global customer base and address its evolving recruitment requirements.

### “If Not Tech…”: Alternative Career Paths
Florian reveals that if he was not securing identity in the Tech industry, there were several alternative career paths he would have pursued. 

Initially, becoming a helicopter pilot captured his imagination, though he eventually dismissed this path, seeking to make a more substantial impact.

Following his military service, Florian considered joining the close protection field as a security operative.  However, after careful consideration, he determined the inherent risks didn’t align with his personal values and life goals.

Surprisingly, citrus farming ultimately emerged as his most compelling alternative career path. Florian believes that through data-driven approaches and thoughtful agricultural practices, the field offers fascinating opportunities for innovation.

*While the world might have gained an innovative orange juice producer, the Zitadel team remains grateful to have Florian’s leadership in his current role 😁.
*


Zitadel’s CEO Florian Forster shares the company’s values and vision for 2025 and some of the common challenges when approaching IAM. 

“The WHY behind Zitadel” with Florian Forster, Co-Founder & CEO

Last week marked an incredible milestone for our team and community:
* We announced [Zitadel Version 3](https://zitadel.com/blog/zitadel-v3-announcement) 
* 🎉⭐️Zitadel crossed  10,000 stars on GitHub! 🎉⭐️ 

Achieving 10,000 stars on GitHub is more than just a number to us—it represents the trust, support, and enthusiasm of thousands of developers who believe in our vision for a modern identity platform.

Zitadel is the leading provider of cloud-native identity infrastructure solutions.  Its platform offers a comprehensive suite of tools for multi-tenant, authentication, authorization, and user management.  Designed for scalability, flexibility, and security, Zitadel empowers organizations to protect their cloud infrastructure and applications across the globe. 
### Our Journey to the first 10,000 stars
When we first launched Zitadel as an open-source project, we already embarked on a clear mission: to create a secure, scalable, and developer-friendly identity and access management platform that would simplify authentication and identity management for modern applications especially in multi-tenant scenarios. What began as a small team's passion project has blossomed into a thriving ecosystem of contributors, users, and advocates.
Our journey hasn't always been straightforward. From our initial commit to reaching our first 100 stars took a lot of dedication and persistence and we fully celebrated our first 1,000 stars as a major achievement, never imagining we'd be here today, announcing this new milestone that puts us among the top open-source identity projects globally.

![](https://cdn.sanity.io/images/y3uu7rkl/production/2acac30edb656e48d5734613f9a992662f9750ad-3628x940.png)

### Community Spotlight
None of this would have been possible without our incredible community. From the developer who fixed that critical bug at 2 AM to the companies that have built their entire identity infrastructure on Zitadel, every contribution has mattered for our ongoing success.

![](https://cdn.sanity.io/images/y3uu7rkl/production/4b0ce733f8e6d6f37ad78c9e772ce6e27afe9ecb-2116x1144.png)

-----

*“Zitadel powers our lab initiative by enabling rapid, secure prototyping with its modern, open source identity management platform. Its multi-tenant design and expansive ecosystem make it the ideal partner for testing our next-generation SaaS solutions, positioning itself as a dynamic alternative to traditional giants like Azure Active Directory. Backed by an engaged community and a forward-thinking team, Zitadel not only safeguards our ideas but also accelerates innovation across the board, ensuring that security remains our top priority. There is just no excuses to not using it :-)”
Florent Cenedese, Principal Solution Architect*

*“Zitadel’s domain expertise drives effortless scaling for startups and enterprises. Its event-driven, event-sourced architecture delivers robust scalability, extensibility, reliability, and thorough auditability—supported by a sustainable business model for the free and open source community”
Yordis Prieto, Principal Software Engineer*

-----

### Technical Evolution
Our codebase and architecture has evolved significantly since our initial release.  Our platform has transformed into a highly scalable, cloud-native platform that can handle millions of authentication requests while maintaining sub-100ms response times and we see this proven in customer hosting multiple millions of tenants in Zitadel.

Some of the most impactful technical achievements:
* Transitioning to resources based APIs for easier integration
* Implementing event sourcing as the basis for robust audit trails and event driven integrations with actions
* Updating actions into an extensibility framework that allows customer full control over each http request and event 
* Expanding our protocol support beyond OIDC and OAuth2 to include SAML, WebAuthn, SCIM and LDAP
* Building a comprehensive set of API that developers can even use to build their own login ui

We made all these improvements while maintaining our commitment to security—undergoing regular penetration testing and security audits to ensure we're providing a solution our users can trust with their most sensitive data.
### Lessons Learned
Building an open-source project at this scale has taught us valuable lessons:
* **Documentation matters deeply.** Some of our most appreciated contributions haven't been code but clear, thorough documentation that makes complex identity concepts accessible.
* **Community feedback is gold.** Our best features often came from community suggestions, and our most significant improvements stemmed from user feedback.
* **Balancing innovation with stability is an art.** We've learned to maintain a stable core while allowing for experimentation in new features.
* **Security is never "done."** We've built security into every aspect of our development process, from design to deployment.
* **Open source is about people, not just code.** Building relationships with our contributors and users has been as important as building the product itself.
### Looking Forward
Reaching this milestone matters beyond the satisfaction of seeing a big number on GitHub.  A developer-first, open-source identity solution is the future; it enables enterprises with a choice.  A choice between self-hosted or cloud solution, a choice between open source and commercial offering, and a choice between building and managing a custom-build platform vs. buying one that offers flexibility and control without the burden of engineering efforts.

In the identity space, this achievement puts Zitadel in the top tier of open-source projects—a significant accomplishment for a specialized security tool in a field dominated by much broader infrastructure projects.

While we're taking a moment to celebrate, we're even more excited about what's next in 2025:
* **Performance Optimization:** Comprehensive platform-wide performance enhancements that focus on core authentication service response times, API endpoint optimization across new and existing services, enhanced resource management efficiency, and improved system scalability. 
* **TypeScript Login with OIDC:** A new, highly customizable login interface for our customers, built in with [TypeScript and OpenID Connect](https://zitadel.com/blog/typescript-login) support. Self-hosting customers will soon be able to use the hosted login option with OIDC.
* **User Schema Management:** This feature offers [advanced user profile customization](https://github.com/zitadel/zitadel/issues/8140) enabling granular control over field management permissions between users and administrators. 
* **Configurable Caching System:** Beta release of [flexible caching](https://zitadel.com/docs/self-hosting/manage/cache) infrastructure supporting Redis integration for improved object lookup performance.  
* **SCIM Integration:** This is [the implementation](https://github.com/zitadel/zitadel/issues/8140) of System for Cross-domain Identity Management (SCIM) protocol for automated user provisioning, synchronization, and lifecycle management across external systems. 
* **Actions Framework v2:** This feature offers [enhanced extensibility framework](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) supporting custom triggers and executions through API endpoints for advanced workflow customization. 
* **User Group Authorization:** The implementation of [user group management](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822) capabilities enable efficient authorization management at scale, expanding beyond individual user permissions.

Our vision remains consistent: to be the most developer-friendly, secure identity platform that grows with your needs from side project to scale-up.
### Thank You!
This milestone belongs to everyone who has been part of the Zitadel journey:
* Our 54 code contributors who have submitted everything from typo fixes to major feature implementations
* The companies who have sponsored development or provided resources
* The thousands of developers who have chosen Zitadel for their projects
* The investors who continue to support Zitadel’s growth and success 
* Everyone who has reported bugs, suggested improvements, or simply spread the word

### Join Us As We Build the Future of Identity
If you are not yet part of the Zitadel community, there has never been a better time to join:
* [Star us](https://github.com/zitadel/zitadel) on GitHub (if you haven't already!)
* Check out our [documentation](https://docs.zitadel.com/) to get started
* Join our [Discord community](https://zitadel.com/chat) to connect with other users and our team
* [Contribute](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to the codebase—we welcome contributions of all sizes
* Join our [upcoming AMA](https://discord.gg/jRA3nhv8?event=1344022255759528027) with our CEO, Florian Dorster, on Discord

![](https://cdn.sanity.io/images/y3uu7rkl/production/494896893ec4af602036b3dae7b88f51050b0f05-800x320.png)

Whether you are building a personal project or enterprise-scale software, we are honored to help secure your applications and manage your users' identities.

Here's to the next 10,000 stars and beyond! 🚀

![](https://cdn.sanity.io/images/y3uu7rkl/production/ceb66bc9ab5d1dbc9bcc6b6183a73dcc2f16ae10-1200x627.png)




Zitadel Identity and Access Management (IAM) platform celebrates the milestone for the open source project reaching 10,000 github stars.

Thank you for 10,000 Stars!


As the snow falls outside here in Switzerland creating a winter wonderland, I am filled with pride looking at the past year’s milestones.  Zitadel has grown in such exciting ways — the features that have been deployed, the product roadmap, the collaboration with our vibrant developer community, partnering with customers from every walk of life, and last but not the least, getting incredible support from our investors.  Each person, team, GitHub comment to the pull requests, Discord discussion have shaped the path to where we stand today!  A heartfelt thank-you to everyone involved.   To say I am thrilled about our next growth phase in 2025 is an understatement! 
 
As we near the last few weeks of 2024, I want to take a minute to reflect and review some of the milestones that made this year one of our best yet!

Before I get to it, I wanted to share our upcoming Discord event on the Back-Channel Logout feature.  If you want to see how it can help you manage your user sessions throughout your identity infrastructure, [register and join us in Discord on December 11th](https://discord.gg/bnuAe2RX?event=1308899625041924127) where [Livio Spring](https://www.linkedin.com/in/liviospring/), Engineer and Co-founder, Zitadel, will give a live demo.

## Zitadel in 2024: Highlights 

- We are [proud to announce](/blog/zitadel-the-future-of-identity-infrastructure) our $9 Million Series A  round of funding in collaboration with Nexus Ventures and Floodgate to advance Cloud-Native Identity Infrastructure.

- We achieved our [ISO 27001 certification](/blog/zitadel-iso-27001-certified) further reinforcing our commitment to security through this internationally recognized standard that confirms our dedication to maintaining the highest levels of security for our customers' data. 

- Zitadel has grown to serve over 150 customers this year such as Klaviyo, Open Systems, Vector Solutions,  and Kaspar&!

- [Zitadel’s Discord Community](https://discord.gg/szfmzC2M) has grown by 93% in 2024 from 1,527 to 2,953 members

- [Zitadel’s Github Repository](https://github.com/zitadel/zitadel) continues to make traction with a 57% increase to 9,100+ Github Stars and another 57% increase of individual contributors to 220+ collaborators across all the Zitadel repositories. 

- Continuing to be a remote-first team, we came together twice this year — in [Italy](/blog/team-retreat-bologna) and [Switzerland](/blog/team-retreat-zurich) — for team get-togethers and planning forward as we level up Zitadel’s future!

## Zitadel in 2024: Product

Looking over the past year we released key features that helped customers across the board in the way they manage their identity infrastructure. 

- **Performance Improvements:** We prioritized stability and scalability enhancements in 2024 to set a solid foundation for our Self-Hosted and Cloud customers.  With some of our customers deploying as many as 2.3 million tenants to manage their identity infrastructure, performance is key.  These enhancements include latency, [benchmark testing](/docs/apis/benchmarks), and reliability on services such as token endpoint and new generation APIs like the [improvedPerformance](/docs/apis/resources/feature_service_v2/feature-service-set-instance-features) field.

- **Easier Integrations:** This allows admins to set up an application in their [framework and programming language of choice](/docs/sdk-examples/introduction) quickly.  Zitadel simplifies the process for the admin’s deployment process of client applications by enabling the use of default settings!

- **Using external SAML IdPs:** This enables admins to level up using external identity providers by defining the preferred nameID format and configuring user mapping in Zitadel based on attributes received from the external IdP.  [Learn more](/docs/guides/integrate/identity-providers/mocksaml) about building using external SAML IdPs.

- **Setting up Email Providers:** This was accelerated greatly thanks to our open source community.  This feature makes it easier to configure email delivery even faster within Zitadel through SMTP provider templates.  [These templates](/docs/guides/manage/console/default-settings#smtp) offer pre-defined settings for popular email service providers (ESPs) like Amazon SES, Mailgun, Mailjet, Postmark, Sendgrid, and a Generic SMTP option.

- **Managing OpenID Connect Signing Web Keys:** This became much easier with Zitadel taking the lead to create keys without expiry for each instance.  Now users can create, rotate, and disable signing Keys via API at your discretion as [documented here](/docs/guides/integrate/login/oidc/webkeys).

- **Organizational Metadata:** This allows developers to use the org’s metadata in the [complement token flow](/docs/apis/actions/complement-token) in Actions as well as include a user’s organization metadata into tokens that can be read by receiving applications. 

- **New Password Expiry:** Policies came out in mid-2024 to aid organizations to require users to change their passwords on a routine basis. [This feature](/docs/guides/manage/console/default-settings#password-expiry) can be used quickly through the Console UI at both instance and organization levels. 

- **New Sample Apps:** We prioritized building out sample apps in [VueJS](https://github.com/zitadel/zitadel-vue), [PHP](https://github.com/zitadel/example-symfony-oidc), and [Java](https://github.com/zitadel/zitadel-java) in the beginning of 2024 to make getting started with authentication and authorization easier with these specific examples and guides.

- **Back-Channel Logout:** This is a feature that resides on the server-side and does not require the user agent to be involved. Through [back-channel logout’s](/docs/guides/integrate/login/oidc/logout#back-channel-logout) ability it has the user logged out from all clients in the event that the authenticated session gets terminated. 

- **Four New Translations added to the Zitadel platform** with **Hungarian**, **Indonesian**, **Swedish**, and the latest being **Korean** thanks to the recent addition from our community contributor [Kim JeongHyeon](https://github.com/KimTibber)!

- **New Translations added to Upcoming Typescript Login** to include **German**, **Spanish**, **Italian**, and **English**.  If you’re not seeing the language of your choice, please request or collaborate with us directly on our [GitHub](https://github.com/zitadel/typescript/tree/main/apps/login/locales).

## Zitadel in 2025: Vision

For 2025, we are focusing on three key areas to enhance the Dev and SecOps experience:

- **A Seamless Onboarding Journey:**  Our goal is to make your first integration with Zitadel as smooth as possible.  We are working on intuitive APIs, comprehensive examples and SDKs, flexible user management tailored to your use case, and streamlined deployment and maintenance processes.

- **Enterprise-Grade Performance and Scalability:** We are committed to making Zitadel a highly scalable and performant identity infrastructure.  This includes linear scalability to meet your growing needs, easy upgrades for business continuity, and efficient user management with group administration and standardized provisioning/deprovisioning capabilities.

- **Proactive System Insights:** We empower you with the tools to proactively monitor and manage your Zitadel environment.  This includes seamless integration with your SOC/SIEM systems, real time system health insights, and user analytics to identify potential issues before they impact your customers.

## Zitadel in 2025: Product 

As we look to the future, we’ve got a wide range of exciting new features on the horizon! 

- **Performance Improvements:** This remains a top priority for the team as we continue to strengthen Zitadel’s core authentication capabilities, the platform’s existing & new API endpoints, and resource management across the board. 

- **New Typescript Login including OIDC:** This allows admins to enhance their Zitadel instance with a ready-to-deploy login that is highly customizable.  [Read the GitHub Product Roadmap Epic here](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50833557&issue=zitadel%7Ctypescript%7C46).

- **User Schemas:** This feature offers flexibility when managing user details from user- and admin- perspective by allowing to define the fields that are allowed to be managed by a user and the ones that are to be managed by admin.  Stay informed through our [GitHub Product Roadmap Epic](https://github.com/zitadel/zitadel/issues/6433).

- **Configurable Cache Options:** This was the last beta feature of 2024 that enables speedy lookup of objects that are often needed by storing them in cache, like Redis.  [Take it for a spin](/docs/self-hosting/manage/cache) before it becomes generally available in 2025 and [share your feedback](https://discord.com/channels/927474939156643850/1309157792292012063/1309158011469692958).

- **SCIM (System for Cross-domain Identity Management):** This is the standard for inbound user-provisioning so other systems can automatically provision and manage users within Zitadel.  This allows creation, update, and deletion of users based on user data changes in the external system and streamlines user management across systems ensuring consistent user states. To dig deeper into this feature, read the [GitHub Product Roadmap Epic here](https://github.com/zitadel/zitadel/issues/8140).

- **Actions v2:**   This feature will allow you to extend Zitadel with custom executions and triggers through API endpoints as you look to make the most out of your Zitadel instance.  Check out the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=50259306&issue=zitadel%7Czitadel%7C7235) to find out more.

- **User Group Authorizations:** Through this feature Zitadel expands past the managing users individually and now offers groups to enable authorizations as a wider scale for user management. To follow along on this feature delivery in 2025, review the [GitHub Product Roadmap Epic](https://github.com/orgs/zitadel/projects/6/views/1?pane=issue&itemId=48898543&issue=zitadel%7Czitadel%7C5822).

## Community & Feedback Opportunities

As always, we appreciate and welcome your feedback.  It helps us shape our product roadmap and build a robust platform that caters to your needs: 

- If you are interested in a sneak peek at our User Schemas update, and would like to share your feedback, please email [Jim@Zitadel.com](mailto:Jim@Zitadel.com)

- Please share your feedback and experiences with our Community team by [scheduling some time here](https://calendar.app.google/UgTzLndLKKMk7BYp8)

- If you are using Zitadel today, please add yourself to the [Adopters](https://github.com/zitadel/zitadel/blob/main/ADOPTERS.md) list with a short description of your use case by opening a pull request and adding a section describing your usage of Zitadel.

- If you are interested in contributing to Zitadel, please review our [Contributing Guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md) to collaborate with us.

Have a look at our great product enhancements of 2024 and what is ahead for 2025.

End Of Year Product Wrap Up 2024


As an open source organization with strong community roots, we want to ensure that the care, intention, and nurturing that we pour into our product is also reflected within our team. Back in May of 2023, we held our first retreat, taking initial steps towards becoming a fully remote, global company. Fast forward to November 2024, we’ve grown from a small unit to a team of almost 20 fully distributed professionals across the globe. Along the way, we’ve made meaningful strides towards curating a strong sense of belonging while cultivating our remote work culture. Our efforts really come to life at our biannual off-sites where we’re all able to reconnect in person. Off-sites are one of many ongoing cultural rituals that allow us to work on the four Cs:  Collaboration, communication, connection, and . . . carbs **(yes, seriously —  stay with me, more on this in a second)**. 
 
## Pre-Arrival

Three days before everyone was set to fly out, we found ourselves needing to make a 1000+ kilometer change to our plans (we originally planned to go to Valencia, Spain). With time against us, we had to quickly rebook flights, shift the location of our activities and accommodations — all of this in less than 1 week. With some team members up to 8000 km away, this last-minute change really tested our ability to be communicative and adaptable. (In hindsight, this felt like an almost impossible task but we did it!)

Despite this being a logistical nightmare & having tight timelines, we were really able to come together as a team and push this through to success on such short notice. Adding on to a whirlwind of a week, illnesses, personal emergencies, and hurdles popped up that threatened to fully derail our upcoming trip. What could have been the end of our plans gave us an opportunity to show how far we’ve come as a remote-first team. We were operating like a well-oiled machine—leadership quickly went to work preparing a compact action plan, while team members supported each other with rebooking flights and figuring out how to navigate locally. From the warm, sunny coastlines we planned to visit to the cool, cozy vibes of Zurich -  the chaos gave us the opportunity to not only show resilience through challenging circumstances but also our ability to adapt and thrive together. 
 
## Arrivals

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-01.jpg" width="100%" alt="Nine Zitadel staff members smiling and posing at a bar near the Zurich opera house, with drinks on the table." />
</figure>

With our travel toils behind us, we began our journey to Zurich. For those already stationed in Switzerland, getting to Zurich wasn’t too much of a hassle. For others, it meant 20+ hours of travel - an experience best summarized as "amazing, spectacular, 10/10, would do again". Can you hear the sarcasm? The excitement to meet our co-workers in person surpassed the jet lag & weariness with all of us finally uniting in the evening. With early arrivals already at the hotel and others still on the way, a smaller group of us met near the opera house, where the view of the water at sunset provided a stunning backdrop for some great photos. We all quickly caught up (and met some new teammates!) before continuing on a short walk to the jazzy, goat-themed Widder Bar where the rest of team Zitadel joined us.  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-02.jpg" width="100%" alt="Table at Raclette Stube with wine glasses, a fondue pot, and plates of vegetables, meat, raclette, and potatoes." />
</figure>

Light banter, warm introductions, and plenty of jokes set the tone for our evening as we made our way to Raclette Stube. We all ate to our heart's content - with some of us experiencing raclette for the first time and others opting for the very classic fondue. After the night's festivities, most of us felt like we turned into a ball of cheese.

That first evening together melted away the strain of those last minute changes, leaving us recharged & ready to dive head first into the rest of a very promising retreat.
 
## Activities & Exploration

After we settled in, our retreat really started on day 2 with a series of workshops led by some of our incredible internal subject matter experts.
Our new product marketing manager, Jim, opened up our sessions with an engaging discussion around our documentation and how it is crucial to your (yes, you, dear reader) Zitadel experience. Following Jim, our head of sales, Jason, broke down the sales process for our engineering team - delving into our processes, how we map customer needs while giving us a quick overview of negotiation tactics, and relationship building.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-03.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jason, the head of sales, present his workshop." />
</figure>

Next, Silvan and Max came in with well crafted & informative workshops focused on engineering. Silvan, through a hilarious presentation, provided much needed insights into Zitadel’s performance and detailed next steps on how we plan to improve it. Max gave a detailed overview of the new Typescript login, its implementation, and how it fits into creating an exceptional user experience. Our workshop series ended with our CEO, Florian, breaking down venture capital and offering a clear picture of where we currently are as a company [(check out our latest funding announcement!)](https://zitadel.com/blog/zitadel-the-future-of-identity-infrastructure)

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-04.jpg" width="100%" alt="Group hiking with those at the front smiling at the camera, while others straggle behind, surrounded by lush greenery." />
</figure>

With our workshops wrapped up, we took a casual stroll through Zurich that included us raiding Migros and Coop (a Swiss rite of passage). We tested our limits with an “intense” hike (spoiler: some of us fumbled on the beginner trail and felt winded at the end of it). The stunning views, adorable cows, and fresh air made every step of that hike worth it.

In the days that followed, we explored Lucerne where some of us shopped for souvenirs, crossed Kapellbrücke (with Florian providing important historical context), and wrapped up that day with a breathtaking ride up Pilatus. Of course, more souvenirs were added to our suitcases by the end of that Lucerne day trip.

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-05.jpg" width="100%" alt="Group exiting the Lindt chocolate factory with the factory sign partially visible in the background." />
</figure>

We can't forget to mention one of the most delicious parts of our trip: our visit to the Lindt chocolate factory. We experienced (and ate) a key piece of Swiss history, with some of it ending up in our jackets & bags at the end of the day. 
 
## Wrapping Up

This was a trip filled with fresh energy, joy, collaboration, and a reinforced sense of belonging. We all had the chance to strengthen our existing relationships (and build new ones!) - From celebrating promotions, to learning through in-depth internal workshops, and getting a thorough workout in Zurich - This trip was a memorable experience that left us all inspired and more than excited to continue growing. 

💜 **Here are some staff quotes from the trip:**  

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-06.jpg" width="100%" alt="Jim and Stefan sitting in the hotel lobby playing Magic: The Gathering, with cards spread across the table and drinks nearby." />
</figure>

"Our team retreat in Zurich was fantastic! It was refreshing to connect with everyone on a personal level. My highlight was those late-night Magic the Gathering sessions with Jim and Stefan – it had been 10 years since I'd played, and the competitive spirit with plenty of laughs was the perfect way to unwind and bond! Beyond the fun, it was inspiring to see how strong our company culture has become. As a remote company, these connections are crucial, and it's clear that even with the team nearly doubling in size, newcomers feel welcomed and supported. That creates such a positive and productive environment, no matter where we're working from. I can't wait for our next retreat!"
-**Florian Forster, CEO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-07.jpg" width="100%" alt="Lindt chocolate factory sign prominently displayed on the factory's exterior." />
</figure>

“It was great to show everyone our beautiful country and where the whole story of Zitadel started. I always love to explore something unique for the place we visit, and the Home of Chocolate was just amazing. Even if it was waaaay too much chocolate. :) Getting to know everyone in person is always my favorite part of the team retreat, and I am sure this makes a big difference for our daily remote work.”
-**Fabienne Bühler, CPO**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-08.jpg" width="100%" alt="Zitadel staff in a meeting room, attentively watching Jim, the product marketing manager, present his workshop." />
</figure>

“It was a lovely offsite that hit all the points you hope for out of a team coming together, from long term strategy discussions to rapport building amongst the crew. It’s exciting to have a strong alignment closing out 2024 and going into 2025!”
-**Jim Morrison, Product Marketing Manager**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-09.jpg" width="100%" alt="Team walking through Lucerne, passing buildings with signs for 'Pilatus', 'Victorinox', and 'La Fenice Steakhouse'." />
</figure>

“The Zurich retreat was an extraordinary experience, one that will forever be etched in my memory. To gather with colleagues from across the globe, to see familiar faces, and meet new ones, was truly inspiring. The days were filled with insightful discussions, thought-provoking presentations, and collaborative problem-solving. Yet, the moments outside of the formal agenda also truly resonated with me. The casual conversations, the shared laughter, the late-night card games with Magic the Gathering– these were the moments that forged deeper bonds and strengthened our team. The opportunity to explore the beauty of Switzerland was an added bonus. Whether it was a leisurely stroll through the city or a breathtaking hike in the mountains, each excursion offered a chance to unwind, recharge, and appreciate the simple joys of life. I’m incredibly grateful for the experience and can’t wait to reconnect with my colleagues at the next retreat.”
-**Stefan Benz, Software Engineer**

<figure>
  <img src="/blog/2024-12-05-zur-team-retreat-10.jpg" width="100%" alt="Small group of Zitadel engineers casually chatting near picnic-style seats at an outdoor restaurant." />
</figure>

"I cherished the in-person conversations and unforgettable moments with these amazing people. The presentations, even though they were in the morning, were a valuable source of knowledge about others' work, making this retreat a truly unique experience."
-**Silvan Reusser, Software Engineer**


Discover how our fourth team retreat in Zurich turned last-minute challenges into opportunities for collaboration, connection, and cultural exploration.

Hopp Schwiiz - Company retreat V4


### Advancing the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Modern organizations have a complex landscape of interconnected systems, spanning hybrid and multi-cloud environments and serverless architectures. To succeed, businesses must constantly adapt their security and identity management strategies to improve developer productivity and user experience across multiple systems. This, however, presents significant challenges. Data ownership and security, the complexities of SSO and MFA, developer-friendly APIs and SDKs, and customization to specific use cases are major concerns that can hinder innovation, slow down time-to-market, and impact customer satisfaction."

### Announcing our Series A Funding Update

Through our collective experiences, we learned that the current solutions for Identity and Access Management and Identity Infrastructure fall short in many different areas. Driven by a shared vision to build a modern identity infrastructure platform, Fabienne, Max, and I, along with a talented group of engineers, founded Zitadel four years ago.

![zitadel raises 9 million series a](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure.png)

We're thrilled to announce today that [we've raised $9 million in Series A funding](https://www.prnewswire.com/news-releases/zitadel-raises-9-million-series-a-to-advance-cloud-native-identity-infrastructure-302311461.html) to further our mission of building a modern identity infrastructure platform. This investment, led by Nexus Ventures with continued participation from Floodgate, will enable us to accelerate development and bring Zitadel to even more organizations. We're incredibly grateful for the ongoing support of our investors and partners, who share our passion for creating a secure and developer-friendly identity solution.

### What makes Zitadel a great Identity Platform

#### Architectural Innovation

Zitadel is built as a cloud-native infrastructure project that leverages modern technologies to ensure a platform that scales with customers' needs. What sets Zitadel apart is its **unique event-sourced architecture**, where every change in the system is captured as an immutable event. This not only provides a **complete audit log** but also allows customers to **subscribe to real-time changes** within their Zitadel. Built with the help of Go, NextJs, Angular, Postgres and Redis, Zitadel is designed to be highly scalable, resilient, and secure. Our multi-tenant architecture allows us to support customers of all sizes, from small businesses to large enterprises. And our API-first approach makes it easy to integrate Zitadel with your existing applications and workflows.

![Architectural Innovation](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-overview.png)

#### Flexible Authentication and Login options

Passwordless authentication along with enterprise or social logins are quickly becoming the de facto standards in identity security. Zitadel supports these and provides a customizable log-in experience for businesses that would like to either embed their login workflow, passkeys, or build a completely custom login experience for their project.

#### Built for Multi-tenancy

Multi-tenancy is a fundamental capability of the Zitadel platform, engineered to effortlessly support millions of tenants. This allows customers to manage a vast number of organizations and policies simultaneously, with the flexibility to handle diverse scenarios – from B2B and B2C to complex mixed setups with both. Customers can seamlessly extend the scope of their applications by adding new organizations and granting projects to them, all within a single, unified Zitadel instance. This scalability ensures that Zitadel can grow with your business, no matter how large or complex your needs become.

![Built for Multi-tenancy](/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-multitenancy.png)

#### Engineered for Developers

Zitadel is built with developers in mind, adopting an API-first approach. This means that every feature and function is accessible through well-defined and documented APIs. We offer both gRPC and REST APIs, giving you the flexibility to choose the best fit for your needs. This allows for seamless integration with your existing tech stack, regardless of your preferred programming languages or frameworks. Our comprehensive SDKs further simplify development, reducing the learning curve and accelerating your time to market.

With Zitadel's API-first approach, you can:

- **Automate user management:** Programmatically create, update, and delete users.
- **Customize authentication flows:** Integrate with your own login UIs or implement passwordless authentication.
- **Manage roles and permissions:** Fine-tune access control for your applications.
- **Extend Zitadel's functionality:** Build custom integrations with other services.

#### Enabling frictionless Security Operations

The Zitadel Identity Platform aims to empower security operators with critical capabilities such as secure login policies, audit and access events, etc. We are excited to grow our platform to extend this so the SecOps teams will be able to derive actionable insights through data aggregation, enabling them to monitor compliance and security across user behaviors and application usage patterns. By streamlining complex processes, security operators can leverage advanced usage analytics and threat intelligence capabilities, allowing them to focus on strategic security initiatives.

#### Continued Commitment to Open Source

Open source is at the heart of Zitadel and we firmly believe in the benefits that open source has. Our commitment to open source fosters innovation, encourages collaboration, and ensures that our platform remains adaptable and extensible. We invite everybody to join our thriving community, contribute to the project, and help shape the future of identity infrastructure.

<img src="/blog/2024-11-20-zitadel-the-future-of-identity-infrastructure-numbers.png" alt="Zitadel By The Numbers" />

### What’s Next

We are eager to set forth on the next part of our journey at Zitadel with our community. Check out our [documentation](https://zitadel.com/docs) or join us on [Discord](https://zitadel.com/chat). You can also stay informed of our updates by following us on your preferred social channel \- [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social).

Check out our [documentation](https://zitadel.com/docs)

Join us on [Discord](https://zitadel.com/chat), Follow us on [LinkedIn](https://www.linkedin.com/company/zitadel/), [Twitter](https://x.com/zitadel), or [Bluesky](http://@zitadel.bsky.social)


Zitadel raises $9 million in Series A to advance the future of identity infrastructure to a cloud-native, multi-tenant, and developer-friendly platform.

Zitadel: The Future of Identity Infrastructure


Imagine this: Dave, an IT manager, is responsible for overseeing access for multiple tenants within his company’s cloud service. He has User A from RetailCo and User B from FinanceCorp, both needing access to the same service but with completely different security requirements. User A prefers logging in with their Google account and demands strict password policies. User B uses their company’s Azure AD and requires multi-factor authentication. Dave thought managing a single organization was tough, but this? This is a whole new level of complexity.

As if that wasn't enough, Dave’s company is rapidly growing, introducing more customers from various industries, each with unique compliance and security requirements. Now he has User C from TechInnovators who needs passkeys for enhanced security, and User D from EduWorld demanding seamless SAML integration with their existing single sign-on system. The more tenants Dave’s company takes on, the more convoluted and headache-inducing his job becomes.


## Understanding Multi-Tenant IAM

Implementing multi-tenant Identity and Access management (IAM) systems can be complex, daunting, and filled with hidden challenges. Whether you're addressing the needs of B2B, B2C, or M2M (Machine-to-Machine) environments, multi-tenancy involves a single service instance serving multiple tenants, such as organizations or customers. This requires meticulous data and component segmentation based on service needs and data types. The chaos gets further compounded with individual compliance requirements. 

Consider a simple login screen—two input fields and a button. It looks straightforward, right? But this seemingly simple UI is just the tip of the iceberg. Behind the scenes, there's a multitude of complexities: username and password management, multi-factor authentication options (SMS codes, email codes, authenticator apps), passwordless authentication (face recognition, fingerprint scans), and identity brokering (social logins like Google, Apple, or Facebook).

On top of that, managing security settings, performing regular penetration testing, adhering to standards (such as SCIM, OAuth 2.0, and OpenID Connect), and obtaining certifications (like ISO and SOC 2) add layers of complexity. This is especially true when these features must be replicated across multiple tenants.


<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-01.png" 
    width="100%"
    alt="Underneath the simple login form"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - Underneath the simple login form lies a multitude of complexities—it's merely the tip of the iceberg

  </figcaption>
</figure>


When you introduce multi-tenancy, everything becomes more complex. Each customer brings their unique requirements—username and password for one, passwordless or multi-factor authentication for another, or integration with existing identity systems like Azure AD or Google Business. These varying needs mean you must be able to configure and maintain diverse systems for each tenant, requiring significant time, expertise, and resources.

<figure>
  <img
    src="/blog/2024-07-25-navigating-pitfalls-of-multitenancy-02.png" 
    width="100%"
    alt="The layers of complexities"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 - The layers of complexities behind the the multi-dimensional aspects of multi-tenancy

  </figcaption>
</figure>

Let’s look at a real-world example. Imagine you run an online store serving end consumers, business partners, and your workforce. Each group has different needs: consumers need a user-friendly login and account management system, business partners (such as other sellers) might use their existing enterprise identity systems and may have their own branding requirements, and your workforce needs robust role and permission management to secure administrative tasks.

Yes, it’s possible to manage all these requirements with roles and permissions. However, when you consider the need for different security settings, it often makes more sense to adopt a multi-tenancy approach. As you scale to multiple customers, each one may require unique domains, branding, social logins, and security settings. Managing these variations with a roles and permissions model becomes increasingly complex and unwieldy. Multi-tenancy offers a more streamlined and efficient solution, allowing you to handle these diverse needs effectively and securely.

Questions to ask when dealing with multi-tenancy include: How many levels of tenancy do you need? Are there multiple organizations within a tenant? What scenarios are you dealing with (B2C, B2B, mixed)? Each user group might need different authentication methods, security policies, and compliance requirements (e.g., GDPR, SOC 2, ISO).

Consider the example of a healthcare application where different tenants have varying password hashing requirements (PBKDF2, Argon2, bcrypt) and audit trail needs. Protocol-specific differences also arise; for instance, integrating customers’ existing Azure AD for user federation can lead to numerous configurations and requirements.

So, do you explain outdated or incorrect policies to each customer, or make your software flexible enough to handle these diverse needs while focusing on your business case? Ideally, you want to provide a robust, flexible platform that can accommodate different configurations and compliance requirements.

From an architectural perspective, you have two main options: shared systems or dedicated systems. Shared systems are cost-effective and simpler to manage but come with lower isolation, potential security risks, compliance challenges, and performance issues. Dedicated systems offer enhanced security, compliance, and customization but require more management, infrastructure costs, and personnel.

In summary, identity infrastructure involves much more than just two input fields and a button. It's intricate plumbing work, particularly with multi-tenancy. Always remember that the customer is king: guide them on security best practices, but also ensure your infrastructure can meet their unique needs. A proven track record in security is essential for enterprise deals, so regular penetration tests and certifications are crucial. Make use of established frameworks like OAuth 2.0 and OpenID Connect, and rely on an existing IAM product, such as ZITADEL, for authentication and authorization instead of building your own from scratch.


## How ZITADEL Handles Multi-Tenancy


ZITADEL has a strong focus on supporting SaaS providers with a multi-tenancy use case. This is achieved by allowing multiple organizations within your ZITADEL instance, where all customers can self-manage their own users and roles. ZITADEL operates as a shared system, but it also allows for virtual instances and separate organizations within each instance. This setup is particularly beneficial for B2B app providers where

- you sell your application to other businesses, where each business wants to manage their own users, roles, and access settings
- your customers have different needs for the login flow, such as unique branding, federated logins, password policies, and MFA options
- your customers want to self-manage their users and roles without relying on your administrative team
- users/employees of your customers need to log in or register independently
- not all customers have the same feature set within your application


## How Does Multi-Tenanacy Work in ZITADEL


### Create Organizations

For each customer, create an [organization](https://zitadel.com/docs/concepts/structure/organizations), the equivalent of a tenant, in ZITADEL. Assign an [organization manager](https://zitadel.com/docs/guides/manage/console/managers) to let each customer manage their users independently. Furthermore, users can belong to multiple organizations and switch between them using the same identity, simplifying user management and improving the user experience.

### Custom Configuration

Customers can configure their login look and feel ([branding](https://zitadel.com/docs/guides/manage/customize/branding), [authorization methods](https://zitadel.com/docs/guides/manage/console/roles), [federation](https://zitadel.com/docs/guides/integrate/identity-providers/introduction) or you can do it for them. ZITADEL supports various authentication methods, including [username/password](https://zitadel.com/docs/guides/integrate/login), MFA, and [passwordless options](https://zitadel.com/docs/concepts/features/passkeys). Integrate existing identity providers like Microsoft Azure AD, Google etc., allowing users to log in with their existing corporate credentials.

### Domain Discovery

ZITADEL offers [domain discovery](https://zitadel.com/docs/guides/solution-scenarios/domain-discovery) capabilities, which routes users to the appropriate organization based on their login methods, whether it's a username, email, or phone number. For instance, if a user from "foo.com" logs in, they are routed to the Foo Organization, while a user from "bar.com" is directed to the Bar Organization. This ensures users are authenticated according to their organization’s policies and access settings.


### Project Grants

With [project grants](https://zitadel.com/docs/concepts/structure/granted_projects) (also known as granted projects) your customers can access your project with a subset of roles so they can manage authorizations for their users. Enable granular role management, allowing organizations to assign specific roles and permissions to users based on their needs.



## Standards and Compliance


From a certification and standards compliance perspective, ZITADEL is [GDPR compliant](https://zitadel.com/gdpr) and [ZITADEL’s OIDC library has been certified by the OpenID Foundation](https://zitadel.com/blog/openid-connect-certification). Furthermore, [ZITADEL recently achieved ISO 27001 certification](https://zitadel.com/blog/zitadel-iso-27001-certified) for its information security management system, to maintain the highest standards of information security. ZITADEL assures customers that their data is protected by robust security measures, reflecting global best practices in information security management. 

By providing these capabilities, ZITADEL simplifies the management of multi-tenant IAM systems, ensuring security, flexibility, and ease of use for both administrators and end-users. Moreover, ZITADEL provides support for unlimited users, projects, and applications, making ZITADEL a trusted, secure, and scalable solution for your multi-tenant IAM needs that can grow with your business. 


*This blog post is based on and expands upon the talk "The Perils and Pitfalls of Multi-Tenant Identity Management" from Cloud Native Security Con 2024, North America. For the full discussion, you can watch the video [here](https://www.youtube.com/watch?v=gZHxjnx81WE&list=PLj6h78yzYM2MSAFvjG22ZynvaUs1nnaQJ&index=46).*




This post explores the complexities and solutions of multi-tenant identity management in modern SaaS environments.

The Complexities and Pitfalls of Multi-Tenant Identity and Access Management


In this newsletter, I want to share updates about our platform, and provide some tips on how you can simplify your identity infrastructure.

## Feature highlights

In June,  we shipped over 60 bug fixes, improvements, and new features. Most of those changes were released with ZITADEL [v2.55.0](https://github.com/zitadel/zitadel/releases/tag/v2.55.0), so make sure you are running the latest version.

### New password expiry feature

ZITADEL has introduced a new password age policy feature, enabling organizations to require users to change their passwords regularly. This feature can be easily managed through the Console UI at both instance and organization levels. Users will be prompted to change their password in the Login UI if their current password exceeds the defined age limit. This enhancement strengthens ZITADEL's password management capabilities and provides organizations with greater control over their password lifecycle.

![ZITADEL Console UI password expiry settings](2024-07-04-zitadel-product-newsletter-june-2024-01.png)

### Limit requested roles with new scope

A new scope was introduced to address the issue of excessive roles being returned in tokens (and as such increasing their size) for users belonging to multiple organizations. This new scope allows administrators and applications to specify which organizations' roles should be included in the token, thus streamlining access control for specific use cases. By using the new scope, either once or multiple times, only the roles of the specified organizations will be included in the token.  It's important to note that this feature is not compatible with legacy mode for Introspection or Userinfo endpoints.

[Reserved Scopes](https://zitadel.com/docs/apis/openidoauth/scopes#reserved-scopes)

### More performance improvements

ZITADEL's performance continues to improve as the team works to identify and eliminate bottlenecks. Notably, import operations for large quantities of project grants will witness a substantial enhancement. Furthermore, a significant improvement has been made to OpenID Connect / OAuth 2.0 session checks, effectively addressing recent observations identified during load testing.

### Sending test emails

The newly introduced feature has enhanced ZITADEL’s SMTP functionality by introducing a new testing step within the SMTP provider wizard. This allows administrators to verify their SMTP configuration before saving or updating it, preventing potential issues with email delivery. Additionally, the existing table of SMTP providers now includes a test option for existing configurations. This streamlined testing process ensures that email settings are correct from the outset, saving time and effort. This feature was contributed by the community - thank you for your efforts!

![ZITADEL Console UI sending test email during configuration of SMTP](2024-07-04-zitadel-product-newsletter-june-2024-02.png)

[Changelog](https://zitadel.com/changelog)

## ZITADEL achieves ISO 27001 certification, reinforcing commitment to security

<img src="/blog/2024-07-04-zitadel-product-newsletter-june-2024-03.png" width="25%" align="left" alt="" class="wrap"/>

In a significant milestone for ZITADEL's commitment to security and data protection, we have achieved ISO 27001 certification for our information security management system (ISMS). This internationally recognized standard validates our dedication to maintaining the highest levels of security for our customers' data.

To provide further transparency and information about our security practices, we have also updated our [Trust Center](https://trust.zitadel.com). This resource offers comprehensive details on our security posture, policies, and certifications.

[ZITADEL Achieves ISO 27001 Certification](https://zitadel.com/blog/zitadel-iso-27001-certified)

## 21 more reasons to celebrate: Community contributions in June

* Many Console UI improvements were contributed by [doncicuto](https://github.com/doncicuto) improving the user experience for administrators and users. Moreover [doncicuto](https://github.com/doncicuto) made it possible to send test mails for SMTP configurations and further improvements to mail providers.
* [JesperWe](https://github.com/JesperWe) made it possible for Swedish speakers to use their beautiful native language
* [Schettn](https://github.com/schettn) created a guide to integrate with the [Pylon](https://github.com/getcronit/pylon) framework

Many thanks to the contributors this month for their efforts, helping to improve documentation, tests, and fixing bugs in our code: [dkaminer](https://github.com/dkaminer), [panapol-p](https://github.com/panapol-p), [jvanderneutstulen](https://github.com/jvanderneutstulen), [danielmoisa](https://github.com/danielmoisa), [Loddan](https://github.com/Loddan), [Yxnt](https://github.com/Yxnt), [Cubox](https://github.com/Cubox), [danielloader](https://github.com/danielloader), [jfschubert](https://github.com/jfschubert)

Thinking of contributing? Grab a ‘good first issue’ or start a discussion. 

[Contributing guide](https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md)

## Additional resources

* [ZITADEL Bi-Weekly Office Hours](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)
* [Forza Italia: Retreat the third edition in Bologna](https://zitadel.com/blog/team-retreat-bologna)
* First time contribution (Japanese only): [OSS コントリビュートの実績を解除した](https://zenn.dev/otakakot/articles/dc58ff849e43e4)
* Integrate .NET (Polish only):  [Integracja Aplikacji .NET z Zitadel | bd90](https://bd90.pl/integracja-aplikacji-net-z-zitadel/)

ZITADEL introduced new features and enhancements, including a password expiry feature, a new scope to limit requested roles in tokens, SMTP configuration testing, and performance improvements. ZITADEL achieved ISO 27001 certification, demonstrating its commitment to security.

Product Newsletter June 2024


ZITADEL, a leading provider of cloud-native identity and access management (IAM) solutions, has achieved ISO 27001 certification for its information security management system (ISMS). This certification demonstrates ZITADEL's deeply rooted commitment to protect the confidentiality, availability, and integrity of customer, company, and employee data.

"Obtaining the ISO 27001 certification is a testament to ZITADEL's commitment to information security," said Florian Forster, CEO of ZITADEL. "This certification demonstrates that we have the systems and processes in place to protect our customers' data."

<img src="/blog/2024-06-20-zitadel-iso-27001-certified-01.png" width="35%" align="left" alt="" class="wrap"/>

The ISO 27001 standard is a globally recognized framework for information security management. It provides a comprehensive set of requirements for establishing, implementing, operating, monitoring, reviewing, maintaining, and continually improving the security of ZITADEL.

We designed our information security management system (ISMS) to protect against a wide range of threats, including unauthorized access, data breaches, and cyberattacks. The ISMS further includes processes for managing and responding to security incidents.

"Secure development and operations practices are essential for protecting our customers' data," said Fabienne Bühler, CPO of ZITADEL. "ISO 27001 certification provides our customers with assurance that their data is safe and secure."

ZITADEL's ISO 27001 certification is a valuable asset for the company's customers. It provides customers with assurance that their data is protected by world-class processes and tools .

"Our commitment to information security and data privacy is steadfast," said Maximilian Panne, COO of ZITADEL. "ISO 27001 certification is a recognition of our efforts to protect our customers' data at ZITADEL."



You can verify the validity of our ISO certificate by visiting the [website of the British Assessment Bureau](https://cvs.babcert.com/babcert.asp?c=258048&v=3fs61l6zn6).

Visit the [Trust Center](https://trust.zitadel.com) to learn more about our commitment to information security and data protection.


ZITADEL achieved ISO 27001 certification, demonstrating its dedication to data protection and cybersecurity. This certification provides a framework for information security management, safeguarding data against unauthorized access and cyber attacks.

ZITADEL Achieves ISO 27001 Certification


As a fully remote company, the time we spend together in person is precious.
This is why twice a year, our team gathers for an in person retreat, an opportunity to connect beyond the virtual world.
Last week, we met outside the beautiful city of Bologna for our first retreat of the year.
Since we really enjoyed it, we wanted to share a glimpse of  our week-long adventure.

## Travel Monday and Arrival in Bologna

After a full day of travel by plane or train excitement filled the air as we arrived in Bologna.
The last steps to our accommodation were harder than expected, the location with its view of its flowing hills and grape wines were worth it.
As everybody arrived later in the afternoon we rounded off the evening with pasta, as one would expect in Italy.
We even committed ourselves to cooking two fresh sauces, ragu and a verdure.  The whole team enjoyed the get-together and chatted until late that night over a drink.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-01.jpg" width="100%" alt="Up the hill." />
</figure>

## Workshop Tuesday (with Pizza)

Tuesday marked the beginning of our planned activities. In the morning, we gathered for a collaborative workshop focused on team dynamics and fostering a productive environment. This session, prepared with the guidance of our coach, Diane, was insightful and set a strong foundation for our company culture.

The afternoon was free for everyone to explore the surroundings or engage in spontaneous discussions. Some team members chose to go for a walk, while others stayed back to exchange ideas and plans that have been in their heads for a long time and some others decided to play a game called Kubb.

The highlight of the day was undoubtedly pizza night. Max brought his portable pizza oven, and Florian had spent the afternoon making pizza dough from scratch. As evening fell, we gathered to create our own pizzas. The making was as enjoyable as the delicious outcome. We laughed, shared stories, and ate homemade pizzas—a perfect blend of teamwork and fun.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-02.jpg" width="100%" alt="Pizza Night" />
</figure>

## Wednesday, Continued Workshops and Exploration

Wednesday morning continued with another productive workshop session. Building on the previous day's discussions and results, we delved deeper into our operating principles, aligning our visions and strengthening our collaborative spirit.

The afternoon was again free for personal activities. These unstructured times were as valuable as the workshops, allowing for organic connections and idea exchanges.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-03.jpg" width="100%" alt="Workshop" />
</figure>

### A Culinary Adventure on Thursday

Thursday was dedicated entirely to food. We went on a walking food tour in Bologna, immersing ourselves in the local culinary delights. From fresh pasta to delicious pastries, we tasted a variety of specialties that the city is renowned for, such as cold-cuts, Tiggele, Tortellini al Brodo, Tagliatelle al Ragù. This gastronomic journey was not just about food but also about experiencing the culture and history of Bologna together.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-04.jpg" width="100%" alt="Pasta" />
</figure>

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-05.jpg" width="100%" alt="Church" />
</figure>

### The Importance of In-Person Retreats

We figured that these in-person retreats are crucial for our company culture. They provide us with a unique opportunity to build stronger relationships and learn about each other's interests and expertise. Spending time together allows us to connect on a personal and social level, enhancing our collaboration and understanding of each other, far beyond what is possible through modern communication channels like video and audio.

Our week in Bologna was a resounding success. From the insightful workshops to unforgettable culinary experiences, we cherished every moment. These retreats remind us of the importance of human connection in a digital world. It made us aware that remote work is hard work, and we are already looking forward to seeing each other again in person in the next retreat.

<figure>
    <img src="/blog/2024-06-19-team-retreat-bologna-06.jpg" width="100%" alt="Team" />
</figure>


As a fully remote company, the time we spend together in person is precious. Get some insights about our third team retreat taking place in Bologna.

Forza Italia: Retreat the third edition in Bologna


This is Max from ZITADEL. As in the previous months, in this update I want to highlight our product updates, and tips and tricks in making your identity infrastructure easier.

## Feature highlights

Again in May, we kept the pace high with more than 76 improvements shipped to our self-hosting and cloud users. Let’s go through the key improvements to ZITADEL this month.

[All changes](https://zitadel.com/changelog)

### Improvements using external SAML IdPs

We understand that many organizations, particularly enterprises, leverage SAML for user federation. In response to your needs, we've made significant steps in enhancing ZITADEL's interoperability with various SAML providers this May.

Previously, ZITADEL relied on a persistent nameID format, requiring external identity providers (IdPs) to consistently return this format for linking users. However, some IdPs utilize transient nameIDs, leading to mismatched user identities.

This update allows you to define the preferred nameID format and configure how ZITADEL maps users based on attributes received from the external IdP. For instance, you can leverage email addresses from the IdP to link users with matching emails in ZITADEL.

While ZITADEL offers pre-configured templates for external IdPs that utilize OpenID Connect, we're considering extending this functionality to SAML providers. We value your feedback – let us know your thoughts on this potential addition!

[Should we support SAML provider templates?](https://github.com/zitadel/zitadel/issues/7995)

### Making it easier to manage resources programmatically

While you get all the functionality through a UI, we are api-first and you are able to manage everything through our APIs. Managing ZITADEL resources and configuration programmatically just got simpler with some recent updates.

When you start with a new ZITADEL system, you need a first admin user to login and configure your system. In the past it was only possible to either create a human user or a service user, but not both at the same time. With a recent update creating both a human and service user is now possible, giving you hopefully a much simpler and easier access to configure ZITADEL from the start.

Moreover our [terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) got significantly updated and improved over the last weeks. Examples are managing organization and user metadata as well as managing SAML and OIDC generic external identity provider templates.

### Scaling to multi-million identities

We're excited to announce performance optimizations in ZITADEL to meet the growing needs of our enterprise customers! This update addresses the demands of multi-million identity deployments and aligns with our ongoing commitment to performance improvement. We've focused on enhancing the token endpoint, specifically for new token creation, alongside optimizations for many frequently used ZITADEL APIs. For detailed upgrade guidance, please refer to the technical advisories.

[Technical Advisories](https://zitadel.com/docs/support/technical_advisory)

## Office hours

Gear up for deeper dives and live engagement! We are excited to announce bi-weekly office hours on our Discord server for our community. These hour-long sessions will offer in-depth explorations of upcoming features, followed by a live Q&A where the ZITADEL team tackles your burning questions.

The first session, held on May 29th, delved into the exciting new version of the Actions feature.

Don't miss out on this chance to connect with the ZITADEL team and stay ahead of the curve! Checkout our [meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md) for upcoming sessions.

[Office hours meeting schedule](https://github.com/zitadel/zitadel/blob/main/MEETING_SCHEDULE.md)

## You will become a Pro

ZITADEL Cloud subscription model is changing to a simpler daily active user (DAU) model on July 1st for easier cost allocation and full feature access across instances. This serves as a friendly reminder that accounts not already on our Pro plan will automatically update.

All new subscription plans will include in the base fee 25’000 Daily Active Users in a month, one custom domain, and 3 external identity providers.

[Pricing Plans](https://zitadel.com/pricing)

## Contributors for the win

19 contributions came from our community in May. 
Thank you for your the continued support and the time you put in to make the project better for everyone.

* [yordis](https://github.com/yordis) helped us bring the typescript repo for our next gen login UI significantly forwards
* Never forget to activate your email service provider with this change from [doncicuto](https://github.com/doncicuto)
* Also by [doncicuto](https://github.com/doncicuto) comes a solution to a  community request, adding customization options to console navigation buttons
* [sujoysb](https://github.com/sujoysb) improved the error messages and user feedback for password complexity validations
* [calRobert](https://github.com/CalRobert), [jayPe69](https://github.com/jayPe69), [aurel004](https://github.com/aurel004), [burahimu](https://github.com/burahimu) all helped with our translations, and typos (is our French that bad? Apologies.)
* [cr1cr1](https://github.com/cr1cr1), [exeteres](https://github.com/exeteres), [kleberbaum](https://github.com/kleberbaum) contributed various improvement to our Charts
* Sign tokens FAPI-compliant with ES256 and PS256 thanks to [nannany](https://github.com/nannany)
* [ymarcus93](https://github.com/ymarcus93) increased compatibility with certain identity providers and fixed some issues around the library

## Additional resources

* [Passkeys: A Shattered Dream](https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/)
* [The SaaS Trends Report | Q1 2024 | Vendr](https://www.vendr.com/insights/saas-trends-report-q1-2024#top-categories-renewed) - Cybersecurity at the top
* [Navigating Session Logouts, Timeouts, and Token Expiry](https://zitadel.com/blog/session-timeouts-logouts)
* [Google Online Security Blog: On Fire Drills and Phishing Tests](https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html)

New Success Story: [Achieving 70% Faster B2B Integration in Document Automation at BLP Digital](https://zitadel.com/blog/success-story-blp)

Thanks for reading, \
Max


Updates on ZITADEL, and tips and tricks to simplify your identity infrastructure for May 2024. In this episode we highlight improvements to SAML IdPs, managing resources programmatically, and scaling to millions of identities.

Product Newsletter May 2024


We're thrilled to announce a significant milestone for ZITADEL: exceeding 100 paying customers as we entered 2024! This achievement marks a pivotal moment in our journey to establish ZITADEL as the leading open-source identity infrastructure platform.

While reaching over 7,000 GitHub stars, having 160+ active contributors across our projects, and a thriving 2,000-member Discord community are fantastic signs of our growing popularity, winning the trust of over 100 paying customers by the start of 2024 demonstrates the demand for a modern identity platform like ZITADEL and sets the stage for continued, rapid growth.

Our customers represent a diverse range of organizations who have chosen ZITADEL for its:

* **Unmatched security and transparency:** The open-source nature of ZITADEL fosters trust and allows for independent security audits, ensuring robust protection for user data.
* **Flexibility and customization:** ZITADEL empowers businesses to tailor its functionalities to their specific needs, offering a high degree of control over their identity infrastructure.
* **Self-hosting:** Many smaller customers trust the scalability and the peace of mind offered by our managed cloud service. Businesses have the option of self-hosting ZITADEL, granting complete control over user data and deployment environment, with support available for added peace of mind.
* **Advanced multi-tenancy:** ZITADEL's robust multi-tenancy features are ideal for B2B scenarios. It allows organizations to manage multiple tenants (customers or partners) with data separation, customizable branding, and secure access control.
* **Enhanced SSO and MFA:** Our customers want to replace their SSO and MFA capabilities with a more robust solution that offers technical and operational scalability. ZITADEL provides teams the functionality to manage their own security policies and SSO configuration coupled with modern phishing-resistant, multifactor authentication methods.

This milestone is a testament to the incredible work done by our amazing community and the unwavering commitment of our team. We are deeply grateful for the trust our customers have placed in ZITADEL, and we remain focused on providing the best possible open-source identity solution.

Join us on this exciting journey! Simplify your identity infrastructure and [get started with ZITADEL Cloud](https://zitadel.com) today.

Together, let's build an open and secure identity infrastructure!


ZITADEL is on Track towards Building the Best Open source Identity Infrastructure

All posts/ #about_us