Documentation (regions and data residency) — Firezone

Cited by

Facts read from this source

• Regions Report an error

  “Firezone Cloud offers US and EU account regions. Your choice determines where Firezone stores your account data and which endpoints your deployment uses. Each account is assigned to one region.”

• Storage locations Report an error

  “US accounts: Iowa (centralus) and Arizona (westus3). EU accounts: Gävle, Sweden (swedencentral), and Paris, France (francecentral).”

• Shared registry Report an error

  “Both US and EU accounts also have their account slugs, account IDs, region identifiers, and slug registration timestamps stored in a shared Microsoft Azure registry in East US. This keeps account slugs unique across regions.”

• Audit log retention Report an error

  “Audit logs: Retained for 90 days. Copies exported through a Log Sink follow the destination's retention settings.”

• Backup retention Report an error

  “Account data backups: Retained for 30 days. For EU accounts, a geo-redundant backup copy is stored in Sweden South, keeping the backups within the EU.”

• List Report an error

  “Microsoft Azure: Hosts the control plane and Relays in the locations on this page. For EU accounts, Azure Communication Services sends service email with its data location set to Europe. Stripe (US): Processes billing contact, customer, subscription, and transaction information. HubSpot (US): Processes contact details and correspondence for sales and support. PostHog (US): Processes product usage and configuration-change metadata, including account identifiers and names. Both regions use the same US project. Website analytics are subject to separate consent controls. Sentry (US): Processes crash and error diagnostics.”

• Staff access cross region Report an error

  “Firezone's authorized staff in the US can also access EU-hosted account data when operating or supporting the service.”

• SOC 2 Report an error

  “Request the latest SOC 2 report from the Trust Center.”

• Regional endpoints Report an error

  “Admin portal https://app.firezone.dev https://eu.app.firezone.dev Control plane API wss://api.firezone.dev wss://eu.api.firezone.dev REST API https://rest-api.firezone.dev https://eu.rest-api.firezone.dev MCP server https://rest-api.firezone.dev/mcp https://eu.rest-api.firezone.dev/mcp”

• Default control plane Report an error

  “Clients and Gateways default to the US control plane API. For an EU account, use the EU endpoints and credentials issued by the EU account:”

• Traffic not region restricted Report an error

  “Selecting the EU account region does not restrict network traffic to the EU. Relays are deployed worldwide to provide nearby fallback paths, and EU accounts can use Relays outside the EU.”

• Relay encryption Report an error

  “Relays forward WireGuard-encrypted packets and cannot decrypt their contents. They process the endpoint IP addresses and ports needed to forward traffic.”

• Wireguard keys local Report an error

  “WireGuard private keys remain on your Clients and Gateways.”

• Region transfer Report an error

  “If your requirements change, an admin can request a move under Settings → Account → Data residency. Firezone support will arrange a maintenance window, copy your users, groups, service accounts, and access configuration to the destination region, then enable the account there. Plan for up to 8 hours of downtime.”

• Transfer audit logs Report an error

  “Historical audit logs don't move. Export and verify any logs you need to keep before the transfer. Firezone deletes audit logs from the original region when the account transfer is complete.”

• Log sinks Report an error

  “The services you connect to Firezone have their own data locations. For example, if you configure a Log Sink outside the EU, your logs are exported there even when your Firezone account is in the EU.”

• Flow logs no packet contents Report an error

  “Flow Logs do not contain packet contents.”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Logs, audit trail & incident response
• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer European sovereignty
• The IT Lead Logs, audit trail & incident response
• The IT Lead European sovereignty
• The MSP Technician Logs, audit trail & incident response
• The MSP Technician Architecture, reliability & security assurance
• The MSP Technician European sovereignty
• The Operations Manager Logs, audit trail & incident response
• The Operations Manager Architecture, reliability & security assurance
• The Operations Manager European sovereignty
• The Information Security Officer Logs, audit trail & incident response
• The Information Security Officer Architecture, reliability & security assurance
• The Information Security Officer European sovereignty
• The Skeptic Logs, audit trail & incident response
• The Skeptic Architecture, reliability & security assurance
• The Skeptic European sovereignty