Business VPN & Zero Trust Access
Firezone
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Firezone, Inc. · www.firezone.dev
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Firezone at a glance
- Vendor
- Firezone, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Outside the EU by default; pages mention the US and the EU source, captured 5 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Firezone 3.5/5, the mean of 6 judges. Firezone is an open-source zero trust access platform built on WireGuard, with weighted totals ranging from 6.8 to 7.0. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Firezone is an open-source zero trust access platform built on WireGuard, with weighted totals ranging from 6.8 to 7.0. Its strongest mark, 8 on identity and policy, rests on directory sync with Okta, Microsoft Entra ID and Google Workspace that deletes a suspended or departed user's identity and clears every active session, on default-deny per-resource policies, and on posture checks built from 350-plus device signals. Most other criteria cluster at 7; visibility and audit scores run 6-7, with the IT lead at 6 over 90-day log retention and no public information on alerts for unusual access. Sovereignty scored lowest at 4-5, where judges weighed the same facts differently: a Cloud EU account hosts the control plane in Sweden and France, but the contracting entity is a US company, US staff can access EU-hosted account data, and billing, CRM and diagnostics run through US subprocessors even on EU accounts. Pricing transparency scored 7, with per-seat prices public in dollars and euros and only Enterprise priced through sales.
Speaks for it
- Directory sync with Okta, Microsoft Entra ID and Google Workspace deletes a suspended or departed user's identity and clears every active session, earning identity and policy the top score of 8.
- Access is default-deny per application, DNS name or subnet, through self-run gateways that make outbound connections only and fall back to 34 relay clusters worldwide.
- Four audit log streams are documented and exportable through the REST API on every plan, with streaming to Splunk or Datadog on Business and Enterprise.
- All source code is published on GitHub, alongside SOC 2 Type 2 compliance, a Q2 2026 pentest and nine published security advisories.
- Per-seat prices are published in dollars and euros, and Starter is free for up to 6 users with no credit card required.
Held against it
- Sovereignty scored 4-5, the lowest of any criterion, with the contract held by Firezone, Inc. of San Francisco and US staff able to access EU-hosted account data.
- Billing, CRM, usage analytics and diagnostics run through US subprocessors even on EU accounts, where account slugs and IDs sit in a shared Microsoft Azure instance in East US.
- Audit logs are retained for 90 days, and we found no public information on alerts or webhooks for unusual access.
- The published advisories name Windows, macOS and Linux clients only, and we found no public information on mobile clients, always-on auto-connect or clientless browser access.
- We found no public information on just-in-time, time-boxed access with approval, so time-limited contractor access is unproven.
Best for
- You need access to end with employment: suspending or deleting someone in your identity provider clears every one of their sessions.
- Your team runs its own servers and wants outbound-only gateways managed as code, with a Terraform provider and a REST API on every plan.
- You want published per-seat prices in dollars and euros, and a free tier for up to 6 users to trial first.
- You weigh source-level transparency heavily, from open code on GitHub to dated security advisories with fixes.
Avoid if
- You must show a client or regulator a fully European data chain: the contracting entity is a US company and US subprocessors handle billing, CRM and diagnostics even on EU accounts.
- Your users connect from phones or a browser: the published clients cover Windows, macOS and Linux, and we found no public information on iOS or Android clients or clientless access.
- You need a year of audit evidence without exporting: retention is 90 days unless logs go to your own destination.
- You are a service provider wanting a tenant per client: we found no public information on a multi-tenant console, and resale is restricted unless agreed in writing.
The scores
| Criterion | Panel median |
|---|---|
| Access model & connectivity | 3.5 of 5 |
| Identity, access policy & device posture | 4 of 5 |
| Logs, audit trail & incident response | 3.5 of 5 |
| Deployment, API & administration | 3.5 of 5 |
| Architecture, reliability & security assurance | 3.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Access model & connectivity
Show reasoningHide reasoning
How this is scored
What the product connects and how: a managed gateway VPN with shared or dedicated gateways and dedicated static IPs, a peer-to-peer mesh between devices and servers, access per application or resource (ZTNA), site-to-site links between offices and cloud networks (AWS, Azure, Google Cloud), connectors behind a firewall without inbound ports, the protocols (WireGuard, IPsec, OpenVPN, a vendor protocol), split tunnelling and full tunnelling, always-on and auto-connect, clients for Windows, macOS, Linux, iOS, Android and ChromeOS, the gateway and relay locations, NAT traversal and relays, and access for contractors without a managed device.
0 — Gives no remote access of its own; a browser extension, a consumer VPN for anonymous browsing or a security tool that only filters traffic.
3 — A VPN client that connects users to one gateway or network; site-to-site, per-resource access, the clients per platform and the locations are basic or not described.
5 — Clients for Windows, macOS, Linux, iOS and Android, a modern protocol (WireGuard or IPsec), access to private networks through a gateway or connector without inbound firewall rules, split tunnelling, dedicated static IPs or self-run gateways, site-to-site or cloud network links, and the gateway or relay locations named.
8 — Access per application or resource rather than whole networks, peer-to-peer connections with relays as fallback, always-on and auto-connect, connectors for the major clouds and Kubernetes, gateways in many named regions, private DNS and split DNS, clientless browser access for contractors, and the protocol and encryption choices documented.
10 — Connectivity a distributed company runs on: every access model above in one product, high-availability gateways and connectors with failover documented, performance and throughput published per gateway type, post-quantum or equivalent key exchange documented, and an exit path to run the same network on self-hosted components.
The IT Lead
This is the model I want: default-deny policies per application, DNS name or subnet, gateways we run ourselves next to the ERP with outbound-only connections, and WireGuard with direct connections falling back to relays worldwide. The pages show Windows, macOS and Linux clients and use cases from site-to-site to full-tunnel, but I found no public information on mobile clients, always-on auto-connect or a dedicated static egress IP for the supplier portal. 1 3 6 15 16
The DevOps Engineer
Gateways make outbound-only connections as a Linux binary, VM or container on my own boxes, so nothing at Hetzner or AWS needs an inbound port, and traffic falls back to 34 relay clusters worldwide when hole-punching fails. Access is per resource — DNS, IP or CIDR with port filters, and a dedicated address per DNS resource — rather than whole networks, on WireGuard with ephemeral keys that never leave clients and gateways, and mesh, site-to-site and full-tunnel are listed use cases. We found no public information on always-on and auto-connect, clientless browser access for contractors, or an explicitly named Kubernetes connector, and the security advisories name macOS, Windows and Linux clients with no public information on other platforms. 1 3 6 9 15 16
The MSP Technician
Per-resource access with port and protocol filters, self-run Linux gateways that only make outbound connections, direct connections falling back to 34 relay clusters worldwide, and WireGuard with private keys kept on the client and gateway — that covers most of what my thirty clients need, including site-to-site and full-tunnel use cases. The captured pages name Windows, macOS and Linux clients; we found no public information on iOS or Android clients, always-on or auto-connect, or clientless browser access for contractors. 1 2 3 6 15 16
The Operations Manager
Access runs on WireGuard with policies down to individual applications and subnets, gateways I deploy myself on outbound-only connections next to each project system, and fallback through 34 relay clusters worldwide, with mesh, site-to-site and full-tunnel uses named. What the pages do not show me is mobile clients — the advisories only name Windows, macOS and Linux — nor always-on or auto-connect settings, nor clientless browser access for contractors. 1 3 9 15 16
The Information Security Officer
Group policies grant access to individual applications, DNS resources and whole subnets, with WireGuard end-to-end encryption, direct connections that fall back to 34 relay clusters worldwide, and outbound-only gateways running on our own infrastructure. Clients are evidenced for Windows, macOS and Linux; we found no public information on iOS or Android clients, always-on or auto-connect behaviour, or clientless browser access for contractors. 1 2 3 9 15 16
The Skeptic
Per-resource access with group policies, traffic routed directly to gateways the customer runs on its own infrastructure with 34 relay clusters as fallback, all on WireGuard with the protocol and key handling documented, and gateways that only make outbound connections so there are no inbound ports. We found no public information on always-on or auto-connect, clientless browser access for contractors, or mobile clients — the published advisories name Windows, macOS and Linux clients only. 1 2 3 9 15 16
Identity, access policy & device posture
Show reasoningHide reasoning
How this is scored
Whether access follows identity and the state of the device rather than the network: single sign-on with Microsoft Entra ID, Google Workspace, Okta or any OIDC/SAML provider, SCIM or directory sync so a leaver loses access, multi-factor authentication, groups and per-resource access policies, least-privilege defaults, device posture checks (operating system version, disk encryption, EDR or MDM status, managed device certificates), just-in-time or time-limited access with approval, session lifetimes and re-authentication, and access revoked when a device is lost.
0 — No user identity at all; a shared key or configuration file grants access to the whole network.
3 — User accounts with a password or one identity provider; groups, per-resource policies and device checks are basic or not described.
5 — Single sign-on with Entra ID, Google Workspace and Okta, multi-factor authentication, user groups, access policies that restrict groups to named networks, resources or ports, automatic or SCIM-based deprovisioning, and basic device posture checks such as operating system version.
8 — SCIM provisioning from the major identity providers, per-resource policies with least privilege by default, device posture from EDR or MDM tools (for example CrowdStrike, SentinelOne, Intune, Jamf), just-in-time access with approval and expiry, session re-authentication, policies kept as code, and the policy model documented.
10 — Access control a security team can audit and trust: continuous evaluation of identity and device state during a session, policies tested before they apply, emergency revocation documented, device identity bound to hardware, and the decision for every connection explainable from the logs.
The IT Lead
Directory sync with Microsoft Entra ID, Google Workspace and Okta deletes a leaver's identity and clears all their sessions the moment they are suspended, groups carry per-resource policies on a default-deny model, and posture checks read Intune compliance, disk encryption and EDR status. That is the same-day leaver lockdown I need; I found no public information on just-in-time approval or session re-authentication, and the sync itself lands on the Business plan. 1 4 6 15
The DevOps Engineer
Directory sync from Okta, Microsoft Entra ID and Google Workspace with nested groups, and deleting or suspending a user removes their identity and clears every client and admin session — that is the leaver story I want before I retire the shared bastion key. Policies are default-deny, group-based and per resource, manageable in Terraform, with posture checks (MDM compliant, disk encryption, no active EDR threats, firewall, corporate owned) built from 350+ device signals against named tools like Intune, Jamf, SentinelOne and Sophos. We found no public information on just-in-time access with approval and expiry, or session re-authentication. 1 3 4 6 7 15
The MSP Technician
Directory sync from Entra ID, Google Workspace and Okta with near-real-time deprovisioning — suspend someone in the directory and every session clears — plus default-deny, per-resource group policies, posture checks from Intune, SentinelOne, Sophos and others over 350-plus device signals, and policies kept as code in Terraform. This is the level I want before moving a dental chain off hand-built VPNs; we found no public information on just-in-time, time-limited access with approval. 1 3 4 6 15
The Operations Manager
Directory sync with Google Workspace, Microsoft Entra ID and Okta, where suspending someone in the identity provider signs them out of every device within seconds, is precisely the "access ends with the contract" behaviour I need, and deleting a group revokes its policies immediately. Default-deny with group-based grants per resource, plus device posture checks from Intune, SentinelOne, Jamf and peers across 380 parameters, and policies managed as code in Terraform. I found no public information on just-in-time or time-boxed approvals. 1 3 4 6 7 15
The Information Security Officer
Directory sync with Okta, Microsoft Entra ID and Google Workspace deletes identities and clears every session when someone is suspended, and ready-made posture checks cover MDM compliance, disk encryption, EDR threats and firewall state before a connection, under a default-deny model with per-resource policies manageable as code. We found no public information on just-in-time access with approval and expiry, so time-boxed contractor access is unproven. 1 3 4 6 7 15
The Skeptic
Access is default-deny with groups granted to named resources, directory sync with Entra ID, Google Workspace and Okta deletes a leaver's identity and clears every active session, and posture checks read disk encryption, firewall state and EDR verdicts from tools like Intune and SentinelOne across 350-plus device signals. Policies are managed as code in Terraform and authorization is described as checked on every connection; we found no public information on just-in-time approval flows, and SCIM is not the term the documentation uses. 1 4 6 15
Logs, audit trail & incident response
Show reasoningHide reasoning
How this is scored
What can be seen and proven afterwards: connection and access logs (who reached which resource from which device, when), admin and configuration audit logs, how long logs are kept per plan, log export and streaming to a SIEM (Splunk, Microsoft Sentinel, Datadog, an S3 bucket), alerts on unusual access, a view of active sessions and the ability to end them, DNS logs where DNS filtering is part of the product, and what the vendor states it does not log, such as the content of traffic.
0 — No logs of any kind; the admin cannot see who connected.
3 — A list of connected users or devices; access logs, admin audit logs, retention and export are basic or not described.
5 — Connection or access logs per user and device, an admin audit log of configuration changes, the retention period stated, log export by CSV or API, a view of active sessions or devices with the option to disconnect or revoke them, and a statement of what traffic data is and is not logged.
8 — Log streaming to named SIEM tools, network flow logs per resource, retention of a year or more stated per plan, alerts or webhooks on security events, logs filterable by user, device and resource, and the log schema documented.
10 — An audit trail that holds up in an investigation: every access decision and admin action recorded with its policy and reason, logs signed or tamper-evident, evidence suitable for ISO 27001, NIS2 or DORA audits, full export in an open format, and the customer able to keep logs entirely on its own infrastructure.
The IT Lead
Four streams — change, session, flow and API request logs — with a documented identifier scheme, 90-day retention, export to log sinks and SIEM streaming to Splunk or Datadog on the upper tiers. Retention is under three months unless we export ourselves, and I found no public information on alerts for unusual access or a live view to end an active session. 1 5 8
The DevOps Engineer
Four documented log streams — change, session, flow and API request — with a published log ID schema, at-least-once delivery to Log Sinks deduplicated by log ID, flow logs attributing traffic to actor, policy and resource, and explicit statements that flow logs carry no packet contents and Firezone cannot see traffic contents. Audit logs are retained 90 days (exports follow the destination's retention), available on all plans, and streamable to Splunk or Datadog on Business and Enterprise. We found no public information on alerts or webhooks on security events, and retention is far short of a year per plan. 1 5 8 11
The MSP Technician
Four log streams including per-flow records that attribute traffic to actor, policy and resource, a documented log identifier scheme with a documented export API on every plan, a stated 90-day retention, streaming to Splunk or Datadog on Business and Enterprise, and a clear statement that flow logs carry no packet contents. Good enough to show a client after an incident, though retention tops out at 90 days in the captured pages and we found no public information on alerts for unusual access or a documented view for ending active sessions. 1 5 8
The Operations Manager
Four documented log streams — changes, sessions, flows and API requests — with the identifier format, delivery guarantee and filters spelled out, flow logs attributing traffic to actor, policy and resource without packet contents, and a stated 90-day retention with export through Log Sinks that follow my own destination's retention. Streaming to Splunk or Datadog sits on the higher plans; I found no public information on alerts for unusual access. 1 5 8 11
The Information Security Officer
Four log streams — Change, Session, Flow and API Request — record actor, policy and resource with a documented identifier scheme, monotonic change-log ordering and at-least-once delivery, streaming to Splunk or Datadog on the higher plans, and the vendor states it cannot see traffic contents. Default retention is 90 days, so a year of evidence for an auditor requires a Log Sink to my own SIEM, and we found no public information on alerts or webhooks for unusual access. 1 5 8 11
The Skeptic
Four log streams are documented in depth — change, session, flow and API request — with the identifier format, at-least-once delivery and a deduplication key, filtering by time range and actor, export through the REST API on all plans, and streaming to Splunk or Datadog on Business and Enterprise. Retention is stated as 90 days for audit logs, the vendor states flow logs carry no packet contents, but we found no public information on alerts or webhooks for security events. 1 5 8
Deployment, API & administration
Show reasoningHide reasoning
How this is scored
How the product is rolled out and run by a small IT team or a service provider: time to the first connection, deployment of clients through MDM (Intune, Jamf, Kandji) with preconfigured settings, a central admin console, a documented REST API, a Terraform provider or configuration as code, roles for administrators, several teams, sites or customer tenants in one account, a multi-tenant console for managed service providers, a self-hosted or on-premises edition, the update process for clients and gateways, and support channels and hours.
0 — No central administration; every client is configured by hand with no console.
3 — A web console to add users and gateways; the API, MDM deployment, admin roles and multi-tenant set-up are basic or not described.
5 — A central admin console, a documented REST API, client deployment through MDM with preconfigured settings, admin roles, several networks or sites in one account, client updates managed centrally, and support channels and response times stated per plan.
8 — A Terraform provider or configuration as code, a multi-tenant console for service providers or several organisations, granular admin roles, a self-hosted or on-premises edition documented for production, gateways deployable as containers or cloud images, and webhooks or integrations with ticketing and chat tools.
10 — Administration that scales across many sites and tenants: every setting reachable by API and code with parity stated, staged rollouts of client and gateway updates, a self-hosted edition with feature parity stated, reseller or MSP billing per tenant, and an exit path for configuration and users documented.
The IT Lead
Ten minutes to a first connection, a REST API on every plan, a Terraform provider that manages sites, resources, policies and gateways and openly lists what still must be done in the portal, and client configuration that can be forced through MDM. That suits a three-person team like mine; I found no public information on centrally staged client updates, granular admin roles, or a provider multi-tenant console. 4 6 7 9 16
The DevOps Engineer
A Terraform provider manages sites, resources, policies, groups, actors and gateways, and the provider docs are unusually honest about the edges — auth providers, device enrollment, posture integrations, logs and service-account tokens stay in the portal, and gateways cannot yet be created via the REST API. The REST API runs on all plans with a Swagger UI, an MCP server and a CLI exist, client configuration can be forced via MDM, synced users get an unprivileged role by default, and support tiers per plan (community, priority email, dedicated Slack on Enterprise) are published. We found no public information on a multi-tenant console for service providers, and self-hosting the entire platform is permitted by the licence but the vendor states it offers no documentation or support for it. 1 6 7 9 10 16
The MSP Technician
A first connection in under ten minutes, a documented REST API on every plan with Swagger UI, a Terraform provider covering sites, resources, policies and gateways plus import of an existing account, MDM-enforced client configuration, several sites in one account, and support channels stated per plan — the automation depth is real, and the docs are honest about what Terraform does not manage. For me as a service provider we found no public information on a multi-tenant console with a tenant per client, the terms restrict reselling the hosted service unless agreed in writing, and the vendor states it does not currently offer documentation or support for self-hosting the entire platform. 6 7 9 10 16
The Operations Manager
A simple deployment in under ten minutes, a REST API on all plans with Swagger and an MCP server, a Terraform provider for sites, resources, policies and gateways, gateways running as containers on my own infrastructure, and support tiers from community to priority email per plan. The Terraform documentation is candid that authentication providers, posture integrations and service-account tokens must be done in the web portal; I found no public information on a multi-tenant console for my external provider, and self-hosting the whole platform is explicitly unsupported. 6 7 9 10 16
The Information Security Officer
A documented REST API on all plans, a Terraform provider for sites, resources, policies and groups, MDM-integrated client deployment and a first connection in under 10 minutes fit a small team. Several pieces stay manual: gateways cannot yet be created through the API, logs and authentication providers are not manageable as code, resale is restricted without written agreement, and we found no public information on a multi-tenant console for service providers. 6 7 9 10 15
The Skeptic
Setup is quoted at under 10 minutes, the REST API with a Swagger reference and an MCP server runs on all plans, Terraform manages sites, resources, policies, groups and gateways, and support channels are published per plan. The Terraform documentation itself lists what stays manual — authentication providers, device enrollment, posture integrations, service-account tokens — and gateways cannot yet be created through the REST API; we found no public information on a multi-tenant console for service providers, and the terms restrict resale unless agreed in writing. 1 6 7 9 16
Architecture, reliability & security assurance
Show reasoningHide reasoning
How this is scored
How the product is built and how its claims are proven: a published architecture showing what the coordination servers, relays and gateways see, whether traffic passes through the vendor or end to end between devices, encryption and key management, open-source clients or servers, independent security audits and penetration tests with reports or summaries published, a vulnerability disclosure or bug bounty programme, high availability and failover of the vendor's control plane, what happens to existing connections when the vendor's service is down, the vendor's own public status page and incident history, and an SLA.
0 — Nothing is published about how the product works or is secured.
3 — Encryption is mentioned in marketing terms; architecture, audits, availability and the vendor's status page are basic or not described.
5 — An architecture overview of clients, gateways and the control plane, the encryption protocol and key handling named, an independent security audit or penetration test stated, a vulnerability disclosure contact, the vendor's public status page, and an availability SLA on the business plans.
8 — A security whitepaper with the data flow and what the vendor can see, open-source clients or core components, audit or pentest reports or summaries published by the auditor, a bug bounty, high availability of the control plane documented, existing connections kept alive when the control plane is down, and the incident history public with post-mortems.
10 — Assurance a regulated buyer can verify: fully open-source and reproducible components, recurring independent audits published in full, the control plane self-hostable with no call home, a documented failure mode for every vendor component, and several years of availability published.
The IT Lead
All source code is on GitHub, traffic is end-to-end encrypted on WireGuard with keys kept on our clients and gateways, relays cannot decrypt, and there is SOC 2 Type 2, a Q2 2026 penetration test and a public page of detailed security advisories with fixes. Audit reports come on request rather than published in full, the SLA is conditional on plan, and I found no public information on whether existing connections survive a control-plane outage. 1 3 10 13 16
The DevOps Engineer
This is what I read first: the regional availability page states relays forward WireGuard-encrypted packets, cannot decrypt them, and process only endpoint IP addresses and ports; private keys stay on clients and gateways; the architecture page names the protocol and NIST zero trust reference; and all source code is on GitHub. SOC 2 Type 2 compliance, a Q2 2026 pentest, a vulnerability disclosure policy, a public advisories page with nine dated, detailed advisories, a status page and 99.994%+ historical uptime are all evidenced, with database replicas in a second region. Audit and pentest reports are available on request rather than published, we found no public information on a bug bounty or what happens to existing connections when the control plane is down, and the SLA applies only if stated on the pricing page, an order or a signed agreement. 1 3 8 10 11 13 16
The MSP Technician
All source code on GitHub, end-to-end WireGuard encryption where relays cannot decrypt and keys stay on clients and gateways, SOC 2 Type 2 compliance, a 2026 pentest, a vulnerability disclosure contact, a public status page, 99.994 percent-plus historical uptime, and nine technically detailed security advisories with fixes and an RSS feed — that transparency is more than I usually see. The SOC 2 and pentest reports are available on request rather than published in full, and we found no public information on what happens to existing connections if the vendor's control plane goes down. 1 3 8 13 16
The Operations Manager
Open-source code auditable on GitHub, WireGuard private keys that stay on clients and gateways, relays that cannot decrypt traffic, SOC 2 Type 2 and a Q2 2026 penetration test available on request, 99.994% historical uptime, and a public advisories page with nine disclosed vulnerabilities — that openness is what I lean on with no IT department of my own. Service levels only apply if stated on the pricing page or a signed agreement, and I found no public information on what happens to live connections if the control plane is down. 1 3 8 10 13 16
The Information Security Officer
All source code is published on GitHub, WireGuard keys stay on clients and gateways, relays cannot decrypt traffic, and a SOC 2 Type 2 attestation, a Q2 2026 penetration test and a public advisories feed with published fixes are evidenced. The audit reports are available on request rather than published, and we found no public information on a bug bounty, incident post-mortems or documented control-plane failover. 1 3 8 13 16
The Skeptic
All source code is published on GitHub, WireGuard private keys stay on clients and gateways, relays forward but cannot decrypt traffic, SOC 2 Type 2 compliance and a Q2 2026 pentest are stated, and nine security advisories are published with technical detail and an RSS feed — that transparency is the good kind. The audit and pentest reports are announced rather than published, with access only on request, and we found no public information on what happens to existing connections when the control plane goes down, on a bug bounty, or on a service-level commitment beyond conditional terms. 1 3 8 13 16
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where account data, user and device identities, connection logs and configuration are stored and processed, which party runs the coordination servers, relays and gateways the traffic passes through, and who the subprocessors are (hosting, identity, email, support and payment tools). Independently sourced by the sovereignty pipeline. Gateway and exit locations outside Europe are part of what the product does and are not counted against it; where the logs and identities are stored and who processes them is. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting of the control plane and logs unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the location of the control plane and logs is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting of logs and account data available and an EU contracting entity or EU representative, but parts of the chain (relays, support, identity, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure for the control plane and logs, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record and connection on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contract is with Firezone, Inc. of San Francisco, but a genuine Cloud EU keeps the control plane and account data in Sweden and France with EU-only backups, a public subprocessor list with locations, and SOC 2 Type 2 stated. Even on EU accounts, billing, CRM and diagnostics run through US subprocessors, US staff can access EU-hosted data, and account identifiers sit in a US registry, while the data processing agreement is available on request — a transparent chain, but not a European one. 8 10 11 12 13
The DevOps Engineer
The contracting entity is Firezone, Inc. of San Francisco, and we found no public information on an EU entity or EU representative. A Cloud EU account does host the control plane and account data on named Azure regions (Gävle, Sweden and Paris, France) with geo-redundant EU backups, and subprocessors are listed with locations and kept under the data processing agreement — but billing (Stripe), CRM (HubSpot), telemetry (PostHog, Sentry) run through US subprocessors even for EU accounts, a shared account-slug registry sits in Azure East US, US staff can access EU-hosted account data, the DPA itself is on request rather than published, and EU accounts may use relays outside the EU. SOC 2 Type 2 is stated and contractual transfer safeguards exist, which lifts this above a bare privacy policy, but the US entity and US-anchored back office keep it well below a sovereign chain. 8 9 10 11 12 13
The MSP Technician
A Firezone Cloud EU account keeps the control plane and account data on Azure in Sweden and France with an EU backup copy in Sweden, and the subprocessor list is published with locations and international transfer safeguards — but the contract is with a US company in San Francisco, US staff can access EU-hosted data, and billing, CRM, usage analytics and diagnostics run through US subprocessors including Stripe, HubSpot, PostHog and Sentry, with a shared account registry in East US even for EU accounts. A data processing agreement is available on request rather than published, so I could not put a fully European chain in front of a client that demands one. 8 10 11 12
The Operations Manager
A genuine EU account option keeps the control plane, logs and backups on named Azure regions in Sweden and France with a published subprocessor list and a data processing agreement available on request, and SOC 2 Type 2 is stated. But the contracting entity is Firezone, Inc. of San Francisco, authorised US staff can access EU-hosted account data, and billing, CRM, usage analytics and diagnostics stay with US subprocessors even on EU accounts, with a shared account registry in East US. 8 10 11 12 13
The Information Security Officer
A Firezone Cloud EU account hosts the control plane and account data on named Azure regions in Gävle, Sweden and Paris, France, with backups kept within the EU, a published subprocessor list with locations, and recognised contractual clauses for transfers. Against that stand the facts my auditor would probe: the contracting entity is a US company, US staff can access EU-hosted account data, both regions store account slugs and IDs in a shared Microsoft Azure instance in East US, and billing, CRM, usage analytics and diagnostics for EU accounts still run through US subprocessors. 8 10 11 12
The Skeptic
A Cloud EU account hosts the control plane and account data in named Azure regions in Sweden and France with backup copies kept within the EU, and the subprocessor list is published with locations and kept under the data processing agreement. But the contracting entity is a San Francisco company, the documentation states US staff can access EU-hosted account data, billing, CRM, usage metrics and diagnostics run through US subprocessors on both regions, and even EU accounts store account identifiers in a shared registry in East US — that last one is a quiet hole in the residency story. 8 10 11 12
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per device and tier, minimum seats, what dedicated gateways, static IPs, extra networks or sites cost, which features (SSO, SCIM, device posture, log streaming, longer retention, site-to-site) need a higher tier, the free tier and its limits, the price of a self-hosted or on-premises licence, monthly versus annual billing, minimum term and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price or a free tier exists, but how cost scales with users, devices, gateways or features is unclear.
5 — Tiers are public with a price per user and their main inclusions, but at least one commonly needed piece (dedicated gateways or IPs, extra sites, SSO or SCIM, log retention, the self-hosted licence) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, devices, gateways, networks), dedicated IPs and gateways priced, add-ons priced, minimum seats, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, number of sites, gateways and devices, with every add-on, overage and support fee and the cancellation and data-return terms published.
The IT Lead
Starter is free to six users and Team and Business carry public per-seat annual prices with stated per-plan limits on users, sites and connected clients, taxes excluded and renewal terms published, while gateways run on our own servers and carry no licence line. The Entra directory sync and SIEM streaming we would need sit on Business, visible before purchase; Enterprise is contact-sales and minimum seats are not stated, so the complete picture still needs one conversation. 1 4 9 10
The DevOps Engineer
Starter is free for up to 6 users with no credit card, Team is $5 per seat per month or $50 per seat per year, Business is $8 per active seat per month or $80 per active seat per year with the euro prices (€50 and €80 per seat per year) published too, plus per-plan limits on users, sites, service accounts and connected clients, a roughly 17% annual discount, taxes explicitly excluded, and auto-renewal and refund terms public. Directory sync and SIEM streaming are tied to named plans whose prices are public, and on every hosted plan gateways run on your own infrastructure, so there is no managed-gateway line item. Enterprise is "pricing tailored to your organization" via sales, and we found no public information on minimum seats or term-length options beyond the stated billing periods. 1 4 9 10 16
The MSP Technician
Starter is free for six users, Team at €50 per seat per year and Business at €80 per seat per year are public in euros and dollars with monthly and annual billing, annual saving roughly 17 percent, and the plan limits per tier are published — gateways run on the customer's own infrastructure on every hosted plan, so I can quote a forty-user client without calling the vendor. Enterprise is priced on request only, directory sync and SIEM streaming sit on the higher tiers, and the terms state taxes are excluded and fees already paid are non-refundable, but we found no public information on longer log retention or other add-on pricing. 4 9 10
The Operations Manager
Starter is free for six users, Team and Business are priced per seat monthly or annually in both dollars and euros with user, site and client limits per tier, taxes excluded, non-refundable auto-renewal stated, and feature gates such as directory sync and SIEM streaming visible on named plans. Enterprise is contact-sales only, and minimum seat counts and minimum terms are not stated; gateways run on my own infrastructure on every hosted plan, so there is no gateway line item to price. 9 10
The Information Security Officer
Seat prices are public in both currencies with per-tier limits for users, sites, service accounts and connected clients, plan gating for directory sync and SIEM streaming, a free tier up to 6 users, a 50% nonprofit discount, and VAT treatment plus annual-versus-monthly billing stated. Enterprise is quote-based and dedicated static IPs are not priced on the captured pages, so the top of the range and that add-on need a sales call. 1 4 9 10
The Skeptic
Per-seat prices are published in euros and dollars with both monthly and annual figures, plan limits in users, service accounts, sites and connected clients per user are stated in numbers, taxes are excluded and stated as the customer's responsibility, and which plans carry directory sync and SIEM streaming is visible from the pages. Enterprise is priced only as a conversation with sales, and we found no public information on a stated minimum term. 4 9 10
European sovereignty — proven facts
1 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Outside the EU ⚠ unverified | 0/4 pts | 12 Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Firezone
Is Firezone European?
No. whats-best.ai classifies Firezone as Rest of world.
Where does Firezone store data?
Firezone stores customer data outside the EU by default, per the vendor’s page captured 5 Nov 2026. The vendor’s pages mention the US and the EU as hosting locations, per the vendor’s page captured 5 Nov 2026.
Does Firezone have a free plan?
Yes. Firezone has a free plan, per the vendor’s page captured 5 Nov 2026.
What are the best alternatives to Firezone?
As of 6 Nov 2026, the panel rates Defguard (3.5/5), Tailscale (3.5/5) and Cloudflare Zero Trust (3.5/5) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Defguard (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Firezone alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Hosting location. Customers can instead choose a Firezone Cloud EU account storing data in Sweden and France, but even then billing, CRM, usage metrics and diagnostics go to US subprocessors, and US staff can access EU-hosted data.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (16)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.firezone.dev Checked 5 Nov 2026 Details →
- 2 Documentation www.firezone.dev Checked 5 Nov 2026 Details →
- 3 Documentation (architecture) www.firezone.dev Checked 5 Nov 2026 Details →
- 4 Documentation (directory sync) www.firezone.dev Checked 5 Nov 2026 Details →
- 5 Documentation (audit logs) www.firezone.dev Checked 5 Nov 2026 Details →
- 6 API documentation www.firezone.dev Checked 5 Nov 2026 Details →
- 7 Documentation (Terraform provider) www.firezone.dev Checked 5 Nov 2026 Details →
- 8 Documentation (regions and data residency) www.firezone.dev Checked 5 Nov 2026 Details →
- 9 Pricing page www.firezone.dev Checked 5 Nov 2026 Details →
- 10 Terms of service www.firezone.dev Checked 5 Nov 2026 Details →
- 11 Privacy policy www.firezone.dev Checked 5 Nov 2026 Details →
- 12 Subprocessor list www.firezone.dev Checked 5 Nov 2026 Details →
- 13 Security / trust page trust.firezone.dev Checked 5 Nov 2026 Details →
- 14 Access model & connectivity — found from sitemap www.firezone.dev Checked 5 Nov 2026 Details →
- 15 Access model & connectivity — found from sitemap www.firezone.dev Checked 5 Nov 2026 Details →
- 16 Architecture, reliability & security assurance — found from sitemap www.firezone.dev Checked 5 Nov 2026 Details →