# Firezone — Business VPN & Zero Trust Access

Firezone by Firezone, Inc. holds a panel rating of 3.5/5 from 6 AI judges (category median 3/5), as of 2026-11-06. Provenance: Rest of world; sovereignty: 1 of 6 dimensions proven.

- Vendor: Firezone, Inc. (https://www.firezone.dev)
- Category: [Business VPN & Zero Trust Access](https://whats-best.ai/software/business-vpn.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/business-vpn/firezone
- Alternatives: https://whats-best.ai/software/business-vpn/firezone/alternatives ([markdown](https://whats-best.ai/software/business-vpn/firezone/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-06 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Firezone, Inc.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Outside the EU by default; pages mention the US and the EU [S12]
- Free plan: Yes, per the vendor’s own page [S15]

## The panel's verdict

Firezone is an open-source zero trust access platform built on WireGuard, with weighted totals ranging from 6.8 to 7.0. Its strongest mark, 8 on identity and policy, rests on directory sync with Okta, Microsoft Entra ID and Google Workspace that deletes a suspended or departed user's identity and clears every active session, on default-deny per-resource policies, and on posture checks built from 350-plus device signals. Most other criteria cluster at 7; visibility and audit scores run 6-7, with the IT lead at 6 over 90-day log retention and no public information on alerts for unusual access. Sovereignty scored lowest at 4-5, where judges weighed the same facts differently: a Cloud EU account hosts the control plane in Sweden and France, but the contracting entity is a US company, US staff can access EU-hosted account data, and billing, CRM and diagnostics run through US subprocessors even on EU accounts. Pricing transparency scored 7, with per-seat prices public in dollars and euros and only Enterprise priced through sales.

**Speaks for it:**
- Directory sync with Okta, Microsoft Entra ID and Google Workspace deletes a suspended or departed user's identity and clears every active session, earning identity and policy the top score of 8.
- Access is default-deny per application, DNS name or subnet, through self-run gateways that make outbound connections only and fall back to 34 relay clusters worldwide.
- Four audit log streams are documented and exportable through the REST API on every plan, with streaming to Splunk or Datadog on Business and Enterprise.
- All source code is published on GitHub, alongside SOC 2 Type 2 compliance, a Q2 2026 pentest and nine published security advisories.
- Per-seat prices are published in dollars and euros, and Starter is free for up to 6 users with no credit card required.

**Held against it:**
- Sovereignty scored 4-5, the lowest of any criterion, with the contract held by Firezone, Inc. of San Francisco and US staff able to access EU-hosted account data.
- Billing, CRM, usage analytics and diagnostics run through US subprocessors even on EU accounts, where account slugs and IDs sit in a shared Microsoft Azure instance in East US.
- Audit logs are retained for 90 days, and we found no public information on alerts or webhooks for unusual access.
- The published advisories name Windows, macOS and Linux clients only, and we found no public information on mobile clients, always-on auto-connect or clientless browser access.
- We found no public information on just-in-time, time-boxed access with approval, so time-limited contractor access is unproven.

**Best for:**
- You need access to end with employment: suspending or deleting someone in your identity provider clears every one of their sessions.
- Your team runs its own servers and wants outbound-only gateways managed as code, with a Terraform provider and a REST API on every plan.
- You want published per-seat prices in dollars and euros, and a free tier for up to 6 users to trial first.
- You weigh source-level transparency heavily, from open code on GitHub to dated security advisories with fixes.

**Avoid if:**
- You must show a client or regulator a fully European data chain: the contracting entity is a US company and US subprocessors handle billing, CRM and diagnostics even on EU accounts.
- Your users connect from phones or a browser: the published clients cover Windows, macOS and Linux, and we found no public information on iOS or Android clients or clientless access.
- You need a year of audit evidence without exporting: retention is 90 days unless logs go to your own destination.
- You are a service provider wanting a tenant per client: we found no public information on a multi-tenant console, and resale is restricted unless agreed in writing.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The DevOps Engineer | The MSP Technician | The Operations Manager | The Information Security Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Access model & connectivity | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Identity, access policy & device posture | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Logs, audit trail & incident response | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Deployment, API & administration | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Architecture, reliability & security assurance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 |
| Pricing transparency | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| **Weighted verdict** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** | **3.5/5** |

### The judges

- **The IT Lead** (v1.0): Head of a three-person IT team at a 140-person mechanical engineering firm with two plants and a sales office in Vienna. The VPN still runs on the firewall, and every update of it is a weekend. Wants a client that installs through Intune and connects on its own, sign-in with Microsoft Entra so a leaver loses access the same day, the ERP and the file server reachable without opening the whole network, a fixed IP for the supplier portal, and a price per user that survives the next budget round.
- **The DevOps Engineer** (v1.0): Platform engineer at a sixty-person software company with servers at Hetzner, a Kubernetes cluster on AWS and a bastion host everyone shares a key for. Wants a mesh that reaches every server and cluster without inbound ports, access policies kept in Git and applied with Terraform, SSH access tied to the identity provider, connectors that run as containers, and a published architecture that says what the vendor's relays can see.
- **The MSP Technician** (v1.0): Senior technician at an IT service provider in Hamburg that looks after thirty clients, from tax advisers to a dental chain. Each client has its own remote access, set up by whoever was on site that year. Wants one console with a tenant per client, gateways and users added in minutes, access logs a client can be shown after an incident, billing per tenant, and prices per user that can be quoted without calling the vendor first.
- **The Operations Manager** (v1.0): Runs operations at a fifty-person consultancy where a third of the work is done by freelancers on their own laptops and the rest of the team travels to client sites. Has no IT department, only an external provider billed by the hour. Wants each freelancer to reach one project system and nothing else, access that ends with the contract, a setup a non-specialist can follow, and no call to the helpdesk from a hotel lobby.
- **The Information Security Officer** (v1.0): Information security officer at a regional energy supplier that falls under NIS2 and was asked by its auditor who could reach the control systems last year. Wants access granted per resource, not per network, device checks before a connection, every access and admin change in a log that reaches the SIEM, an independent audit of the product, and the identities and logs kept in Europe by a vendor whose subprocessors are listed.
- **The Skeptic** (v1.0): Has seen "zero trust" on a VPN that still drops every user into the whole office network, "no logs" from a vendor that keeps every connection for a year, and a remote access tool that locked out the whole company when its own control plane went down. Asks who can see the traffic and the metadata, what keeps working when the vendor is offline, whether the audit was published or only announced — and whether the network could be moved to a self-hosted server.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: 1 of 6 dimensions proven.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Outside the EU | 0/4 | [S12] |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Cookie consent regions: EEA · UK · enabled, opt-out available [S11]
- DPA available: yes [S10]
- Encryption docs: Docs cover encryption used, vulnerability disclosure, regional availability, and subprocessors [S2]
- Industry standards not supported: no · no · no [S10]
- International transfer safeguards: approved contractual clauses · transfer addenda [S11]
- Pentest report: Q2 2026 · request · yes [S13]
- Security measures: encryption in transit · access controls · monitoring · security review [S11]
- Shine the light: no [S11]
- SOC 2: yes [S8]
- SOC 2: yes [S1]
- SOC 2 type1 report: request · yes [S13]
- SOC 2 type2: compliant · SOC 2 Type 2 [S13]
- SOC 2 type2 report: 2024-11 · request · yes [S13]
- Staff access cross region: yes [S8]
- Status page: firezone.statuspage.io [S13]
- US sanctions restriction: yes [S10]
- US state opt out: yes [S11]
- Vulnerability disclosure policy: yes [S10]

**Data**
- Aggregated use: yes [S10]
- Audit log retention: 90 [S8]
- Backup deletion: backups removed via normal backup-rotation process [S11]
- Backup retention: 30 · yes · Sweden South [S8]
- Customer data ownership: yes [S10]
- Deletion contact: privacy@firezone.dev [S10]
- Export responsibility: yes [S10]
- No sale: no [S11]
- Posthog recordings retention: 90 · PostHog session recordings [S11]
- Privacy contact email: privacy@firezone.dev [S11]
- Region transfer: yes · 8 [S8]
- Shared registry: unique account slugs across regions · East US [S8]
- Transfer audit logs: no · yes [S8]

**Hosting**
- API base urls: https://eu.rest-api.firezone.dev · https://rest-api.firezone.dev · yes [S6]
- Cloud EU: yes · billing · diagnostics · sales/CRM use US subprocessors [S11]
- EU option: EU · yes [S9]
- EU region: Firezone Cloud EU offering exists [S1]
- Firezone cloud EU regions: swedencentral (Gävle, Sweden) · francecentral (Paris, France) · Europe via Azure Communication Services [S12]
- Firezone cloud US regions: centralus (Iowa, United States) · westus3 (Arizona, United States) [S12]
- Regional endpoints: https://eu.rest-api.firezone.dev · https://rest-api.firezone.dev [S7]
- Regions: US · EU · yes [S8]
- Regions: US · EU [S10]
- Storage locations: swedencentral · francecentral · centralus · westus3 · Microsoft Azure [S8]

**Integrations**
- API docs: yes · yes [S6]
- API terms: yes [S10]
- API token setup: API token via Settings → API Tokens, exported as FIREZONE_TOKEN env var [S7]
- Audit logs rest API: change · session · flow · api_request · time range · actor · /logs [S5]
- Cli: yes [S2]
- Idp mdm siem: yes · yes · yes · yes · yes · yes [S1]
- Listed: Okta · Microsoft Entra ID · Google Workspace · Microsoft Intune · Jamf Pro · SentinelOne · Splunk · Datadog · Terraform · AWS · Google Cloud · Docker [S1]
- Log sinks: stream audit logs to SIEM or log management platform · yes [S5]
- Log sinks: yes [S8]
- Mcp server: MCP server listed under automation docs [S6]
- Mdm edr tools: Intune · Defender · SentinelOne · Sophos · Iru · Santa [S15]
- Resale restriction: yes [S10]
- Rest API: yes [S15]
- Rest API: yes [S11]
- Rest API: yes [S2]
- Siem streaming: yes · Business · Enterprise [S1]
- Terraform provider: Terraform Provider available for automation [S6]

**Legal**
- Address: 2261 Market Street, Suite 4574, San Francisco, CA 94114, United States [S10]
- Address: San Francisco · CA · United States [S11]
- Arbitration: AAA · yes [S10]
- Arbitration venue: Santa Clara County, California [S10]
- Claim filing deadline: 1 [S10]
- Confidentiality duration: 3 [S10]
- Controller role: processor/service provider [S11]
- DPA agreement precedence: yes [S10]
- Entity: Firezone, Inc. [S11]
- Entity name: Firezone, Inc. [S10]
- Jurisdiction: California [S10]
- Jurisdiction: US [S11]
- Last updated: August 8, 2026 [S10]
- Liability cap: 6 months of fees · 100 [S10]
- No class actions: yes [S10]
- Policy last updated: 2026-08-08 [S11]
- Terms change notice: yes [S10]

**Pricing**
- Auto renewal: yes [S10]
- Business annual eur: EUR · annual · 80 · 6.67 [S9]
- Currency regions: EUR · USD [S10]
- Enterprise custom: yes · custom, contact sales [S9]
- Enterprise trial: 30 · Enterprise · yes [S9]
- Free tier: 6 · no [S10]
- Free tier: 6 · no [S11]
- Free tier: 6 · no [S16]
- Free tier: 6 · no [S1]
- Nonprofit discount: 50 · yes [S9]
- Price change notice: no [S10]
- Refund policy: no [S10]
- Starter: Starter · 0 [S9]
- Taxes not included: no [S10]
- Team annual eur: EUR · annual · 50 · 4.17 [S9]
- Usd rates: 50 · 17 · 5 · 80 · 8 [S9]

**Product**
- Access control: Access Control and Authorization controls including MFA for critical services, access reviews, dormant account disabling, password management policies [S13]
- Access model: Granular, least-privileged access with group-based policies for apps and subnets [S2]
- Admin roles: account · user · device · activity · audit [S10]
- Advisories official source: Security Advisories page is the official source for disclosed Firezone vulnerabilities [S16]
- Advisories rss: Advisories have an RSS feed [S16]
- Advisory fz 2026 001: FZ-2026-001 · 2026-06-04 · 1.5.16 · macOS Client [S16]
- Advisory fz 2026 002: FZ-2026-002 · 2026-06-04 · 1.5.13 · Linux GUI Client [S16]
- Advisory fz 2026 003: FZ-2026-003 · 2026-06-04 · 1.5.13 · Windows GUI Client [S16]
- Advisory fz 2026 004: FZ-2026-004 · 2026-06-04 · 1.5.13 · Linux GUI Client [S16]
- Advisory fz 2026 005: FZ-2026-005 · 2026-06-04 · 1.5.13 · Windows GUI Client [S16]
- Advisory fz 2026 006: FZ-2026-006 · 2026-06-04 · 1.5.13 · Windows Client [S16]
- Advisory fz 2026 007: FZ-2026-007 · 2026-06-22 · Resolved in the managed service · Portal [S16]
- Advisory fz 2026 008: FZ-2026-008 · 2026-09-08 · 1.6.1 · Gateway [S16]
- Advisory fz 2026 009: FZ-2026-009 · 2026-10-02 · 1.6.3 · Gateway [S16]
- Age restriction: 18 [S11]
- API auth: bearer_token · top-level data object [S6]
- API availability: all plan levels [S6]
- API gateway creation limitation: no · yes [S6]
- API gateway token rotation: single-owner gateway tokens managed via token and token/rotate endpoints [S6]
- API group access: access granted via Groups [S6]
- API resource types: dns · ip · cidr · optional port/protocol restrictions [S6]
- API site creation: Sites can be created via POST /sites [S6]
- Audit log change logs ordering: yes [S5]
- Audit log delivery guarantee: at-least-once · log_id [S5]
- Audit log flow logs no location: no [S5]
- Audit log id format: 96 · 24 lowercase hex characters · yes [S5]
- Audit log location resolution: write time · MaxMind GeoLite2 City [S5]
- Audit log streams: Change Logs · Session Logs · API Request Logs · Flow Logs [S5]
- Audit logs: yes [S1]
- Audit logs: Audit Logs and Log Sinks supported [S2]
- Audit logs plan availability: yes [S5]
- Authentication: Connects to OIDC providers with user and group syncing [S2]
- Automatic role mapping: no [S4]
- Automation: Deployment automation with tools like Terraform [S2]
- Built on wireguard: ephemeral encryption keys · firewall hole-punching · WireGuard [S3]
- Business limits: 200 · 1000 · 200 [S9]
- Client apps: Firezone client applications available for installation [S2]
- Client platforms: advisories name macOS, Windows, and Linux Clients · macOS · Windows · Linux [S16]
- Client platforms: macOS · Windows · Linux · iOS · Android · ChromeOS [S1]
- Connected clients: 5 · 3 · 10 · Enterprise [S9]
- Data protection: Data encrypted at rest and in-transit; data inventory and retention policy maintained [S13]
- Default control plane: US control plane API [S8]
- Default deny policy: yes [S6]
- Definition: secure remote access platform connecting users to computing resources [S3]
- Deleted group handling: yes [S4]
- Deleted user handling: yes [S4]
- Description: Open source platform for secure remote access management for any-sized organization [S2]
- Device posture checks: MDM compliant · disk encryption · no active threats (EDR) · firewall enabled · corporate owned [S15]
- Device signals: 350 [S15]
- Device trust: yes [S1]
- Device trust: Device Trust, Device Posture, and Directory sync capabilities documented [S2]

**Subprocessors**
- Hubspot: HubSpot · United States · CRM storing points-of-contact for communications, deals, support tickets and sales data [S12]
- List: Microsoft Azure · hosting control plane and Relays; Azure Communication Services email (EU data location for EU accounts) · Stripe · billing · US · HubSpot · sales and support correspondence · US · PostHog · product usage metadata · US · S… [S8]
- List maintained in DPA: Subprocessor list maintained as part of the Data Processing Agreement [S12]
- List published: cloud hosting · payments · CRM · support · analytics · email · security · error monitoring · yes [S11]
- Microsoft azure: Microsoft Azure · Infrastructure vendor providing infrastructure services for the Firezone product · United States · Sweden · France [S12]
- Posthog: PostHog · United States · Feature flags and product usage metrics from Firezone client applications; cookieless site analytics [S12]
- Published list: yes [S10]
- Sentry: Sentry · United States · Crash logs and backtraces from Firezone client and gateway applications · yes [S12]
- Stripe: Stripe · United States · Payments processor; stores Customer business address and billing contact email address for invoicing and billing [S12]
- Stripe payments: Stripe · payment processing · no [S11]

**Support**
- Community: Starter · community + GitHub issue tracker [S9]
- Github tracker: yes [S9]
- Priority email: yes · no · yes · yes [S9]
- Privacy request response: within period required by applicable law [S11]
- SLA availability: yes [S10]
- Slack: yes [S9]
- Termination for breach: 30 [S10]
- Trust center: A Trust Center page exists [S16]
- Unauthorized access contact: support@firezone.dev [S10]

78 more facts on the canonical page: https://whats-best.ai/software/business-vpn/firezone

## Questions

### Is Firezone European?

No. whats-best.ai classifies Firezone as Rest of world.

### Where does Firezone store data?

Firezone stores customer data outside the EU by default, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19092). The vendor’s pages mention the US and the EU as hosting locations, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19069).

### Does Firezone have a free plan?

Yes. Firezone has a free plan, per [the vendor’s page captured 5 Nov 2026](https://whats-best.ai/evidence/19105).

### What are the best alternatives to Firezone?

As of 6 Nov 2026, the panel rates [Defguard (3.5/5)](https://whats-best.ai/software/business-vpn/defguard), [Tailscale (3.5/5)](https://whats-best.ai/software/business-vpn/tailscale) and [Cloudflare Zero Trust (3.5/5)](https://whats-best.ai/software/business-vpn/cloudflare-zero-trust) highest among the other 12 Business VPN & Zero Trust Access products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Defguard](https://whats-best.ai/software/business-vpn/defguard) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Firezone alternatives](https://whats-best.ai/software/business-vpn/firezone/alternatives).

## What this page leaves out

- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://www.firezone.dev/ (checked 2026-11-05)
- [S2] Documentation: https://www.firezone.dev/kb (checked 2026-11-05)
- [S3] Documentation (architecture): https://www.firezone.dev/kb/architecture (checked 2026-11-05)
- [S4] Documentation (directory sync): https://www.firezone.dev/kb/directory-sync (checked 2026-11-05)
- [S5] Documentation (audit logs): https://www.firezone.dev/kb/audit-logs (checked 2026-11-05)
- [S6] API documentation: https://www.firezone.dev/kb/automate/rest-api (checked 2026-11-05)
- [S7] Documentation (Terraform provider): https://www.firezone.dev/kb/automate/terraform-provider (checked 2026-11-05)
- [S8] Documentation (regions and data residency): https://www.firezone.dev/kb/legal/regional-availability (checked 2026-11-05)
- [S9] Pricing page: https://www.firezone.dev/pricing (checked 2026-11-05)
- [S10] Terms of service: https://www.firezone.dev/terms (checked 2026-11-05)
- [S11] Privacy policy: https://www.firezone.dev/privacy-policy (checked 2026-11-05)
- [S12] Subprocessor list: https://www.firezone.dev/kb/legal/subprocessors (checked 2026-11-05)
- [S13] Security / trust page: https://trust.firezone.dev/ (checked 2026-11-05)
- [S14] Access model & connectivity — found from sitemap: https://www.firezone.dev/solutions/mesh-vpn (checked 2026-11-05)
- [S15] Access model & connectivity — found from sitemap: https://www.firezone.dev/solutions/remote-access (checked 2026-11-05)
- [S16] Architecture, reliability & security assurance — found from sitemap: https://www.firezone.dev/security-advisories (checked 2026-11-05)

---

Cite as: whats-best.ai, "Firezone — Business VPN & Zero Trust Access", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-vpn/firezone

Corrections: https://whats-best.ai/correct/1603?target=page