Introducing the Firezone EU Region
EU hosting for identity data, access policies, and audit logs. Available on every plan.
Today we're launching Firezone Cloud EU: you can now use Firezone with your identity data, access policies, and audit logs hosted exclusively in the European Union.
It's available on every plan, including Starter. Same apps, same features, billed in euros. You can create an EU account now if you're interested in trying it out.
To learn more about what this means for your organization, read on.
Firezone architecture recap
Firezone encrypts network traffic end to end between your devices. That means we can't read your database queries, SSH sessions, Git clones, and other application traffic that routes through Firezone. The architecture is designed to keep us out of that traffic.
But there's still information we need to run the service: user identities, group memberships, device details, and the policies that decide who can access what. An access log showing that someone connected to production at 2 a.m. is sensitive even without the contents of the connection. If you're considering Firezone for your organization, you probably need to know where we store that information.
For Firezone, the storage choice is now straightforward: EU accounts use our new Microsoft Azure deployment in Gävle, Sweden, and Paris, France. And US accounts continue to use our existing deployment in Iowa and Arizona in the United States.
Here's how the two regions compare:
| Firezone Cloud US | Firezone Cloud EU | |
|---|---|---|
| Data residency | The United States | The European Union |
| Account data regions | Iowa and Arizona | Sweden and France |
| Auth / admin portal | https://app.firezone.dev | https://eu.app.firezone.dev |
| Control plane API | wss://api.firezone.dev | wss://eu.api.firezone.dev |
| Relay points-of-presence | 34 cities worldwide | 10 cities on four continents |
| Best fit for | Users in or near the Americas | Users in or near Europe |
| Billed in | US dollars | Euros |
| Plans available | Starter, Team, Business, Enterprise | Starter, Team, Business, Enterprise |
We've also published a data residency reference that lists the data we store, its locations, retention, and exceptions.
Account region doesn't affect network traffic
Choosing the EU region doesn't mean sending every packet through Sweden.
Firezone Clients authenticated to an EU-region account use the EU control plane to authenticate and get connection information, then establish WireGuard tunnels to Gateways. Thanks to our home-grown NAT traversal system, those connections take the direct path whenever possible (in our estimate, that's about 98% of the time), and always pick Gateways closest geographically to the Client.
Connections that can't be direct fall back to a Relay. Relays are deployed around the world to keep latency low and throughput high, and importantly, can't see or decrypt your traffic. Their only job is to forward packets as fast as physically possible and otherwise stay out of the way.
- Relay, Firezone Cloud US
- Relay, Firezone Cloud EU
- Control plane, Firezone Cloud US
- Control plane, Firezone Cloud EU
Your account region determines where we store your identities, policies, and audit logs. It doesn't put a geographic fence around your network traffic.
Other types of data
Firezone also processes data to improve the product, troubleshoot problems, respond to support requests, and manage billing:
- Product telemetry: Software versions, usage counts, enabled features, and internal user and account identifiers help us understand product usage and prioritize improvements. Events can also include account names.
- Crash and diagnostic data: Error messages, stack traces, software versions, and diagnostic logs help us investigate crashes and connection problems. Reports can include device and account identifiers to help correlate errors.
- Support and billing: Contact details, support messages, billing addresses, subscription details, and payment information let us answer questions and process payments.
These services currently use US-based providers, listed on our subprocessors page.
See the data residency reference for details, or request our latest SOC 2 report from the Trust Center.
Try it
Create an EU account, then select Settings → Control plane → Firezone Cloud (EU) in your Clients before signing in. Our regional configuration guide covers Gateways, managed devices, and API endpoints.
Starter is free for up to 6 users, with no credit card required. Paid plans are billed in euros. See the pricing page for the numbers.
Already using Firezone Cloud US? We can transfer your account. You'll need to schedule downtime, update regional endpoints, and replace deployment credentials, so give the guide a read before picking a date.
And if your vendor questionnaire has a question we haven't answered, send it to support@firezone.dev. We'd like the docs to answer the next person's question too.