Regional availability and data residency

Firezone Cloud offers US and EU account regions. Your choice determines where Firezone stores your account data and which endpoints your deployment uses. Each account is assigned to one region.

For a residency review, also consider the data processed by subprocessors, staff access, and destinations you configure for log exports. These can be outside your account region. See Core components for the architecture and the roles of the control plane and data plane.

Account data and storage locations

Account data is stored in Microsoft Azure at these locations:

• US accounts: Iowa (centralus) and Arizona (westus3).
• EU accounts: Gävle, Sweden (swedencentral), and Paris, France (francecentral).

What Firezone stores

The table below describes the account data stored in your selected region. The fields collected depend on your Client platform, enabled features, and connected providers. For example, connecting a device posture provider adds device inventory and security status from that provider.

Shared account identifiers: Both US and EU accounts also have their account slugs, account IDs, region identifiers, and slug registration timestamps stored in a shared Microsoft Azure registry in East US. This keeps account slugs unique across regions.

Retention and backups

• Audit logs: Retained for 90 days. Copies exported through a Log Sink follow the destination's retention settings.
• Account data backups: Retained for 30 days. For EU accounts, a geo-redundant backup copy is stored in Sweden South, keeping the backups within the EU.

Subprocessors and access

The storage locations above apply to your account data. Services used for billing, support, analytics, and diagnostics have their own processing locations. For example, product usage metadata from EU accounts is sent to PostHog in the US.

Firezone uses these subprocessors:

• Microsoft Azure: Hosts the control plane and Relays in the locations on this page. For EU accounts, Azure Communication Services sends service email with its data location set to Europe.
• Stripe (US): Processes billing contact, customer, subscription, and transaction information.
• HubSpot (US): Processes contact details and correspondence for sales and support.
• PostHog (US): Processes product usage and configuration-change metadata, including account identifiers and names. Both regions use the same US project. Website analytics are subject to separate consent controls.
• Sentry (US): Processes crash and error diagnostics.

Firezone's authorized staff in the US can also access EU-hosted account data when operating or supporting the service.

The services you connect to Firezone have their own data locations. For example, if you configure a Log Sink outside the EU, your logs are exported there even when your Firezone account is in the EU. The same principle applies to your identity and device posture providers.

See the Privacy Policy for details. Request the latest SOC 2 report from the Trust Center.

Regional endpoints

Configure your Clients, Gateways, and integrations for the region where your account data is stored. Use the endpoints below with credentials from the same region. For example, an EU API token works with the EU REST API.

See ports and protocols for firewall requirements and MCP setup for client authorization. Client, Gateway, and Terraform settings are listed below.

Configure Clients and Gateways

Clients and Gateways default to the US control plane API. For an EU account, use the EU endpoints and credentials issued by the EU account:

• Desktop and mobile Clients: Select Settings → Control plane → Firezone Cloud (EU). This setting is available in macOS and iOS 1.5.24, Windows and Linux 1.5.20, and Android 1.5.18 and later. On older Clients, set Auth Base URL to https://eu.app.firezone.dev and API URL to wss://eu.api.firezone.dev under Settings → Advanced.
• Managed Clients: Set authURL and apiURL to those respective values using managed configuration. Users can't change the control plane when these values are managed.
• Gateways: Set FIREZONE_API_URL=wss://eu.api.firezone.dev and use a Gateway token from the EU portal. Persist the endpoint in your deployment configuration. For NixOS use apiUrl. The AWS and Azure Terraform Gateway modules use firezone_api_url. The GCP module uses api_url.
• Headless Clients: Set FIREZONE_API_URL=wss://eu.api.firezone.dev and use a service account token from the EU account. For browser-based sign-in, also set FIREZONE_AUTH_BASE_URL=https://eu.app.firezone.dev. See the references for Linux and Windows.

The Terraform provider's REST API endpoint is separate from the Gateway module's control plane API URL. Set both when you use Terraform to manage your Firezone account and deploy Gateways in the EU region. See the Terraform provider guide.

Account region transfer

If your requirements change, an admin can request a move under Settings → Account → Data residency. Firezone support will arrange a maintenance window, copy your users, groups, service accounts, and access configuration to the destination region, then enable the account there.

Before scheduling a move, plan for the following:

• Users must sign in again after the transfer. Existing sessions will no longer be valid.
• Update deployment tokens and URLs. Generate new Gateway, service account, and API tokens in the destination region. Configure your Gateways, headless Clients, and API integrations with the new tokens and that region's URLs. Reauthorize MCP clients at the destination region's MCP endpoint.
• Historical audit logs don't move. Export and verify any logs you need to keep before the transfer. Firezone deletes audit logs from the original region when the account transfer is complete.
• Backups remain temporarily. Source-region account data backups expire 30 days after the transfer.

See transfer your account for the request steps, preparation, and checks to run afterward.

Network traffic and Relay locations

Your Clients and Gateways run on devices and infrastructure you manage. Selecting the EU account region does not restrict network traffic to the EU. Relays are deployed worldwide to provide nearby fallback paths, and EU accounts can use Relays outside the EU.

Relays forward WireGuard-encrypted packets and cannot decrypt their contents. They process the endpoint IP addresses and ports needed to forward traffic. See Core components for how Relays fit into the network path.

Firezone Cloud US uses Relays in all locations below. A check mark indicates a Relay that also serves Firezone Cloud EU, including locations outside the EU.

For detailed questions about this page, contact Firezone support.