Zitadel

The open-source identity platform built for banking, fintech, and insurance. DORA, PCI-DSS, SOC 2 Type II, and ISO 27001 ready, with native B2B multi-tenancy and full choice over self-hosted or sovereign cloud deployment.

Zitadel's device identity APIs support machine-to-machine authentication, service users, non-human identities, and automated token validation for industrial IoT applications.

The page describes deploying ZITADEL's multi-tenant CIAM platform in a sovereign cloud or on-premises, with data ownership and low latency.

The company builds an identity platform.

Zitadel was founded in Switzerland by identity and infrastructure veterans and builds an open-source identity platform. Its team has decades of experience in enterprise software and open-source communities.

Technical advisories are notices that report major issues with Zitadel that could potentially impact security or stability in production environments. These advisories may include details about the nature of the issue, its potential impact, and recommended mitigation actions.

ZITADEL describes how it supports GDPR compliance through data residency choices in Switzerland, the EU, or globally, as well as its corporate contracting structure and DPF self-certification.

GitHubRepository owner

Zitadel expands its identity management platform to address complex challenges for enterprise customers, now supporting millions of users and integrating with enterprise identity providers. The company continues to develop its roadmap openly, reflecting evolving customer needs in authentication and beyond.

Jul 2026zitadel.comNews article

Zitadel introduces a preview allowing developers to integrate login directly into their codebase. The new feature eliminates the need for external service setups, such as tenant creation or secret management. Developers can now test login functionality within their editor without switching between applications.

Jun 2026zitadel.comNews article

ZITADEL’s SAML POST endpoint contains a cross-site scripting (XSS) vulnerability (CVE-2026-29191) that could enable session hijacking or account compromise. The flaw resides in the `/saml-post` route, allowing attackers to execute malicious scripts in the context of affected users. Researchers highlight the risk of unauthorized access to user sessions through this exploit.

Mar 2026CibersafetyNews article