Pricing & plans
From your first deployment to your entire organization. Choose the features and support that fit your team.
For small teams
Secure access for homelabs and small projects.
Free
No credit card required
No credit card required
The essentials, included
Free for up to 6 users
For growing teams
Everyday zero trust access for your team.
$50
per seat / year
Billed annually · $4.17/seat/mo equivalent
Self-serve · No contract
Everything in Starter, plus
Per user or service account in your account How seats work
For mid-sized organizations
Comprehensive zero trust security for your organization.
$80
per seat / year
Billed annually · $6.67/seat/mo equivalent
Self-serve · No contract
ALL OF FIREZONE’S FEATURES
Per active seat · Rolling 30-day window How seats work
For large organizations
All our features, with the assurance and support you need.
Let’s talk
Pricing tailored to your organization
30-day trial available
Everything in Business, plus
Active seats · Custom annual agreement How seats work
All prices in USD.
“Firezone's easy-to-setup, sleek, and simple interface makes management effortless. It perfectly met our zero-trust security needs without the complexity found in other products we tested.”
Mark Sim
Technical Account Manager, Beakon
“At Strong Compute, we have been using Firezone for over 3 years and it is still the most stable and best VPN solution we tested for remote access.”
Cian Byrne
Founding Engineer, Strong Compute
Trusted by teams around the world
The details
Start free. Upgrade when you’re ready.
Swipe the table to compare all four plans.
| What’s included | Starter | Team | Business | Enterprise |
|---|---|---|---|---|
| Usage & limits | ||||
| UsersIncludes both admins and end-users of your Firezone account | 6 | 500 | 1,000 | Unlimited |
| Service AccountsMachine accounts used to access Resources without a user present | 10 | 100 | 200 | Unlimited |
| SitesSites are a collection of Gateways and Resources that share the same network connectivity context. Typically a subnet or VPC. | 10 | 100 | 200 | Unlimited |
| AdminsUsers with account-wide access to deploy Gateways, manage billing, and edit users, Sites, or other configuration | 1 | 10 | 20 | Unlimited |
| PoliciesPolicies control access to Resources (e.g. Group “A” may access Resource “B”) | Unlimited | Unlimited | Unlimited | Unlimited |
| ResourcesAnything you wish to manage access to (e.g. database, VPC, home network, web server, SaaS application) | Unlimited | Unlimited | Unlimited | Unlimited |
| Connected ClientsAny device or machine that the Firezone Client connects from | 3 per user | 5 per user | 10 per user | Unlimited |
| Automation | ||||
| REST APIManage your Firezone account programmatically | Included | Included | Included | Included |
| MCP serverConnect AI assistants to read and manage your Firezone account using the Model Context Protocol | Included | Included | Included | Included |
| Networking Features | ||||
| NAT hole punchingConnect to Resources without opening inbound firewall ports | Included | Included | Included | Included |
| Native Firezone ClientsNative client apps for all major platforms | Included | Included | Included | Included |
| Split tunnelingRoute traffic to Resources through Firezone leaving other traffic unaffected | Included | Included | Included | Included |
| IPv4 and IPv6 ResourcesConnect to Resources over IPv4 or IPv6 | Included | Included | Included | Included |
| Automatic NAT64Connect to IPv6-only Resources from IPv4-only networks and vice-versa | Included | Included | Included | Included |
| DNS-based routingRoute traffic through Firezone based on DNS matching rules | Included | Included | Included | Included |
| Secure DNSResolve queries for non-Firezone Resources using popular DNS-over-HTTPS providers | Included | Included | Included | Included |
| Gateway load-balancingSpread traffic across multiple Gateways within a Site | Included | Included | Included | Included |
| Automatic Gateway failoverClients automatically switch from unhealthy Gateways to healthy ones | Included | Included | Included | Included |
| Device PoolsDirect, peer to peer access to other devices in your Firezone account | Included | Included | Included | Included |
| Full-tunnel routingRoute all traffic from select Clients through Firezone | Not included | Included | Included | Included |
| Authentication & Authorization | ||||
| Resource-level access policiesControl access to Resources based on user identity and group | Included | Included | Included | Included |
| Email (OTP) authenticationAuthenticate users with a one-time code sent to their email | Included | Included | Included | Included |
| OpenID Connect authenticationAuthenticate users with any OIDC-compatible provider | Included | Included | Included | Included |
| Conditional access policiesAllow access based on source IP, authentication method, time of day, or country. | Not included | Included | Included | Included |
| Custom account slugCustomize the sign-in URL for your account. E.g. https://app.firezone.dev/your-organization | Not included | Included | Included | Included |
| Google Workspace directory syncAutomatically sync users and groups from Google Workspace to Firezone | Not included | Not included | Included | Included |
| Microsoft Entra ID directory syncAutomatically sync users and groups from Microsoft Entra ID to Firezone | Not included | Not included | Included | Included |
| Okta directory syncAutomatically sync users and groups from Okta to Firezone | Not included | Not included | Included | Included |
| Security Features | ||||
| Session-based key rotationRotate WireGuard encryption keys each time a user signs in | Included | Included | Included | Included |
| Client verificationRequire Clients to be marked as verified in the admin portal before they can access Resources | Included | Included | Included | Included |
| GeoIP MappingShow where your users are connecting from | Included | Included | Included | Included |
| Change LogsSee who changed what in your account configuration and when | Included | Included | Included | Included |
| Session LogsSee who connected, from where, and with which device | Included | Included | Included | Included |
| API Request LogsSee what every API token did, request by request | Included | Included | Included | Included |
| Network Flow LogsSee what traffic flowed between Clients and Resources | Included | Included | Included | Included |
| Traffic restrictionsRestrict access to specific ports and protocols | Included | Included | Included | Included |
| Device TrustRequire device attestation using trusted X.509 certificates and cryptographic proof of private-key possession over mutual TLS before granting access to Resources | Included | Included | Included | Included |
| Device PostureRequire device security checks from your MDM and endpoint protection providers before granting access to Resources | Not included | Not included | Included | Included |
| Log SinksStream audit logs directly to Splunk, Datadog, Elastic, and other destinations | Not included | Not included | Included | Included |
| Firezone service compliance reportsIndependent audit reports of Firezone's service for compliance with industry standards | Not included | Not included | Not included | SOC 2 |
| Firezone service pentest reportsPenetration testing for security vulnerabilities in Firezone's service conducted by a third party firm | Not included | Not included | Not included | Included |
| Support & Customer success | ||||
| GitHub issue tracker | Included | Included | Included | Included |
| Priority Email | Not included | Included | Included | Included |
| Dedicated Slack | Not included | Not included | Not included | Included |
| Roadmap accelerationShape the product roadmap with customized features and integrations | Not included | Not included | Not included | Included |
| White-glove onboardingGet personalized deployment support and training for your team | Not included | Not included | Not included | Included |
| Uptime SLAGuaranteed uptime for your Firezone service | Not included | Not included | Not included | 99.9% |
| Billing & payment | ||||
| Seat countingSee the FAQ for how billable seats are counted. | — | All users & service accounts | Active in past 30 days | Active in past 30 days |
| Payment by credit cardPay for your subscription using a credit card | Not included | Included | Included | Included |
| Payment by ACH transferPay for your subscription using an ACH transfer | Not included | Included | Included | Included |
| Payment by wire transferPay for your subscription using a wire transfer | Not included | Not included | Not included | Included |
| Annual invoicingPay for your subscription annually | Not included | Not included | Not included | Included |
Team uses static seats. Every user or service account present in your account is a billable seat, whether or not they sign in.
Business and Enterprise use active, or floating, seats. Seats are counted by unique users or service accounts that signed in from a Firezone Client during the previous 30 days. Multiple client sign-ins by the same user or service account count as one seat, not additional seats.
For example, if your account has 100 users but only 40 signed in from a client in the previous 30 days, that is 40 active seats on Business or Enterprise. On Team, all 100 users count, plus any service accounts present in the account.
Business includes all of Firezone’s product features, including directory sync, device posture checks, and log sinks. It’s self-serve, with no contract, and you can choose monthly or annual billing.
Enterprise adds unlimited usage limits, compliance and pentest reports, a 99.9% uptime SLA, dedicated Slack support, white-glove onboarding, roadmap acceleration, and annual invoicing. These services and contractual commitments are not included in Business. Both plans use the same active-seat counting model.
Increases take effect immediately. We invoice the prorated amount for the added seats for the remainder of your current billing cycle.
Decreases take effect at the end of your current billing cycle, whether monthly or annual. The seats already paid for remain available until renewal.
For example, adding 5 Business seats halfway through an $80-per-seat annual cycle costs 5 × $80 × ½ = $200, invoiced immediately. Reducing your seats takes effect at the new billing cycle.
Team is $5 per seat per month or $50 per seat per year. Business is $8 per active seat per month or $80 per active seat per year. Annual subscriptions are charged upfront and save approximately 17% compared with 12 monthly payments.
Choose your billing period when upgrading in the admin portal. Enterprise pricing and annual billing are handled by your account manager.
Yes. Start with the free Starter plan, with no credit card required. To evaluate Enterprise, contact sales for a 30-day trial.
Team and Business support self-serve payment by credit card or ACH. Business does not offer invoiced payment terms. Enterprise also supports wire transfers and annual invoicing. Starter is free and requires no payment method.
Manage Team and Business subscriptions in your Firezone admin portal’s Account settings. For Enterprise, contact your account manager. Decreases take effect at the end of the current billing cycle. To delete your account, cancel your subscription first, then schedule account deletion from Settings → Account.
A simple deployment takes less than 10 minutes: install the Firezone Client and deploy a Gateway on your infrastructure. Follow our quickstart guide to connect your first resource. You can run Firezone alongside your existing VPN when they access different resources, and migrate at your own pace.
Traffic is end-to-end encrypted and, by default, routes directly to Gateways on your infrastructure. If a direct connection cannot be established, encrypted traffic can pass through our relay network. Firezone cannot decrypt the contents of your traffic.
The full source code is available in our GitHub repository, and you can self-host it for your organization. We do not currently offer documentation or support for self-hosting the entire platform. On every hosted plan, you deploy Gateways on your own infrastructure.
Yes. Nonprofits and educational institutions are eligible for a 50% discount. Contact sales to request it.
Deploy in minutes. Start free, with no credit card required.