Every European identity management tool reviewed
London, United Kingdom
Free and open source
Free
Best for: Enterprises needing complete self-hosted IAM with no licence cost
Keycloak is a full enterprise identity and access management platform released under Apache 2.0, and the combination is unusual enough to explain its position here: everything an organisation typically pays Okta for, running on your own infrastructure at no licence cost. Single sign-on across OAuth 2.0, OpenID Connect and SAML 2.0 covers federation with essentially anything already deployed.
The capabilities that matter to established organisations are all present. Identity brokering and social login bring users in from external providers.
User federation connects LDAP and Active Directory so the existing directory remains the source of truth rather than being migrated — usually the deciding factor. Multi-factor authentication with adaptive policies steps up requirements by context, and fine-grained authorisation services decide what a user may do rather than only whether they may log in, which is the part lightweight tools omit.
Its Quarkus foundation gives fast startup and a low memory footprint, with first-class Kubernetes integration and an operator for cluster deployment, and extensive customisation through themes and provider SPIs. Red Hat offers a commercially supported build for organisations that need someone to call. The costs are operational: you run, patch, back up and scale it, upgrades between major versions require attention, and the configuration surface is large enough to be genuinely complex.
What Keycloak does well
- Complete enterprise IAM under Apache 2.0, no licence cost
- OAuth2, OpenID Connect and SAML 2.0 with identity brokering
- LDAP and Active Directory federation, no user migration
- Fine-grained authorisation, not only authentication
- Kubernetes operator and commercially supported Red Hat build
Where Keycloak falls short
- You run, patch, back up and scale it yourself
- Large configuration surface with real complexity
- Major version upgrades need planning
- No hosted first-party service
Standout feature. Everything organisations pay Okta for, under Apache 2.0 — the licence cost is zero at any scale.
Pennsylvania, United States
Free and open source / Enterprise $5 per user per month, billed annually
Free
Best for: Self-hosters running a mix of legacy and modern applications
Authentik is the identity provider for people who already self-host a lot of things. Its flow-based authentication engine treats login, enrolment, recovery and verification as configurable flows built from stages rather than as fixed behaviours — so an unusual requirement, like a specific approval step during enrolment, is a configuration change instead of a fork.
The application proxy is what makes it particularly suited to a mixed estate. It puts authentication in front of applications that have none of their own, which is the practical situation for anyone running a mix of modern services with OIDC support and older tools without it. Protocol support spans SAML, OAuth2, OpenID Connect, LDAP and SCIM, so it federates in both directions.
Around that sit user management and self-service so people reset their own credentials, plus MFA. Authentik is open source and free to self-host, with an enterprise licence available for organisations wanting support. It originates from Hamburg. Compared with Keycloak it is lighter to deploy and configure while offering less depth in fine-grained authorisation, and as with any self-hosted IAM you own the operations.
What Authentik does well
- Flow-based engine makes unusual auth requirements configurable
- Application proxy adds auth to apps that have none
- SAML, OAuth2, OIDC, LDAP and SCIM support
- Lighter to deploy and configure than Keycloak
- Free and open source with an enterprise option
Where Authentik falls short
- Less depth in fine-grained authorisation than Keycloak
- You own the operations and upgrades
- Smaller ecosystem and community
- No first-party managed cloud service
Standout feature. The application proxy puts a login in front of software that never had one — which is what a real self-hosted estate needs.
Kiel, Germany
Free tier / from €99 per month
Free tier
Best for: Developers who want to remove passwords from an application
Hanko exists to make passwordless authentication a week of work. It is built around passkeys, WebAuthn and FIDO2 from the ground up rather than adding them to a password-based system, and the difference shows in what ships: drop-in UI components mean the login interface arrives working rather than as a specification to implement.
The security argument for passkeys is not incremental. A cryptographic credential held by the device and unlocked by fingerprint, face or PIN cannot be phished, cannot be reused across sites and cannot leak in a breach, which eliminates most real-world account compromise rather than reducing it. Hanko provides fallback methods for users whose devices or habits are not ready, alongside OAuth2 support.
The Passkey API is the underrated part: it adds passkeys to an existing authentication system without replacing it, which is the only realistic migration path for a product that already has users and cannot ask all of them to re-enrol.
Hanko is open source with self-hosted and cloud options, free tier and paid plans from €99 per month, based in Kiel with GDPR processing. Its focus is narrow by design — this is not an enterprise IAM platform with LDAP federation and fine-grained authorisation.
What Hanko does well
- Built passkey-first on WebAuthn and FIDO2
- Drop-in UI components — login works out of the box
- Passkey API adds passkeys to an existing system
- Open source with self-hosted and cloud options
- German company, GDPR processing
Where Hanko falls short
- Narrow focus — not a full enterprise IAM platform
- Paid plans from €99/month
- No LDAP federation or fine-grained authorisation
- Passkey adoption still uneven across older devices
Standout feature. A Passkey API that retrofits passkeys onto the login you already have — the only migration path that does not restart your user base.
Hungary
Flat €3–5 per user per month, no per-MAU billing
30-day free trial
Best for: Small teams wanting managed EU identity at a predictable price
Signward answers the complaint that actually drives teams off Auth0, which is not features but the bill. It prices flat at €3 to €5 per user per month with no per-MAU billing, so authentication costs scale with your team rather than with traffic spikes, dormant accounts reactivating, or a B2B customer bringing hundreds of occasional users.
Everything is included in every plan rather than tiered upwards: single sign-on, passkeys via WebAuthn and FIDO2, TOTP multi-factor authentication, custom domains and branding, webhooks, API keys and audit logs. That matters because the features usually reserved for higher tiers — SSO especially — are exactly the ones a small team needs to sell to a business customer.
It is hosted on Microsoft Azure EU regions within the EU Data Boundary, with a signed DPA, consent management, data export and tenant deletion, built on OpenID Connect and OAuth 2.0 with MIT-licensed SDKs, plus AI anomaly detection and security reporting.
Signward is Hungarian, aimed at teams of 5 to 500 users, with a 30-day free trial. The honest limits: the platform itself is not open source and cannot be self-hosted, it is a young vendor without the ecosystem of Keycloak or Auth0, and it is scoped to small teams rather than enterprise federation.
What Signward does well
- Flat €3–5 per user per month, no per-MAU billing
- SSO, passkeys, TOTP MFA and audit logs in every plan
- Hosted in Azure EU regions within the EU Data Boundary
- Signed DPA, consent management, data export, tenant deletion
- MIT-licensed SDKs and a 30-day free trial
Where Signward falls short
- Platform is not open source and cannot be self-hosted
- Young vendor with a small ecosystem
- Scoped to 5–500 users, not enterprise federation
- No LDAP or Active Directory federation
Standout feature. Flat per-user pricing with SSO in every plan — the two things that make Auth0 expensive, removed.
Trondheim, Norway
Custom pricing
Contact sales
Best for: Regulated businesses that must verify who a user really is
Signicat solves a different problem from everything else in this category. The other six authenticate a returning user — this one establishes, at the point of onboarding, that the person is who they claim to be. For a bank, an insurer, a lender or anyone under know-your-customer obligations, that verification step is a legal requirement rather than a product decision.
What makes it European rather than merely available in Europe is the connection to national identity schemes.
Signicat brokers the eID systems that people in each country already have and already trust — the bank ID, the national scheme, the government credential — so a Norwegian, a Dutch or a Spanish customer verifies with the method they use for everything else instead of photographing a passport for a service they have never heard of. Alongside that sit authentication, KYC workflows, electronic signatures and eIDAS qualified signatures with the legal standing that carries.
Signicat operates from Trondheim, so Norwegian jurisdiction inside the EEA under GDPR — the same regime as the EU without EU membership, and squarely inside European identity infrastructure. Pricing is custom and enterprise-oriented, so evaluation means a sales conversation and there is no self-serve route in. It is also not a developer IAM platform: for application login, Keycloak, Ory or Zitadel remain the answer, and many organisations run Signicat alongside one of them.
What Signicat does well
- Brokers the national eID schemes people already use
- KYC and identity verification, not just authentication
- eIDAS qualified signatures with legal standing
- Norwegian company in the EEA under GDPR
- Built for regulated onboarding obligations
Where Signicat falls short
- Custom enterprise pricing, no self-serve entry
- Not a developer IAM platform for application login
- Overkill without a verification obligation
- Coverage of national schemes varies by country
Standout feature. Customers verify with the bank ID they already trust rather than photographing a passport for a stranger.
Wimsheim, Germany
Customer IAM: Essentials €699/month (1,000 users) / Standard €1,399/month (5,000 users) / Pro €2,999/month / Enterprise on request; Workforce IAM €4.50 per user/month; 20% off yearly; VAT treatment not stated
30-day free trial (Customer IAM up to 500 users; Workforce IAM up to 30 users)
Best for: German-hosted customer and workforce IAM with list prices you can read before calling sales
cidaas is the product; Widas ID GmbH in Wimsheim, registered at the Amtsgericht Mannheim under HRB 731110, is the company you contract with. The About page describes cidaas as a business unit of WidasConcepts GmbH, and names no other shareholders. It covers both halves of the category — customer IAM for the people who log into your application, and workforce IAM for the people who work for you — with ID validation as an option on top.
The prices are on the page, which in this category is rarer than it should be. Customer IAM runs from €699 a month for a thousand users, €1,399 for five thousand, €2,999 for the Pro tier, with Enterprise on request; workforce IAM is €4.50 per user per month; paying yearly takes 20% off.
The trial is 30 days, up to 500 customer users or 30 workforce users. The pricing page does not say whether those amounts include VAT. Independent assurance exists in the form of ISO 27001 and ISO 9001, and the OpenID Foundation certification confirms the protocol implementation rather than the security of the operation.
The residency claim is the part to press on. cidaas says it is developed and hosted in Germany, and names the Open Telekom Cloud of Deutsche Telekom — but as an example, on a marketing page.
The security pages name no infrastructure partners, and no public sub-processor list was found; the website privacy policy names Google as a processor without stating where. For a German entity with German hosting that is a thin paper trail, so ask for the sub-processor list before signing. The product is closed source, and there is no edition you host yourself.
What cidaas does well
- German GmbH in Wimsheim, registered at Amtsgericht Mannheim (HRB 731110)
- Developed and hosted in Germany, with Open Telekom Cloud named as an example
- ISO 27001, ISO 9001 and OpenID Certified
- List prices published: Customer IAM from €699 per month for 1,000 users
- Workforce IAM at €4.50 per user per month, 20% off paid yearly
- 30-day trial covering up to 500 customer users
Where cidaas falls short
- Hosting partners are not named beyond one example, and there is no public sub-processor list
- Closed source, with no self-hosted edition
- The pricing page does not state whether the amounts include VAT
- €699 a month is a steep entry point for a small application
- The "since 1997" on the site belongs to the Widas group; no founding year is given for the cidaas entity
Standout feature. A German GmbH that prints the number — €699 a month for a thousand customer identities — instead of routing you to a sales call.
Stockholm, Sweden
Founded 2015
Community Edition free / Standard, Enterprise and Token Handler editions on a flat annual subscription, price on request
Free Community Edition; 14-day free trial of the paid editions
Best for: Teams that want a standards-heavy OAuth and OpenID Connect server on their own hardware
Curity AB is a Swedish limited company founded in Stockholm in 2015, registration number 559017-0196, at Sankt Göransgatan 66. Its terms of use, last updated on 30 March 2026, name that entity as the contracting party. The product is an identity server built around the standards rather than around a console: OAuth, OpenID Connect, FAPI, SAML and SCIM, with OpenID Foundation certification confirming the implementation conforms.
There is no Curity-operated SaaS. The deployment page describes on-premise, single-cloud, multi-cloud and hybrid installations and nothing else, which is a stronger residency position than any hosted service can offer — the data sits where you put it, and no vendor region picker is involved. It also means the whole operational burden is yours, and there is no way to try the product without standing it up.
The Community Edition is free and the paid editions — Standard, Enterprise and Token Handler — are sold on a flat annual subscription with the price on request, plus a 14-day trial.
Free is not the same as open source here: the code is not published under an open licence. Since May 2023 GRO, a Danish private equity fund, has held an investment in the company, with the size of the stake not stated. Curity's own pages name no ISO 27001 or comparable audit.
What Curity does well
- Swedish AB in Stockholm, founded 2015, registration number 559017-0196
- You choose the infrastructure: on-premise, single-cloud, multi-cloud or hybrid
- OAuth, OpenID Connect, FAPI, SAML and SCIM, certified by the OpenID Foundation
- Free Community Edition, plus a 14-day trial of the paid editions
- Flat annual subscription rather than billing per active user
Where Curity falls short
- No price published for the paid editions — flat annual subscription on request
- Free Community Edition, but the product is not open source
- No vendor-run service at all, so every deployment is your operation
- No ISO 27001 or comparable independent audit stated on its own pages
- Part-owned since 2023 by GRO, a Danish private equity fund, with the stake undisclosed
Standout feature. It runs on hardware you chose, because there is no Curity cloud to run it on instead.
Bremen, Germany
Founded 2002
Core Edition free (open source) / Enterprise Subscription from €35 per user per year, excl. VAT (recommended retail price, sold through certified partners)
Free (Core Edition)
Best for: Organisations replacing Active Directory with an open-source directory they run themselves
Univention GmbH has been in Bremen since 2002, registered there as HRB 20755; Nubus is the name it gave its identity management in 2024, out of what used to be part of Univention Corporate Server.
It bundles the pieces an organisation needs to stop paying for a directory: an OpenLDAP directory with SCIM, the Directory Manager, a portal, self-service password reset, and single sign-on over SAML and OpenID Connect. All of it is AGPL-3.0-only, so the Core Edition is free to run and the source is there to read.
The honest description of the single sign-on is one Univention gives itself: the identity provider inside Nubus is, in the words of its own README, a preconfigured deployment of Keycloak. That overlaps directly with the tool at number one in this list. What you are buying, or downloading, is the package around it — the directory, the portal, the self-service and the management interface assembled and maintained as one product, rather than seven components you integrate.
There is no Univention-operated cloud. You deploy it on a VM, on Kubernetes or hybrid, which means the residency question is answered by wherever you put it rather than by a vendor's region picker.
The Enterprise Subscription starts at €35 per user per year excluding VAT, but that figure is a recommended retail price sold through certified partners, so what you actually pay depends on which partner you buy from. Univention's own pages name no ISO 27001 or comparable audit, which for a self-hosted product matters less than for a SaaS but is still absent.
What Univention Nubus does well
- AGPL-3.0-only, with a free Core Edition
- German GmbH in Bremen, trading since 2002 (HRB 20755)
- Self-hosted on a VM, Kubernetes or hybrid — residency is your decision
- Directory, portal, self-service and SSO assembled as one package
- Published price: from €35 per user per year for the Enterprise Subscription
Where Univention Nubus falls short
- The identity provider is a preconfigured Keycloak, which is already number one here
- No ISO 27001 or comparable independent audit stated on its own pages
- The €35 is a recommended retail price sold through partners, not a checkout price
- No Univention-run service, so the operations and upgrades are yours
Standout feature. A directory, a portal and single sign-on in one AGPL package from Bremen — with the price per user per year printed on the site.
Copenhagen, Denmark
Custom pricing; no public price list
Best for: Enterprises that need identity governance rather than a login provider
Omada does a different job from almost everything above it here. Identity governance and administration is about who may hold which access and whether that is still justified, so the products it replaces are SailPoint, Saviynt and Microsoft Entra ID Governance rather than Auth0. Omada A/S is at Oesterbrogade 135 in Copenhagen, owned by GRO, a Danish private equity fund, and Kirk Kapital, a Danish family investor, both represented on the board.
The contract follows the customer. Under the Customer Agreement V01 2025, buyers in the EEA and the rest of the world contract with Omada A/S under Danish law with the Copenhagen City Court as venue; US and Canadian customers get Omada Solutions, Inc., and UK customers Omada Solutions, Ltd. For a European buyer that is a clean Danish contract. Independent assurance is unusually thorough for this list: ISO/IEC 27001:2022, SOC 2 Type 2 and SOC 3.
Then the infrastructure. Omada Identity Cloud runs on Microsoft Azure, and the DPA V04 2025 offers an EU region operated by Microsoft Ireland Operations Ltd. or a US region, as selected by the customer — without stating which one you get by default. Transactional e-mail goes through Twilio SendGrid in the EU and the US. So a Danish company, Danish law, American infrastructure underneath: the combination this directory keeps warning about. There is no public price list and no trial.
What Omada does well
- Danish A/S in Copenhagen, contracting under Danish law for EEA customers
- ISO/IEC 27001:2022, SOC 2 Type 2 and SOC 3
- Identity governance, a job the login providers in this category do not do
- Danish ownership: GRO and Kirk Kapital, both on the board
- Replaces SailPoint, Saviynt and Microsoft Entra ID Governance
Where Omada falls short
- Omada Identity Cloud runs on Microsoft Azure — American infrastructure under a Danish contract
- The DPA offers an EU or a US region and does not say which is the default
- Transactional e-mail runs through Twilio SendGrid in both the EU and the US
- No public price list and no trial
- Closed source, with no self-hosted edition
Standout feature. A Danish contract under Copenhagen jurisdiction, running on Microsoft Azure — settle which region you get before you sign.
Puteaux (Paris), France
Founded 2022
Custom pricing; no public price list
Demo on request
Best for: French organisations wanting governance, SSO and MFA as a service without leaving European hosting
Memority SAS sits at 11-13 Cours Valmy in Puteaux, with capital of €2,435,048 and RCS Versailles number B 920 613 478. The register records the company as created on 28 September 2022, with the SAS AIGAVE as président — so the entity is young even though the careers page claims ten years of IAM work behind it. In May 2025 it raised €13m in a Series A led by Tikehau Capital, a French investor, through Brienne, its cybersecurity strategy.
The product is IDaaS covering three modules — identity governance, single sign-on and multi-factor authentication — rather than only application login, which puts it closer to Memority's stated competitors, Okta, Entra ID and SailPoint, than to the developer-facing tools higher up this list. It holds ISO 27001 and ISO 27701, the privacy-management extension, plus AirCyber Gold from the aerospace supply-chain programme.
Hosting runs in one cloud region per customer, Paris or Dublin, on a shared or dedicated platform, with three underlying options: AWS, Google Cloud or S3NS.
Only the last is SecNumCloud-qualified, and the qualification is S3NS's own — announced on 13 May 2026 for SecNumCloud 3.2 — not a certification Memority holds. Pick AWS or Google Cloud and you have a French contract on American-owned infrastructure, which is exactly the distinction this directory exists to make. No prices are published and there is no trial; a demo request is the only way in.
What Memority does well
- French SAS in Puteaux, RCS Versailles B 920 613 478, backed by the French investor Tikehau Capital
- ISO 27001 and ISO 27701
- Hosting stays in Europe: one region, Paris or Dublin
- A SecNumCloud-qualified hosting option through S3NS
- Governance, single sign-on and MFA in one platform, shared or dedicated
Where Memority falls short
- Two of the three hosting options, AWS and Google Cloud, are American-owned infrastructure
- The SecNumCloud 3.2 qualification belongs to S3NS, the host, not to Memority
- No price published and no trial — a demo on request is the only entry
- Closed source, with no edition you host yourself
- The entity you contract with dates only from September 2022, whatever the ten years of expertise claimed
Standout feature. Paris or Dublin, one region, and a SecNumCloud option — provided you notice the qualification belongs to S3NS and not to Memority.
Wiesbaden, Germany
Founded 2021
Bare.ID is priced by monthly active users (MAU) on a 12 or 36 month contract, with plans called Professional, Premium and Enterprise (custom, including on-premise or hybrid operation). The pricing page has a price calculator for B2E, B2B and B2C use cases, but the amounts it shows are not present in the server-rendered HTML, so no euro prices are quoted here. The FAQ says payment can be monthly, quarterly or yearly, by invoice or SEPA direct debit, and that special terms exist for non-profits, education and public bodies. Prices: see website or ask sales.
30-day free trial with full functionality (per the vendor FAQ)
Best for: German organisations wanting managed Keycloak with support
Bare.ID GmbH in Wiesbaden (Amtsgericht Wiesbaden, HRB 33190) runs an identity and access management platform built on Keycloak. The company grew out of Keycloak consulting inside the AOE group, became its own company in 2021 and was spun off from AOE in 2023. It covers workforce identities, customer identities and partner identities, with single sign-on, multi-factor authentication, lifecycle management and access policies on top of the open-source core.
The pitch is that Keycloak is made operable. Bare.ID adds a management interface, white-label templates, staging environments, daily backups with point-in-time recovery, SLA-backed support up to a 24/7 hotline, and migration help for existing Keycloak installations. Development, hosting and support are described as entirely German, and the company holds ISO 27001. SaaS is the main offer, with hybrid and on-premise available when data must stay local.
Weigh it honestly against what is already on this page. Keycloak itself costs no licence, so Bare.ID is a paid service on top of it, not a cheaper route. Unlike cidaas, Bare.ID does not publish list prices in the page source: a calculator exists, but you will end up talking to sales. Hosting partners are not named. It suits mid-sized German and public-sector buyers rather than small teams or developers who want a free tier.
What Bare.ID does well
- German GmbH in Wiesbaden, registered at Amtsgericht Wiesbaden (HRB 33190)
- Keycloak core with no vendor lock-in and a stated one-day migration path for existing installations
- SaaS in Germany, plus hybrid and on-premise operation
- ISO 27001 certification, with hosting partners described as BSI C5 compliant
- 30-day trial with full functionality, MAU-based pricing and support levels up to 24/7
Where Bare.ID falls short
- No prices in the page source, only a calculator and a sales route
- Hosting partners and data centres are not named
- A paid service on a free core, so more expensive than running Keycloak yourself
- Platform extras beyond Keycloak are proprietary, and there is no free tier
Standout feature. A managed, supported, German-operated Keycloak with on-premise and hybrid options for organisations that do not want to run it themselves.
Rennes, France
Founded 2018
Checked on 26 October 2026 on cloud-iam.com/pricing. Freemium: free for up to 100 users, 1 realm, mutualized infrastructure, no SLA, community support, hosted on AWS only. Starter: from €225/month, dedicated high-availability deployment, up to 100 realms, unlimited monthly active users, 99% uptime SLA, community support. Essential: from €495/month, 99.9% SLA, email and ticket support, custom extensions (.jar), automatic planned updates. Premium: from €1,440/month, 99.95% SLA, 24/7 on-call team, 1 day per month of Keycloak consulting, dedicated status page. Max: custom pricing (contact sales), 99.98% SLA, multi-region deployment, 15 minute backups. Prices depend on the number of users and the chosen cloud provider; the page has a calculator, monthly or yearly billing, and states a 10% saving on yearly billing.
Freemium plan, free for up to 100 users (1 realm, mutualized, no SLA, AWS only)
Best for: Teams wanting Keycloak run for them in the EU
Cloud-IAM is a French company in Rennes (CLOUDIAM, SIREN 900205436) that does one thing: it deploys, upgrades, backs up and monitors Keycloak for you.
Every paid plan is a dedicated high-availability deployment on the cloud you pick, and Scaleway and 3DS Outscale are both on the list next to AWS, Google Cloud and Azure. Its own sub-processor page says an EU-hosted deployment involves no transfer of personal data outside the EU, and that logs and backups stay in France. You get Keycloak without having to operate a cluster, a database and a patch schedule yourself.
The product underneath is Keycloak, so the trade-offs of Keycloak apply and the page already lists it at #1.
What Cloud-IAM adds is the operations layer: automatic planned updates, theme editing and custom extension upload without downtime, an uptime SLA from 99% to 99.98%, and a 24/7 on-call team on Premium and Max. Support sits on top of that, from community-only on Starter to consulting days on Premium. For a team that likes Keycloak but has no one to run it, that is the real offer.
It is not cheap next to running Keycloak yourself, and it is not a different engine. Paid plans start at €225 a month for Starter and €495 for Essential, and the 99% SLA on Starter is thin for a login system.
Compared with Zitadel Cloud or Ory Network it is more of a hosting and support service than a distinct product, and it has no pay-per-user cloud model of its own. The free tier is useful for testing, but it is shared infrastructure on AWS with no SLA, so the sovereignty story starts on the paid plans.
What Cloud-IAM does well
- Dedicated Keycloak deployment per customer on Scaleway or 3DS Outscale in France, or AWS, Google Cloud or Azure
- French company registered in Rennes, with an EU-only operator model stated on its sub-processor page
- Free tier for up to 100 users to try Keycloak before committing
- Unlimited monthly active users on paid plans, priced by plan rather than per login
- Custom themes and .jar extensions supported, with SLAs up to 99.98% and 24/7 on-call on Premium
Where Cloud-IAM falls short
- It is Keycloak, so it carries the same admin complexity and sparse polish as the #1 tool on this page
- Paid plans start at €225 a month, well above Zitadel Cloud or Ory Network entry prices
- The free tier runs on AWS with a shared deployment and no SLA, so it is not a sovereign setup
- ISO 27001 is stated by the vendor but no certificate was visible, and SecNumCloud and HDS apply to Outscale deployments only
Standout feature. It is the managed route for teams who want Keycloak itself on a French company's dedicated EU deployment, with an SLA behind it.
Munich, Germany
Founded 2022
No prices are published on the vendor's site. The vendor offers a demo and a free security assessment; pricing is on request.
Best for: Security teams that need data-level access visibility
CyberDesk is a Munich company, CyberDesk GmbH, founded in 2022 by Dr. Tobias Lieberum and Prabhakar Mishra, that sells identity-centric data security. It sits next to an identity provider instead of replacing one. The platform builds an inventory of human and non-human identities (service accounts, tokens, secrets, third parties, AI agents) and an inventory of sensitive data, then maps who can reach which data through which groups, roles and permissions, down to individual resources.
On top of that map, the vendor lists access reviews at data-privilege level, lifecycle management with simulated provisioning, and risk monitoring that traces what a compromised identity could touch. The integrations page names Entra ID, Okta, Active Directory, SharePoint, OneDrive, Google Workspace, Slack, Jira, ServiceNow, Personio and many AWS, Azure and Google Cloud services. According to the vendor, the connectors are agentless and work out-of-band, so no change to application code is needed.
It is last on this page because it solves a different problem from the single sign-on and customer identity tools above. It does not log users in. It also publishes no prices and no trial, offers a demo and a free security assessment instead, and shows a 'TÜV Certified Security' claim without naming the scheme. Read it as a governance layer for companies that already run an identity provider and need to see over-provisioned access.
What CyberDesk does well
- Shows access down to file and resource level, not only group membership
- Covers non-human identities such as tokens, secrets and service accounts
- Agentless connectors for Entra ID, Okta, SharePoint, AWS, Azure and Google Cloud, per the vendor
- Access reviews and lifecycle simulation tied to data context
- German GmbH with a Handelsregister entry and VAT ID in the imprint
Where CyberDesk falls short
- Not a login or SSO product, so it does not replace an identity provider
- No published prices and no self-service trial
- 'TÜV Certified Security' is claimed without a named scheme or certificate
- Founded in 2022, with one customer case study on its site
Standout feature. It is the only entry here that measures who can actually reach which data, rather than how users sign in.
