Best European Identity Management

#1 Keycloak

London, United Kingdom Free and open source Free

Best for: Enterprises needing complete self-hosted IAM with no licence cost

• Operating company. Keycloak (CNCF project, Red Hat originated)
• Jurisdiction. Self-hosted; project governance is international
• Where the data sits. Wherever you deploy it
• Independent checks. GDPR — you remain the controller
• Source code. Open source
• Replaces. Auth0, Okta

Keycloak is a full enterprise identity and access management platform released under Apache 2.0, and the combination is unusual enough to explain its position here: everything an organisation typically pays Okta for, running on your own infrastructure at no licence cost. Single sign-on across OAuth 2.0, OpenID Connect and SAML 2.0 covers federation with essentially anything already deployed.

The capabilities that matter to established organisations are all present. Identity brokering and social login bring users in from external providers.

User federation connects LDAP and Active Directory so the existing directory remains the source of truth rather than being migrated — usually the deciding factor. Multi-factor authentication with adaptive policies steps up requirements by context, and fine-grained authorisation services decide what a user may do rather than only whether they may log in, which is the part lightweight tools omit.

Its Quarkus foundation gives fast startup and a low memory footprint, with first-class Kubernetes integration and an operator for cluster deployment, and extensive customisation through themes and provider SPIs. Red Hat offers a commercially supported build for organisations that need someone to call. The costs are operational: you run, patch, back up and scale it, upgrades between major versions require attention, and the configuration surface is large enough to be genuinely complex.

Standout feature. Everything organisations pay Okta for, under Apache 2.0 — the licence cost is zero at any scale.

#2 Ory

Munich, Germany Free tier / from €29 per month (Ory Network) Free tier

Best for: Developers building API-first applications who want composable identity

• Operating company. Ory Corp
• Jurisdiction. EU (Germany)
• Where the data sits. Self-hosted, or Ory Network
• Independent checks. GDPR
• Source code. Open source
• Replaces. Auth0, Firebase Auth

Ory takes identity apart and lets you deploy only the pieces you need. Kratos handles identity and user management — registration, login, recovery, verification, profile — without prescribing a UI. Hydra is a certified OAuth 2.0 and OpenID Connect server for issuing tokens to your own clients and third parties. Keto handles permissions using the model behind Google's Zanzibar, which scales to relationship-based authorisation that role lists cannot express. Oathkeeper is a zero-trust API gateway enforcing policy at the edge.

For an API-first architecture that composability is the point: you can run Kratos alone for authentication, add Hydra when you need to be an OAuth provider, and bring in Keto when permissions outgrow roles — rather than deploying a monolith on day one and configuring around it.

All of it is Apache 2.0 and self-hostable, with Ory Network as the managed service from €29 per month above a free tier, so a team can start hosted and move in-house without changing product. Ory Corp is based in Munich under EU jurisdiction. The trade-off is operational surface: deploying all four services is more moving parts than one platform, and the developer-oriented design assumes you are building the interface yourself.

Standout feature. Identity as four separate services — run authentication alone today and add OAuth or permissions when you actually need them.

#3 Zitadel

St. Gallen, Switzerland Free tier / from €100 per month Free tier

Best for: B2B SaaS products that need multi-tenant authentication

• Operating company. ZITADEL
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. Switzerland, or self-hosted
• Independent checks. GDPR-adequate
• Source code. Open source
• Replaces. Auth0, AWS Cognito

Zitadel is built for the shape a B2B SaaS product actually has. Multi-tenancy is architectural rather than configured on top: separate organisations each with their own users, policies, branding and identity providers, inside one deployment — which is the requirement that makes generic IAM awkward and is the reason B2B products keep arriving here.

Its event-sourced architecture is the other distinguishing property. Every change to identity state is stored as an immutable event, so a complete audit trail exists by construction rather than because someone remembered to log it — and state at any past moment can be reconstructed, which is a materially stronger position in a compliance review than a log file.

Protocol support covers OpenID Connect, OAuth2 and SAML, with passwordless and passkey authentication, comprehensive APIs and a developer experience aimed at building rather than configuring. It is open source and self-hostable, with a managed service on a free tier and paid plans from €100 per month. ZITADEL operates from St. Gallen, so Swiss data protection under an EU adequacy decision rather than intra-EEA processing — relevant only if procurement requires EU establishment, and removable by self-hosting.

Standout feature. Multi-tenancy in the architecture rather than in the configuration — the reason B2B products stop fighting their IAM.

#4 Authentik

Hamburg, Germany Free and open source / Enterprise available Free

Best for: Self-hosters running a mix of legacy and modern applications

• Operating company. Authentik Security
• Jurisdiction. Self-hosted; German origins
• Where the data sits. Wherever you deploy it
• Independent checks. GDPR
• Source code. Open source
• Replaces. Okta, OneLogin

Authentik is the identity provider for people who already self-host a lot of things. Its flow-based authentication engine treats login, enrolment, recovery and verification as configurable flows built from stages rather than as fixed behaviours — so an unusual requirement, like a specific approval step during enrolment, is a configuration change instead of a fork.

The application proxy is what makes it particularly suited to a mixed estate. It puts authentication in front of applications that have none of their own, which is the practical situation for anyone running a mix of modern services with OIDC support and older tools without it. Protocol support spans SAML, OAuth2, OpenID Connect, LDAP and SCIM, so it federates in both directions.

Around that sit user management and self-service so people reset their own credentials, plus MFA. Authentik is open source and free to self-host, with an enterprise licence available for organisations wanting support. It originates from Hamburg. Compared with Keycloak it is lighter to deploy and configure while offering less depth in fine-grained authorisation, and as with any self-hosted IAM you own the operations.

Standout feature. The application proxy puts a login in front of software that never had one — which is what a real self-hosted estate needs.

#5 Hanko

Kiel, Germany Free tier / from €99 per month Free tier

Best for: Developers who want to remove passwords from an application

• Operating company. Hanko
• Jurisdiction. EU (Germany)
• Where the data sits. EU, or self-hosted
• Independent checks. GDPR
• Source code. Open source
• Replaces. Auth0, Firebase Auth

Hanko exists to make passwordless authentication a week of work. It is built around passkeys, WebAuthn and FIDO2 from the ground up rather than adding them to a password-based system, and the difference shows in what ships: drop-in UI components mean the login interface arrives working rather than as a specification to implement.

The security argument for passkeys is not incremental. A cryptographic credential held by the device and unlocked by fingerprint, face or PIN cannot be phished, cannot be reused across sites and cannot leak in a breach, which eliminates most real-world account compromise rather than reducing it. Hanko provides fallback methods for users whose devices or habits are not ready, alongside OAuth2 support.

The Passkey API is the underrated part: it adds passkeys to an existing authentication system without replacing it, which is the only realistic migration path for a product that already has users and cannot ask all of them to re-enrol.

Hanko is open source with self-hosted and cloud options, free tier and paid plans from €99 per month, based in Kiel with GDPR processing. Its focus is narrow by design — this is not an enterprise IAM platform with LDAP federation and fine-grained authorisation.

Standout feature. A Passkey API that retrofits passkeys onto the login you already have — the only migration path that does not restart your user base.

#6 Signward

Hungary Flat €3–5 per user per month, no per-MAU billing 30-day free trial

Best for: Small teams wanting managed EU identity at a predictable price

• Operating company. Signward
• Jurisdiction. EU (Hungary)
• Where the data sits. Microsoft Azure EU regions, within the EU Data Boundary
• Independent checks. GDPR with signed DPA, consent management, data export, tenant deletion
• Source code. Closed source
• Replaces. Auth0, Okta

Signward answers the complaint that actually drives teams off Auth0, which is not features but the bill. It prices flat at €3 to €5 per user per month with no per-MAU billing, so authentication costs scale with your team rather than with traffic spikes, dormant accounts reactivating, or a B2B customer bringing hundreds of occasional users.

Everything is included in every plan rather than tiered upwards: single sign-on, passkeys via WebAuthn and FIDO2, TOTP multi-factor authentication, custom domains and branding, webhooks, API keys and audit logs. That matters because the features usually reserved for higher tiers — SSO especially — are exactly the ones a small team needs to sell to a business customer.

It is hosted on Microsoft Azure EU regions within the EU Data Boundary, with a signed DPA, consent management, data export and tenant deletion, built on OpenID Connect and OAuth 2.0 with MIT-licensed SDKs, plus AI anomaly detection and security reporting.

Signward is Hungarian, aimed at teams of 5 to 500 users, with a 30-day free trial. The honest limits: the platform itself is not open source and cannot be self-hosted, it is a young vendor without the ecosystem of Keycloak or Auth0, and it is scoped to small teams rather than enterprise federation.

Standout feature. Flat per-user pricing with SSO in every plan — the two things that make Auth0 expensive, removed.

#7 Signicat

Trondheim, Norway Custom pricing Contact sales

Best for: Regulated businesses that must verify who a user really is

• Operating company. Signicat
• Jurisdiction. Norway (EEA, not an EU member state)
• Where the data sits. EEA
• Independent checks. GDPR, eIDAS qualified signatures
• Source code. Closed source
• Replaces. Onfido, Jumio, DocuSign identity

Signicat solves a different problem from everything else in this category. The other six authenticate a returning user — this one establishes, at the point of onboarding, that the person is who they claim to be. For a bank, an insurer, a lender or anyone under know-your-customer obligations, that verification step is a legal requirement rather than a product decision.

What makes it European rather than merely available in Europe is the connection to national identity schemes.

Signicat brokers the eID systems that people in each country already have and already trust — the bank ID, the national scheme, the government credential — so a Norwegian, a Dutch or a Spanish customer verifies with the method they use for everything else instead of photographing a passport for a service they have never heard of. Alongside that sit authentication, KYC workflows, electronic signatures and eIDAS qualified signatures with the legal standing that carries.

Signicat operates from Trondheim, so Norwegian jurisdiction inside the EEA under GDPR — the same regime as the EU without EU membership, and squarely inside European identity infrastructure. Pricing is custom and enterprise-oriented, so evaluation means a sales conversation and there is no self-serve route in. It is also not a developer IAM platform: for application login, Keycloak, Ory or Zitadel remain the answer, and many organisations run Signicat alongside one of them.

Standout feature. Customers verify with the bank ID they already trust rather than photographing a passport for a stranger.

#8 cidaas

Wimsheim, Germany Customer IAM: Essentials €699/month (1,000 users) / Standard €1,399/month (5,000 users) / Pro €2,999/month / Enterprise on request; Workforce IAM €4.50 per user/month; 20% off yearly; VAT treatment not stated 30-day free trial (Customer IAM up to 500 users; Workforce IAM up to 30 users)

Best for: German-hosted customer and workforce IAM with list prices you can read before calling sales

• Operating company. Widas ID GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Germany/Europe; hosting partners not named apart from Open Telekom Cloud (Deutsche Telekom) as an example; no public sub-processor list
• Independent checks. ISO 27001, ISO 9001, OpenID Certified
• Source code. Closed source
• Replaces. Auth0, Okta, Microsoft Entra ID

cidaas is the product; Widas ID GmbH in Wimsheim, registered at the Amtsgericht Mannheim under HRB 731110, is the company you contract with. The About page describes cidaas as a business unit of WidasConcepts GmbH, and names no other shareholders. It covers both halves of the category — customer IAM for the people who log into your application, and workforce IAM for the people who work for you — with ID validation as an option on top.

The prices are on the page, which in this category is rarer than it should be. Customer IAM runs from €699 a month for a thousand users, €1,399 for five thousand, €2,999 for the Pro tier, with Enterprise on request; workforce IAM is €4.50 per user per month; paying yearly takes 20% off.

The trial is 30 days, up to 500 customer users or 30 workforce users. The pricing page does not say whether those amounts include VAT. Independent assurance exists in the form of ISO 27001 and ISO 9001, and the OpenID Foundation certification confirms the protocol implementation rather than the security of the operation.

The residency claim is the part to press on. cidaas says it is developed and hosted in Germany, and names the Open Telekom Cloud of Deutsche Telekom — but as an example, on a marketing page.

The security pages name no infrastructure partners, and no public sub-processor list was found; the website privacy policy names Google as a processor without stating where. For a German entity with German hosting that is a thin paper trail, so ask for the sub-processor list before signing. The product is closed source, and there is no edition you host yourself.

Standout feature. A German GmbH that prints the number — €699 a month for a thousand customer identities — instead of routing you to a sales call.

#9 Curity

Stockholm, Sweden Founded 2015 Community Edition free / Standard, Enterprise and Token Handler editions on a flat annual subscription, price on request Free Community Edition; 14-day free trial of the paid editions

Best for: Teams that want a standards-heavy OAuth and OpenID Connect server on their own hardware

• Operating company. Curity AB
• Jurisdiction. EU (Sweden)
• Where the data sits. Self-hosted (on-premise or any cloud you choose); no Curity-operated SaaS found
• Independent checks. OpenID Foundation certified
• Source code. Closed source
• Replaces. Auth0, Okta, Ping Identity

Curity AB is a Swedish limited company founded in Stockholm in 2015, registration number 559017-0196, at Sankt Göransgatan 66. Its terms of use, last updated on 30 March 2026, name that entity as the contracting party. The product is an identity server built around the standards rather than around a console: OAuth, OpenID Connect, FAPI, SAML and SCIM, with OpenID Foundation certification confirming the implementation conforms.

There is no Curity-operated SaaS. The deployment page describes on-premise, single-cloud, multi-cloud and hybrid installations and nothing else, which is a stronger residency position than any hosted service can offer — the data sits where you put it, and no vendor region picker is involved. It also means the whole operational burden is yours, and there is no way to try the product without standing it up.

The Community Edition is free and the paid editions — Standard, Enterprise and Token Handler — are sold on a flat annual subscription with the price on request, plus a 14-day trial.

Free is not the same as open source here: the code is not published under an open licence. Since May 2023 GRO, a Danish private equity fund, has held an investment in the company, with the size of the stake not stated. Curity's own pages name no ISO 27001 or comparable audit.

Standout feature. It runs on hardware you chose, because there is no Curity cloud to run it on instead.

#10 Univention Nubus

Bremen, Germany Founded 2002 Core Edition free (open source) / Enterprise Subscription from €35 per user per year, excl. VAT (recommended retail price, sold through certified partners) Free (Core Edition)

Best for: Organisations replacing Active Directory with an open-source directory they run themselves

• Operating company. Univention GmbH
• Jurisdiction. EU (Germany)
• Where the data sits. Self-hosted (on-premises VM, Kubernetes or hybrid, wherever you run it)
• Source code. Open source
• Replaces. Microsoft Entra ID, Microsoft Active Directory, Okta

Univention GmbH has been in Bremen since 2002, registered there as HRB 20755; Nubus is the name it gave its identity management in 2024, out of what used to be part of Univention Corporate Server.

It bundles the pieces an organisation needs to stop paying for a directory: an OpenLDAP directory with SCIM, the Directory Manager, a portal, self-service password reset, and single sign-on over SAML and OpenID Connect. All of it is AGPL-3.0-only, so the Core Edition is free to run and the source is there to read.

The honest description of the single sign-on is one Univention gives itself: the identity provider inside Nubus is, in the words of its own README, a preconfigured deployment of Keycloak. That overlaps directly with the tool at number one in this list. What you are buying, or downloading, is the package around it — the directory, the portal, the self-service and the management interface assembled and maintained as one product, rather than seven components you integrate.

There is no Univention-operated cloud. You deploy it on a VM, on Kubernetes or hybrid, which means the residency question is answered by wherever you put it rather than by a vendor's region picker.

The Enterprise Subscription starts at €35 per user per year excluding VAT, but that figure is a recommended retail price sold through certified partners, so what you actually pay depends on which partner you buy from. Univention's own pages name no ISO 27001 or comparable audit, which for a self-hosted product matters less than for a SaaS but is still absent.

Standout feature. A directory, a portal and single sign-on in one AGPL package from Bremen — with the price per user per year printed on the site.

#11 Omada

Copenhagen, Denmark Custom pricing; no public price list

Best for: Enterprises that need identity governance rather than a login provider

• Operating company. Omada A/S
• Jurisdiction. EU (Denmark)
• Where the data sits. Microsoft Azure, EU region (Microsoft Ireland Operations Ltd.) or US region as selected by the customer; transactional e-mail via Twilio SendGrid (EU and US)
• Independent checks. ISO/IEC 27001:2022, SOC 2 Type 2, SOC 3
• Source code. Closed source
• Replaces. SailPoint, Saviynt, Microsoft Entra ID Governance

Omada does a different job from almost everything above it here. Identity governance and administration is about who may hold which access and whether that is still justified, so the products it replaces are SailPoint, Saviynt and Microsoft Entra ID Governance rather than Auth0. Omada A/S is at Oesterbrogade 135 in Copenhagen, owned by GRO, a Danish private equity fund, and Kirk Kapital, a Danish family investor, both represented on the board.

The contract follows the customer. Under the Customer Agreement V01 2025, buyers in the EEA and the rest of the world contract with Omada A/S under Danish law with the Copenhagen City Court as venue; US and Canadian customers get Omada Solutions, Inc., and UK customers Omada Solutions, Ltd. For a European buyer that is a clean Danish contract. Independent assurance is unusually thorough for this list: ISO/IEC 27001:2022, SOC 2 Type 2 and SOC 3.

Then the infrastructure. Omada Identity Cloud runs on Microsoft Azure, and the DPA V04 2025 offers an EU region operated by Microsoft Ireland Operations Ltd. or a US region, as selected by the customer — without stating which one you get by default. Transactional e-mail goes through Twilio SendGrid in the EU and the US. So a Danish company, Danish law, American infrastructure underneath: the combination this directory keeps warning about. There is no public price list and no trial.

Standout feature. A Danish contract under Copenhagen jurisdiction, running on Microsoft Azure — settle which region you get before you sign.

#12 Memority

Puteaux (Paris), France Founded 2022 Custom pricing; no public price list Demo on request

Best for: French organisations wanting governance, SSO and MFA as a service without leaving European hosting

• Operating company. Memority SAS
• Jurisdiction. EU (France)
• Where the data sits. SaaS in one cloud region, Paris or Dublin, on AWS, Google Cloud or S3NS (SecNumCloud-qualified); shared or dedicated platform
• Independent checks. ISO 27001, ISO 27701, AirCyber Gold (the SecNumCloud 3.2 qualification belongs to the S3NS hosting option)
• Source code. Closed source
• Replaces. Okta, Microsoft Entra ID, SailPoint

Memority SAS sits at 11-13 Cours Valmy in Puteaux, with capital of €2,435,048 and RCS Versailles number B 920 613 478. The register records the company as created on 28 September 2022, with the SAS AIGAVE as président — so the entity is young even though the careers page claims ten years of IAM work behind it. In May 2025 it raised €13m in a Series A led by Tikehau Capital, a French investor, through Brienne, its cybersecurity strategy.

The product is IDaaS covering three modules — identity governance, single sign-on and multi-factor authentication — rather than only application login, which puts it closer to Memority's stated competitors, Okta, Entra ID and SailPoint, than to the developer-facing tools higher up this list. It holds ISO 27001 and ISO 27701, the privacy-management extension, plus AirCyber Gold from the aerospace supply-chain programme.

Hosting runs in one cloud region per customer, Paris or Dublin, on a shared or dedicated platform, with three underlying options: AWS, Google Cloud or S3NS.

Only the last is SecNumCloud-qualified, and the qualification is S3NS's own — announced on 13 May 2026 for SecNumCloud 3.2 — not a certification Memority holds. Pick AWS or Google Cloud and you have a French contract on American-owned infrastructure, which is exactly the distinction this directory exists to make. No prices are published and there is no trial; a demo request is the only way in.

Standout feature. Paris or Dublin, one region, and a SecNumCloud option — provided you notice the qualification belongs to S3NS and not to Memority.