Best European Identity and Access Management (2026): 8 Services Compared

The best European identity and access management service for most apps is Hanko (Germany): hosted login with passkeys, social login and MFA, free for 10,000 monthly active users and open source. For enterprise single sign-on with SAML and LDAP on European clouds, choose Cloud-IAM (France); for a full customer identity platform hosted in Germany, cidaas.

Identity and access management (IAM) is the part of your app that signs users in, keeps their accounts and decides what they may access – logins, single sign-on, MFA and user management. Because it holds every user account, where the provider is based matters more than for most tools. This page ranks every European IAM service I would recommend. If you are leaving one specific US provider, the deeper comparison is in Best European alternatives to Auth0. I compared fifteen services with European roots and kept eight.

What are the best European identity and access management tools?

These are the European IAM services I would choose, in order. Each one is reviewed below.

1. Hanko (Germany) – hosted, open-source login with passkeys and 10,000 free MAU. Best for most apps.
2. Cloud-IAM (France) – managed Keycloak on European or global clouds. Best for enterprise SSO.
3. cidaas (Germany) – full CIAM platform hosted in Germany. Best for large consumer platforms.
4. Quasr (Belgium) – self-service CIAM with a free start-up plan. Best for European start-ups.
5. Bare.ID (Germany) – Keycloak-based IAM in BSI C5 data centres. Best for German compliance.
6. Curity (Sweden) – self-hosted identity server with a free Community edition. Best for API security.
7. Login-Master (Germany) – Keycloak with delegated administration. Best for B2B portals.
8. Nevis (Switzerland) – passwordless authentication for banks. Best for regulated industries.

European identity and access management tools compared

Prices from public pricing pages. Affiliate links and sponsored placements are labelled.

“Data hosted in” shows where each provider says it runs its identity service; the hosting lines on each tool add a DNS and ASN lookup of its website (25 Oct 2026). Curity runs in your own infrastructure.

How I chose the best European identity and access management tools

I looked at fifteen IAM services with European roots and kept eight. The order follows how complete the service is for a typical app – hosted login, self-service sign-up, social and enterprise connections, MFA and user management – then sovereignty, then price. I weighed five things:

• Jurisdiction and ownership – where the company is registered and whether the contracting entity is European.
• Features – OpenID Connect, OAuth 2.0 and SAML, social login, MFA, passkeys, user management and APIs.
• Hosting – the country of the data centres and whether the service runs on a US cloud.
• Price – a free plan, the first paid plan and how the price grows with users.
• What users say – Trustpilot ratings where a profile exists.

Left out: Keycloak itself, because it is an open-source project of the Cloud Native Computing Foundation and a Red Hat trademark rather than a European company – Cloud-IAM, Bare.ID and Login-Master run it for you. Scaleway IAM is free and European, but it only controls access to Scaleway’s own cloud resources and is not a login service for your apps. ZITADEL now lists its headquarters in San Francisco, Ory’s data controller is Ory Corp in Arizona, authentik is sold by Authentik Security Inc., and Logto names Silverhand Inc. and no European entity. Corbado (Munich) adds passkeys on top of an existing identity provider rather than replacing it. All data comes from the providers’ own pricing, legal, privacy and product pages, GitHub and Trustpilot, checked on 25 October 2026.

The best European identity and access management tools, reviewed

Each service gets the same treatment: who is behind it, what users say, what it offers and what it lacks, its pros and cons, and who should use it.

1. Hanko

Open-source login from Kiel – passkeys first, free for 10,000 users

Hanko GmbH is based in Kiel, Germany, and led by founder and CEO Felix Magedanz; adesso ventures and High-Tech Gründerfonds are among its investors. Hanko Cloud runs only in the AWS Frankfurt region, so data stays in Germany but on a US cloud. You can also self-host the open-source code or get a private cloud.

What users say. Hanko has a Trustpilot profile with no reviews yet; its GitHub repository has 9,000 stars.

What it offers – and what it lacks. Passkeys, passwords, email passcodes, social login, MFA, a custom domain, drop-in web components and an admin dashboard are all in the free plan. Pro adds webhooks, an admin API and custom SMTP. It lacks cheap enterprise SSO – SAML costs $49 a month per connection – and a hosting option outside AWS in the cloud version.

Facts: HQ Germany (Kiel) · free plan: 10,000 MAU · Pro $29/month, then $0.01 per MAU · open source (AGPL-3.0 backend, MIT frontend) · AWS Frankfurt. Hanko review →

My take: Hanko is the easiest European IAM to start with and the cheapest as you grow, which is why it leads. If AWS is a problem for you, look at Cloud-IAM on Scaleway or Outscale. Best for: start-ups and SaaS products that want a fast, modern login. Not for: teams that rule out US clouds.

Visit hanko.io →

2. Cloud-IAM

Managed Keycloak from Rennes – your choice of European or global cloud

Cloud-IAM SAS from Rennes, France, has run managed Keycloak since 2018 and is owned by a joint venture of ELLIXO SAS and FGRibreau SARL. Paid plans run on AWS, Google Cloud, Azure, Scaleway or 3DS Outscale; the free plan runs on AWS.

What users say. 4.6/5 from 17 reviews on Trustpilot – the best score in this list, from a small sample.

What it offers – and what it lacks. The full Keycloak feature set – SSO, MFA, social login, identity brokering, LDAP and Active Directory, OIDC, OAuth 2.0 and SAML – with managed upgrades, backups, Terraform support, full data export and up to a 99.98% SLA. It lacks polished SDKs and a cheap first paid plan.

Facts: HQ France (Rennes) · free plan: 100 users, 1 realm · Starter from €225/month · ISO 27001:2022 · SecNumCloud 3.2 and HDS on Outscale. Full review →

My take: Cloud-IAM is the best way to get Keycloak’s power without running it, and the only service here where you can pick a SecNumCloud-qualified cloud. Best for: B2B SaaS and enterprises that need standard enterprise SSO. Not for: small apps on a budget.

Visit cloud-iam.com →

3. cidaas

German customer identity platform – no US hyperscaler

cidaas is made by Widas ID GmbH in Wimsheim, Germany, part of the Widas group, which has built software since 1997 and employs more than 100 people. It says the platform is hosted in Germany and the EU, independent of US hyperscalers, with ISO 27001-certified operation.

What users say. No reviews on Trustpilot. cidaas says it has more than 500 customers.

What it offers – and what it lacks. SSO, passwordless login, risk-based and step-up MFA, consent management, progressive profiling, authorisation with RBAC and OPA, workforce IAM and ID document checks. It lacks a free plan and a low entry price.

Facts: HQ Germany (Wimsheim) · 30-day trial · Essentials €699/month (1,000 users) · workforce IAM €4.50 per user · hosted in Germany/EU. Full review →

My take: cidaas is the most complete German CIAM platform, priced for companies that need it. Best for: large consumer platforms with compliance requirements. Not for: start-ups.

Visit cidaas.com →

4. Quasr

Belgian CIAM for developers – all features on every plan

Quasr BV is registered in Antwerp, Belgium, and says its platform runs within the EU; its privacy policy names third-party database hosting in the US and the EU without naming providers.

What users say. No reviews on Trustpilot.

What it offers – and what it lacks. Self-service sign-up without a credit card, all features on every plan and pricing by active accounts and tenants – useful for multi-tenant SaaS. It lacks published prices beyond the free allowance and named hosting providers.

Facts: HQ Belgium (Antwerp) · free: 100 accounts and 3 tenants · Startup plan: 25,000 accounts free for European early-stage companies · Enterprise with SLA. Full review →

My take: Quasr is promising for young European companies; I would ask for the hosting list before signing. Best for: European start-ups and multi-tenant SaaS. Not for: teams that need a long track record.

Visit quasr.io →

5. Bare.ID

Keycloak-based IAM in German data centres with BSI C5

Bare.ID GmbH is based in Wiesbaden and started inside the AOE Group. All data is processed in German data centres certified to ISO 27001 and BSI C5, and it can also run hybrid, self-hosted or on-premises.

What users say. No reviews on Trustpilot.

What it offers – and what it lacks. SSO over OIDC and SAML, MFA, user federation, lifecycle management, white-label templates and billing only for users who logged in that month. It lacks a free plan and a clear pricing page.

Facts: HQ Germany (Wiesbaden) · trial · plans from $99/month · 99.9% availability · ISO 27001 and BSI C5. Full review →

My take: Bare.ID is the choice when an auditor asks for BSI C5 and German data centres. Best for: German companies with BSI C5 requirements. Not for: indie developers.

Visit bare.id →

6. Curity

Swedish identity server you run yourself

Curity AB was founded in Stockholm in 2015. The Curity Identity Server runs in your own environment, on-premises or in any cloud, and is used by PagerDuty, Santander, Tele2 and Telenor.

What users say. No reviews on Trustpilot.

What it offers – and what it lacks. A complete OAuth and OpenID Connect server with strong API and single-page-app security, and authorisation for AI agents; the Community edition is free with unlimited users. It lacks a hosted service and public prices for paid editions.

Facts: HQ Sweden (Stockholm) · founded 2015 · Community edition free · paid editions: flat annual subscription, on request. Full review →

My take: Curity is the most sovereign choice because it runs where you put it – if you can operate it. Best for: teams with ops capacity and complex APIs. Not for: teams that want a managed service.

Visit curity.io →

7. Login-Master

Keycloak as a service for B2B portals, made in Germany

Login-Master comes from intension GmbH in Ostfildern, Germany, sold through the Login Alliance with Syntlogo. The SaaS is made and hosted in Germany; you can also self-host.

What users say. No reviews on Trustpilot.

What it offers – and what it lacks. Keycloak plus self-service, delegated administration, approval workflows, data synchronisation and audit logging. It lacks a free plan and named certifications.

Facts: HQ Germany (Ostfildern) · Extended from €900/month (1,000 users) · Advanced from €1,840/month (10,000 users). Full review →

My take: Login-Master is a consulting-led product for B2B portals, not a quick sign-up. Best for: B2B portals with complex user administration. Not for: small apps.

Visit login-master.com →

8. Nevis

Swiss passwordless authentication for banks and insurers

Nevis Security AG is based in Zurich with companies in Berlin, Budapest and London and more than 100 employees. It says its technology secures over 80% of Swiss online banking transactions.

What users say. No reviews on Trustpilot.

What it offers – and what it lacks. CIAM, passkeys, MFA, usernameless login, fraud detection and transaction confirmation as a platform or SaaS. It lacks public prices, a trial and a stated hosting location for its cloud.

Facts: HQ Switzerland (Zurich) · pricing on request · SOC 2 Type 2 and ISO badges. Full review →

My take: Nevis is an enterprise vendor for regulated industries; everyone else should start higher up this list. Best for: banks, insurers and healthcare. Not for: developers and start-ups.

Visit nevis.net →

What European identity and access management costs

Prices as shown on each provider’s pricing page on 25 October 2026, in the currency shown there.

How to choose a European identity provider

1. Decide hosted or self-hosted. Hosted services save operations work; Curity, Hanko and Keycloak-based tools can also run on your own servers.
2. Check your must-have protocols. If customers need SAML or LDAP, Keycloak-based services cover them – Cloud-IAM even on its free plan – while Hanko charges per SAML connection.
3. Check where it runs. If a US cloud is ruled out, skip AWS-based options or choose Scaleway or Outscale at Cloud-IAM.
4. Model the price at your user count. Per-user pricing (Hanko) is cheap when small; fixed packages (cidaas, Login-Master) suit large, predictable user bases.
5. Test with a staging app. Use a free plan or trial and connect over OpenID Connect before migrating real users.

European identity and access management: FAQ

My verdict

For most apps, Hanko is the best European identity service: quick to set up, free for 10,000 users and open source. Pick Cloud-IAM when you need enterprise SSO and want a European cloud, and cidaas when a large consumer platform needs German hosting and full CIAM.

If you run your own infrastructure, Curity and self-hosted Keycloak give you full control – at the cost of running it yourself.