Priced per application, not per user
You pay for the application sets you register. A customer that grows from ten seats to a hundred thousand costs you the same; a second product line is what moves you up a plan.
See pricing
Multi-tenant SSO & authorization
Multi-tenant SSO that doesn't bill you per user.
Multi-tenant SSO and authorization for B2B platforms, priced per application, not per user. Model any org tree, isolated in the database. Hosted in Germany, the US, or on your own instance.
Any-depth org tree, isolated in the database
Company, entity, branch, department, as deep as your customer actually goes, with delegated admins at every level. The boundary is enforced by row-level security and schema constraints, not only by application code.
How isolation worksYour region, DPA/AVV on every plan
EU production runs in Germany on Hetzner by default, US production in the United States, and other regions on request. The sandbox runs in Germany. On Regulated you can have a dedicated instance in the region you choose. Data stays in its region, a DPA (AVV) is signed on every plan before any customer data is processed, and a BAA is available on Regulated.
Security and residencyOne identity layer, not five you stitch together
Single sign-on, hierarchical tenancy, and granular permissions through one REST API and SDKs for PHP, Python, Node and Java — plus any stack that can verify a JWT against JWKS. Tenant isolation enforced in three independent layers, encryption with searchable blind indexes, MFA, and an append-only audit trail.
White-label login and branding at any node of the tree, subtrees hidden from their own parent, and independent tenants on one account are on the Regulated plan. Team and Scale give you one tenant with sub-organizations at any depth, isolated by role reach.
Building this in-house costs quarters of senior engineering and ships no revenue on its own.
115
Isolation tests against a real database
9,700 rps
Sustained, verified against 1,000,000 organizations
4
Official SDKs: PHP, Python, Node, Java
BAA
Signed on request, on the Regulated plan
Public packages
Read the code. It's public.
The SDKs your services will actually import are published, versioned and readable before you talk to us. Verification happens locally in your process: your API checks each token itself and never calls us on the request path.
Contact
Start a conversation.
Email
[email protected]
Response time
Within one business day