ayedo ID
Identity provider for ayedo Cloud
The multi-tenant Keycloak of ayedo Cloud authenticates your users to GitLab, Argo CD, Harbor, OpenBao, Grafana, and other ayedo Cloud services. A single login covers all shared services.
Identity
Made in Germany
Identity and access as part of your certified hosting – ayedo operates ayedo ID for ayedo Cloud services or Dedicated Keycloak in the Platform Cluster, with expert support from Germany.
Made in Germany
ISO 27001
ISO 9001
DSGVO-konform
DORA Compliant
24/7 Support
Control identities centrally
Our identity service is based on Keycloak in the Platform Cluster – SSO without months of in-house build-out, predictable costs per realm, and one identity path instead of parallel user databases in every app. ayedo takes over operations and availability, including OIDC/SAML and LDAP or Active Directory integration.
Separate realm
Dedicated capabilities on shared infrastructure
A separate realm for your business applications and end-customer user management provides login, roles, and MFA – fully isolated from the ayedo ID realm of the platform services.
Single Sign-On
OIDC & SAML
Modern protocols enable sign-in for applications, cluster access via kubelogin, and federation to Entra ID, Google, or existing identity providers.
MFA & Policies
Strong authentication
TOTP, WebAuthn, and fine-grained realm and client policies form the foundation for zero-trust architectures and audit requirements.
Directory integration
LDAP / Active Directory
Connect your existing user directories and use identities, groups, and roles centrally for SSO and access control.
Kubernetes & Apps
One shared identity path
Cluster OIDC, managed apps, and business applications share the same identities. Parallel user databases become unnecessary.
EU infrastructure
Sovereign hosting
Your identity data resides on European infrastructure – GDPR-compliant and without dependency on US cloud providers for your identity provider.
Pricing
Billing is user-based per separate realm on ayedo Cloud. A separate realm is suitable for business-application login, end-customer user management, and additional clients – functionally comparable to a dedicated instance, operated on shared infrastructure.
ayedo Cloud
Own realm · Shared platform
Price on request
Your own isolated realm for business apps and end customers
OIDC/SAML clients, MFA, and standard policies
Operated in the central Platform Cluster
ayedo ID for platform services remains separate
Dedicated
Dedicated Keycloak · Single-tenant
€799.95/ month
- Operating mode: Zero downtime
Your own Keycloak in a dedicated Platform Cluster
Isolated realms and clients exclusively for your organization
Custom themes & flows
LDAP/AD and enterprise federation
Custom SLAs
Compare with alternatives
Managed Keycloak on ayedo is a sovereign, European option compared to established identity services. The following overview presents the key differences objectively.
vs. Okta
| Criterion | ayedo | Okta |
|---|---|---|
| Jurisdiction | EU / GDPR-compliant | US / Cloud Act |
| ayedo Cloud integration | Native to ayedo Cloud services | Extra integrations |
| On-premises / BYOC | Available | Cloud-first |
| Support | Personal support in German and English | Primarily ticket-based |
vs. Microsoft Entra ID
| Criterion | ayedo | Microsoft Entra ID |
|---|---|---|
| Vendor lock-in | Open-source Keycloak | Microsoft ecosystem |
| Kubernetes | Cluster OIDC integrated | Extra configuration |
| Multi-cloud | Cloud-agnostic | Azure-focused |
| Data residency | EU hosting selectable | Depends on the tenant region |
vs. Auth0
| Criterion | ayedo | Auth0 |
|---|---|---|
| Jurisdiction | EU hosting | US company |
| Self-hosted | Dedicated & BYOC | SaaS-focused |
| Platform SSO | One identity provider for ayedo Cloud | Integration per application |
| Pricing model | User-based per realm | MAU-based pricing tiers |
Compliance & regulatory requirements
The ayedo Cloud is ISO 27001-certified and meets the requirements of current EU regulations by default: GDPR, NIS-2, DORA, CRA, Data Act and the Cloud Sovereignty Framework.
GDPR-compliant data processing
Privacy by Design & Default.
EU data residency (Germany), customer-managed keys (BYOK/BYOHSM), encryption at rest/in transit. ISO 27001-certified data protection management. More about GDPR.
NIS-2-compliant operations
Resilience in operations.
24/7 monitoring, incident response, BCP/DR processes, supply chain transparency (SBOM). More about NIS-2.
DORA-ready
ICT resilience, tailored.
ICT risk management, documented exit strategies, third-party risk management, TLPT readiness. More about DORA.
CRA-compliant software supply chain
Security by design across the entire lifecycle.
SBOM generation, CVE scanning, signed container images, GitOps-based audit trails. More about the CRA.
Cloud Sovereignty Framework
Digital sovereignty made measurable.
EU-based operations, open standards, exit capability without lock-in. More about the framework.
Data Act-compliant portability
Switching without barriers.
Open APIs, standardized formats, complete exit runbooks. More about the Data Act.
Integrated compliance roadmap
Holistic approach.
How ayedo systematically addresses GDPR, NIS-2, DORA, CRA, Data Act and ISO 27001/9001. To the overview.
Part of the Software Delivery Platform
Identity is the shared authentication layer for Platform, Code Repository, Delivery, Container Registry, Secrets Management, and Observability.
Platform
Big picture
Get an overview of the platform cluster, the operating models, and all building blocks of the Software Delivery Platform (SDP).
Managed Kubernetes
Cluster OIDC
Secure your workload clusters against the same identity provider – for consistent identities from the platform to the application.
Keycloak App
Managed app in detail
You can find the technical specification and block reference on the page of the Keycloak managed app.
Documentation
Access control
Further documentation on identity provider and OIDC topics is available at docs.ayedo.de.
You build it. We run it.
Excellent performance and maximum uptime - that's what we wake up for. And sometimes even in the middle of the night.
100+ clusters
under Management
We operate more than 100 Kubernetes clusters in production for our customers.
300+ databases
under Management
We operate, monitor, and protect more than 300 production databases.
1 Petabyte Object-Storage
under Management
We operate one petabyte of object storage for backups, artifacts, and application data.
100 million timeseries
on average
Our monitoring systems ingest 4 million datapoints per second.
38.000+ Logs
per second
Our collectors capture logs continuously and store them GDPR-compliant — over 100 billion entries per month.
5.000+ Backups
per day
We write more than 5,000 backups every day to encrypted long-term storage — about 150 terabytes of backup volume per month.
270 million user sessions
per month
More than 9 million user sessions run through software we operate every day.
99,99% Uptime
annual average
Our managed services are unavailable for less than one hour per year on average.
MTTD < 5 minutes
on average
Our alerting typically detects faults and outages within a few minutes.
Frequently asked questions
Answers to common questions about ayedo ID, Dedicated Keycloak, and identity in the context of the Software Delivery Platform.
What is the difference between ayedo ID, a separate realm, and Dedicated Keycloak?
ayedo ID authenticates users to the ayedo Cloud services (GitLab, Argo CD, Harbor, OpenBao, Grafana, and more). A separate realm on ayedo Cloud is priced per user and covers business applications, end-customer login, and user management – functionally comparable to a dedicated instance, but operated on shared infrastructure. Dedicated Keycloak is your own Keycloak instance in a dedicated platform cluster, offering maximum isolation, custom themes, federations, and custom SLAs.
What is a separate realm used for?
A separate realm is suitable for login to your business applications, end-customer user management, additional OIDC/SAML clients, and multi-tenant scenarios – fully separated from the ayedo ID realm of the platform services. Pricing: €49.95 up to 100 users, €99.95 up to 250 users, €199.95 up to 500 users – each per month and realm.
Do business applications need to use the same IdP?
We recommend it, as this avoids parallel user databases. Business applications can receive their own clients in your separate realm or be connected via federation. SSO for the platform services continues to run via ayedo ID.
Can we connect our existing Active Directory?
Yes. Integration works via LDAP/AD user federation or as an identity broker (OIDC/SAML) to Entra ID and other identity providers. This scenario is typical for Dedicated and BYOC/on-premises environments.
Why identity from day one?
Without a well-considered identity concept, local user accounts accumulate in every application on the platform. Consolidating them later is considerably more effort than establishing a clean OIDC path when rolling out the Software Delivery Platform.