Notes on European identity
Long-form, sourced pieces on the law and the mechanics behind European authentication. Every claim links to a primary source and carries the date we checked it. Written in English only — a translation that drifts from its citations would be worse than none.
Which authentication provider is actually European? A jurisdiction comparison
What nine CIAM vendors say in their own terms of service and DPAs about which law governs them and where your users’ data lives — quoted, dated, and with the gaps left as gaps. Plus where we stand on the same three questions, marked self-declared.
The SSO tax: what enterprise sign-in costs, per vendor, in published prices
Single sign-on is a security control, and several authentication vendors price it as a luxury. The published per-connection rates, and what they add up to on a real enterprise rollout.
What the GDPR actually requires from an authentication provider
The articles that bind a login system — 28, 32, 17, 20, 33 and Chapter V — quoted from the regulation, with what each one means for the vendor you pick and for the contract you sign.
Passkeys in production: what the spec actually requires, and what breaks anyway
A working engineer’s guide to WebAuthn — what makes a passkey phishing-resistant, which decisions are irreversible, and the failure modes that only appear after real users arrive.
EU data residency is not EU jurisdiction
Why an "EU region" toggle does not answer the question your legal team is actually asking, explained through the statute and the two judgments that decided it.
European eID: 32 notified schemes, and which ones a SaaS can actually use
A complete, sourced map of the electronic identity schemes notified under eIDAS — how many exist, which are open to private companies, what they cost, and why "notified" does not mean "available to you".