What you get
EU residency by default
Pick eu-central-1 (Frankfurt) or eu-west-3 (Paris). Your data stays there. Full stop.
Built for the GDPR
DPA, current subprocessor list, one-click GDPR erasure, and full data export — first-class, not afterthoughts.
Audit-ready
Tamper-evident logs of every sign-in and change, exportable when you need them. SIEM streaming is on the roadmap.
Pick a region. It stays there.
Choose Frankfurt or Paris at setup. Every byte of identity data and every audit log lives in that EU region — provably, not by promise.
Open the live demoPick once. Verify forever.
Pick your region at setup
Frankfurt (eu-central-1) or Paris (eu-west-3). That choice is recorded and shown read-only in your dashboard from day one.
Everything stays in-region
Sessions, profiles, credentials and audit logs live and are processed in that region — not mirrored to another jurisdiction for convenience.
Check us whenever you like
Inspect a decoded token, pull your export, watch the requests your app makes. Sovereignty here is a property you can test, not a paragraph in a brochure.
Sovereignty you can verify yourself.
Claims are cheap in this category. These are the ones you can check from your own browser and API calls.
Zero third parties on our pages
No third-party fonts, CDNs, analytics or trackers. Open the network tab: your visit never touches a US server.
Every outbound call, inventoried
We keep a jurisdiction verdict for every network call the service makes — sovereignty is audited, not assumed.
Self-hosted bot defense
Our CAPTCHA is a self-hosted proof-of-work challenge. No third-party vendor, no data sent anywhere.
Tenant-bound tokens
Access tokens are cryptographically audience-bound to your tenant — a token minted for one tenant is invalid against another.
Exit with everything
Full export through the API, password hashes included. Leaving is a product feature, not a negotiation.
Region on the record
Your region is shown read-only in the dashboard. A move is an operation we perform on request — there is no silent replication elsewhere.
Where sovereignty stands today.
The same rule as everywhere on this site: what is done says done, what is planned says planned.