Keymate as a Managed Service (on the roadmap)
A managed Keymate service is on our roadmap, without a date. The design principle is full isolation: each customer would get its own tenant, with nothing shared at runtime. Today Keymate runs on your own infrastructure.
A fully isolated managed service, on the roadmap
Why It Matters
A managed Keymate service would not share databases, runtime or memory between customers.
Tenant Hardening by Design
Key Components:
Full hard-tenant architecture: isolated DB, Keycloak, and microservices
Dedicated namespaces or clusters per customer
Independent deployment, upgrade, and failure domains
Tenant Hardening by Design
How It Would Work:
Key Components:
Each customer would receive dedicated Keycloak + Keymate microservices
Separate namespace or K8s cluster for each tenant
Data, logs, events, secrets would never cross tenant boundaries
Upgrades would be version-controlled and customer-specific
Monitoring and alerting with tenant-level observability
Design principles
Hard-Tenant Isolation
Separate infra, DB, and runtime per tenant
Customizable Deployment
Branding, policies, connectors per tenant
Observability Per Tenant
Full trace, log, and metric isolation
Tenant-Specific Upgrades
No global updates-each tenant version-controlled
Frequently Asked Questions
Each customer would get its own tenant: its own database, Keycloak and services, with nothing shared at runtime.
A managed service is on our roadmap, without a date, so we cannot describe a move yet. Today Keymate runs on your own infrastructure.