SaaS Without Compromise
A managed Keymate service is on our roadmap, without a date. It would offer enterprise-grade IAM as a fully isolated hard-tenant SaaS, deployable across regions and VPCs.
A fully isolated managed service, on the roadmap
Each Customer, Fully Isolated. Always.
Our SaaS architecture would be built around hard multi-tenancy, not shared runtime: Dedicated Keycloak, OpenFGA, DB, and telemetry stack per tenant. Data would never be shared across tenants (separate schema, volume, and config). It would be deployable in Keymate's managed region or in a customer VPC, with end-to-end encryption and per-tenant ingress. Observability, backup, policy store, and audit logs would be tenant-scoped. RBAC, org-structure, impersonation, and token policies would behave exactly as in self-hosted model.
Managed SaaS (on the roadmap)
Hard multi-tenant SaaS architecture with dedicated infrastructure per customer, which would ensure complete isolation.
Example: Fully isolated IAM hosting, which would be delivered as a hard-tenant cloud service
Key Components:
Design principles
Hard Multi-Tenant Architecture
Each customer would get its own pods, databases and infrastructure
Data Residency Control
Deployment in the EU, the US or a customer VPC would be offered
Per-Tenant Encryption & Key Mgmt
Customer-managed keys would be supported, including bring your own key
Audit, Logs, and Metrics Isolation
Logging and monitoring would not be shared between customers
Zero Shared Control Plane
No super-admin or runtime configuration would be shared
SSO & External Federation
SAML, OIDC, e-Gov, and enterprise IdPs would be supported
Admin Console for Full Tenant Control
Policies, organizations, impersonation and events would all be self-service