# HelixIAM

> HelixIAM is self-hosted identity and access management for people, workloads and AI agents: SSO, MFA and federation, keyless workload identity and AI-agent delegation, on infrastructure and keys you control. Commercial software from KubeDNA B.V.

HelixIAM is European identity infrastructure for people, workloads and AI agents. It is one self-hosted platform for
sign-in, federation, workload identity and AI-agent delegation, offered as two propositions on one product:
HelixIAM AI Identity (identities with an owner, a lifecycle and delegated authority for AI agents and workloads) and
HelixIAM Sovereign (enterprise IAM on infrastructure and keys you control, with European eIDs). It is built and backed
by KubeDNA B.V. (Enschede, the Netherlands), which builds Kubernetes infrastructure software and offers deployment and operations support for HelixIAM on the customer's own or a European cloud, scope per contract. Languages: English (https://helixiam.com/),
French (https://helixiam.com/fr/), Dutch (https://helixiam.com/nl/).

## Key facts
- Licence: commercial software from KubeDNA B.V., available under a commercial licence. Pricing on request through the contact form (https://helixiam.com/contact/?topic=pricing); prices are not published.
- Availability: early access; KubeDNA is onboarding launch partners. The usual start is a technical demo and a paid pilot.
- Deployment: self-hosted on your Kubernetes with a Helm chart (high availability built in), PostgreSQL required, Redis optional, no message broker, no telemetry. Docker Compose for evaluation.
- Standards: OpenID Connect and OAuth 2 provider, SAML 2.0 identity provider, SCIM 2.0, passkeys (WebAuthn/FIDO2), DPoP, PAR, device authorization grant, resource indicators, RFC 8693 token exchange, dynamic client registration, high-security profiles with mTLS-bound tokens and PS256.
- AI agents: agent identities with an owner and a lifecycle; every agent token issued or refused, direct or delegated, is recorded in the audit log; on-behalf-of delegation where the token carries the user as subject and the agent as actor and authority only narrows; suspending an agent stops new tokens and introspecting resource servers see it at once; OAuth protected-resource metadata (RFC 9728) for MCP tool servers.
- Workloads: Kubernetes and CI workloads exchange their platform-signed JWT for a short-lived HelixIAM token, with no stored secret.
- Keys: per-tenant signing keys with rotation; keys can be kept in an HSM over PKCS#11 or in HashiCorp Vault / OpenBao Transit. A dedicated key store (HSM partition or Vault credential) per tenant, online key-encryption-key rotation, and credential-issuer and eID connection keys in the HSM or Vault.
- European identity: DigiD, eHerkenning and eIDAS connectors included (you connect with your own Logius or broker agreement). Early access: EU Digital Identity Wallet sign-in (tested with the EU reference wallet), credential issuance and EU trusted lists.
- Security engineering: static analysis, dependency and image scanning on every change; security reviews and automated security testing in CI; independent penetration test in preparation; every release cosign-signed with an attested SBOM. Security reports: security@helixiam.com. Trust centre: https://helixiam.com/trust/
- Migration from Keycloak: import clients, roles and identity providers from a realm export, then a validated, phased cut-over.

## Propositions
- [AI agent identity management](https://helixiam.com/ai-identity/): Non-human identity for AI agents and workloads: every agent gets an owner and a lifecycle, acts on behalf of users through RFC 8693 token exchange with authority that only narrows, and can be suspended. Self-hosted.
- [Sovereign identity and self-hosted enterprise IAM](https://helixiam.com/sovereign/): Enterprise IAM on infrastructure and keys you control: OIDC, SAML, SSO and MFA, signing keys in your HSM or Vault, DigiD, eHerkenning and eIDAS connectors, and the EU Digital Identity Wallet in early access.

## Platform
- [Platform overview](https://helixiam.com/product/): One self-hosted identity core for people, workloads and AI agents: authentication, SSO and federation, AI-agent identity, workload identity, European eIDs, key custody and an admin API.
- [Authentication & MFA: passkeys, MFA, adaptive step-up](https://helixiam.com/product/authentication/): Passwordless sign-in with passkeys (WebAuthn/FIDO2), authenticator-app MFA on by default, magic link, adaptive step-up and breached-password checks.
- [SSO & federation: OpenID Connect, SAML 2.0, LDAP, SCIM](https://helixiam.com/product/sso-federation/): A standards-based OpenID Connect and OAuth 2 provider and SAML 2.0 identity provider: single sign-on and logout, LDAP/AD, OIDC/SAML/social brokering, SCIM 2.0 and multi-tenant realms.
- [AI agents & non-human identity: owners, delegation, suspension](https://helixiam.com/product/ai-agents/): Non-human identity for AI agents: each agent has an accountable owner and a lifecycle, acts on behalf of users via RFC 8693 with authority that only narrows, can be suspended, and is ready for MCP (RFC 9728).
- [Workload identity for Kubernetes and CI: keyless federation](https://helixiam.com/product/workload-identity/): Keyless workload identity: Kubernetes and CI workloads exchange their platform-signed JWT for a short-lived HelixIAM token bound to application roles. No long-lived secrets to store or rotate.
- [DigiD, eHerkenning, eIDAS and EU Digital Identity Wallet integration](https://helixiam.com/product/european-eid/): DigiD, eHerkenning and eIDAS connectors included for use with your own agreements, plus early access to EU Digital Identity Wallet sign-in, credential issuance and EU trusted lists. Self-hosted.
- [Security & key custody: HSM, Vault, hardened tokens, audit](https://helixiam.com/product/security/): Per-tenant signing keys in your HSM over PKCS#11 or in Vault / OpenBao, high-security token profiles with DPoP, PAR and mTLS-bound tokens, a searchable audit log streamed to your SIEM, and signed releases.
- [Admin API, Terraform and automation](https://helixiam.com/product/developers/): Everything in the HelixIAM console is available through a documented admin REST API. Manage applications, roles and wallet connections with Terraform, provision with SCIM 2.0 and import from Keycloak.

## Solutions
- [Solutions](https://helixiam.com/solutions/): How HelixIAM serves AI and platform teams, regulated European enterprises, the public sector and sovereign cloud providers and MSPs — and how to move from Keycloak.
- [AI agent and non-human identity for platform teams](https://helixiam.com/solutions/ai-platform-teams/): For AI and platform engineering teams: give every agent an owner and a lifecycle, delegate with RFC 8693, suspend misbehaving agents and run workloads without long-lived secrets — self-hosted.
- [Enterprise IAM in Europe for regulated organisations](https://helixiam.com/solutions/european-enterprise/): For banks, insurers, health and critical infrastructure: self-hosted enterprise IAM with SSO, MFA, LDAP/AD and SCIM, signing keys in your HSM, per-tenant isolation, audit to your SIEM and one accountable vendor.
- [IAM for the public sector: DigiD, eHerkenning and EU wallet](https://helixiam.com/solutions/public-sector/): For municipalities and shared-service organisations: one multi-tenant IAM with a realm per organisation, DigiD, eHerkenning and eIDAS connectors for your own agreements, GDPR tooling and early access to the EU Digital Identity Wallet.
- [IAM as a service for sovereign cloud providers and MSPs](https://helixiam.com/solutions/cloud-providers/): For European cloud providers, MSPs and integrators: run HelixIAM as a multi-tenant identity service on your own cloud, Helm-deployed, automated through the admin API and Terraform, backed by KubeDNA.
- [Migrate from Keycloak to HelixIAM](https://helixiam.com/migrate-from-keycloak/): A Keycloak migration in steps: assessment, import of clients, roles and identity providers from a realm export, an agreed validation plan, and a phased cut-over with both identity providers running.
- [Keycloak alternative for European enterprises](https://helixiam.com/keycloak-alternative/): A fair, sourced comparison of HelixIAM and Keycloak: workload and AI-agent identity, key custody in your HSM, DigiD and eHerkenning connectors, and one commercial vendor — plus how to migrate.

## Company
- [Trust centre](https://helixiam.com/trust/): How HelixIAM is built, tested and released: security architecture, supported protocols, static analysis and scanning on every change, signed releases with SBOMs, vulnerability disclosure, GDPR-supporting features and backup guidance.
- [Platform partners](https://helixiam.com/partners/): Partner with KubeDNA to offer HelixIAM on your sovereign cloud or as a managed service: multi-tenant by design, automated through the admin API and Terraform, with technical onboarding and support from KubeDNA.
- [About](https://helixiam.com/company/): HelixIAM is commercial identity software from KubeDNA B.V. (Enschede, the Netherlands), which builds Kubernetes infrastructure software and offers deployment and operations support for HelixIAM.
- [Why HelixIAM](https://helixiam.com/why-helixiam/): Humans, AI agents and workloads in one platform; keyless workloads; your infrastructure and keys; European eID connectors included; one vendor from software to operations support; realm-per-tenant.
- [Book a technical demo](https://helixiam.com/demo/) · [Contact](https://helixiam.com/contact/)

## Blog
- [How to give AI agents their own identity: ownership, lifecycle and on-behalf-of delegation](https://helixiam.com/blogs/ai-agent-identity-ownership-delegation/): Shared API keys cannot tell you which agent acted, for whom, or how to stop it. The building blocks of real agent identity: an accountable owner, a lifecycle, RFC 8693 delegation that only narrows, suspension and audit.

## Documentation
- [Docs](https://docs.helixiam.com): guides, admin API reference, Terraform provider, operations.
- [Docs index for LLMs](https://docs.helixiam.com/llms.txt)
- [Full site text](https://helixiam.com/llms-full.txt): every page of this website as plain text.

## Contact
- Email: contact@helixiam.com