HelixIAM by KubeDNA

For the public sector

One identity platform for many organisations, with DigiD and eHerkenning connectors included.

For municipalities, shared-service organisations and their implementation partners: a realm per organisation, European eIDs included, and a start with the EU Digital Identity Wallet.

Reference architectureRuns in your cluster
HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS INCLUDED DigiD eHerkenning eIDAS EUDI Wallet · early access brokered sign-in HELIXIAM IN YOUR KUBERNETES CLUSTER HelixIAM realms · policy · tokens · sessions · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR PostgreSQL · Redis (optional) · Helm chart, HA no message broker · no telemetry signing keys Key custody HSM · PKCS#11 Vault / OpenBao Transit Peopleemployees · customers · citizenspasskeys · MFA · SSO WorkloadsKubernetes pods · CI pipelineskeyless JWT exchange AI agentsassistants · MCP clientson-behalf-of · narrowed scope Applicationsweb, SaaS and existing appsOIDC · SAML 2.0 APIsresource serversaudience-restricted tokens MCP tool serversAI tool endpointsRFC 9728 tokens HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS DigiD eHerkenning eIDAS EUDI Wallet · early access PeoplepasskeysMFA · SSO WorkloadsK8s · CIkeyless AI agentson-behalf-ofnarrowed IN YOUR CLUSTER HelixIAM realms · tokens · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR Key custody HSM PKCS#11 Vault / OpenBao Transit tokens AppsOIDC · SAML APIsaudience-restricted MCP toolsRFC 9728
Reference architecture. HelixIAM runs in your Kubernetes cluster with PostgreSQL. Signing keys stay in your HSM or in Vault / OpenBao. European eID connectors are included; you connect DigiD or eHerkenning under your own agreement. Your applications, APIs and agents can run in the same infrastructure.

Familiar challenges

Integrations per organisation

Each organisation repeats the same eID and IAM integration work.

Wallet uncertainty

eIDAS 2.0 is coming; you want to start with the EU Digital Identity Wallet without betting the platform.

Privacy work

DPIAs and audits need controls, logs and data-subject tooling in place.

What you get

A realm per organisation

Multi-tenant by design: each organisation gets its own realm, users, keys and branding.

  • Per-tenant administrators on their own console
  • Fine-grained admin permissions
  • Dutch-language sign-in pages

European eIDs

DigiD, eHerkenning and eIDAS connectors included, for use with your own agreements.

  • DigiD connector; you connect with your own Logius agreement
  • eHerkenning via your own broker agreement
  • Sign in with the EU Digital Identity Wallet Early access

Privacy and audit controls

Input for your DPIA, and the tooling to act on it.

  • Built-in GDPR data export and erasure per user
  • Searchable audit log, streamed to your SIEM
  • Self-hosted: you decide where data lives

Questions

How do we connect DigiD?
The DigiD connector is included; you connect with your own Logius agreement and complete the onboarding Logius requires. We support you through it.
Can we work through an integrator or MSP?
We are onboarding integrators and MSPs as platform partners. Tell us who you work with and we'll involve them; see partners.

Early access/now onboarding launch partners

Plan your shared IAM with us.

Start with a technical demo and a paid pilot on your own use case, and work directly with the engineers who build HelixIAM.