HelixIAM by KubeDNA
EnglishENFrançaisFRNederlandsNL
Book a technical demo Demo

HelixIAM Sovereign

Enterprise IAM on infrastructure and keys you control.

Your primary identity provider for employees, customers or citizens: self-hosted on your Kubernetes, with signing keys in your HSM or Vault, European eID connectors included, and KubeDNA as one accountable vendor.

Book a technical demoRequest an architecture consultation

No telemetry · you decide where data lives

Reference architectureRuns in your cluster
HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS INCLUDED DigiD eHerkenning eIDAS EUDI Wallet · early access brokered sign-in HELIXIAM IN YOUR KUBERNETES CLUSTER HelixIAM realms · policy · tokens · sessions · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR PostgreSQL · Redis (optional) · Helm chart, HA no message broker · no telemetry signing keys Key custody HSM · PKCS#11 Vault / OpenBao Transit Peopleemployees · customers · citizenspasskeys · MFA · SSO WorkloadsKubernetes pods · CI pipelineskeyless JWT exchange AI agentsassistants · MCP clientson-behalf-of · narrowed scope Applicationsweb, SaaS and existing appsOIDC · SAML 2.0 APIsresource serversaudience-restricted tokens MCP tool serversAI tool endpointsRFC 9728 tokens HelixIAM reference architecture People, workloads and AI agents authenticate to HelixIAM, which runs inside your own infrastructure on Kubernetes with PostgreSQL. HelixIAM brokers European eIDs (DigiD, eHerkenning, eIDAS, and the EU Digital Identity Wallet in early access), keeps signing keys in your HSM over PKCS#11 or in Vault or OpenBao Transit, and issues tokens to applications, APIs and MCP tool servers. EUROPEAN eIDs · CONNECTORS DigiD eHerkenning eIDAS EUDI Wallet · early access PeoplepasskeysMFA · SSO WorkloadsK8s · CIkeyless AI agentson-behalf-ofnarrowed IN YOUR CLUSTER HelixIAM realms · tokens · audit OpenID Connect · OAuth 2 SAML 2.0 Token exchange · RFC 8693 SCIM 2.0 Passkeys · MFA DPoP · PAR Key custody HSM PKCS#11 Vault / OpenBao Transit tokens AppsOIDC · SAML APIsaudience-restricted MCP toolsRFC 9728
Reference architecture. HelixIAM runs in your Kubernetes cluster with PostgreSQL. Signing keys stay in your HSM or in Vault / OpenBao. European eID connectors are included; you connect DigiD or eHerkenning under your own agreement. Your applications, APIs and agents can run in the same infrastructure.

Control

Four things you keep.

Your infrastructure

Self-hosted on your own infrastructure: you decide where data lives. No telemetry.

  • Helm chart with high availability built in
  • PostgreSQL required, Redis optional, no message broker
  • Evaluate with Docker Compose on an evaluation licence

Your keys

Per-tenant signing keys with safe rotation; bring your own CA-signed keys.

  • Keys in your HSM over PKCS#11
  • Or HashiCorp Vault / OpenBao Transit
  • A dedicated HSM partition or Vault credential per tenant
  • Online key-encryption-key rotation

Your identities

Users, sessions and audit stay in your database, under your policies.

  • Multi-tenant realms with their own users, keys and branding
  • Built-in GDPR data export and erasure per user
  • Searchable audit log, streamed to your SIEM over HTTPS

Your AI agents

Agent identities, ownership, delegation and suspension run on your infrastructure too, with tokens signed by your keys.

  • Every agent has an accountable owner and a lifecycle
  • On-behalf-of delegation that only narrows (RFC 8693)
  • Suspend an agent and it gets no new tokens
HelixIAM AI Identity

European identity

DigiD, eHerkenning and eIDAS connectors included.

The connectors ship with HelixIAM, including assurance-level mapping. You connect them with your own Logius or broker agreement — we help you through onboarding.

  • DigiD connector included; you connect with your own Logius agreement.
  • eHerkenning connector included, for use with your own broker agreement.
  • eIDAS cross-border sign-in connector included.
  • Sign in with the EU Digital Identity Wallet, tested with the EU reference wallet. Early access
  • Issue verifiable credentials to your users' EU wallets. Early access
European eIDs in detail

Enterprise IAM

Everything your applications expect from an identity provider.

Federation & SSO

  • OpenID Connect and OAuth 2 provider
  • SAML 2.0 identity provider for your existing applications
  • Single sign-on and single logout across OIDC and SAML apps
  • Connect your existing LDAP or Active Directory
  • SCIM 2.0 provisioning, inbound and outbound

Sign-in & MFA

  • Passwordless sign-in with passkeys
  • Authenticator-app MFA, on by default
  • Adaptive step-up authentication
  • Argon2id, lockout and breached-password checks

Tenancy & administration

  • Multi-tenant realms
  • Organisations for B2B: membership, branding and claims
  • Fine-grained admin permissions and per-tenant administrators
  • Documented admin REST API; Terraform for applications and roles

Operations

Kubernetes-native, with one accountable vendor.

HelixIAM is built and backed by KubeDNA, a Dutch company that builds Kubernetes infrastructure software. You get the identity server, the console and the Helm chart from one vendor, and KubeDNA offers deployment and operations support on your own or a European cloud, with the scope set per contract.

  • Every release is cosign-signed with an attested SBOM.
  • Prometheus metrics and alert rules out of the box.
  • Support and service levels defined per contract.
Request pricingAbout KubeDNA

Questions from security and architecture boards

Where does our data live?
Wherever you run HelixIAM. It is self-hosted on your infrastructure and sends no telemetry, so you decide where data lives.
How do we connect DigiD?
The DigiD connector is included; you connect with your own Logius agreement, and your organisation completes the onboarding Logius requires. We support you through it.
Which HSMs can we use?
HelixIAM keeps signing keys in an HSM through the standard PKCS#11 interface, or in HashiCorp Vault or OpenBao Transit. We validate your specific HSM with you during the pilot.
What about independent security testing?
HelixIAM is built with security reviews and automated security testing in CI; an independent penetration test is in preparation. You can also run your own test during a pilot. See the trust centre.

Early access/now onboarding launch partners

Design your sovereign IAM with us.

A paid pilot with HelixIAM as identity provider for a handful of your applications: MFA and passkeys, your directory or brokering, per-tenant keys — optionally in your HSM or Vault — and, if relevant, a test against your eID broker's test environment.

Request an architecture consultationBook a technical demo