Self-hosted
Self-hosted on your own infrastructure: you decide where data lives. No telemetry.
- Stateless server behind a Helm chart
- PostgreSQL required, Redis optional, no message broker
- High availability built in
Trust centre
Security engineering you can inspect.
How HelixIAM is designed, built, tested and released — so your security team can review it before a pilot starts.
Security architecture
Designed for control.
Keys under your control
Per-tenant signing keys with safe rotation, kept in your HSM over PKCS#11 or in Vault / OpenBao Transit.
- Bring your own CA-signed keys
- A dedicated key store per tenant
- Online key-encryption-key rotation
Tenant isolation
Each tenant gets its own realm, users, keys and branding.
- Fine-grained admin permissions
- Per-tenant administrators
- Searchable audit log of sign-ins and admin changes
Protocols
Built on open standards.
Identity
- OpenID Connect and OAuth 2
- SAML 2.0
- SCIM 2.0
- WebAuthn / FIDO2 passkeys
Token security
- DPoP (RFC 9449)
- PAR (RFC 9126)
- Resource indicators (RFC 8707)
- Token exchange (RFC 8693)
- mTLS-bound tokens, PS256
European identity
- DigiD, eHerkenning and eIDAS connectors
- OpenID4VP wallet sign-in Early access
- OpenID4VCI credential issuance Early access
Security engineering process
Every change, every release.
- 01
Review
Security reviews of designs and changes to authentication, tokens and key handling.
- 02
Analyse
Static analysis, dependency and image scanning on every change.
- 03
Test
Automated security testing in CI, alongside unit and end-to-end tests.
- 04
Sign
Every release is cosign-signed with an attested SBOM.
Releases and disclosure
How we handle vulnerabilities and releases.
Vulnerability disclosure
Report a suspected vulnerability to [email protected] (see security.txt). We aim to acknowledge reports promptly, fix in a new release and coordinate disclosure with the reporter.
Signed releases and SBOM
Images and charts are cosign-signed and come with an attested SPDX SBOM, delivered to licensed customers from a private registry, so you can verify what you run.
Assurance roadmap
Independent penetration test in preparation. During a pilot you are welcome to run your own security testing.
Security pack
Architecture, our build and release process and SBOM access, for your security questionnaire and review.
Privacy
Features that support your GDPR obligations.
HelixIAM does not make an organisation compliant on its own; it gives you the controls to meet your obligations.
- Built-in GDPR data export and erasure per user
- Consent records
- Searchable audit log with configurable retention
- Self-hosted: you decide where data lives
Operations
Backup and recovery.
Users, configuration and audit live in PostgreSQL; sessions are in PostgreSQL, or in Redis when you enable it. The HelixIAM server is stateless. Back up PostgreSQL with your standard tooling and keep key-store backups in line with your HSM or Vault policy. Upgrade guides start with a backup step, and KubeDNA can review backup and disaster recovery for your environment as part of deployment support.
- Stateless server, two replicas by default
- PostgreSQL holds users, configuration and audit
- Prometheus metrics and alert rules out of the box
Review HelixIAM with us.
An architecture consultation with KubeDNA engineers, and our security pack for your review.