Humans, AI agents and workloads in one platform
Every agent gets its own identity, an accountable owner and a lifecycle. When it acts for a user, the token carries both, and authority only ever narrows.
Why HelixIAM
Not one feature. The combination.
Each capability below exists elsewhere in some form. HelixIAM combines them in one self-hosted product from one vendor.
Six differentiators.
Workloads without secrets
Kubernetes and CI workloads exchange their platform token for a short-lived HelixIAM token. Workloads, agents and people share one issuer, one audit log and one key policy.
Your infrastructure, your keys
Self-hosted, no telemetry. Per-tenant signing keys in your HSM over PKCS#11 or in Vault / OpenBao, with a dedicated key store per tenant and online key-encryption-key rotation.
European eID connectors included
DigiD, eHerkenning and eIDAS connectors included, for use with your own agreements. EU Digital Identity Wallet sign-in and credential issuance Early access.
One vendor, from software to operations support
Built and backed by KubeDNA: Kubernetes-native deployment with a Helm chart and high availability built in. KubeDNA offers deployment and operations support on your own or a European cloud, with the scope set per contract.
Realm-per-tenant
Each tenant is a realm with its own users, keys, flows and branding, plus per-tenant administrators — for MSPs and shared-service organisations.
See the combination on a running system.
A technical demo mapped to your use case.