Evaluating EU identity providers: Ory, Zitadel, and managed Keycloak compared

An evaluation of managed identity providers for European compliance, benchmarking Germany's Ory Network, Switzerland's Zitadel, and France's Cloud-IAM on cost and data residency.

The verdict up front

If you need a strictly EU-founded, fully managed identity provider, Ory Network (Germany) is the top pick for modern developer experience. If you require Keycloak but want to avoid the operational overhead, Cloud-IAM (France) is the best choice. Skip Zitadel if your compliance team strictly demands an EU-headquartered corporate entity, as it is based in Switzerland, though its data hosting options remain fully compliant.

Methodology

This review evaluates three primary European identity options based on the Reddit signal from user romanic-svezia. We analyze Ory Network (Munich, Germany), Zitadel (St. Gallen, Switzerland), and Cloud-IAM (Paris, France). Pricing and feature sets are sourced from official vendor documentation as of May 2026. This review does not cover independent performance benchmarks, latency testing, or long-term SDK stability. It focuses instead on entity origin, data residency guarantees, and pricing structures.

What they do

Ory Network: API-first identity

Ory Network is a fully managed SaaS built on the open-source Ory stack, which includes Kratos for identity management and Hydra for OAuth2 and OpenID Connect. Headquartered in Munich, Germany, Ory hosts its managed network on European infrastructure. It provides a headless, API-first architecture, meaning developers build their own user interfaces while Ory handles session management, multi-factor authentication, and user schemas.

Zitadel: Turnkey multi-tenancy

Zitadel is built by Zitadel AG, based in St. Gallen, Switzerland. While Switzerland is not an EU member state, it holds an adequacy decision from the European Commission, meaning its data protection laws are recognized as providing equivalent protection to the GDPR. Zitadel is designed specifically for B2B SaaS applications, offering native multi-tenancy, self-service organization management, and a built-in login portal out of the box.

Cloud-IAM: Managed Keycloak

Cloud-IAM, operated by a team in Paris, France, provides fully managed deployments of Keycloak, the industry-standard open-source identity provider from Red Hat. Instead of forcing developers to configure and scale Keycloak on their own servers, Cloud-IAM deploys dedicated or shared Keycloak instances on European cloud providers such as OVHcloud and Scaleway. This ensures that the entire operational and hosting pipeline remains within the EU.

What is interesting and what is not

The sovereign cloud advantage

The most compelling aspect of these three providers is their commitment to European data sovereignty. Unlike US-based giants like Okta, Auth0, or Clerk, these platforms ensure that user data does not cross the Atlantic, shielding customers from the legal uncertainties of the EU-US Data Privacy Framework. Cloud-IAM stands out by hosting exclusively on European cloud providers like Scaleway and OVHcloud, completely bypassing US hyperscalers.

The complexity trade-offs

However, the developer experience varies wildly. Ory Network is highly modular but requires you to build your own login and registration interfaces if you want a seamless user experience. This is a stark contrast to Zitadel, which provides a ready-to-use login console but forces you into its specific architectural patterns.

Meanwhile, Cloud-IAM solves the hosting burden of Keycloak but cannot fix Keycloak itself. Keycloak remains a heavy, enterprise-grade Java application with a complex administration console. If you do not already have a specific requirement for Keycloak, starting a new project on Cloud-IAM will feel significantly more complex than using a modern alternative like Ory.

Pricing snapshot

Pricing is current as of May 2026.

• Ory Network: Free developer tier (up to 100 active users). Essentials tier starts at $29/month. Scale tier starts at $299/month.
• Zitadel: Free tier includes up to 25,000 requests per month. Pro tier starts at $24/month. Enterprise custom pricing is available for larger volumes.
• Cloud-IAM: Free tier (up to 100 users on a shared cluster). Bud tier (shared Keycloak) starts at €39/month. Dedicated production clusters start at €349/month.

Final verdict

Choose Ory Network if you want a modern, API-first, EU-headquartered identity provider with a low starting cost and a highly customizable user flow. Choose Cloud-IAM if your architecture is already coupled to Keycloak but you want to offload the hosting and maintenance to a French provider. Choose Zitadel if you run a B2B SaaS needing complex multi-tenancy, provided your compliance team accepts a Swiss corporate entity.

What we would test next

In a future benchmark, we would test the cold-start latency of Cloud-IAM's shared "Bud" tier under simulated traffic spikes. We would also measure the integration complexity of migrating 10,000 users from Auth0 to Zitadel using their standard import APIs, comparing the developer hours required for each platform.

The investor read

The identity and access management (IAM) market remains dominated by US giants Okta/Auth0 and Microsoft Entra ID, but European data sovereignty regulations (GDPR, Schrems II, and NIS2) are driving a structural shift toward localized alternatives. Ory and Zitadel represent a growing class of commercial open-source software (COSS) startups capitalizing on this regulatory tailwind. While Keycloak remains the default enterprise choice, its operational complexity leaves a massive market gap for managed providers like Cloud-IAM. For investors, the investability of these EU-native tools hinges on their developer adoption velocity outside of Europe; without global scale, they risk remaining niche regional players serving highly regulated local enterprises.

Pull quote: “If you need a strictly EU-founded, fully managed identity provider, Ory Network (Germany) is the top pick for modern developer experience.”