Alternatives to IAM platforms: one place for the comparison
Most people landing here already run a platform in production and have a specific reason to reassess it: cost that grows with users, identity data outside the European Union, or a NIS2 requirement handed down by compliance. This page compares the criteria that actually matter and points to the detailed comparison with each vendor.
The eight criteria that decide the choice
The left column describes the model adopted by most traditional IAM platforms. The specifics of each individual product live on its own comparison page.
| Criterion | Traditional IAM platforms | LoginMaster |
|---|---|---|
| Where personal data lives | In the vendor's cloud, often outside the European Union. | Exclusively inside the customer Tenant. The Cloud only operates on encrypted, pseudonymized data. |
| Vendor access to your data | Limited by contractual policy and internal controls. | Impossible by architecture: no readable emails, names or credentials ever reach the Cloud. |
| Isolation between organizations | Logical, handled at application level by the vendor. | Cryptographic: unique keys, certificates and salts for every tenant and every project. |
| Pricing model | Per monthly active user: cost grows with the organization. | Flat per tenant and project, unlimited users included, no per-user fee. |
| Credential protection | Hashing handled entirely inside the vendor's infrastructure. | Argon2 with split-salt between Tenant and Cloud, plus tokens signed twice (Tenant and Cloud). |
| Federation and protocols | Broad protocol coverage, often gated behind higher tiers. | SSO with Google Workspace and Microsoft Entra ID via OAuth 2.0/OpenID Connect. SAML 2.0 and SCIM 2.0 are on the roadmap. |
| GDPR and NIS2 compliance | Achievable through extra configuration and contractual clauses. | A property of the architecture: data never leaves the Tenant, with controls also aligned to ISO 27001. |
| Support and engineering | English-language support on non-European time zones. | Platform designed and built in Italy, with technical support in Italian. |
The detail of the architecture that makes vendor access impossible is on the security page, the regulatory mapping on compliance and the cost model on pricing.
Which platform are you evaluating?
Each page compares LoginMaster with one specific product on architecture, protocols, cost and switching path.
See also the joint Okta and Auth0 comparison and the comparison between European IAM platforms.
How to evaluate an alternative
Four questions that narrow the field faster than a feature checklist.
Start from the regulatory constraint
If you operate in a NIS2-regulated sector or handle special-category data, the question is not which platform has more features but where your users' identities end up and who can read them. It is the criterion that rules out the most options, so apply it first.
Project the cost over three years
Per-active-user pricing looks competitive at the start and becomes the dominant cost line as the organization grows or as you add test environments. Compare cost at the size you expect in three years, not today's.
Check the exit cost
Proprietary authorization rules and non-standard SDKs make every future change expensive. Ask yourself how you would export users, roles and configuration if you had to switch again: the answer says a lot about the real lock-in.
Account for non-human identities
IoT devices, service accounts and AI agents are becoming the majority of the identities you have to govern. A platform that treats them as an exception will force you to build a second system alongside the first.
On the fourth point the reference page is the one on AI agent identities and the one on IoT device identities.
IAM alternatives FAQ
LoginMaster is an enterprise IAM platform designed and built in Italy, with hosting and data exclusively in Europe. The substantive difference from non-EU providers is not the legal address but the architecture: personal data stays inside the customer Tenant and the Cloud only handles encrypted, pseudonymized data, so vendor access to identities is impossible by design rather than merely forbidden by contract.
LoginMaster's model is flat and based on tenants and projects, with unlimited users included: spend does not grow when you add employees, end customers or test environments. On monthly-active-user platforms that same growth translates straight into recurring cost, which is why many evaluations restart from scratch after two or three years.
Today federation runs over OAuth 2.0 and OpenID Connect toward Google Workspace and Microsoft Entra ID, while provisioning and lifecycle are automated with REST APIs, TypeScript/.NET SDKs and webhooks. Native SAML 2.0 and SCIM 2.0 support is on the platform roadmap: if your scope depends on either, that is a point to put on the table during the assessment.
Applications that speak OAuth 2.0 and OpenID Connect reconnect by changing configuration. Where the previous provider's proprietary customizations exist, those have to be redesigned on open standards: that is exactly what the initial migration assessment is there to map, before committing application teams.
The dedicated pages cover Auth0, Okta, Keycloak, Microsoft Entra ID, AWS Cognito, Firebase Auth, Ping Identity, ForgeRock, OneLogin, JumpCloud and ZITADEL. For platforms not on the list the comparison happens directly during the assessment, where the configurations actually running in production get mapped.
Compare on your actual use case
A comparison table tells you what changes in general. How much it changes for you depends on how many applications you have integrated, which policies you wrote and which regulation applies: those are the first things we look at together.
In-depth guides
Step-by-step procedures, request examples and explicit comparisons between the available options.
IAM cost with tens of thousands of users
Three pricing models compared, explicit arithmetic at 10,000, 25,000, 50,000 and 100,000 users, the hidden multipliers and the real cost of self-hosting.
Migrating from self-hosted Keycloak to managed IAM
What 'without losing users' really means, three migration strategies compared, the Keycloak concept map, the phased plan with rollback and an honest chapter on credentials.