Okta, 1Password, Microsoft Entra ID and LastPass rent sign-on and the password vault. Keycloak is Apache-2.0. Authentik's code outside its enterprise directory is MIT, and that enterprise directory is a separate licence, so we deploy the MIT tree. Vaultwarden is AGPL-3.0 and is the vault, compatible with Bitwarden clients, not a second Okta.
What does owned identity not include?
Okta's device trust, a vendor's breach report, and a family plan. Entra ID is also the door to Microsoft 365. Replacing the login box does not pull the company out of Microsoft. Say that before the project starts.
Why separate the vault from the login?
Because they fail differently. A vault the client can export is the minimum. A single sign-on system is a production dependency. We do not fold them into one casual migration.
When should identity stay rented?
When the company is ten people inside Microsoft 365 and Entra is already the door. Own identity when applications the client built need a login they can still run if the suite is cancelled.
What do we hand over?
We select the system, deploy it on infrastructure you control, connect it to the tools you keep, and write the runbook so your own team can operate it. Support after handover is optional. The rest of the map is in software you can stop renting; the engagement behind it is open-source business systems.
Name one process that still needs a person. We will tell you what a one-time build takes.
Contact us today