Managed Keycloak – from Switzerland

Keycloak is an open-source Identity and Access Management (IAM) solution that provides Single Sign-On (SSO), multi-factor authentication, social login, user federation with LDAP and Active Directory, and fine-grained authorisation. It supports industry-standard protocols including OAuth 2.0, OpenID Connect, and SAML 2.0. Keycloak is backed by Red Hat and is a CNCF incubating project, licensed under Apache 2.0.

VSHN provides Level 2 operations — 24/7 monitoring, infrastructure management, patching, upgrades, backups, and incident response. Inventage provides Level 3 engineering support — expert analysis of Keycloak configuration, custom extensions, and core product issues. Together, this three-tier model (your team for Level 1 end-user support, VSHN for operations, Inventage for engineering) covers the full support stack.

The Best Effort plan at CHF 360 per month includes professional operations without a formal uptime commitment — suitable for development and staging environments. The Guaranteed Availability plan at CHF 1,500 per month provides 99.99% uptime SLA with two Keycloak instances and a PostgreSQL database, backed by 24/7 engineer support. A dedicated test and development instance is included at Best Effort tier.

Managed Keycloak is available on Swiss cloud providers including cloudscale.ch and Exoscale, both operating data centres exclusively in Switzerland. Through Servala, Keycloak is also available on Xelon, Switch, Levigo, APPUiO, Managed OpenShift, and Enterprise Private Cloud. Swiss providers are recommended for organisations with data residency requirements.

All Keycloak data is stored in a managed PostgreSQL database. Automated daily backups run at 22:00 with six retained copies and up to 500 GiB of cumulative storage. Backups are encrypted at rest. VSHN uses CloudNativePG with Barman for backup orchestration. Deletion protection is available as an additional safeguard.

Yes. Managed Keycloak supports custom themes for login pages, account management, and email templates — including logos, colours, fonts, and custom stylesheets. Custom extensions are supported via container images. Inventage develops custom authenticators, event listeners, protocol mappers, and federation providers as part of their Level 3 engineering service.

Each managed Keycloak instance supports up to 100 realms with unlimited users, admin console access, built-in metrics and dashboards, custom subdomain configuration, keycloak-config-cli for declarative configuration, and TLS-encrypted PostgreSQL database. High-availability configurations use Infinispan clustering across two or three instances with zero-downtime maintenance.

Identity is the service every other application depends on for authentication and authorisation. Choosing an open-source IAM solution hosted in Switzerland means your identity infrastructure is not controlled by a foreign cloud vendor. With managed Keycloak, your data stays on Swiss cloud providers (cloudscale.ch, Exoscale), your configuration is portable because Keycloak uses open standards (OAuth 2.0, OpenID Connect, SAML 2.0), and you are never locked in to VSHN — you can migrate to another provider or self-host at any time. This makes Keycloak the natural foundation for a digital sovereignty strategy.

Self-hosting Keycloak requires Kubernetes expertise, database administration, backup automation, security patching, and on-call coverage. Managed Keycloak provides all of this as a service with a fixed monthly fee. VSHN handles the infrastructure and operations while Inventage provides engineering expertise that would be difficult to build in-house. For production workloads, the Guaranteed Availability plan includes 99.99% SLA and 24/7 support.

The fastest way is to order managed Keycloak through Servala at servala.com/service/keycloak/ — self-service provisioning on your choice of cloud provider. For enterprise deployments with custom requirements, contact us using the form below. VSHN and Inventage offer a consulting and onboarding package (CHF 8,000 for 5 days, 40 hours) covering architecture design, realm configuration, identity provider integration, and theme customisation.