A straight, no-hype comparison of the providers that run Keycloak for you, scored on SLA, support, compliance, data residency, pricing model, and migration help. We built Skycloak, so we have a horse in this race, but the table below is honest. As you compare, watch the two things that bite later: pricing that scales with your user count, and whether you can host in your region and leave with your data.
Managed Keycloak means someone else runs the upgrades, backups, scaling, and uptime so your team can ship features instead of babysitting servers. Before you pick one, weigh these six things, and pay closest attention to pricing model, data residency, and portability, where providers differ the most.
These figures come from each provider's public pricing, SLA, and trust pages as of June 2026. Vendors change terms often, so confirm the specifics with the provider before you sign.
| Provider | SLA | Support | Migration Help |
|---|---|---|---|
| Skycloak | 99.99% (contractual) | White-glove, Keycloak experts | Self-serve realm import and export |
| Clever Cloud | 99.9%/yr, 99.99% on Premium (credits) | Email and in-app, 24/7 phone on Premium | Self-serve import/export, paid expert help |
| Elestio | 99.9% to 99.95% on paid tiers (none on free) | Tiered: free best-effort to paid (4h, dedicated CSM) | Assisted DB migration, one-click clone |
| cloud-iam | 99% to 99.98% (99.95% Premium, 99.98% Max) | Keycloak specialists, plan-based | Migration services available |
| Phase Two | 99.95% (Enterprise), 99.5% (Premium) | Keycloak contributors, 24/7 on-call | Expert migration help |
| Inteca | 99.99% (all support tiers) | Four tiers, Bronze (8x5, 8h) to Platinum (24/7, 1h) | Consultant-led deployment |
| AWS Marketplace (Solodev) | No published SLA | Basic email (business hours EST), managed tier extra | Self-deploy via CloudFormation, setup help is paid |
| Provider | Compliance | Data Residency | Pricing Transparency | Best For |
|---|---|---|---|---|
| Skycloak | SOC 2 Type II, ISO 27001, HIPAA, GDPR | US and EU | Public, flat (unlimited users) | Teams that want managed Keycloak without per-user pricing or DevOps |
| Clever Cloud | ISO 27001, HDS (SecNumCloud in progress) | France (Paris), other zones on request | Public, plan-based | EU teams already on the Clever Cloud PaaS |
| Elestio | SOC 2 Type II, ISO 27001, HIPAA, GDPR | 100+ regions across many clouds | Public (support billed separately) | Budget-conscious teams wanting managed open-source |
| cloud-iam | ISO 27001:2022 (SOC 2 in progress), GDPR/NIS2 | Global, 70+ regions (EU-sovereign options) | Public, per user not MAU | EU teams wanting Keycloak specialists |
| Phase Two | SOC 2 Type II, ISO 27001, GDPR | Multi-region (AMER, EU, APAC on AWS) | Public, tiered (free to custom) | Teams needing heavy Keycloak extension and contributor work |
| Inteca | SOC 2, ISO 27001, HIPAA at client level; NIS2, DORA | Your own infrastructure, any region | Private quote, per project (not MAU) | Enterprises that must self-host identity data |
| AWS Marketplace (Solodev) | No published certs (verify) | Runs in your AWS account (us-east-1 default) | Public per-node listing plus AWS infra (managed = private quote) | Teams that want Keycloak on their own AWS invoice |
Sources: each provider's own public pricing, SLA, and trust pages as of June 2026. Inteca's figures were confirmed by the vendor in August 2026. Details change, so verify before purchase. Skycloak figures reflect our published SLA and compliance posture.
Short, fair summaries so you can shortlist fast.
Managed Keycloak with a 99.99% SLA, SOC 2 Type II, ISO 27001, and HIPAA with a BAA available, and your choice of US or EU data residency. Pricing is flat and public (you pay for infrastructure, not per user), and migration is self-serve using standard Keycloak realm import and export. Best fit if you want production Keycloak without the DevOps tax or surprise MAU bills.
A French (EU) platform-as-a-service with a fully managed Keycloak add-on (built with partner Please Open-IT). It is ISO 27001 and HDS certified, hosts primarily in France with other zones on request, and offers 99.9% uptime (99.99% on the Premium tier). A strong pick if you are already on Clever Cloud or want an EU-sovereign PaaS.
A managed open-source host that runs Keycloak on dedicated VMs across 8+ cloud providers and 100+ regions, with public, low-cost pricing (support billed separately). It is SOC 2 Type II, ISO 27001, HIPAA, and GDPR compliant. Good for teams that want low-cost, multi-cloud managed open-source with optional enterprise SLAs.
A Keycloak-focused managed provider with an EU-based in-house team. It offers tiered SLAs up to 99.98% (99.95% on its popular Premium plan), ISO 27001:2022 certification (SOC 2 in progress), and GDPR and NIS2 alignment. Pricing is public and plan-based, charged on total user count rather than MAU, with a free tier for small projects. Hosting spans 70+ regions, with EU-sovereign options on Scaleway and Outscale.
Built by active Keycloak contributors (authors of the keycloak-orgs, magic-link, and events extensions), Phase Two brings deep extension and customization expertise. It publishes transparent per-cluster pricing billed by concurrent sessions rather than seats: a free Starter tier plus paid Premium, Enterprise, and Custom plans. SOC 2 Type II and ISO 27001 certified, with multi-region hosting on AWS.
A managed Keycloak service that deploys into your own servers or cloud account rather than a vendor-hosted cluster, so identity data never leaves your environment. Every tier carries a 99.99% SLA, from Bronze (8x5, 8 hour response) up to Platinum (24/7, 1 hour). SOC 2 Type II, ISO 27001 and HIPAA apply to your environment rather than being certifications Inteca holds itself, and deployments support NIS2 and DORA. Priced per project after an architecture review. Best fit if sovereignty rules out a hosted cluster.
Solodev's Keycloak on AWS Marketplace is a vendor-maintained Keycloak you deploy into your own AWS account via CloudFormation, billed through AWS as a per-node listing plus your AWS infrastructure costs. It is not fully managed by default: Solodev maintains the distribution and provides basic business-hours email support, while full setup, monitoring, and US-based support are a separate paid Managed Keycloak service quoted privately. Convenient if you want Keycloak on your AWS invoice and running in your own account.
Skycloak gives you a 99.99% SLA, SOC 2 Type II, ISO 27001, and HIPAA, US or EU data residency, flat pricing with unlimited users, and self-serve realm import so you can bring your existing Keycloak. Start free, deploy in minutes.
There is no single best provider for everyone, it depends on your priorities. If you want a strong SLA (99.99%), SOC 2 Type II, ISO 27001, and HIPAA compliance, US or EU data residency, flat pricing with unlimited users, and self-serve realm migration, Skycloak is built for that. EU-only teams might prefer Clever Cloud or cloud-iam, budget-first teams often look at Elestio, and AWS-centric teams may want the AWS Marketplace listing.
Managed Keycloak means the provider handles the operational work: provisioning, version upgrades, security patches, backups, monitoring, scaling, and uptime. You still own your realms, clients, and configuration, but you do not have to run the infrastructure. The level of hands-on help (especially with Keycloak config and migration) varies a lot between providers.
Pricing models differ. Some providers publish flat infrastructure pricing (you pay for the cluster, not per user), while others charge per monthly active user or by usage, and a few are contact-only. Entry points range from low-cost budget hosts to custom enterprise plans. Skycloak uses flat, public pricing with unlimited users so your bill does not explode as you grow. See the pricing page for current numbers.
Yes. Several providers offer EU data residency, and a few (such as Clever Cloud) are EU-based, while others like cloud-iam offer EU-sovereign hosting options. If your rules say identity data cannot leave infrastructure you control at all, Inteca deploys into your own servers or cloud account rather than a vendor-hosted cluster. If you need both US and EU regions, confirm that the provider supports the regions you need. Skycloak offers both US and EU data residency, plus SOC 2 Type II, ISO 27001, HIPAA, and GDPR alignment.
It depends on your team. Self-hosting gives you full control but means you own upgrades, high availability, backups, scaling, and security patching. Managed Keycloak trades a bit of that control for far less operational overhead and a contractual SLA. Teams without dedicated identity or DevOps staff usually come out ahead with a managed provider. See our self-hosted vs managed breakdown.
Yes. Keycloak supports standard realm export and import, so your data is portable. The difference between providers is how much help you get. Skycloak gives you self-serve realm import and export (you run it, using the standard Keycloak format), while some providers such as cloud-iam and Phase Two offer more hands-on migration assistance. If you have a complex realm, weigh how much migration help you want.