Identity and access management (IAM) services

Hanko

Open source authentication and passkeys from Germany

GermanyEUOpen sourceFree plan Ownership reviewed, controller unresolved

Scope verdict

Ownership reviewed, controller unresolved

This service remains visible for context, but it is not counted or recommended as a European-controlled option.

How we classify services

Hanko is an open source authentication service from Germany. It covers passkeys, social single sign-on, two-factor authentication and SAML, and supports passwordless, passkey-only or classic password setups. Hanko Elements provides ready-made web components, while the API and SDKs allow custom web and native implementations. The API is written in Go and licensed under AGPLv3, with Elements and the SDKs under MIT.

Hanko Cloud is hosted on AWS in Frankfurt across three availability zones, and the software can be self-hosted, so you can move data to your own infrastructure at any time. As a European alternative for identity and access management, it suits development teams that want phishing resistance and data minimisation.

Pricing

The free plan covers two production projects and 10,000 monthly active users. Pro costs $29 per month plus $0.01 for every monthly active user above 10,000, and an Enterprise plan with a 99.99% SLA is available on request.

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Public website

Cloudflare

Non-European provider
Observed
A 198.202.211.1 · CNAME cdn.webflow.com · AS209242

Why this matters

Public DNS routes website visits through Cloudflare. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Incoming business email

Google Workspace

Non-European provider
Observed
MX 1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 alt3.aspmx.l.google.com · 10 alt4.aspmx.l.google.com

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked:

More in Identity and access management (IAM) services

View all →

More from Germany