Managed Keycloak providers vs. self-hosting: an honest comparison
Last reviewed: 2026-08-26. Vendors change — if anything here is out of date, email hello@keelinfra.io and we'll correct it within one business day.
When managed Keycloak is the right answer
Honestly: often. If you have no ops team, no data-residency constraint, and you want the 2am pager to be someone else's problem, both vendors below do that genuinely well — Phase Two has SOC 2 and ISO 27001, enterprise customers, and a real published SLA; Skycloak has flat infrastructure pricing, a strong security page, and first login in minutes. If that's you, use them.
This page exists for the buyer they both structurally cannot serve: the team whose identity data cannot live on someone else's cloud — regulated industries, data residency, air-gapped networks, formal change control. Skycloak's own blog puts it plainly: if identity data can't leave your infrastructure, "a SaaS identity provider is off the table by definition."
The table
| keelinfra | Phase Two | Skycloak | DIY | |
|---|---|---|---|---|
| Where identity data lives | Your machines, always | Their cloud; on-prem via consulting + container | Their cloud (4 regions) | Your machines |
| License of the ops layer | Apache-2.0, all of it | Extensions are Elastic License v2 (relicensed from AGPL in 2023; not OSI open source; restricts on-prem redistribution) | Proprietary SaaS | n/a — you write it |
| Air-gapped / offline | Designed for it — offline bundle ships with the subscription | Not offered; container phones home by default | Not offered — SaaS by definition | Possible, all on you |
| HA / backup / upgrade docs public? | Yes — docs, and CI-proven | No — docs cover app integration; ops is sold as support | n/a — they operate it for you | Upstream docs only |
| Upgrade testing you can inspect | Nightly public CI matrix + published probe logs | None published; upgrades are a service engagement | None published; no version pinning, sequential upgrades only | Yours to build |
| SLA / uptime — verifiable? | No SLA — measurements and drills instead | Published SLA doc with credit formula | "99.99%" on the homepage; SLA page says best-effort below Enterprise; no public status page | n/a |
| Exit path | Nothing to export — it's already your database | Your data in their container/cloud, ELv2 terms on extensions | DB export: Launch tier and up, credentials excluded by default, files expire in 24h | n/a |
| Custom extensions / SPIs | Unrestricted — it's your Keycloak | Their ecosystem, ELv2 terms | Custom JARs are Enterprise-only; curated marketplace below that | Unrestricted |
| Who carries the 2am pager | You — with drills, runbooks, and a $200/hr emergency line | Them (managed); you + retainer (self-hosted) | Them | You, alone |
| Time to first login | ~10 minutes — but you bring 1–3 VMs | Minutes, free trial | Minutes, free trial | Days to weeks |
| Compliance paperwork | None from us — your data never reaches us; auditable source instead | SOC 2 Type II, ISO 27001 | SOC 2, ISO 27001, HIPAA claimed; documented pentests & subprocessors | Yours |
| Pricing model | $0 OSS · $1,500/node/yr sub · fixed-scope services | $149–2,999/mo by MAU; support $3.5K–7.5K/mo | $29–599/mo by infrastructure + Enterprise | Your engineers' time |
How to read it
If you can use a managed cloud, the pager row and the compliance row may be all that matters — and both vendors win them. Per-MAU cost is the thing to model carefully: Skycloak's infrastructure-based pricing is genuinely different from Phase Two's MAU tiers.
If your data can't leave, the structural facts are these. Phase Two's self-hosted offering is a container image plus a support retainer ($42K–90K/yr at their published rates) — the HA, backup, and upgrade knowledge stays behind the retainer. Skycloak has no self-hostable product at all. In both cases the ops knowledge is the paywall.
keelinfra's bet is the opposite: the ops knowledge is the product, and it's Apache-2.0 — the installer, the docs, the drills, the upgrade runbooks, and the nightly CI that re-proves them. You pay for people and guarantees, not for access to how it works.
What we concede
- With keelinfra, the 2am pager is still yours. We give you drills, runbooks, and an emergency line — we don't carry it for you.
- Managed gets you to first login faster. Ten minutes and three VMs is fast for self-hosted; it is not faster than a free trial button.
- We have no SOC 2 — and we'd argue you don't need ours, because nothing of yours touches us. But if your procurement checklist requires a vendor certificate for the software supply chain, that's a real difference today.
Also in this series: Phase Two alternatives · Skycloak alternatives