Delegated access management

Hosted Login

Multifactor Authentication

Passwordless Authentication

Audit Trail

Identity Brokering

Platform

Service Accounts

Features

Easy integration

B2B (Business to Business)

Self Service

Existing identities

Secure authentication

Use Cases

Learn how to install, setup, and use ZITADEL.

Documentation

ZITADEL Cloud

Self-hosting

Trust center

Examples and Guides

Github Repository

Develop

Get Started

Contribute

Roadmap

Changelog

About Us

Jobs

Contact

Company

Read the blog

Sign up

Login

Pricing

Blog

BLP Digital experienced significant operational improvements after implementing ZITADEL, highlighted by the following key achievements:

- **70% faster B2B client integration** 
- **Full migration in just 4 weeks** 
- **50% reduction in machine user management overhead**


<img
    src="/blog/2024-05-14-success-story-blp-01.jpg"
    width="100%"
    height="75%"
    alt="Banner Image"
    style={{ margin: '0 auto' }}
  />


## Company Background

[BLP Digital AG](https://www.blp-digital.com/en/), which sprang from a pioneering project at the Swiss Federal Institute of Technology (ETH Zurich) in 2018, focuses on leveraging the latest neural network advancements to automate document-based ERP processes. The founding team, comprising both entrepreneurs and machine learning pioneers, officially formed the company in 2019, earning the prestigious ETH Zurich spin-off label. Today, driven by a team of over 50 skilled software engineers and business experts, BLP Digital serves a diverse global clientele, adapting to 20 languages and multiple regulatory environments. Their SaaS solution targets medium to large-sized industrial companies, trading companies, retailers, and financial institutions, all of whom benefit from high-volume document processing with minimal manual intervention.

## The Challenge

As BLP Digital expanded its services globally, it became clear that their existing Identity and Access Management (IAM) systems were inadequate. The company faced critical technical and financial challenges, particularly in creating a scalable and secure Single Sign-On (SSO) solution that adhered to open standards. The need for a more efficient and secure system became urgent as they planned to migrate thousands of active B2B users from traditional password systems managed through Auth0 to a streamlined SSO setup. 

## The ZITADEL Solution

After evaluating several options, including Keycloak, Firebase, Supertokens, and Ory, BLP Digital selected ZITADEL for its comprehensive capabilities. Through Role-Based Access Control (RBAC), flexible authentication options (including MFA and SSO), and simplified identity federation with a variety of corporate identity providers (including Microsoft Entra ID), ZITADEL significantly improved security and user experience.
ZITADEL stood out because of its:
- **Advanced Multi-Tenancy Capabilities**: Offering the ability to manage distinct, secure environments for each B2B client.
- **Flexible Hosting Options**: Including both cloud services for production environments and self-hosted setups for development, facilitating seamless integration into BLP Digital’s architecture.
- **Machine User Management**: Non-interactive accounts are vital for authorizing automated processes and backend services. This capability ensures secure and seamless service execution, a feature not available with their previous provider, Auth0.
- **Commitment to Open Standards**: Ensuring flexibility and preventing vendor lock-in, crucial for future scalability.
- **Support Model**: The integration process evolved into a dynamic partnership, with BLP Digital working closely with ZITADEL to refine and adapt features to better meet their needs.

## Key Outcomes

- **70% Faster B2B Client Integration**: The time required to set up and manage B2B client environments was reduced from 5 hours to just 1.5 hours.
- **Full Migration in Just 4 Weeks**: Demonstrating ZITADEL’s exceptional adaptability and speed in deployment.
- **50% Reduction in Machine User Management Overhead**: ZITADEL’s service user feature halved the time and effort required to manage backend services and automate processes.

## Testimonials

<img
  src="/blog/2024-05-14-success-story-blp-02.jpg"
  width="250px"
  alt="Portrait of Tim Beck"
/>

“As a leading SaaS company serving tens of thousands of users, we prioritize a robust and reliable authentication solution. After extensive research for the best provider, we were impressed by ZITADEL’s exceptional flexibility and cutting-edge technology. Their seamless integration and unwavering support have significantly enhanced our platform's security, making them an invaluable partner in our growth.”

- [Tim Beck](https://www.linkedin.com/in/timbeque/), Founder and CEO, [BLP Digital AG](https://www.blp-digital.com/en/)


Discover how BLP Digital uses ZITADEL's IAM features to boost their document automation services across B2B platforms.

Achieving 70% Faster B2B Integration in Document Automation at BLP Digital


<img
    src="/blog/2024-01-25-success-story-crossclassify-01.png"
    width="100%"
    alt="Banner Image"
    style={{ margin: '0 auto' }}
  />

## Key Outcomes

- [CrossClassify](https://www.crossclassify.com/), a provider of AI-powered online account fraud prevention, required a robust Identity and Access Management solution to integrate with its services. They needed a system capable of handling Single Sign-On(SSO), identity federation, and multi-tenancy, catering to their B2B clients' diverse authentication requirements.

- [ZITADEL](http://www.zitadel.com) emerged as the ideal solution for CrossClassify's IAM requirements, offering features like secure authentication, Role-Based Access Control (RBAC), SSO, identity federation, and multi-tenancy. CrossClassify evaluated other vendors, including RedHat SSO (Keycloak), but chose ZITADEL for its cloud-agnostic deployment, SaaS offering along with self-hosting capabilities, and comprehensive technical support. The flexibility to run ZITADEL on any platform and its active community were also key deciding factors.

- By adopting ZITADEL, CrossClassify was able to efficiently develop their comprehensive authentication system and RBAC authorization in under 3 months. This implementation included the advantages of self-hosting and the flexibility for cross-platform scalability. Opting for ZITADEL instead of constructing a solution from the ground up, CrossClassify not only halved the development time frame—typically a 5-to-6-month endeavor—but also significantly minimized potential security risks.

For an insightful exploration into CrossClassify and their implementation of ZITADEL, we had the opportunity to speak with [Amir Moghimi](https://www.linkedin.com/in/amir-moghimi-10b4b624/), the co-founder and CEO of CrossClassify. Amir provided valuable insights into how CrossClassify integrates ZITADEL to strengthen the security and efficiency of their solution.


## CrossClassify: Pioneering AI-Enabled Fraud Detection

Founded in 2020 in Melbourne, and currently based in Brisbane, Australia, CrossClassify offers a B2B AI-enabled fraud prevention solution. The company currently focuses on providing cutting-edge, online account fraud prevention services that are affordable and easy to integrate into any mobile and web app. The core offering, a Software as a Service(SaaS) product, is designed to alleviate concerns around fake accounts and account takeovers. These issues, if not addressed, can lead to significant consequences for businesses, such as fines or the loss of operating licenses. 

Their primary customer base includes businesses that provide an application with sign-up and sign-in features. These businesses, particularly as they scale, become increasingly vulnerable to fake account creation and account takeover attacks. Currently, CrossClassify is particularly focused on serving the fintech and healthcare sectors. These domains face stringent regulatory requirements and handle sensitive data, where breaches can lead to substantial fines and severe reputational damage.

Startups and scale-ups are their early adopters. These companies, often working with tighter budgets, find CrossClassify's cost-effectiveness appealing – CrossClassify’s solution is at a price point that is at least ten times less expensive than their nearest competitor. Additionally, these businesses are typically more agile and quicker to adopt new technologies.

One of the key advantages of their solution is its ease of integration that is comparable to analytics SaaS platforms. Amir claims that most of their clients are able to integrate the system within a single day, allowing for swift testing and the ability to go live in just two weeks. This easy integration process, combined with their competitive pricing, makes CrossClassify an attractive option for businesses looking to enhance their security against fraud while adhering to regulatory standards.

### The User Journey with CrossClassify

The journey of a B2B user with CrossClassify begins with the initial step of signing up for the service. 

- Once signed up, a key is generated per environment (e.g., dev/staging/prod), which serves as the unique identifier and access token for their application. It allows secure data collection between the B2B user's app and CrossClassify's services.
- The next phase involves integrating CrossClassify into the B2B user's application. This is facilitated by CrossClassify's client-side SDK, which is available for various programming languages and platforms, catering to both web and mobile applications. This allows the application to start collecting behavioral data from their application users to detect potentially fraudulent activities.
- Following the client-side integration, the user integrates CrossClassify with their application’s backend. This step is optional but is strongly recommended for implementing security measures, such as blocking access to an account when CrossClassify's AI-driven algorithms detect an unusually high risk of fraud in real-time. 
- After integration, users in the B2B organization can log in and access CrossClassify's portal, where they can monitor and review flagged and blocked accounts. This feature provides valuable insights into end-user behavior and potential security threats, enabling businesses to make informed decisions about account activities.

<figure>
  <img
    src="/blog/2024-01-25-success-story-crossclassify-02.png" 
    width="100%"
    alt="CrossClassify in Action"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - CrossClassify in Action

  </figcaption>
</figure>


## Problem and Solution

The primary need for CrossClassify was a centralized Identity and Access Management (IAM) system capable of handling both authentication and user management effectively. This system would play a crucial role when B2B users sign up for CrossClassify, managing their credentials and access rights while ensuring compatibility with their cloud-native infrastructure. 

For B2B customers integrating CrossClassify into their applications, the IAM system should facilitate authentication services. Moreover, in instances where these organizations use their own Identity Providers (IdPs), the IAM system must offer identity federation support. This feature allows them to authenticate with their pre-existing credentials across various IdPs, enhancing the user experience.

An essential requirement for the IAM solution was Single Sign-On (SSO). SSO is pivotal in ensuring a frictionless sign-in process for the B2B users across different services and applications, particularly vital in multi-application ecosystems in large organizations that demand consistent user authentication. CrossClassify wanted to offer SSO for clients who needed it via their enterprise plan. Large companies often wanted to use SSO for all of their internal systems, including CrossClassify’s fraud prevention portal.

### Criteria for IAM Selection

1. **Secure and Scalable Authentication**: A fundamental requirement was robust authentication to secure user sign-up and sign-in processes. This was vital for preventing fraudulent activities and ensuring system integrity.

2. **SSO and Identity Federation**: The IAM solution had to facilitate seamless integration with various IdPs used by CrossClassify's clients. They were also looking for SSO capabilities to cater to the needs of large organizations that prefer to integrate SSO across their internal systems. This integration should extend to their fraud prevention portal, allowing seamless access.

3. **Multi-Tenancy Support**: The solution had to be capable of supporting multiple B2B clients, reflecting a multi-tenanted architecture that could handle diverse requirements.

4. **Flexible Hosting Options**: A dual hosting approach was sought – a cloud-based solution with the option for self-hosting. This flexibility was necessary to meet specific client demands, especially for direct control over data and authentication processes.

5. **Cloud-Agnostic Deployment**: CrossClassify required an IAM solution that could be deployed across various cloud platforms like GCP and AWS. This cloud-agnostic feature would ensure compatibility and flexibility across different infrastructures.

6. **Reliable Support and SLA**: The vendor needed to provide dependable commercial support, backed by service level agreements (SLAs), particularly crucial for scenarios involving self-hosting configurations.

7. **Cost-Effective Solution** Catering to startups and scaleups, the IAM solution had to be budget-friendly, offering valuable features at a price accessible to early-stage businesses.

8. **Ease of Integration**: The solution had to be easy to implement, with a focus on reducing the time and resources required for integration, therefore enabling smooth adaptation and operational testing.

### Choosing ZITADEL

CrossClassify discovered ZITADEL through a Google search and chose it over other options like RedHat SSO (Keycloak) because it closely matched their outlined criteria. Amir mentioned that their team managed to develop the entire authentication framework and Role-Based Access Control (RBAC) on ZITADEL in a span of less than three months. He emphasized the advantage of ZITADEL in providing future flexibility for self-hosting and cross-platform compatibility—benefits not typically offered by standard cloud IAM solutions. Amir also pointed out that creating an IAM solution from scratch would not only have required a significantly longer development time but also would have introduced greater security risks.

Central to their decision was ZITADEL’s multitenancy support, enabling the management of multiple B2B clients within a single instance, each with the capability to self-manage users and roles. This setup was vital for addressing diverse login requirements and security policies across different client organizations.

ZITADEL’s SSO and identity federation capabilities were crucial, allowing seamless access needed for user applications and for the integration with various IdPs used by CrossClassify's clients, thereby facilitating a unified authentication experience. ZITADEL’s support for RBAC aligned with their need for precise user permission management. 

Its open-source nature and scalability catered to CrossClassify’s expanding client base, and the dual hosting options—cloud-based SaaS and self-hosting—offered the deployment versatility they required. The choice was further reinforced by the active development community around ZITADEL and the availability of comprehensive technical support.


## Solution Architecture and Deployment

In this setup, ZITADEL acts as the central IAM system that manages both direct authentication (for users without an external IdP) and federated authentication (for users with an external IdP). At present, CrossClassify uses ZITADEL’s cloud hosting solution.

CrossClassify leverages both Google Cloud Platform (GCP) and Amazon Web Services (AWS). Their infrastructure heavily utilizes serverless technologies, including Google Cloud Functions and AWS Lambda, which allows for scaling and resource management suited to the dynamic needs of their applications. In terms of data storage, they use a NoSQL approach, using MongoDB for its advanced querying and indexing capabilities and AWS's DynamoDB for its scalability and pay-as-you-go pricing. 

For their software development, Python is the programming language of choice for backend development, while the front end is built using React and TypeScript. The integration with ZITADEL is implemented through ZITADEL’s APIs. 

### ZITADEL and CrossClassify in Action

<figure>
  <img
    src="/blog/2024-01-25-success-story-crossclassify-03.png" 
    width="100%"
    alt="The Complete User Flow with CrossClassify and ZITADEL"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

  Figure 2: The Complete User Flow with CrossClassify and ZITADEL

  </figcaption>
</figure>


1. **Organization and Project Creation**: In the dynamic collaboration between ZITADEL and CrossClassify, the process begins with the creation of an organization and a specific project within ZITADEL when a B2B customer registers with CrossClassify. This setup allows each customer to have an individually tailored security environment, where they can add users, configure [Role Based Access Control (RBAC)](https://zitadel.com/docs/guides/manage/console/roles), [multi-factor authentication (MFA)](https://zitadel.com/docs/guides/integrate/login-ui/mfa), [identity federation via external IdPs](https://zitadel.com/docs/guides/integrate/services), and [passkeys](https://zitadel.com/docs/guides/integrate/login-ui/passkey) at an organizational level, thanks to ZITADEL's support for [multi-tenancy](https://zitadel.com/docs/guides/solution-scenarios/b2b).

2. **API and Service User Setup in the Project**: In the project setup phase, B2B client applications are required to transmit behavioral data to CrossClassify each time a user logs in or performs other relevant actions. This is achieved through API calls to CrossClassify. Within ZITADEL, these client apps are identified as service users. For secure communication, a private-public key pair is generated for each service user using the [JSON Web Token (JWT) profile](https://zitadel.com/docs/guides/integrate/private-key-jwt#get-an-access-token). This key pair enables the service user to request tokens from ZITADEL's OIDC token endpoint, which are then used to access CrossClassify's protected APIs. To facilitate this process, an API application is also set up within the same ZITADEL project. This application is specifically configured to communicate with the CrossClassify API, using the token obtained with the service user's private key for authentication. The CrossClassify API, upon receiving a request, validates the access token by consulting ZITADEL's introspection endpoint, which then determines whether to grant or deny access based on the token's validity. For additional insights on API access and token introspection in ZITADEL, explore further in this detailed post: [API Access and Token Introspection - ZITADEL Blog](https://zitadel.com/blog/api-access-and-introspection).

3. **SDK Configuration**: The client-side SDK is set up with specific ZITADEL OIDC client configurations. This includes essential details like the service user's private key, the token endpoint, and the API Client ID and Secret. Alternatively, an API key may be used if the JWT profile is implemented for API security. These elements, obtained during the service user and API creation phase, enable the SDK to effectively manage the login process and token handling. Additionally, the SDK facilitates interaction with CrossClassify’s fraud detection system by securely communicating with the API.

4. **End-User Interaction**: In this phase, B2B applications utilize the assigned private key to transmit end-user behavioral data to CrossClassify. ZITADEL plays a critical role in verifying the validity of this key and identifying its assigned user. This validation process is essential for ensuring that the data is securely and accurately relayed to the CrossClassify API for processing. Based on the fraud score returned, the B2B application can grant or deny access to the end user. 

5. **Portal Access**: Within ZITADEL, users assigned to an organization gain access to the CrossClassify portal. Here, they can log in to view end-user data and execute a range of tasks tailored to their specific roles and permissions. This login functionality and access control are efficiently managed by ZITADEL.

<figure>
  <img
    src="/blog/2024-01-25-success-story-crossclassify-04.png" 
    width="100%"
    alt="User Activity of End-User in the CrossClassify Portal"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

  Figure 3: User Activity of End-User in the CrossClassify Portal 


  </figcaption>
</figure>

<figure>
  <img
    src="/blog/2024-01-25-success-story-crossclassify-05.png" 
    width="100%"
    alt="Reviewing User Registrations in the CrossClassify Portal "
    style={{ margin: '0 auto' }}
  />
  <figcaption>

  Figure 4: Reviewing User Registrations in the CrossClassify Portal 

  </figcaption>
</figure>

<figure>
  <img
    src="/blog/2024-01-25-success-story-crossclassify-06.png" 
    width="100%"
    alt="Summary Statistics in the CrossClassify Portal"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

  Figure 5: Summary Statistics in the CrossClassify Portal 

  </figcaption>
</figure>


## User Experience and Challenges in Implementing ZITADEL

CrossClassify's experience with implementing ZITADEL has been largely positive. They found ZITADEL's documentation to be very helpful and sufficiently detailed, which facilitated a smoother integration process. On occasions where additional assistance was required, the technical support provided by ZITADEL proved to be highly responsive and effective, addressing their queries directly and efficiently.

One particular aspect CrossClassify wished for improvement was the customization of sign-up and login pages in ZITADEL's SaaS option. They found that more flexibility in this area would enhance their user experience and better align with their branding needs. Recognizing this need, ZITADEL plans to introduce functionality for full customization of the sign-up and register pages within this year, aiming to provide users with more control and alignment with their unique branding and user experience requirements.

Despite this challenge, what CrossClassify appreciates the most about ZITADEL is its cloud-native and modern design. 


## Future Plans

Currently, CrossClassify primarily utilizes the cloud-based SaaS hosting of ZITADEL. However, they have a strategic plan to expand their hosting options by deploying a self-hosted version of ZITADEL, specifically tailored for certain clients in the future. This move is aimed at providing more customized and controlled hosting solutions to meet the diverse needs of their clientele.

Regarding their service reach, CrossClassify is predominantly active in Australia and Europe at present. Nonetheless, they are not restricting their services geographically and are open to expanding their service offerings to other regions, aligning with their growth strategy and client demand.


## Testimonials

<img
  src="/blog/2024-01-25-success-story-crossclassify-07.jpg"
  width="250px"
  alt="Portrait of Amir Moghimi"
/>

“We needed an SSO solution that can be deployed independenty of the cloud provider and self-hosted if required by our clients. ZITADEL is a great choice because it is designed to be deployed as containers, which makes it straightforward to run on any platform and provides commercial SLA with technical support for self-hosting.”

-[Amir Moghimi](https://www.linkedin.com/in/amir-moghimi-10b4b624/), Co-Founder and CEO, [CrossClassify](https://www.crossclassify.com/)



Discover how CrossClassify leverages ZITADEL to offer B2B customers advanced fraud prevention and streamlined identity management, enhancing security in their digital ecosystems.

Built with ZITADEL: CrossClassify's Fraud Prevention Solution


<img
    src="/blog/2023-12-21-success-story-open-systems-01.png"
    width="100%"
    alt="Banner Image"
    style={{ margin: '0 auto' }}
  />

## Key Outcomes

- [Open Systems](https://www.open-systems.com/) has adopted self-hosted [ZITADEL](https://zitadel.com/) to modernize their identity and access management. This adoption provides a robust authentication framework for their customer portal, serving a large customer base with diverse global networks and is pivotal in managing secure access to their backend systems for both admin users and potentially end users in the future.

- The decision to switch to ZITADEL was driven by its seamless integration with various third-party identity providers, cloud-native design, self-hosting capability, and adaptability in accommodating new features and custom requirements. This strategic choice allows Open Systems to stay ahead with a modern authentication stack, offering significant improvements over the previous legacy RADIUS-based system and well-known solutions like Auth0 and Microsoft AD (now Entra ID).

- This shift to a more advanced, off-the-shelf solution aligns them with current identity management trends. It drastically cuts down development time, with **the setup now accomplished in just 15 minutes per customer, as opposed to the previous duration of 24 hours**. Furthermore, it enhances system compatibility across diverse Identity Providers (IdPs) and streamlines risk management effectively.

## Introduction

[Open Systems](https://www.open-systems.com/) is a leader in networking and cybersecurity, primarily focusing on the Secure Access Service Edge (SASE) domain. With a customer base of around 200, primarily large-scale organizations with global networks, Open Systems focuses on providing robust security and network solutions. The key aspect of their service includes a customer portal for service management, emphasizing the importance of authentication and identity management. This portal serves several thousand users, necessitating a strong authentication solution. Open Systems has effectively addressed their authentication requirements by choosing ZITADEL, a decision influenced by its capabilities and advantages over notable solutions like Auth0 and Microsoft AD (currently referred to as Entra ID). 

We had an insightful discussion with [Simon Stäheli](https://www.linkedin.com/in/simon-stäheli-179a6a78/), product owner and manager for the authentication platform team at Open Systems, about how they leverage ZITADEL for their authentication needs.  

## Open Systems Managed Secure Access Service Edge (SASE)

The Open Systems Managed SASE solution addresses the critical challenges that businesses face today, especially in enabling secure and efficient access for a globally distributed workforce and leveraging cloud capabilities for business empowerment, all while minimizing costs and risks.

Features of Open Systems Managed SASE:

- **Comprehensive Framework**: The Managed SASE solution unifies essential components like Software-Defined Wide-Area Network (SD-WAN), Firewall, Secure Web Gateway(SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access(ZTNA) into a single framework. This integration facilitates secure connectivity across cloud and hybrid environments, simplifying network and security management.
- **Unified Data Platform**: A centralized data platform underpins Open Systems Managed SASE. This unified approach allows for consistent policy enforcement across global networks. Enhanced with predictive analytics, this platform proactively identifies potential issues.
- **Customer Portal**: The solution is delivered as a 24×7 managed service, offering an easy-to-use customer portal for visibility and control. This service model includes onboarding, unlimited support, and lifecycle management.

The Open Systems Managed SASE stands out for its ability to facilitate seamless work from anywhere, integrating a cloud-delivered network and security architecture that efficiently allocates resources, and eliminates the need for traditional network components and VPNs. It incorporates Zero Trust principles for secure access to cloud resources.

## Customer Focus and Differentiation at Open Systems

Open Systems mainly caters to large-scale organizations with an extensive global presence, often including companies with over 20 branches and exceeding 1,000 employees. This client base typically comprises sectors like insurance, banking, and major international organizations. The company's specialty lies in building and managing global networks, efficiently interconnecting numerous sites—some clients have over 300 locations.

A key distinction of Open Systems is their customer portal, which goes beyond typical service offerings. The portal provides direct access to engineers for issue resolution or consultancy, enabling immediate and expert-level interaction. This approach contrasts with the common industry practice of multi-level support structures, where initial responses often come from first-level support. The customer experience at Open Systems is also defined by a longstanding commitment to self-provisioning. While this approach is becoming more common in the industry, Open Systems has been integrating it into their services for quite some time.

Their service offerings combine traditional and modern solutions. This hybrid approach allows clients to choose between physical appliances ('old-world' solutions) and cloud-native services ('new-world' solutions) depending on their specific location needs. Such flexibility in service offerings is relatively rare among their competitors, who typically specialize in either traditional or cloud-based solutions.

Integrating Open Systems' services into a client's network includes integrating critical network infrastructure components like WANs, firewalls, web proxies, and email security, creating network schemas, defining policies, and configuring and implementing these policies.

## The Customer Portal 

The [Customer Portal](https://www.open-systems.com/sase/customer-portal/) of the Managed SASE offering is a tool designed for managing the SASE services.

<figure>
  <img
    src="/blog/2023-12-21-success-story-open-systems-02.png" 
    width="100%"
    alt="Customer Portal"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 1 - The Open Systems Customer Portal

  </figcaption>
</figure>


### Key Features and Functions

- **Real-Time Insights and Analytics**: The portal provides a comprehensive overview of network and security postures, offering real-time reports, tools, and trend analysis. 
- **Collaboration and Transparency**: It acts as a collaborative platform, sharing technical data between clients and Open Systems engineers. Users can view service statuses, analyze network performance, and observe current threats, mirroring the visibility available to engineers. The integrated ticketing system offers detailed configuration views and operational metrics.
- **Audit and Compliance**: An embedded audit trail in the portal ensures that every change is documented, enhancing transparency and compliance.
- **Network Health Monitoring**: The portal facilitates detailed mapping of network connections and health, enabling users to prioritize and address critical issues promptly.

## The Problem

Open Systems faced substantial challenges in identity and access management, primarily stemming from the need to modernize their authentication systems, thereby reducing technical debt, and effectively serving a diverse customer base. With over 30 years in the industry and a business model more than two decades old, the company had historically relied on legacy systems, including a self-developed authentication solution based on [RADIUS](https://en.wikipedia.org/wiki/RADIUS). 

The primary issue was the lack of an identity management solution that could seamlessly interface with the identity providers (IdPs) used by their 200 customers. Given that the majority of these customers used Entra ID for account management, with others utilizing platforms like Auth0 or Okta, it was important for Open Systems to adopt a system compatible with these varied third-party IdPs. This need for compatibility and seamless integration was pivotal in their search for a new solution.

Open Systems required a solution that offered the flexibility of self-hosting while ensuring robust support and ongoing development. This requirement ruled out solely cloud-based solutions and self-hosted, open-source options that lacked substantial backing and support.

## The Solution

ZITADEL emerged as the chosen solution for Open Systems after they evaluated various options, including well-known services like Auth0 and Keycloak. The decision leaned towards ZITADEL due to its alignment with Open Systems' specific technical and operational requirements, and the limitations encountered with other cloud services. Interestingly, their discovery of ZITADEL through social media interactions presented a solution that closely matched their specific needs.

The primary factors that made ZITADEL an appealing choice for Open Systems are:

- **Cloud-Native Design**: ZITADEL's architecture is inherently cloud-native, built to operate efficiently in Kubernetes environments. This modern approach to product design was crucial, especially compared to competitors whose products were not developed with a cloud-native focus.

- **Integration with Third-Party IdPs**: A crucial requirement for Open Systems was the ability to integrate seamlessly with various third-party identity providers (IdPs) used by their clients. ZITADEL's provision of IdP templates for easy identity brokering or federation with these third-party IdPs was a key feature that met Open Systems’ needs.

- **Self-Hosting with Support**: Open Systems valued the ability to self-host the identity management solution while still receiving robust support. ZITADEL offered this balance, providing a self-hosted solution with a solid support model—a combination that was lacking in purely cloud-based solutions or open-source products without substantial backing.

- **Rapid Development Cycle**: ZITADEL's development life cycle stood out, with frequent releases (every two weeks) allowing for quick bug fixes and feature updates. This agility was a significant improvement over previous experiences where updates and new feature implementations were much slower.

## Solution Architecture and Deployment 

The primary application of ZITADEL within Open Systems is centered around their customer portal, where it serves to authenticate users accessing the SASE services. The portal application is designed with a frontend built in Typescript and a backend developed using Java. Currently, the utilization of ZITADEL is predominantly by the administrators or IT teams of Open Systems' clients. For these users, the interaction with ZITADEL occurs during essential processes such as logging in or resetting passwords within the customer portal. Internally, ZITADEL functions as the Identity Provider (IdP) for Open Systems, employing the best practices of the OpenID Connect (OIDC) standard for authentication. The system currently utilizes opaque tokens for security purposes, but they are considering a transition to JSON Web Tokens (JWT) soon. 

In terms of configuration within ZITADEL, Open Systems makes use of a single instance that includes all their customers. These customers, amounting to about 200, are each represented as separate organizations within ZITADEL, with the number of IT administrators per organization ranging from 3 to 1000. The system uses ZITADEL's [custom claims and action features](https://zitadel.com/blog/custom-claims) to import data from third-party IdPs, including essential information like contact details, job titles, and roles. This data is then efficiently distributed to other products, ensuring streamlined and consistent information management across the board.

To access the customer portal via third-party logins, Open Systems has configured and managed the[ IdP federation between their clients' identity providers and ZITADEL](https://zitadel.com/docs/guides/integrate/identity-providers). A majority of their clients, around 80%, use Microsoft's Entra ID for internal account management. 

<figure>
  <img
    src="/blog/2023-12-21-success-story-open-systems-03.png" 
    width="100%"
    alt="Architecture Diagram"
    style={{ margin: '0 auto' }}
  />
  <figcaption>

    Figure 2 -User Identity and Access Management with ZITADEL

  </figcaption>
</figure>


Open Systems' decision to self-host, rather than use a cloud service provider, is driven by a combination of compliance requirements and the need for operational control. For example, working with clients in the finance sector imposes specific contractual obligations that necessitate a higher degree of control over how and where data is processed and stored. 

When a company like Open Systems considers using a cloud or Software as a Service (SaaS) provider, this external provider becomes a subprocessor. They would be processing data on behalf of Open Systems (who is the primary data processor). Adding a new subprocessor in such a regulated environment is not a simple task—it often involves a thorough vetting process to ensure compliance with various data protection laws and industry-specific regulations. This process can be time-consuming, often taking several months, due to the need for careful review, risk assessments, and possibly contract negotiations to ensure all compliance requirements are met.

Therefore, by opting to self-host, Open Systems avoids the complexities and delays associated with adding a new subprocessor. Self-hosting ZITADEL gave them the flexibility to fulfill that requirement, and they decided to integrate it into their existing Kubernetes cluster. 

The core of their deployment is a mid-sized Kubernetes cluster, which includes various backend systems of the SASE, the customer portal, and observability tools. They make use of the [ZITADEL Terraform provider](https://zitadel.com/docs/guides/manage/terraform/basics) to manage ZITADEL resources, which allows them to efficiently automate and manage ZITADEL configurations, ensuring streamlined deployment and consistency across their cloud environments. 


## Product Experience, Challenges, and Support

### Efficiency in Authentication 

Simon highlighted that the switch to ZITADEL has greatly simplified their process of configuring and deploying authentication mechanisms for each customer. This improvement is significant compared to their previous system, which relied on managing local accounts and using older protocols like RADIUS and LDAP. With ZITADEL, the process of setting up and integrating authentication services for a new customer – including configuring identity providers, user access, and security policies – is now notably quicker, typically completed in about 15 minutes. Previously, this setup process could take up to 24 hours, which required deploying a host into the customer's network followed by the configuration of RADIUS and LDAP. This showcases the efficiency benefits of a modern IdP system.

### Challenges 

Open Systems encountered several challenges, primarily when migrating to ZITADEL. Simon highlighted that the most significant hurdle was updating the existing username patterns and naming conventions to conform to ZITADEL’s system. Given the diversity and complexity of their user base, this task was far from trivial. Open Systems had to account for numerous unique cases and intricacies inherent in their legacy system, making the transition to ZITADEL somewhat challenging.

### Flexible Feature Roadmap

Despite this challenge, ZITADEL's flexibility, particularly in introducing features to its frequent release cycle, was key in managing Open Systems' transition effectively. He noted that while about 90% of their required features were already in ZITADEL, for the remaining 10% that needed customization, Open Systems worked closely with the ZITADEL team. This collaboration facilitated the timely introduction of new features into ZITADEL’s existing release cycle, effectively meeting Open Systems' specific needs.

### Consultancy and Support

According to Simon, a key aspect of the implementation process was the consultancy and support provided by ZITADEL, including the valuable assistance of a dedicated Technical Account Manager (TAM). This professional guidance went beyond just the technical features of the product; it also covered broader aspects of the transition process. The involvement of the TAM was particularly beneficial in aligning Open Systems' future goals with ZITADEL's capabilities, offering insights into potential opportunities and solutions. 

## Future Plans

Open Systems is still in the process of migrating to ZITADEL, with their immediate focus on tracking the transition of users from their old authentication platform to ZITADEL. Looking ahead, they are contemplating broader applications of ZITADEL within their operations. 

One of the key plans under consideration is the extension of ZITADEL’s capabilities to authenticate end users, especially for client VPN and Zero Trust network services. Currently, ZITADEL's use is predominantly by the IT administrators of their clients, but extending its application to end users would mark a considerable enhancement in their service offerings.

## Testimonials

<img
  src="/blog/2023-12-21-success-story-open-systems-04.jpg"
  width="250px"
  alt="Portrait of Simon Stäheli"
/>

"Choosing ZITADEL was a key decision for us at Open Systems, particularly for its straightforward integration with various third-party identity providers used by our client base. ZITADEL's cloud-native approach and rapid development cycle aligned perfectly with our needs. This, coupled with the ability to self-host and receive excellent support, made ZITADEL stand out as the best choice for our modern authentication requirements." 

-[Simon Stäheli](https://www.linkedin.com/in/simon-stäheli-179a6a78/), Product Owner/Manager, [Open Systems](https://www.open-systems.com/)

Discover how Open Systems' shift to ZITADEL has enhanced security and efficiency for their global network management.

Built with ZITADEL: Open Systems' IAM Strategy for Global Networks


<img
    src="/blog/2023-11-20-success-story-enseva-01.jpg"
    width="100%"
    alt="Enseva Image"
    style={{ margin: '0 auto' }}
  />

## Key Outcomes

**Centralized Identity Management**: [Enseva](https://www.enseva.com/), achieved a unified authentication process across various services and cloud infrastructures by integrating ZITADEL as their primary Identity Provider (IdP).
  
**Streamlined User Authentication**: [ZITADEL](https://zitadel.com/) simplified the login process for Enseva’s clients with Single Sign-On, enhancing the overall user experience and reducing complexity in accessing multiple applications.

**Cost-Effective Solution**: ZITADEL Cloud provided a cost-effective alternative to other identity management solutions, aligning with Enseva's goal of maintaining cost efficiency without compromising on features.


## About Enseva

[Enseva](https://www.enseva.com/), headquartered in Iowa, United States, is a specialized data center and cloud solutions and service provider with a global reach, extending services to customers with locations in countries like Germany and the UK as well. 

Enseva primarily offers a comprehensive suite of services tailored to meet the diverse requirements of its customers. In our conversation with [Greg Smith](https://www.linkedin.com/in/greg-smith-90289425/) from Enseva, we gained deeper insights into the company's operations and offerings. The core of Enseva's operations revolves around its [Tier 4+](https://www.techtarget.com/searchdatacenter/definition/Uptime-data-center-tier-standards) data center, which is equipped with advanced colocation and private cloud technologies. Their services are designed to be highly reliable and secure, featuring locked cabinets, private micro-suites, and dependable network connectivity, all backed by on-site technical support.

The company's core product offerings include:

- **SIEM Solutions**: Enseva provides Security Information and Event Management(SIEM) solutions, crucial for modern cybersecurity and network health monitoring.
- **Monitoring Tools**: Their suite includes various tools for monitoring networks and systems.
- **Cloud Services**: Enseva's cloud infrastructure is a significant part of their offerings, providing scalable and flexible resources to clients.
- Physical Storage Solutions
- Internet and Network Services
- **Virtual Hands Services**: These services include remote assistance for various IT tasks, including deploying and managing cloud-based solutions on clustered servers for redundancy.

Greg’s role involves performing a diverse array of critical tasks centered around problem-solving and customer support. He is a Data Center Administrator assisting customers with their challenges, and testing new products that enhance Enseva's ability to automate tasks. Enseva also leverages open-source software, including ZITADEL, and innovative automation strategies to efficiently manage and scale their operations, ensuring top-tier service quality and reliability for their diverse clientele.

### Enseva’s Customers

Enseva's customers span a diverse range of industries, each with unique requirements and applications for Enseva's services. Here's an overview of their user base and how these users utilize Enseva's products and services:

- **OEM Product Manufacturers**: Original Equipment Manufacturers (OEMs) likely use Enseva for reliable data storage, cloud services, and network solutions to support their manufacturing processes and data management needs.
- **Civil Services**: This includes hospitals, police departments, and construction companies. These entities require robust and secure data management and storage solutions. For instance, hospitals need to securely store sensitive patient data, while police departments require reliable data centers for their operational data and records.
- **Apartment Complexes**: Enseva provides internet services to apartment complexes, ensuring residents have access to reliable and high-speed internet connectivity.

### The User Journey
- Customers start by setting up their domain, which is the foundational step in creating their network and IT infrastructure.
- Enseva provides the necessary server infrastructure, including AD/DNS servers. These servers are redundant, ensuring high availability and reliability.
- Depending on the specific needs of the customer, Enseva tailors its services. For example, a hospital may require additional security measures for patient data.
- All virtual machines and physical servers provided by Enseva are continuously monitored. This monitoring ensures optimal performance and quick response to any issues that may arise.
- Optionally, Enseva will provide ongoing technical support and maintenance services.


## Problem

Enseva faced significant challenges in the area of identity and access management and they were:

**Centralized Operations**: In their day-to-day operations, Enseva's team frequently supports customers by accessing various applications to troubleshoot issues or monitor environments. This task often involves managing multiple logins across different customer systems, which can be quite time-consuming. To streamline these processes, Enseva was in pursuit of a centralized system, what they termed as Combat Information Centers (CIC), aiming to efficiently handle their identity and access management needs.

**Complexity in Authentication**: Managing a multitude of logins for various environments, especially with customers having large numbers of virtual machines and production toolsets, became a cumbersome task. The challenge was amplified by different password policies across environments, leading to a significant administrative burden. To paint a picture of the problem with numbers, consider a single customer. Enseva has to manage access to around 150 different virtual machines. Each virtual machine potentially requires a unique set of login credentials. In addition to the virtual machines, there are around 12 different production tools, such as web servers and file servers, each again potentially requiring separate authentication. Moreover, each virtual machine and toolset was likely part of different environments (e.g., development, testing, production). This complexity meant that Enseva's team had to manage a multitude of login credentials across these environments. With policies such as mandatory password changes every 30 to 60 days, the administrative burden of keeping track of credentials and ensuring they are updated regularly added to the complexity.

**Cost-Effectiveness**: Enseva required a solution that was not only effective but also cost-efficient. They needed to avoid solutions with multiple license requirements, which can be costly.

## Solution

Enseva’s search for a new identity and access management solution led them to ZITADEL, which effectively addressed their challenges:

- ZITADEL served as the central point of operations that Enseva required. Its user-friendly interface and straightforward functionality made it an ideal choice.
- With ZITADEL, Enseva could manage user access more efficiently. The burden of handling numerous passwords and usernames across different environments was significantly reduced. ZITADEL streamlined the Single Sign-On (SSO) process and made user management more manageable, directly addressing the pain points related to multiple logins and varying authentication requirements. SSO significantly streamlines the authentication process, allowing users to access multiple applications with a single set of credentials. This not only enhances operational efficiency by reducing the time spent on logging in but also improves security. By minimizing password fatigue and simplifying the enforcement of security policies, SSO ensures a more secure and manageable system. Additionally, it offers a better user experience and scales effectively with Enseva's expanding service offerings and client base, making it a vital component in their operational infrastructure.
- ZITADEL Cloud offered a cost-effective solution with a pricing structure that suited Enseva’s budgetary constraints, avoiding the high costs associated with multiple licenses. Furthermore, it provided the reliability and ongoing support that Enseva was seeking.

Enseva discovered ZITADEL through professional forums and chose it over other vendors like Azure AD, Clerks, Ory, Okta, OneLogin, and Auth0 due to its functionality, ease of use, and cost-effectiveness. Opting for ZITADEL's cloud solution, Enseva was able to integrate a robust and efficient identity management system without the need for additional in-house maintenance.


## Technology Architecture, Deployment, and Future Plans

<figure>
  <img
    src="/blog/2023-11-20-success-story-enseva-02.png" 
    width="75%"
    alt="Architecture Diagram"
    style={{ margin: '0 auto' }}
  />
  <figcaption>
    Figure 1 - Integrating ZITADEL Cloud into Enseva’s Infrastructure for Optimized Identity Management and SSO Implementation
  </figcaption>
</figure>

Enseva's technology stack includes a cloud infrastructure based on server clusters and virtual machines in their physical data center storage, featuring rack units and private suites for additional computing power. Monitoring and analytics are integral, with a central logging server and tools for trace analytics and metrics monitoring. ZITADEL Cloud, residing separately, integrates as an external identity and access management solution, providing centralized user authentication and Single Sign-On (SSO) capabilities across Enseva's diverse infrastructure.

Enseva chose to use ZITADEL Cloud for their identity management needs. Managing numerous projects internally, they found value in delegating the responsibility of identity and access management to an external, specialized service. This approach allows them to focus more on their core competencies while ensuring that their identity management system is handled by experts.

They are actively configuring SAML (Security Assertion Markup Language) and OpenID Connect protocols with all their applications. This phase involves rigorous testing to ensure that the integration of ZITADEL with their systems is seamless and meets their security and operational requirements. The use of SAML and OpenID protocols suggests a focus on secure, standardized methods for exchanging authentication and authorization data.

### Implementation Experience

Enseva's use of ZITADEL Cloud is a strategic decision aimed at enhancing their identity and access management capability without overburdening their internal team. The experience of implementing ZITADEL Cloud with Enseva's applications has been positive, primarily due to the clarity and comprehensiveness of ZITADEL's documentation. Enseva found the documentation easy to follow, which facilitated a smoother integration process. 


## Testimonials

<img
  src="/blog/2023-11-20-success-story-enseva-03.png"
  width="250px"
  alt="Portrait of Greg Smith"
/>

“ZITADEL is a great platform for many applications. I have been at Enseva for the past 11 years and had an opportunity to work on different IDP software, and ZITADEL is on the rise. It's simple and easy to use, and I see ZITADEL becoming a top member in this IDP group. Not only for SSO but it has been a game changer for controlling user access to different organizations that we maintain. ZITADEL Cloud is a great feature for those who have
enough to maintain on a daily basis.”

- [Greg Smith](https://www.linkedin.com/in/greg-smith-90289425/) , Data Center Administrator, [Enseva](https://www.enseva.com/)


Explore how Enseva revolutionized their identity management and streamlined operations by using ZITADEL.

Built with ZITADEL: Enhancing Enseva's Operations with Single Sign-On


<img
    src="/blog/2023-10-24-success-story-23-technologies-03.jpg"
    width="100%"
    alt="23 Technologies Image"
    style={{ margin: '0 auto' }}
  />

## Key Outcomes

- **Centralized Authentication Solution**: [23 Technologies](https://23technologies.cloud/en) successfully partnered with ZITADEL to centralize their fragmented authentication mechanisms across multiple services. By using ZITADEL as their primary Identity Provider (IdP), they achieved a cohesive user management system, eliminating complexities from multiple infrastructures.

- **Efficient Organizational Management**: With ZITADEL's robust organizational and instance structures, 23 Technologies can now effectively manage their organizational hierarchy through a single ZITADEL instance. This enhancement offers partners and customers seamless onboarding, streamlined role allocation, and the ability to deploy services efficiently.

- **Streamlined Deployment on Kubernetes**: ZITADEL's use of Helm charts greatly benefited 23 Technologies, simplifying their deployment process. As a result, 23 Technologies could seamlessly run ZITADEL on their Kubernetes clusters, further integrating their Managed Kubernetes offering.


## Introduction 

We spoke to Christian Berendt, CEO of [23 Technologies](https://23technologies.cloud/en), a company that offers a service for Managed Kubernetes and was founded in late 2020. 

They initially adopted [Gardener](https://gardener.cloud/), an open-source Managed [Kubernetes](https://kubernetes.io/)-as-a-Service solution developed by [SAP](https://www.sap.com/) in Germany. However, Christian noted challenges with Gardener, especially in its deployment framework. To address this, 23 Technologies developed their own solution based on the open-source project. The outcome is an enterprise-grade Kubernetes engine called 23KE for industrial use and for the use of Cloud Service Providers (CSPs) and Managed Service Providers (MSPs). It prioritizes scalability, reliability, and the self-repair of Kubernetes clusters without unnecessary bloatware. 

Christian clarified their position in the market: they don’t sell only infrastructure. Instead, they act as a middleware layer for both managed and cloud services targeting independent software vendors, large enterprises, and the Industrial Internet of Things (IIoT) world. Their Kubernetes engine caters to industrial applications and other Cloud Service Providers (CSPs) and Managed Service Providers (MSPs) (such as platform services like [Prometheus](https://prometheus.io/) and [Grafana](https://grafana.com/), and industrial services like [CODESYS](https://www.codesys.com/) and [OpenPLC](https://autonomylogic.com/)), with a focus on scalability, reliability, and self-healing of Kubernetes clusters. Their primary offering is Kubernetes Clusters as a Service.

Christian discusses the shift in Europe from major cloud providers (often referred to as "scalers") to regional cloud infrastructures. European customers are increasingly interested in using regional cloud services, like [OVHcloud](https://www.ovhcloud.com/en/), [IONOS](https://www.ionos.com/), and [Deutsche Telekom](https://www.telekom.com/en). However, many of these regional cloud services in Europe are smaller and often lack the same reach as the major scalers. For instance, a European cloud provider might not have resources in Asia, which could be a problem if one wants to deploy services worldwide.

23 Technologies addresses these challenges by providing a middleware layer for cloud services. Instead of relying on the infrastructure provided by regional providers, they establish a Managed Kubernetes layer. This allows them to deploy Kubernetes on any cloud infrastructure, be it [AWS](https://aws.amazon.com/), [Azure](https://azure.microsoft.com/), OVHcloud, IONOS, and so on. Their solution offers customers the flexibility of choosing from various cloud infrastructures via the service. 

### The User Journey

- **For Partners**: Upon registration, service providers undergo an onboarding process and are categorized based on partnership tiers. Once integrated, they possess the capabilities to manage their client base, allocate roles, and roll out services on their behalf.
- **For Users**: Users can sign in to a dashboard, enabling them to tap into the services they're permitted to use, navigate links to their respective services, or put forth requests for new ones.

### 23 Technologies' Value Proposition

- 23 Technologies simplifies the cloud infrastructure, requiring customers to have just one contract with 23 Technologies to access any cloud infrastructure.
- Through their service, businesses can deploy services globally without being limited to a specific cloud provider.
- Their service is tailored to regional requirements. For example, if a service needs to be run in Sri Lanka, 23 Technologies can set up a Kubernetes cluster in that region and deploy the requested service.

## Problem and Solution

### The Problem: Fragmented Authentication

23 Technologies operates as a middleware layer between a variety of cloud infrastructures and their clients. As they integrated multiple external services, such as cloud solutions, IIoT platforms, and software services, a significant challenge arose: each of these services had its own separate authentication mechanism. This resulted in:

- **Complicated Onboarding/Offboarding**: Each service's unique authentication required distinct setup and teardown procedures.
- **Disjointed User Experience**: Users had to juggle multiple identity management platforms, causing confusion and inefficiencies.
- **Security Concerns**: Managing multiple authentication systems can lead to vulnerabilities if not maintained with precision.

In essence, there was a clear need for a centralized identity provider that could simplify the identity management process for all integrated services.

### The Solution: A Centralized, User-Friendly and Cloud Native Identity Platform

To address the fragmented authentication issue, 23 Technologies was looking for a solution that:

1. **Centralizes Authentication**: A singular system where all integrated services trust one primary IdP for authenticating users.
2. **Enhances User Experience**: A unified system reduces the confusion of multiple logins and creates a smoother user experience.
3. **Boosts Security**: One integrated solution is easier to monitor, update, and secure.

After evaluating several platforms, including [Keycloak](https://www.keycloak.org/), [Authentik](https://goauthentik.io/), and [ZITADEL](https://zitadel.com/), they ultimately chose ZITADEL.

With ZITADEL, 23 Technologies introduced a centralized ID service for their service. This service aims to provide a European-centric authentication system comparable to the widespread logins offered by platforms like Google, Github, Facebook, or Instagram, tailored specifically for B2B and IIoT needs.
Key features from ZITADEL that 23 Technologies utilizes include the:

- **Distinct Hierarchical Architecture for User Management** -  [Instance and Organization Structures](https://zitadel.com/docs/guides/manage/console/organizations) in ZITADEL allow them to efficiently manage their organizational hierarchy with a singular ZITADEL instance. 

- **User-friendly Self-Service**: ZITADEL offers an intuitive self-service option, allowing users and organizations to manage their profiles, preferences, and security settings without requiring administrative intervention. This directly streamlines user management.
  
- **Efficient OIDC Workflows**: OpenID Connect (OIDC) is a modern authentication protocol that allows centralized authentication. ZITADEL's efficient handling of OIDC aids in providing cohesive identity and access management, linking all services under a unified system.


The decision to integrate ZITADEL was also influenced by the following factors:
  
- **No Feature Bloat**: While many platforms offer an array of features, not all are essential for every organization. ZITADEL's focus on providing just the necessary features (without unnecessary add-ons) ensures that the system remains efficient and user-friendly.

- **Responsiveness of Support**: Effective support is paramount, especially when integrating crucial systems like authentication. The ZITADEL team's responsiveness ensured that any challenges faced during integration were swiftly addressed.


## Technology Architecture and Deployment

<figure>
  <img
    src="/blog/2023-10-24-success-story-23-technologies-01.png"
    width="75%"
    alt="23 Technologies Diagram 1"
    style={{ margin: '0 auto' }}
  />
  <figcaption>
    Figure 1 - ZITADEL Integration: Centralizing Authentication in a Multi-Service Cloud Environment
  </figcaption>
</figure>


**Base Layer**:
The foundational infrastructure is primarily built on cloud technology, with OpenStack being the principal component.

**Kubernetes Management**:
23 Technologies utilizes Gardener for Kubernetes management. Additionally, they have developed their own tool named [23 KE](https://23ke.cloud/) to facilitate the deployment and oversight of Kubernetes across multiple cloud providers.

**User Management and Authentication**:
ZITADEL provides 23 Technologies with a centralized system for user management, ensuring organized and efficient handling of user data. It offers authentication mechanisms, such as multi-factor authentication and single sign-on, ensuring users securely access the system. Beyond authentication, ZITADEL aids in authorization, defining user roles, granting permissions, and maintaining access controls. Various services work harmoniously with ZITADEL's authentication and authorization protocols, maintaining consistent and secure user credentials and permissions across the platform.

**Deployment Preferences**:
Instead of using ZITADEL Cloud, 23 Technologies has chosen to host ZITADEL as an independent service. With an emphasis on security and reliability, they store user identities on a trusted cloud provider based in Germany. Aligning with their inclination towards open-source solutions, they have deployed the open-source variant of ZITADEL, utilizing [Helm charts provided by ZITADEL](https://zitadel.com/docs/self-hosting/deploy/kubernetes) and leveraging a Cockroach database for backend operations.

## Learning Curve and Product Support

While the solution has largely been efficient, Christian's team did face some challenges initially, particularly concerning version upgrades and the integration of the database layer for which they used CockroachDB. However, these issues were subsequently addressed, and the overall experience with ZITADEL has been straightforward. Christian praised the ZITADEL team for their responsiveness, both at the management level and in technical support.

## Future Plans

### In General

The service platform, currently geared towards German-speaking regions, offers deployment for various platform services like [Harbor](https://www.harbornetworks.com/harbor-cloud), [Grafana](https://grafana.com/), and [Prometheus](https://prometheus.io/). They intend for other CSPs and MSPs to be able to integrate their solutions into the 23 Technologies solution.

Future provisions will allow customers to operate their Kubernetes cluster, integrate it with the 23 Technologies service, and deploy services on top of their clusters, adhering to a "bring-your-own-device" philosophy.

While their initial focus is on Germany, they have plans to expand to the DACH region (Germany, Austria, Switzerland), then to the rest of Europe, and eventually to a global audience. They are open to serving any region based on demand.

### Integrating ZITADEL within the Gaia-X Narrative

23 Technologies aims to integrate ZITADEL as a centralized authentication service, especially in the context of the [Gaia-X initiative](https://gaia-x.eu/) in Europe. Their vision is for users to have a unified ID, similar to a Github login, to access multiple online platforms, thereby removing the hassle of creating multiple accounts and repeated registrations.
Gaia-X is a European strategy to boost investment in the regional cloud market. Its primary objective is to set up a standardized data ecosystem that promotes smooth data exchanges between entities, such as car manufacturers and their vehicles. One key aspect of Gaia-X is the federation service, which prioritizes self-sovereign identities. The ultimate aim is to build trust in digital identities, ensuring genuine online verification of a company or its personnel.
While the details are still being refined, 23 Technologies has plans to weave ZITADEL into the Gaia-X story. Being associated with Gaia-X and other European projects like [Catena-X](https://catena-x.net/en/) and [Manufacturing-X](https://www.plattform-i40.de/IP/Navigation/EN/Manufacturing-X/Manufacturing-X.html) offers them a chance to better access European opportunities.

## Testimonials

<img
  src="/blog/2023-10-24-success-story-23-technologies-02.jpeg"
  width="250px"
  alt="Portrait of Christian Berendt"
/>

“What I appreciate most about ZITADEL is the responsiveness and supportiveness of the ZITADEL team. Beyond the product itself, the team and community around it play a crucial role in our satisfaction. We value the open communication lines, especially through platforms like Discord.”

-[Christian Berendt](https://www.linkedin.com/in/christian-berendt-364a01203/), CEO, [23 Technologies GmbH](https://23technologies.cloud/en)


Dive into 23 Technologies' journey of creating a unified user experience in their cloud services with ZITADEL.

Built with ZITADEL: 23 Technologies' Kubernetes-as-a-Service


## Key Outcomes

- [Orbica](https://www.orbica.com/), headquartered in Christchurch, New Zealand, is a company that specializes in the field of geospatial technology. They have recently launched a cloud platform, a geospatial powerhouse that simplifies the complexities of large-scale data analysis for its users and have chosen to use [ZITADEL Cloud](https://zitadel.com/) for managing the identity and access needs of their customers.
- With ZITADEL, Orbica has effectively improved both the user experience and security measures of its customers using the Orbica Geospatial Platform. Orbica estimates to have saved themselves at least 1-2 months of UX and development time, in addition to mitigating the risk of constructing and hosting their own solution incorrectly.
- ZITADEL's compliance with the General Data Protection Regulation (GDPR) primes Orbica for future success by ensuring it meets data protection requirements. Furthermore, Orbica aims to make ZITADEL's authentication system accessible to their customers, enabling them to manage their own user authentication within applications built on the Orbica Geospatial Platform.


## Introduction

Orbica began as a professional services firm, providing geospatial applications, data products, and workloads. Over time, they identified recurring patterns in these projects, which led them to the idea of developing a platform. The intention behind this platform was to enable others to integrate the capabilities of geospatial technology into their own workflows and apps, allowing them to construct more sophisticated applications.

The Orbica Geospatial Platform is a fully managed, cloud-native platform engineered to leverage geospatial data analysis and AI knowledge to unlock insights in data assets, enabling developers to create solutions for a variety of applications. Beyond the conventional geographical information system (GIS) tools, the platform is designed for all types of users - not just GIS experts - eliminating data silos and making geospatial knowledge accessible across an organization. Through the platform, users can easily interact with and manage their geospatial data via an intuitive user interface, setting various exploration goals, choosing from different visualization methods, and monitoring their data insights.

Orbica's clientele primarily consists of businesses in various sectors that require intricate geospatial analysis to drive decision-making and uncover latent trends and patterns within their data. With a range of use cases that include urban planning, disaster response, environmental monitoring, infrastructure management, agriculture, supply chain management, and water management, Orbica's Geospatial Platform caters to a broad spectrum of industries. This makes it a go-to tool for developers aiming to make a significant impact with geospatial AI.

We spoke with [Santosh Seshadri, Head of Platform at Orbica](https://www.linkedin.com/in/santosh-seshadri-9a6b4559) to delve deeper into the technical intricacies they faced and the driving factors behind their decision to embrace ZITADEL as their identity and access infrastrucure solution. 


## Problem and Solution

Orbica's journey in the Identity and Access Management (IAM) space was not a new one. They had tried several other providers, including Microsoft’s Azure Acitve Directory and Azure Active Directory B2C. They had also used Auth0 for some projects due to client requirements. However, when the need to choose an IAM solution for their platform arose, the options were narrowed down to ZITADEL, Auth0, AWS Cognito, and Azure Active Directory. Although AWS and Microsoft were closely tied to their vendors, Orbica was seeking greater flexibility.

Their discovery of ZITADEL was a result of their ongoing exploration of new, flexible, and modular tools in the tech space, consistent with their philosophy of avoiding monolithic systems. They had been testing different options and were impressed by what ZITADEL had to offer. After a thorough investigation and evaluation of ZITADEL's APIs by their development team, they decided to onboard with ZITADEL. This choice was driven by several pain points and unique requirements, which ZITADEL managed to resolve.

Firstly, the organizational and project-based hierarchy presented by ZITADEL resonated perfectly with Orbica's schema level because the Orbica Geospatial Platform was designed around a hierarchical structure of organizations, workspaces, and projects. ZITADEL's ability to provide fine-grained, role-based access control within the same hierarchical structure has been crucial to Orbica. They also appreciated the ability to have multiple instances and the flexibility and comprehensiveness of ZITADEL's metadata. 

From a commercial standpoint, the seat-based pricing model offered by most providers was a significant constraint for Orbica. In contrast, ZITADEL's pricing structure was more conducive to their needs. ZITADEL abandons the conventional per-user licensing model in favor of a consumption-based approach, making it highly suitable for organizations dealing with data and analytics. The model is based on requests rather than user count, reflecting Orbica's commitment to providing usage-based solutions. 


## The Platform’s User Journey

The Geospatical Platform's user journey begins with creating an organization for each new customer. Currently, this is done internally, but there are plans for future self-service. After sign-up, users receive an email from Orbica via ZITADEL to complete their account setup, after which they can access the platform.

Initially, the users are presented with an empty canvas. The first step involves creating a workspace defined according to the organization's needs. These workspaces can be divided as desired and further segmented into projects. Within these projects, users can set up data stores, databases with APIs, and map services. Any data with a geospatial aspect can be viewed on a map, and the platform performs this orchestration. Users can customize server resources to their liking, specifying things like database size or computing resources, and the platform provisions these resources accordingly. Users can opt for any database of their choice; however, Orbica provides spatial databases curated explicitly for advanced spatial analytics and functions as an additional service.

Next, users can add an analytics service, a Jupyter Lab implementation, which comes pre-packaged with geospatial and AI libraries and is automatically connected to the database. If the user has Python scripts or other workloads in their organization, they can bring them in too, and run them in the cloud, scaling resources as necessary. Users can tap into this feature to perform various functions immediately, right out of the box.

<figure>
  <img
    src="/blog/2023-08-22-success-story-orbica-01.png"
    width="100%"
    alt="Orbica Diagram 1"
  />
  <figcaption>
    Figure 1 - Adding an analytics service via a Jupyter Lab implementation with pre-packaged geospatial and AI libraries
  </figcaption>
</figure>

Finally, users can build their custom frontend app and host it on the platform. Currently, users can create multiple projects representing isolated environments, but in the future, they will be able to promote an existing project to a higher environment, e.g., a production environment, with different access policies to run their workloads seamlessly in their respective ecosystems.

<figure>
  <img
    src="/blog/2023-08-22-success-story-orbica-02.png"
    width="100%"
    alt="Orbica Diagram 2"
  />
  <figcaption>
    Figure 2 - An application utilizing Orbica integrating geospatial data with advanced AI capabilities
  </figcaption>
</figure>

<figure>
  <img
    src="/blog/2023-08-22-success-story-orbica-03.png"
    width="100%"
    alt="Orbica Diagram 3"
  />
  <figcaption>
    Figure 3 - Another interface powered by Orbica
  </figcaption>
</figure>


## Architecture and Deployment

Architecturally, the platform is a cloud-native solution modeled on a microservices architecture. Orbica has designed its core to be provider-agnostic; a Kubernetes layer is responsible for seamlessly orchestrating resources in AWS. Network communications between pods and clusters are maintained by a service mesh, forming a critical part of the system by handling the deployment of functions-as-a-service. These functions are directly connected to the service mesh, enabling on-demand resource deployment. A React-based user interface delivers an interactive experience to users. All the platform's operations are enabled through Orbica's SDKs. 

The platform incorporates ZITADEL Cloud, and ZITADEL's primary function within the platform is to provide robust authentication and authorization services. When onboarding a client, an organization is provisioned on the platform, which manages its workloads via workspaces and projects, where the microservices operate. A parallel organization is created on ZITADEL. Subsequent user registrations are also added to this ZITADEL organization, integrating each user into the authentication system right from the start. 

The authentication process uses OpenID Connect to validate the user's identity, using the information provided during the registration, ensuring only verified users gain access to the platform. Once users have been authenticated and are active within the platform, ZITADEL manages the authorization of these users and determines the permissions that each user has within the platform, which resources they can access, and what actions they can perform. 

As the Orbica Geospatial Platform is designed around a hierarchical structure of organizations, workspaces, and projects, [ZITADEL's ability to provide granular access control within the same hierarchical structure](https://zitadel.com/blog/multi-tenancy-with-organizations) is crucial. For instance, an administrator might be allowed to create, delete, or modify projects, while a data engineer might only have permission to view data and perform analysis. Orbica uses ZITADEL’s metadata feature to categorize their projects into workspaces – an intermediary level between organization and project – and to define respective roles within a user's metadata. They further leverage ZITADEL’s custom claims to organize this data, embedding it into JWT. This structured approach ensures they can accurately determine a user's access permissions for various workspaces.

The current hosting is in AWS's Sydney region, but they are actively developing a multi-region cluster for the platform, enabling deployment in other regions around the globe. This global vision is in alignment with Orbica's existing international footprint, with branches in Germany and Australia. 

<figure>
  <img
    src="/blog/2023-08-22-success-story-orbica-04.png"
    width="300%"
    alt="Orbica Diagram 4"
  />
  <figcaption>
    Figure 4 - How ZITADEL integrates with the Orbica Geospatial Platform
  </figcaption>
</figure>


## Learning Curve and Product Support

According to Santosh, the developer experience with ZITADEL has been highly positive. The system is user-friendly, making the integration process relatively smooth. However, there were challenges when certain key features needed for Orbica's operations were initially missing. For instance, the team sought a method to authenticate users through their own login UI and ZITADEL APIs instead of using the ZITADEL UI to log in and acquire a token. Implementing their own login UI would offer a smoother user experience and grant Orbica greater control over authentication. After discussing with the ZITADEL team, Orbica learned that the feature was already under development and has since been released. See the [Login API](https://zitadel.com/docs/guides/integrate/login-ui) for more details. 

Santosh commended ZITADEL’s customer service as they provided swift responses and communicated the progress of feature development effectively. There were slight hiccups in the initial stages regarding custom claims. While the current state of [custom claims](https://zitadel.com/blog/custom-claims) is perfectly suited to Orbica's needs, it was a feature that wasn't available during their early testing phase. 

Presently, ZITADEL is used exclusively for Orbica's Geospatial Platform. The beta process went smoothly, and the registration or login process from the user's perspective was generally positive. 


## Future Plans

The team at Orbica is interested in leveraging ZITADEL's support for the General Data Protection Regulation (GDPR). As Orbica plans to launch a European instance and cluster, [ZITADEL's GDPR compliance](https://zitadel.com/gdpr) becomes an attractive aspect as it helps them meet data protection requirements. 

A more long-term vision for the company's use of ZITADEL involves making the identity provider more accessible to their customers. The idea is to enable customers, who are already creating applications on the Orbica platform, to manage their own user authentication. The goal is to eliminate the need for customers to bring their own authentication systems for their apps. While they could still choose to do so, Orbica wants to give them the option of leveraging the existing authentication system, thus providing a more integrated and seamless experience. This would allow end users to build their applications with the reassurance of having a reliable authentication system in place. To set this plan in motion, the team at Orbica is considering the kind of support they can provide, whether it's at the technology level through the platform or through other means, such as documentation. 


## Testimonials

<img
  src="/blog/2023-08-22-success-story-orbica-05.jpg"
  width="250px"
  alt="Portrait of Santosh Seshadri"
/>

“Auth is complex and critical to get right the first time. I was relieved to discover ZITADEL, allowing us to leverage their expertise so we can focus on the rest of our platform development. ZITADEL’s consumption-based pricing model also aligns perfectly with Orbica’s, allowing us to offer our platform without restrictive per-user charges.” 

— [Santosh Seshadri](https://www.linkedin.com/in/santosh-seshadri-9a6b4559/?originalSubdomain=nz), Head of Platform at [Orbica](https://www.orbica.com/) 

Exploring how Orbica leveraged ZITADEL for exclusive authentication in its geospatial platform.

Built with ZITADEL: Orbica's Cloud Native Geospatial Platform


## Key Outcomes

- **Leveraging Real-World Tools for Practical Learning:** The CAS Frontend Engineering Advanced course run by smartive uses ZITADEL, an open-source Identity and Access Management platform, providing students with hands-on experience in working with industry-grade tools. This exposure gives students practical understanding and skills applicable to their professional careers, making their learning experience highly relevant and impactful.

- **Simplified Authentication and Security:** ZITADEL's straightforward setup and comprehensive free tier made it an ideal choice for managing the authentication and security of the API used in the course. This ease of use allowed students to focus more on learning advanced web development topics and less on configuring security tools, enhancing the overall efficacy of the course.

- **Effective Management of User Access:** With ZITADEL, smartive was able to manage and control user access to the course's shared API effectively. Despite accessing a shared resource, ZITADEL's configuration allowed each student to have a personalized experience. Students were expected to create their own ZITADEL account to access the API and set up authentication for their individual front-end applications.


## Introduction

[smartive](https://smartive.ch/), a leading IT services company, conducts the [Certificate of Advanced Studies (CAS) Frontend Engineering Advanced Course](https://www.ost.ch/de/weiterbildung/weiterbildungsangebot/informatik/software-engineering-testing/cas-frontend-engineering-advanced?li_fat_id=aca37124-dfc7-4d1e-ae8e-dbc432c034d1&cHash=1fffb9398099735c3d77acb6bd4a8005) at the [Eastern Switzerland University of Applied Sciences (OST)](https://www.ost.ch/). The collaboration emerged from a longstanding relationship between smartive and OST, as several smartive team members are alumni of the university and have previously been invited to deliver guest lectures. The opportunity for smartive to take a lead role in the course materialized when OST invited them to design and conduct an entire course. 

### About The Eastern Switzerland University of Applied Sciences (OST)

[The Eastern Switzerland University of Applied Sciences](https://www.ost.ch/), also known as OST, is an institution steeped in history, having brought together 170 years of tradition in education and research. Founded by the six cantons of St.Gallen, Schwyz, Glarus, Appenzell Ausserrhoden, Appenzell Innerrhoden, Thurgau, and the Principality of Liechtenstein, OST has positioned itself as an essential educational hub for Eastern Switzerland and Liechtenstein.

OST is a public institution, independent in its functioning, characterized by its own legal personality and the right to self-administration. At its heart, OST is a cooperative venture, sustained by the shared vision and commitment of the various founding regions.

In terms of its impact and reach, OST is a significant player in the region's educational landscape. The university hosts around 3,800 students across six departments, furthers the professional competencies of approximately 1,500 individuals via executive education, and advances the field of academic research with more than 1,000 ongoing research projects.


### About smartive

[smartive](https://smartive.ch/) is an IT services company based in German-speaking Switzerland, renowned for its bespoke digital products and comprehensive IT solutions. With a diverse portfolio ranging from startups to the largest employers in Switzerland, including notable clients like Bin, Migros, Schweizerische Eidgenossenschaft, and Frontify, smartive stands as a hallmark of IT innovation and digital transformation.

The company's services span from the conceptualization of an idea to its realization into a live digital entity. Specializing in web apps, APIs, and DevOps, smartive has been setting up brand new products, analyzing existing solutions, and providing ongoing support and development for projects since 2012.


### About the Course

The [Certificate of Advanced Studies (CAS) Frontend Engineering Advanced Course](https://www.ost.ch/de/weiterbildung/weiterbildungsangebot/informatik/software-engineering-testing/cas-frontend-engineering-advanced?li_fat_id=aca37124-dfc7-4d1e-ae8e-dbc432c034d1&cHash=1fffb9398099735c3d77acb6bd4a8005) offered at the OST University is designed for individuals with experience in frontend engineering aiming to progress to a "Senior Frontend Engineer" position. Admission requires a minimum of two years of professional experience in a development team and a recognized tertiary degree. The course spans nine months.

The structure of the course involves the completion of three sub-projects, where students have the opportunity to build a 'Twitter Clone'. This provides practical experience and allows students to demonstrate their ability to independently set goals and develop their projects.

The course delves into Design Systems, offering students an understanding of the fundamentals, how it evolves from Bootstrap, recent developments in CSS, and updates on JavaScript frameworks. Students also gain insights into the areas of Architecture and Cloud DevOps, which include frontend engineering with Next.js, mastering TypeScript/React Hooks, understanding various APIs, managing data and state, and optimizing performance with Progressive Web Applications (PWAs).

A significant component of the course is Cloud DevOps, where students explore frontend security, OpenID Connect (OIDC), Continuous Integration/Continuous Deployment (CI/CD), and concepts of Cloud Native Applications and serverless computing.


### About the Students

The course attracts students with a background in computer science or web development. The students' experience levels vary, but most of them possess substantial professional experience in their respective fields. Some students come to the course seeking to update their skills, having used older practices for web development and are keen to learn how to apply modern methodologies.

Professionally, many of these students are already working as front-end engineers. Their experience with programming languages and frameworks is diverse. Some students come with a strong foundation in languages like Java or PHP, while others already have experience with more modern frameworks like Angular or React. 


## Problem

One of the fundamental aspects of this course is the use of an Identity and Access Management system—a component that is central to a major assignment requiring the development of a NextJS application. The course focuses on teaching students about API access, front-end security, state management, and design tokens among other advanced topics.

Throughout the course, students create a real-world project in a one-to-one context with all the topics covered. An identity and access management provider that supports OpenID Connect (OIDC) must be utilized in the login and security segment, where students learn how OIDC works and how it is implemented in the provider.


## Solution

### Why smartive picked ZITADEL

smartive chose to incorporate ZITADEL into the course for a multitude of reasons:

Being a free-to-use system, ZITADEL eased potential budget constraints for the course. Compared to its competitors, ZITADEL eliminated the need to negotiate educational agreements or struggle with complex onboarding processes. The fact that smartive had prior experience with ZITADEL was also a contributing factor, as they were familiar with how to navigate and utilize ZITADEL effectively.

Everything the students needed was available right out of the box on the free tier, making it more than sufficient for the course's nine-month duration. This served as an ideal way to showcase OIDC, login, and security operations in a practical setting.

Compared to in-house solutions, ZITADEL presented a clear advantage with its open-source nature. Universities often rely on sophisticated enterprise authentication schemes like Shibboleth, but integrating such a system into the course could have resulted in a considerable amount of work. 


### How ZITADEL is Used in the Course

ZITADEL is used to facilitate a practical assignment that tasked students with building a web application, specifically a Twitter-like platform named "Mumble." This hands-on approach required ZITADEL primarily for its security features and OIDC part of the course.

In this context, the students' application needed to interact with an API created by smartive, simulating a real-world software development environment. The API underpinned the entirety of Mumble's functionality, managing tasks like creating posts (or 'mumbles'), deleting and liking posts, and following other users. It also facilitated real-time updates of activities on the platform via server-sent events. This approach exemplified an API-first methodology, mirroring ZITADEL's own implementation.

To access and interact with this API, students had to create a ZITADEL account. This process simulated an authentic software development experience, where front-end applications must interact with authenticated APIs securely. Since the API can be hosted as a separate project, students can create their own project for their Mumble application, only needing to specify the API project's resource ID as the audience from their client side. This will allow them to manage their front-ends and redirect URIs independently.

<figure>
  <img
    src="/blog/2023-07-27-success-story-smartive-ost-01.png"
    width="100%"
    alt="smartive OST Diagram 1"
  />
  <figcaption>
    Figure 1: Use of ZITADEL for User Management and Authentication
  </figcaption>
</figure>

Each cohort of students, typically comprising 20 to 25 individuals, is granted access to a ZITADEL instance for the duration of the course. Despite the small class size, ZITADEL is used intensively, generating significant traffic. This hands-on experience with ZITADEL forms a critical part of the learning process, enabling students to familiarize themselves with real-world security solutions.

## Learning Curve 

The foremost challenge faced by the students was learning how to create a front-end application, specifically, grasping how to implement certain features, such as setting up Proof Key for Code Exchange (PKCE) and redirecting URLs.

However, it is important to note that the learning curve associated with these challenges was somewhat anticipated, given that most students did not have prior experience with comparable technologies. 

## Future Plans

smartive has clear future plans for the CAS Frontend Engineering Advanced course, aiming primarily to enhance the course content and teaching methodologies. One central focus is the topic of login and security, a crucial aspect of any advanced web development course. This focus won't change, as it forms a core part of the real-world project-based learning approach that the course employs.

The emphasis on OIDC and web application security is expected to persist, as these aspects remain critical in the evolving landscape of web development. The year 2023 and beyond will likely see these topics retaining, if not growing, their importance.

## Testimonials

<img
  src="/blog/2023-07-27-success-story-smartive-ost-02.jpg"
  width="400px"
  alt="Portrait of Christoph Bühler"
/>

“ZITADEL is the right choice to show students how OIDC works. It adheres to the spec and has a generous free tier such that the students can fiddle around with the system.” - [Christoph Bühler](https://www.linkedin.com/in/christoph-b%C3%BChler-a3a262270/), Software Engineer at [smartive](https://smartive.ch/) and Course Lecturer at [OST](https://www.ost.ch/)

## Further Reading

Explore the [documentation](https://zitadel.com/docs/guides/solution-scenarios/frontend-calling-backend-API) on accessing secure back-end APIs via a front-end application after users log in. The guide presents a solution scenario that demonstrates how a front-end application can call a secure back-end API. It explains the steps to implement this workflow, detailing how to manage user access and effectively handle tokens.


Smartive and OST have enhanced the user experience in their Advanced Frontend Engineering Course by utilizing ZITADEL.

ZITADEL in the Classroom: A Look at smartive's and OST's Advanced Frontend Engineering Course


## Key Outcomes

- [Kaspar&](https://www.kasparund.ch/), a Swiss fintech company,  uses [ZITADEL Cloud](https://zitadel.com/signin) for centralized user and access management, serving both external customers and internal users.
- By leveraging ZITADEL, Kaspar& has successfully enhanced the user experience and security for B2C customers interacting with their mobile app. They achieved this through streamlined user registration and management processes while maintaining high security standards with features, such as passwordless authentication and multi-factor authentication offered by ZITADEL. This resulted in a significant reduction in time spent on these tasks compared to when they were using their in-house solution.
- ZITADEL will play a crucial role in the growth and expansion of Kaspar&'s core offering to expand its fintech services to a broader clientele in Switzerland. By integrating additional two-factor authentication methods, Kaspar& can offer a higher level of security for their customers.  Furthermore, ZITADEL's built-in organization model and federated authentication capabilities  will enable Kaspar& to efficiently manage their B2B user base.

## Introduction

[Kaspar&](https://www.kasparund.ch/) is a fintech in Switzerland, co-founded by CTO [Sebastian Büchler](https://www.linkedin.com/in/sebastian-b%C3%BCchler/), that offers a user-friendly, mobile app-based wealth management service.  We spoke with Sebastian to gain insight into the problems they encountered and the reasons behind choosing ZITADEL as their identity and access management solution.
Kaspar& provides users a convenient and affordable way to invest and manage their finances using their smartphones. Users can set various investment goals, choose from different investment strategies, and track their portfolio performance. Kaspar&'s customers are retail customers, primarily from traditional banks, wanting to invest money. Kaspar& operates on a cost-effective, technology-driven business model. By leveraging digital platforms and forgoing the need for physical branches and expensive financial advisors, the company can provide professional wealth management services at a fraction of the cost compared to traditional financial institutions. Kaspar& also offers a debit card for making online and offline purchases, which enables automatic investment of the spare change from those transactions.

Kaspar& generates revenue by charging a fee for its wealth management services. This fee is typically lower than those charged by traditional banks and investment advisors. As a spin-off from the University of St.Gallen (HSG) and ETH Zurich, Kaspar& bases its investment decisions on the latest financial market theories and practical concepts, ensuring that users benefit from a professional, research-driven approach to wealth management. Moreover, Kaspar& is regulated by the [Swiss Financial Market Supervisory Authority FINMA](https://www.finma.ch/en/) and partners with [Hypothekarbank Lenzburg](https://www.hbl.ch/de/private/), ensuring that users' investments are held securely in a Swiss bank.
To get started with Kaspar&, users have to: 
- Download the Kaspar& app from the App Store or Play Store.
- Sign up by providing personal information, answering financial questions, and completing the KYC (Know Your Customers) process, which includes an automated video identification process. Kaspar&'s services are restricted to Switzerland; customers must have a Swiss domicile address to register.
- Make an initial deposit from a Swiss bank account.
- Set investment goals, such as retirement or education funding.
- Choose an investment strategy (Comfortable, Normal, or Sporty).
- Start investing with as little as one franc.
- Monitor and manage investments, adjust strategy, and change thematic focus within the app.

## Problem

Kaspar& faced several pain points related to authentication and user management. As Sebastian explained, the company had used an in-house solution that used JSON Web tokens for customer authentication. Although the basic login functionality was relatively simple to implement, other aspects, such as the sign-up process, password reset, two-factor authentication, and security-related concerns proved to be more challenging. 

With the rapid growth and expansion of their customer base, Kaspar& needed a robust and scalable identity and access management (IAM) solution to manage user authentication, both for the customer-facing mobile app and for accessing internal  applications. 

Moreover, Kaspar& wanted a managed solution that was cost-effective, compatible with their Business-to-Customer (B2C) model, and provided data residency in Switzerland to ensure regulatory compliance and maintain customer trust. Sebastian explained that they found the per-user pricing of most of the major market players to be too expensive for their customer base.

## Solution

### Addressing Customer Identity and Access Management Needs

Based on the recommendation of a mentoring agency, the Kaspar& team was introduced to ZITADEL, which they found to be a better fit for their needs compared to other major vendors. Kaspar& found ZITADEL's user registration and management process much easier to handle, and they value the security aspects provided by the platform. 

Kaspar&'s native mobile app for customers applies the OpenID Connect (OIDC) flow with Authorization Code Grant and Proof Key for Code Exchange (PKCE) to securely authenticate users and provide access to its wealth management services. The app initiates the authorization request by opening the system browser with a URL pointing to ZITADEL’s authorization endpoint, including parameters such as client ID, redirect URI, code challenge, etc. Users then authenticate within the system browser using their credentials (the user ID is the phone number), which is accompanied by multi-factor authentication for added security. Upon successful authentication, ZITADEL sends an authorization code to the app via a custom scheme or universal links/app links for iOS and Android, respectively. The app exchanges the authorization code along with the code verifier for an ID token and access token by making a request to ZITADEL's token endpoint.The ID token contains user information, while the access token enables the app to access protected resources, such as APIs. With a valid access token, the authenticated user can set up investment goals, choose investment strategies, and track their portfolio performance within the Kaspar& mobile app.

<figure>
  <img
    src="/blog/2023-04-20-success-story-kaspar&-01.png"
    width="100%"
    alt="Kaspar& Diagram 1"
  />
  <figcaption>
    Figure 1: OIDC Flow with Authorization Code Grant and PKCE for Kaspar& Mobile App
  </figcaption>
</figure>

### Addressing Internal Access Management Needs

ZITADEL is also used internally throughout Kaspar&, mainly for integration into internal applications for single sign-on. They use features such as team pass keys. Passkeys eliminate the need for users to remember and enter passwords. By leveraging passkeys for passwordless authentication, Kaspar& can improve security and provide a more seamless login experience for their internal users as the passkey can be securely delivered and used only once, reducing the risk of unauthorized access. 
Kaspar& currently utilizes ZITADEL's managed cloud solution for their infrastructure, dividing their setup into three environments: production, development, and internal. They separated their cloud instance into projects to map their environments, with customer-facing sites for production and dev environments, and internal tools like Grafana and Admin Dashboard for the internal environment.

### Cost-effective Pricing Model 

Another reason for Kaspar& to choose ZITADEL as their IAM solution was due to its competitive pricing and compatibility with their B2C model. While they initially compared ZITADEL to other major market players, they found the per-user pricing of these alternatives to be too expensive for their customer base. ZITADEL's approach to pricing and technical capabilities aligned well with Kaspar&'s goals of reaching a mass clientele: ZITADEL's pricing is based not on a pay-per-user model but on the number of requests made. This allows ZITADEL to offer a cost-effective and scalable solution for businesses of all sizes.

## Learning Curve and Product Support 

Sebastian explained that they started using ZITADEL at its inception and that the ZITADEL team provided extensive support, helping Kaspar& successfully set up their identity infrastructure. He also mentioned that the availability of libraries and support materials has improved over time, making the integration process even smoother.

Getting accustomed to ZITADEL for Kaspar& was challenging at first because of the numerous features and possibilities it offered. However, once they had gained a better understanding of the platform, they found it to be a powerful tool for creating enterprise-grade solutions with just a few clicks.

With the release of ZITADEL 2.0, the Kaspar& team found the UX to be much more intuitive and significantly improved, making it easier to set up and configure the platform. They found the developer tutorials helpful for setting up authentication clients in NextJS and TypeScript. 

Their overall experience with ZITADEL has been positive, receiving good feedback for the new technology from their users. They appreciate the regular feature updates and ZITADEL's responsiveness to suggestions.

## Future Plans

### Expanding Authentication Options with Hardware/Device Tokens

Kaspar& has several upcoming plans to leverage ZITADEL's capabilities to enhance their offerings and provide a seamless experience for their customers. They plan to introduce hardware/device tokens as an optional opt-in feature and explore other two-factor authentication methods, such as [FIDO](https://fidoalliance.org/)-enabled credit cards and [Swiss Pass](https://www.swisspass.ch/home) cards.

### B2B User Management and Access Delegation for Kaspar& Fintech Services

In addition, as the company also began exploring Business-to-Business (B2B) solutions, they found ZITADEL's multi-tenancy features to be an added advantage. Kaspar& aims to expand their B2B offerings with ZITADEL, using ZITADEL’s built-in organization model to structure their user base and grant access to necessary projects. Their typical B2B customers are banks, and they plan to create a dedicated organization for each bank to manage their users. Here's how it could work:

1. Kaspar& sets up a project in ZITADEL with specific roles tailored to the access levels required for their fintech services.
2. They then delegate access to their fintech services to their B2B customers, such as banks, allowing these organizations to manage their own users and assign roles to them.
3. Each bank (B2B customer) can now self-assign access to their users and manage user authorizations for the Kaspar& fintech services, without Kaspar& having to build a multi-tenant user management system.
4. Users from the banks can self-register for Kaspar&'s services and manage their own profile information and authentication methods, providing a seamless user experience.

This approach reduces the burden on Kaspar& to develop a multi-tenant user management system, and enhances the overall experience for their customers.

<figure>
  <img
    src="/blog/2023-04-20-success-story-kaspar&-02.png"
    width="100%"
    alt="Kaspar& Diagram 2"
  />
  <figcaption>
    Figure 2: B2B User Management for Kaspar& with ZITADEL 
  </figcaption>
</figure>

### Federated Authentication for Seamless Bank Login Integration with Kaspar& Services

One standout feature they hope to deploy is reusing existing clients' logins from the banks to provide a smooth experience for clients through federated authentication. To achieve this, Kaspar& would need to configure a trusted Identity Provider (IdP) for each bank within the ZITADEL platform. These IdPs could be the bank's own identity management systems or popular third-party IdPs such as Google or Microsoft, depending on the bank's preference.

Once the trusted IdP is set up for a bank, users from that bank can use their existing login credentials to access Kaspar&'s services. When they log in, the user's credentials are verified by the bank's IdP, and an authentication token is issued. This token is then used by Kaspar& to grant access to the user, based on their assigned roles and permissions.

This approach not only simplifies the login process for users but also enhances security, as the bank retains control over the user's credentials, and Kaspar& does not store any sensitive information. Full integration with B2B partners will likely be completed by the end of the year, allowing bank customers to experience the new setup from start to end.



## Testimonials

<img
  src="/blog/2023-04-20-success-story-kaspar&-03.png"
  width="200px"
  alt="Portrait of Sebastian Büchler"
/>

“ZITADEL has made a significant difference for our startup, offering a cost-effective solution that aligns with our business model. The ZITADEL development team is highly responsive, regularly adding new features that make our lives easier. As we expand into the B2B market, ZITADEL's multi-tenancy features have proven to be an excellent choice for our needs. Their customer-centric approach and technical expertise set them apart from other big players in the market.“ - [Sebastian Büchler](https://www.linkedin.com/in/sebastian-b%C3%BCchler/), CTO & Co-Founder of [Kaspar&](https://www.kasparund.ch/)

By leveraging ZITADEL, Kaspar& has successfully enhanced the user experience and security for B2C customers interacting with their mobile app.

Built with ZITADEL: A Partnership in Fintech Security with Kaspar&


## Key outcomes

- Chapati Systems uses self-hosted instances of ZITADEL for centralized user and access management for both internal users and external customers. 
- Overall, Chapati Systems' use of ZITADEL has improved the user experience and security for their internal and external applications such as Alphalerts. 
- ZITADEL's  ability to authenticate and manage users across various systems, as well as its ability to share data across different apps, will enable Chapati Systems to expand and improve its offerings to customers.


## Introduction

[Chapati Systems GmbH](https://chapati.systems/), founded and led by [Christoph Miksche](https://www.linkedin.com/in/cmiksche), is a new software development company that has been in operation since 2022. Christoph has experience creating software solutions for a variety of industries, including automotive, marketing, and manufacturing. Currently, Chapati Systems' focus is on creating financial and project management applications.

One of Chapati Systems' core offerings, [Alphalerts](https://alphalerts.com/), is a SaaS platform hosted in Germany that allows customers to set filters based on key performance indicators (KPIs) to receive alerts when certain stock, option, or crypto events occur.
The target customers for the app are investors looking for advanced filters and real-time alerts, who want to analyze and build their own strategies.

Alphalerts offers over 80 KPIs for stocks on NYSE and Nasdaq and allows customers to search through thousands of stocks and get alerts when specific events occur.
Users can also query the options and crypto-currencies databases, and receive alerts via SMS, email, or app notifications.

The service allows users to create custom alerts based on their preferred stocks or crypto-currencies, and also offers a 14-day free trial for users to test the platform and its capabilities in addition to the Basic, Pro, and Biz plans. The number of alerts and advanced filters available depends on the subscription plan chosen. 

## Problem

Alphalerts required a centralized identity and access management solution to allow its users to access their accounts securely and seamlessly. Chapati Systems  wanted to offer their users the flexibility to log in to Alphalerts through either a traditional password-based method or their Google accounts because almost all users had a Google account. Additionally, they also wanted to enable MFA, which is optional for the users. 

At the same time, Chapati Systems also required a Single Sign-On solution that allowed their internal users to simplify access to their internal applications, namely their Gitea instance for source control,  CI/CD application, and project management system. 

## Solution

ZITADEL was chosen as the identity and access management solution for Alphalerts, which allowed Chapati Systems to easily identify and authenticate customers.  They also decided to use ZITADEL for internal user authentication and Single Sign-On. Chapati Systems chose to self-host ZITADEL on a Virtual Private Server (VPS) in Germany along with all their internal applications. 

According to Christoph, one of the main reasons for choosing ZITADEL was the simplicity the product offered.
Another was that it allowed an organization to register multiple applications, whereas other identity and access management solutions that were evaluated demanded a separate registration for each application.
So, ZITADEL was used not only to improve security but also to enable Chapati Systems to offer services such as bundle deals for separate applications (Alphalerts and other upcoming apps) and share data across these apps.

## Centralized Identity and Access Management for Alphalerts

<figure>
  <img
    src="/blog/2023-02-09-success-story-chapati-systems-alphalerts-01.png"
    width="100%"
    alt="Application Architecture of Alphalerts"
  />
  <figcaption>
    Figure 1: Application Architecture of Alphalerts
  </figcaption>
</figure>

The architecture for Alphalerts  includes a front-end written in plain Javascript and JQuery, with users able to log in to the system via ZITADEL, and users can create custom queries for alerts based on their preferred stocks or crypto-currencies, then subscribe to alerts via SMS, email or push notifications.

Alphalerts utilizes a Python backend that is integrated with Firebase for push notifications, Twilio for SMS notifications, and an email server for email notifications to provide a variety of notification options, giving users the flexibility to receive alerts in the way that best suits them.

The “Collector” component in the backend continuously collects data from various financial data APIs and feeds the stock data into a MongoDB database. Data related to users are stored in an SQLite database. The backend is also responsible for processing the user's filters and sending out notifications based on those filters. This allows for alerting and ensures that users receive the most up-to-date information on the stock, option, or crypto events they are interested in. 

ZITADEL allows Alphalerts to easily authenticate and manage access for each user, ensuring that only authorized users have access to the platform and their personalized alerts. ZITADEL uses PostgreSQL as the  database  to store user data. 

All the core components of the Alphalerts application are hosted on its own VPS. ZITADEL is hosted on a separate VPS with the rest of the internal applications of Chapati Systems. 

## Single Sign-On for Internal Applications

To manage user identities and access across their internal projects and public applications, Chapati Systems chose ZITADEL as their central user management and identity solution. ZITADEL's centralized platform allows Chapati Systems to easily manage and authenticate internal users across their various systems, including their Gitea instance, CI/CD, and project management systems. The internal users currently use Google login with optional MFA. For MFA, they use  OTP code and passwordless with Apple FaceID/TouchID.

<figure>
  <img
    src="/blog/2023-02-09-success-story-chapati-systems-alphalerts-02.png"
    width="100%"
    alt="Use of ZITADEL for Single Sign-On for Internal Applications"
  />
  <figcaption>
     Figure 2: Use of ZITADEL for Single Sign-On for Internal Applications
  </figcaption>
</figure>

## Future Plans

os.money is a new app being developed by Chapati Systems that allows users to track their existing portfolio of companies and receive updates on any significant changes. The app will use certain key performance indicators (equity-to-debt ratio, revenue growth rate, and other audit KPIs) to identify potential red flags in a company's financials that are often overlooked by investors but are crucial for auditing and assessing the trustworthiness of a company's balance sheet. 

In summary, Alphalerts is a tool designed to help users discover new investment opportunities, while os.money is focused on providing a way for users to monitor and assess the safety of their existing investments. However, the two apps will share some similarities.

ZITADEL will play an important role in os.money by providing user authentication and allowing for data sharing across the app, Alphalerts, and other upcoming products. This will enable users to use their os.money portfolio data in Alphalerts and create additional filters that only check companies from their existing portfolio or companies not yet in their portfolio. This data sharing will allow the system to better understand the user's interests and make personalized suggestions based on the data from both apps.

<figure>
  <img
    src="/blog/2023-02-09-success-story-chapati-systems-alphalerts-03.png"
    width="100%"
    alt="ZITADEL's Organization Structure Allowing for Sharing of Resources Between Projects"
  />
  <figcaption>
     Figure 3: ZITADEL's Organization Structure Allowing for Sharing of Resources Between Projects
  </figcaption>
</figure>

This is possible due to the fact that ZITADEL has the ability to [grant different projects](/docs/concepts/structure/granted_projects) to customers individually, which is a significant advantage for these cases.

For example, if a customer has a subscription for Alphalerts and wants to purchase os.money, the grant for project os.money can be easily added to the Alphalerts organization in ZITADEL through automatic processes, such as a call from the subscription component. This offers the following benefits:

- Self-service (e.g., authorizing users) can be done like with Alphalerts.
- Clients can discover available and authorized services.
- Downgrading is as easy as removing the grant, which is then propagated to all users.

Therefore, in addition to the standalone subscription, Chapati Systems will also offer combined subscription plans for os.money and Alphalerts at a discounted rate for existing Alphalerts users. This will allow users to benefit from the full suite of Chapati Systems products and make the most of their investment decisions.

## Testimonials

<img
  src="/blog/2023-02-09-success-story-chapati-systems-alphalerts-04.png"
  width="200px"
  alt="Portrait of Christoph Miksche"
/>

“ZITADEL is the best identity management system I have used. It is perfect for managing users across multiple apps, and it offers innovative features like passwordless authentication, which I got used to.

I plan to use ZITADEL for managing users across all my different programs for both customers and employees. Third-party login definitely makes it easier for customers to sign up, and as a single source of trust, it can be used for combined marketing and data sharing efforts across multiple apps.” - [Christoph Miksche](https://www.linkedin.com/in/cmiksche) founder of [Chapati Systems GmbH](https://chapati.systems/)

Read Christoph's own opinion on selecting an open-source identity provider [here](https://blog.m5e.de/post/open-source-authentication-solutions/).

Chapati Systems uses self-hosted instances of ZITADEL for centralized user and access management for both internal users and external customers.

Built with ZITADEL: Improved User Experience and Security for Chapati Systems


<a href="https://micromate.ai" target="_blank" rel="noreferrer">
  <img
    height="150px"
    width="150px"
    style={{ margin: "0 auto 2rem auto" }}
    src="/blog/2022-11-24-success-story-micromate-01.png"
    alt="Logo of Mircomate"
  />
</a>

[Micromate](https://micromate.ai) offers a time-efficient, sustainable, and fun way to encourage learning. Companies and public institutions of various sizes use the learning assistant to bring everyone’s knowledge to the next level. Micromate presents learning content in a personalized conversational form and integrates in your Messenger application, learning tool or Website.

## Key outcomes

- Highly flexible user management across organizations for a seamless user experience
- Less time spent on developing user and access features, more time for core value
- All data is stored and processed only in Switzerland

## Challenge

Micromate is used by many different companies and organizations to help their employees learn in a more meaningful way. Learning users can interact with Micromate through chat applications like Microsoft Teams or via a web-based application. As a cloud-based software-as-a-service created and hosted in Switzerland, Micromate can offer a truly GDPR/DSVGO compliant solution.
The staff members in charge of learning and development have special permission to access an administrative portal to manage the learning content as well as review the learning progress.

Each company or organization within Micromate requires an own logical tenant for managing their individual content, users, and configuration. One of the biggest challenges of the team was enabling users to be part of multiple tenants with different roles. Accordingly, the platform’s goal included allowing a single user to be the content editor for a company's compliance training module and simultaneously be enrolled in a university program that uses Micromate to deliver spaced learning lessons tailored to the student’s needs.

To access their accounts, all users should be able to sign into Micromate via SSO (single-sign-on) by using their organization‘s login method, such as AzureAD, Moodle account, or social logins. Once logged in, users should be able to switch seamlessly between the different learning modules and tenants.

<figure>
  <img
    src="/blog/2022-11-24-success-story-micromate-04.png"
    width="100%"
    alt="Microsoft teams showing a Mircomate chat"
  />
  <figcaption>
    Micromate conversation integrated with Microsoft Teams
  </figcaption>
</figure>

## Solution

Since building an authentication server from scratch is generally risky, costly and time-consuming, the startup team behind Micromate found that the identity & access management (IAM) solution of ZITADEL would suit their need for organization, flexibility and scalability. The selected SaaS version of ZITADEL offers a pre-configured public cloud service that manages scaling and resource allocation, allowing Micromate’s time and effort to be spent on developing and optimizing their main product. When choosing a region to house their data, the team has found that the region of Switzerland best fits their deployment preferences .

<figure>
  <img
    src="/blog/2022-11-24-success-story-micromate-02.png"
    width="100%"
    alt="Diagram showing Micromate and User Organization with Grants to different Tenants"
  />
  <figcaption>
    Micromate application is granted to multiple organizations. All users are
    being stored in one organization and can be granted to multiple
    organizations. The receiving organization can allocate different roles in
    self-service.
  </figcaption>
</figure>

With the help of a multi-tenant architecture, both in their business logic and the IAM they were able to map complex organizational structures that can collaborate with each other and to which they can assign individuals with different permissions for a given context.
All the client applications, base configuration, and access roles were set up in a main Micromate organization, which only staff has access to. When a new customer signs up to Micromate, a new organization is created via the ZITADEL APIs.
This newly implemented organization receives an automatic project grant from Micromate to enable it to use the applications and roles.

<figure>
  <img
    src="/blog/2022-11-24-success-story-micromate-03.png"
    width="100%"
    alt="Micromate admin website showing organization picker"
  />
  <figcaption>Switching organizations</figcaption>
</figure>

In order to ensure even greater flexibility, Micromate stores its users in an independent organization and creates individual user grants for the establishments to which they wish to gain access. With the help of this pattern, users are enabled to be part of various different tenants with varying assigned roles (eg, Learner, Content editor, Analytics, etc.). This seamless switch between tenants is available to the user without the need to sign-in again.

As ZITADEL Cloud allows all features to be used in the free tier, the team was allowed to test several architecture and solution options quickly to determine the best fit.

## Result

Through the use of ZITADEL, Micromate was able to focus on their business logic and use a highly flexible identity management to handle their multi-tenancy access, secure login, and self-service needs. Thus, their users can enjoy a streamlined user experience where they can seamlessly switch between their learning content. The time saved by not having to develop a multi-tenancy access management themselves, resulted in a fast time to market, while the security and complexity remains invisible to the users.

<figure>
  <img
    src="/blog/2022-11-24-success-story-micromate-05.png"
    width="100%"
    alt="ZITADEL Login screen branded with Micromate Logo, Colors, and domain"
  />
  <figcaption>
    Login screen branded with Micromate Logo, colors, and custom domain
  </figcaption>
</figure>

By choosing the data region Switzerland, all user data remains in Switzerland all the time together with trusting a Swiss provider, Micromate can offer a fully GDPR compliant cloud solution.

## Future Plans

Looking into the future, the team behind Micromate has one key aim in mind: Continuously improving their platform to ensure that it is always up to the highest standards of the market and their individual users alike. Naturally, this aspiration has noteworthy stepping stones on its way, which represent the major leaps the application can take toward its goal. Some of the innovations they wish to realize include a new voice-recognition feature, a virtual market for studying materials, and the expansion of the bots' communication capabilities.

## Testimonials

<img
  src="/blog/2022-11-24-success-story-micromate-06.jpg"
  width="200px"
  alt="Portrait picture of Christoph Süess in a blue suit and white shirt."
/>
“Mapping complex, collaborative organization structures requires a flexible identity
management system like ZITADEL” - Christoph Süess, Founder

## About the Micromate

[Micromate](https://micromate.ai) is a modern learning assistant platform that imparts knowledge in a time-efficient, sustainable and fun way. With the help of chatbot integration into various established messengers, the application aims to monitor and enhance users' learning processes and assist them in setting new study objectives.

Learn more about Micromate:  
[https://micromate.ai](https://micromate.ai)


Companies and public institutions of various sizes use the learning assistant to bring everyone’s knowledge to the next level with the power of ZITADEL.

How the learning assistant Micromate profits from the multi-tenancy power of ZITADEL


<a
  href="https://money-key.ch/"
  target="_blank"
  rel="noreferrer"
  className="hidden dark:block"
>
  <img
    src="2022-04-27-success-story-money-key-02.svg"
    width="80%"
    alt="Logo of money key"
  />
</a>
<a
  href="https://money-key.ch/"
  target="_blank"
  rel="noreferrer"
  className="dark:hidden"
>
  <img
    src="2022-04-27-success-story-money-key-01.svg"
    width="80%"
    alt="Logo of money key"
  />
</a>

[Money Key](https://money-key.ch/) is a digital web and voice application that allows entrepreneurs and financial managers easy access to their financial information. Due to the interconnected nature of the business relationships, Money Key uses ZITADEL as the identity platform to provide authentication, self-service and delegation of authorizations to their B2B customers.

## Key outcomes

- Small invest in identity management by using core B2B features
- Using Organizations for each customer to enable SSO and self-service
- SaaS service with data location Switzerland

## Challenge

Money Key is a digital web and voice application that connects to your accounting system. Fiduciaries and companies log into their web solution to review financial information via interactive reports and voice chat. The hierarchical relationship between trustees and their customers poses some challenges with regards to multi-tenancy and self-service.

The proof of concept used a social login provider to authenticate users with the application. As the maturity of the product evolved, it became clear that there needed to be a better solution, not only for authentication, but mainly also for authorizing the different B2B customers. A decisive criteria was a provider from Switzerland and ideally hosting of the SaaS in Switzerland.

## Solution

![Screenshot of Money Key application showing liquidity KPIs of a demo account](/blog/2022-04-27-success-story-money-key-04.png)

When looking for alternative solutions, the option to build an own solution was out of the question. The investment would have been too high and taken away valuable time in creating core business value.

ZITADEL was introduced to Money Key by their initial implementation partner, [Paixon](https://paixon.ch/), who has been using the identity platform for other solutions already. It seemed like the ideal solution for the B2B use case in addition to being a hosted cloud offering from Switzerland.

Money Key likes the fact that ZITADEL is organized around the concept of Organization, which can delegate access management to other Organizations and the flexibility of how ZITADEL Organizations can be used.

The solution required delegation of access roles through a hierarchy of Organizations where a product owner can administer the primary customer group, that is the trustees, who can self-manage their own company customers.
The application’s business logic creates new Organizations and internal users for new customers programmatically by connecting to the ZITADEL Management-API.  
The big advantage is that each entity has the possibility to act as its own administrator and set/edit the different users on different levels. Hence Money Key keeps its focus on offering new features and on the other hand its clients get the flexibility to manage the users on their side.

Money Key relies on the ZITADEL state-of-the-art security and benefits from features like two-factor authentication and password reset, which is easy to use as a consumer as well as administrator. It is possible for customers to use a social login (e.g. Google), as originally intended, which is related to ZITADEL identity management via Account Linking.  
At the moment they are missing the option to use their own domain for login and in emails to customers. This feature will be released to the Public Cloud service in May 2022.

## Result

Money Key was able to get a first working version of their B2B service within six months, with first customers using the application since the end of 2020. Following the success of the initial feedback, development continues with ZITADEL as the identity platform.

During the early phase it is quite important that the costs are only a small part of the overall product revenues. The availability guarantees and the pricing was convincing and Money Key is happy to have the option to buy additional support after initially scaling their growth.

## Future Plans

With a strong IT team at their disposal, Money Key is working towards integrating with various accounting software providers, such as Sage (Infoniqa), Bexio or Abacus, but also growing strategic partnerships to make life as data-driven entrepreneur easier. The goal for 2022 is to expand in the german-speaking part of Switzerland, soon followed by the german-speaking countries around.

## Testimonials

<img
  src="/blog/2022-04-27-success-story-money-key-03.jpg"
  width="30%"
  alt="Portrait of Ernest Ukaj"
/>

> “We needed a better solution for authorizing customers. We did not want to build this on our own, but focus on our core competencies.” - Ernest Ukaj, Founder and CEO

## About the solution

Money Key is a digital web and voice application that connects to your accounting system. The financial manager tool is a fiduciary and financial assistant in one and provides quick and understandable insight into your company's finances through intuitive usability.

## About Money Key GmbH

Money Key GmbH  
Industriestrasse 28  
CH-9100 Herisau  
[money-key.ch](https://money-key.ch/)

Money Key GmbH is currently part of the MYK Group, that offers fiduciary, audit and tax consulting services, with a special focus on SMEs and start-ups. Right now they are finalizing agreements with further Business-Angels/Investors. Currently Money Key has 5 employees and productizes their solution not only in Switzerland but also internationally.


Money Key is a digital web and voice application that allows entrepreneurs and financial managers easy access to their financial information. Money Key uses ZITADEL as their B2B identity platform.

Money Key built a financial manager tool for fiduciaries and entrepreneurs with ZITADEL


<a href="https://joshmartin.ch/" target="_blank" rel="noreferrer">
  <img
    src="/blog/2022-01-05-success-story-joshmartin-hygeia-01.svg"
    width="80%"
    alt="Logo of joshmartin"
  />
</a>

[JOSHMARTIN](https://joshmartin.ch/) developed a service for health departments to make tracing of cases , such as SARS-Cov-2 spread, more efficient. ZITADEL was used for secure authentication of users and enabling customers to self-manage their data, settings, and access.

## Key outcomes

- Release of Hygeia within one month with very few resources
- Compliance with strict data governance
- Hosted login and self-service access management for customers provided by ZITADEL

## Challenge

JOSHMARTIN built Hygeia right in the middle of the SARS-CoV-2 pandemic to support efficient contact tracing. The departments for health required a solution for collection and processing of personal data for contact tracing during the pandemic. Data should be accessible only to authorized personnel from the responsible department and should remain in Switzerland at all times. Due to the rapid spread of the pandemic, time-to-market and efficient development was crucial.

## Solution

Some developers of JOSHMARTIN have tried out ZITADEL already before the development of Hygeia and are also familiar with other solutions such as Auth0 that have been used for other projects. Eventually it was decided to go with ZITADEL because of the fast and competent support, as well as data is stored and processed in Switzerland exclusively.

Multiple segregated health departments, each managing their own users, are using Hygeia. For each health department a separate organization was set up and JOSHMARTIN granted the project Hygeia to customers’ organizations. With this setup each department can self-manage their users and access to the application on their own. As this is already built into ZITADEL, minimal development was required for this authorization.

<img
  src="/blog/2022-01-05-success-story-joshmartin-hygeia-02.png"
  width="80%"
  alt="Mockup of an Mac Display showing a browser with a screen of the Hygeia App"
/>

The rigid guidelines on information security required to strictly manage access to the application. This meant on the one hand to provide secure authentication with 2FA and on the other hand fast synchronization of user information and their access rights.

JOSHMARTIN used ZITADEL’s default login flow and allowed customers to manage their own settings regarding the login page and authentication methods. A service account is used to lifecycle users periodically even after the initial provisioning to the application. Highest accuracy was achieved by validating not only the session at the introspect endpoint with each call, but also request user information and roles from the user-endpoint without application-side caching.

The project was implemented when ZITADEL was still in a closed beta version. The teams worked closely together to ensure security, optimal integration, and performance of the systems.

## Result

JOSHMARTIN went live with the first version of Hygeia only one month after project initiation, with only 2 developers and 1 project manager. ZITADEL provides a secure login, user management, and self-service authorization for the multi-tenancy service.

## Future Plans

Hygeia is currently being used by three cantonal health departments. JOSHMARTIN is working towards a greater adoption of Hygeia in other cantons, also through expanding capability to trace not only SARS-CoV-2 cases.

## Testimonials

<img
  src="/blog/2022-01-05-success-story-joshmartin-hygeia-03.jpg"
  width="30%"
  alt="Portrait of Jonatan Männchen on black background"
/>
“What I like is that I can reach out to someone and receive fast and competent feedback
on the request. The team really cares about it.” - Jonatan Männchen

## About the solution

Hygeia is an application for collecting and processing personal and case data in connection with pandemic diseases.
To learn more about the solution and further links at [joshmartin.ch/en/projects/kanton-st-gallen-contact-tracing/](https://joshmartin.ch/en/projects/kanton-st-gallen-contact-tracing/)

Code BEAM V Europe 21 featured a talk about the development of the solution on [YouTube](https://www.youtube.com/watch?v=7ypfyCOfwLo).

Hygeia is cross-licensed under the Business Source License and the Apache License and is available on [https://github.com/jshmrtn/hygeia](https://github.com/jshmrtn/hygeia).

## About Joshmartin

Joshmartin GmbH
Neugasse 51
9000 St. Gallen  
[https://joshmartin.ch](https://joshmartin.ch)

- Specialize in business automation on the web platform
- Focus on finance, insurance and medical sectors in Switzerland
- Team Size: 7

[Download this story.](/blog/2022-01-05-success-story-joshmartin-hygeia-04.pdf)


JOSHMARTIN developed a service for health departments to make tracing of cases , such as SARS-Cov-2 spread, more efficient.

All posts/ #case_studies