Stay on your version. Stay protected.
CVEs patched. Without the upgrade.
A new Keycloak CVE lands. Our team backports the fix to the version you run; not the latest one and hands you the proof. You choose when to upgrade. Once a year is fine.
100+
clusters patched in under 24h
0
forced upgrades
1
attestation per patched CVE
1 year
min coverage per version
Critical and high CVEs patched on the exact version you run, no major upgrade, no downtime.
A downloadable attestation for each fix — evidence of when you were exposed, and when you stopped being.
During the June 2026 CVE wave, more than 100 clusters were updated in under 24 hours.
Each Keycloak version is covered for up to three years. You pay for our availability, we act the moment a CVE lands.
Pricing built around your setup. Short and confident
Every deployment is different, so we price yours around what you actually need. Tell us about your project.
For teams that can't just upgrade
Your release calendar is yours. Upgrade once a year or when you decide.
Banking, public sector, healthcare already sold to a major French financial institution.
Extensions and themes that turn every Keycloak upgrade into a project.
You pay for our readiness, not a constant workload. We act when a CVE lands.
Attestations you can attach to audits aligned with the Cyber Resilience Act.
Frequently Asked Questions
Can’t find your answer? Need any help?
Do I need to host with Cloud-IAM?
Today it covers Cloud-IAM-maintained versions. Contact us if you’d be intereted in coverage beyond Cloud-IAM hosting is on the table for a second phase.
How is this different from my SLA?
The SLA guarantees uptime and support response. Assurance guarantees security fixes on a version you choose not to move, a separate, dedicated contract.
What exactly counts as a covered CVE?
Critical and high CVEs (cover vulnerability score equal and over 7) affecting Keycloak core on your covered version. Performance issues and feature bugs follow the standard support path.