Sign-in for your customers, with organizations and roles, two-factor, an audit log and a signed token your backend can verify offline. Webhooks and scheduled jobs come on the same account. Servers in France.
No credit card required · Free tier included
(What You Get)
Nautilus is one product from Verne Software: sign-in and users for your customers, on one account, one dashboard and one API. Webhooks that tell your backend what happened and scheduled jobs are parts of it, not products of their own. Official SDKs for Node, Python, PHP and Rust. It goes on top of the code you already have, and your application database stays where it is.
(AUTH)
Registration and login by password, one-time code or ten social providers; recovery, verification and two-factor. Organizations with named roles, carried in a signed token or checked with one call. An audit log, and rules that delete unused accounts after a warning email. An API; the screens stay yours.
PATCH /v1/gate/identities/:id/metadata(SIGN-IN METHOD)
POST /v1/passepartout/login/startOne more way for your customers to sign in: their Telegram account. No password, no email flow, no SMS bill. You connect your own bot from the dashboard.
(WEBHOOKS)
POST /v1/relay/messagesSend events from your product to your customers' endpoints. Failed deliveries are retried automatically, every message is signed, and every attempt is logged with the response it got.
(SCHEDULED JOBS)
POST /v1/clockwork/jobsSchedule recurring jobs with a cron expression, or one-off tasks for a set time. Nautilus calls your URL, retries on failure and keeps a log of every run. Schedules run in any IANA timezone, daylight saving handled.
(What Is Different)
Each line points at a docs page or a public price list. None of it is a superlative.
(01)
Set a rule per project. For example: delete accounts never confirmed after 14 days, and accounts that have not signed in for 12 months after a warning email 30 days earlier. The periods are yours; inactivity runs from 1 to 120 months. Every rule is off until you switch it on, a preview tells you how many people it would touch today, and nobody is deleted before the date in the email. Free covers unconfirmed accounts. Pro and Advanced add inactive accounts, a reminder to confirm, and deadlines on roles.
How the rules work(02)
Some providers sell roles, organizations and two-factor as separate line items. Here roles and organizations come with every plan, Free included, and two-factor and the audit log have no price of their own. This is about knowing your bill, not about being the cheapest: on free tiers and at small scale, others cost less, and the comparison pages show their numbers with the date we looked.
For 10,000 active users with roles, organizations and two-factor, the Logto pricing page gives $152 a month and the Clerk one $125 ($25 plus $100 for custom roles). Here it is €99, about $111. Prices read on 15 Oct 2026.
(03)
Sign-in runs on Ory Kratos and webhooks on Svix, both open source. Kratos is a small service written in Go; Keycloak is a Java server, and that difference is part of why a full setup fits these prices. The trade-off is recognition: people ask for Keycloak by name, and fewer know Kratos. Scheduling is our own code and does not come with you, though every job and run stays readable through the API. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
(Rust + Go)
The gateway is written in Rust and checks your API key from memory: no Postgres query and no cold start in between. We do not print a latency promise here; measured response times are on the status page.
(How It Works)
Create your free Nautilus account. No credit card needed.
Create a key in the dashboard. A key opens only the parts you tick: sign-in, webhooks, scheduled jobs, or all of them.
Call the HTTP API from your backend, or use the Node, Python, PHP or Rust SDK. We run the servers and the upgrades.
(Why Nautilus)
Your API keys, users, webhook endpoints and cron jobs are scoped to your account: a key can act only on your own users, and the platform enforces that — the control lives in Nautilus, not in integration code you have to write and keep correct. One limit: a social login (a given Google or GitHub identity) can be a user of only one account on the service.
Sign-in runs on Ory Kratos and webhooks on Svix, both open source, so you can read how they work and, if you ever need to, run them yourself. Scheduling is our own code, so that part does not come with you, but every job and run stays readable through the API. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
The API, the databases and the engines run on servers in France, at OVHcloud. That makes Nautilus EU-hosted: a fact about where it runs, not a compliance badge. A data processing agreement based on the EU Standard Contractual Clauses comes with Pro.
We aim for 99.9% availability and publish how we are doing: uptime history for each component, 90 days back, on the public status page. It is a target, not a contract. There is no SLA and no service credit behind it.
You can, and if you already have the people for it, it is a fair choice. Sign-in, webhook delivery and scheduled jobs on AWS means Cognito, SQS, Lambda and EventBridge, wired together, monitored and kept up to date by your team. Nautilus is the same three jobs behind one account, free for up to 1,000 active users a month: 10,000 webhook messages, plus scheduled jobs, up to 10 recurring and 100 delayed at a time. What you give up is control over the internals: you depend on us, and the engines are open source. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
Our servers are in France, at OVHcloud. A data processing agreement based on the European Commission's Standard Contractual Clauses comes with Pro. Deleting a user removes their identity and sessions at any time, so you can act on a deletion request, and your endpoints get an identity.deleted webhook. You can also have Nautilus delete accounts that were never confirmed and, on Pro, accounts that have gone unused for a period you choose, each after a warning email and only if you switch the rule on. An audit log records key and role changes and your users' sign-ins, kept 7, 30 or 90 days by plan. None of this makes you compliant by itself: the retention period is your decision, and we are not lawyers.
Sign-in, webhooks and cron jobs run as separate services, so a stalled cron worker leaves sign-in and webhook delivery untouched, and the status page shows each part on its own. The one shared piece is the thin gateway that checks API keys and counts usage. It is still one vendor, and that is a real trade-off: sign-in and webhooks run on open-source engines, Ory Kratos and Svix, which you can host yourself. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
Nautilus has a free tier as well: up to 1,000 active users a month, 10,000 webhook messages, and cron jobs on top, up to 10 recurring and 100 delayed at a time. The difference shows up later. Supabase and Firebase expect your data to live inside them, so the moment webhooks or sign-in have to work against a database you already run, you are rebuilding your backend around theirs. Nautilus goes on top of the code you already have: your application database stays where it is, and you call an HTTP API from whatever stack you run. Paid plans start at €99 a month and are counted in monthly active users, not in requests.
Both are possible, and a page like this cannot rule either out. The plans on the pricing page are the ones in force today. What protects you if either happens is the engines: sign-in runs on Ory Kratos and webhooks on Svix, both open source, so you can run them yourselves, and every cron job and run stays readable through the API. To move elsewhere, ask support for an export of all your users with their password hashes, social links, metadata, organizations and roles: you get one encrypted file within 7 days, in a format our own import accepts and that maps onto Ory Kratos.
Yes, through the API. You group your end users into organizations, define named roles with permissions inside each one, and a user can hold a different role in every organization they belong to. The roles come back in the signed token your backend verifies offline, in token introspection and in the session check, and one call to authorize answers whether this user may do this in this organization. Nautilus keeps the data and answers; your code enforces it. A signed token is valid for 15 minutes and cannot be revoked, so a role you take away can live on in a token already issued until it expires; the live calls read the database. The dashboard has no screen for members yet. Roles and organizations are on every plan, Free included.
No SAML and no enterprise single sign-on: if your customers' IT departments ask for it, Auth0, Clerk and Ory Network sell it. No hosted login page and no prebuilt components, so you build the screens. No passkeys, no SMS codes and no Sign in with Apple. Nautilus is not an OAuth or OpenID provider for third parties. The emails we send on your behalf, such as the warning before a deletion, come from Verne's address and are written in your user's language (six languages, from the user's locale); sending from your own domain is coming (Pro). Official SDKs for Node, Python, PHP and Rust only. One region, France. No SOC 2 or ISO 27001 report, and no SLA: availability is a 99.9% target, published on the status page.
(How We Compare)
We wrote the comparison we would want to read: what each of them does better than us, the prices from their own pages with the date we looked, and where your users' data is stored. Prebuilt interface components, enterprise single sign-on and a hosted login page are on their side, not ours. The pages are in English.
(Get Started)
Create an account and a key, and your first 1,000 active users every month are free. Official SDKs for Node, Python, PHP and Rust, and a tagged release behind every fix.