Ory Kratos implementation and Keycloak migration

Contact us

What we do

Nautilus runs the open-source Ory Kratos identity server as a sign-in API. The person who runs it will also set Kratos up for your product, move your users over from Keycloak or a home-grown login, and maintain it afterwards. The final price is quoted per project.

Who it is for

  • You run Ory Kratos, or are about to, and want it set up by someone who operates it in production.
  • You run Keycloak for password login, Google and GitHub sign-in, recovery and two-factor, and would rather not host it.
  • Your sign-in is old code nobody wants to touch.

Not for you if you depend on SAML, LDAP federation or enterprise single sign-on. Kratos does not provide these natively; keep Keycloak. We would tell you so at the first exchange.

The three services

1. Ory Kratos implementation

On your servers, or on Nautilus.

Included

  • On your servers: your own Kratos, with an identity schema and configuration for your product.
  • Registration, login, recovery, verification and two-factor flows wired to your front end, with Google, GitHub or another OpenID Connect login if you want it.
  • E-mail through your provider, webhooks to your backend, and written notes on what was set up.

On Nautilus there is no Kratos of your own to configure. You use the shared sign-in API, whose user schema is fixed (an e-mail, a locale, a JSON field), and we connect your app to it.

If you would rather have your own Kratos configuration on our hosting, that is the Contract plan: a dedicated installation agreed with us. See the pricing page or write to us.

Not included: designing your screens, SAML or enterprise single sign-on, running your servers.

2. Migrating your sign-in

From Keycloak or a home-grown system, to Kratos on your servers or to Nautilus.

Included

  • An inventory of what the old system stores: users, password hashes, social logins, verified e-mails.
  • A mapping to Kratos identities, and an import script tested on a copy.
  • A cutover plan with a way back.

Kratos can import existing password hashes, bcrypt, Argon2 and PBKDF2 among them: those users keep their password, the rest get a reset e-mail. Open sessions do not carry over. For a move to Nautilus, we check at scoping what can be imported.

Not included: what Keycloak does and Kratos does not (SAML clients, LDAP federation, custom extensions), and rewriting your app's permission logic.

3. Support and maintenance

Included: Kratos upgrades, with release notes read and a test before production; configuration changes; questions about flows and schema; sign-in problems you report.

Not included: round-the-clock on-call, new development (quoted separately), servers beyond the access you give us.

How it works

  1. Scoping. A short exchange by e-mail or one call: what you run, how many users, what must not change.
  2. Quote. A written price for the project, before any work.
  3. Delivery. You review the result before it reaches production.
  4. Handover. Written notes, so you can run it without us. Support is optional.

We give no standard duration; it depends on what your current system holds. The quote carries dates.

Prices

  • Implementation and migration: from €500, one-off.
  • Support and maintenance: from €150 per month.

"From" is where it starts. The final price is quoted per project, after the scoping exchange. A Nautilus subscription, if you use Nautilus, is billed separately at the published plan price.

Language

Write to us in French if you like. Replies, calls and delivery, documentation included, are in English.

Availability

For support we aim to reply within one business day. That is a target, not a contract: no SLA, no service credit, no round-the-clock cover. Nautilus itself has a 99.9% availability target, with uptime published on the public status page, on the same terms. A Kratos on your servers is as available as your servers; we cannot promise uptime for what we do not run.

Where it runs

Nautilus runs on our own servers in France, at OVHcloud, and identity data is stored there. If you choose your own servers, Kratos runs where you put it.

FAQ

Should we leave Keycloak at all?

Only if you use it for password login, social login, recovery and two-factor. Kratos is narrower: no hosted login pages, so your screens stay yours, and no SAML or LDAP. If you need those, stay. We will say which side you are on during scoping.

Do we have to use Nautilus?

No. Kratos is open source, and the one we set up on your servers is the standard release. Support is optional either way.

Who are we dealing with?

Verne Software, the company behind Nautilus, is one person: the one who wrote it. That limits how many projects run at once, and we say at scoping when we could start. The company is registered in Serbia; the Nautilus servers are in France. Terms and invoicing details come with the quote.

Contact

Tell us what you run today: Keycloak, or the outline of your own login code; roughly how many users; where Kratos should run.

Write to us in French if you prefer. We reply in English, and the work, calls and documentation are in English.

Contact us