AURIS - EUROPEAN IDENTITY CONTROL PLANE

AUTHENTICATION.USER RIGHTS.IDENTITY SYSTEM.

The European control plane for hosted login, fine-grained authorization, and immutable audit. Built for teams that need identity infrastructure they can actually govern.

OPEN AURIS →

HOSTED LOGIN Standard auth edge

Authorization Code + PKCE with branded entry and safe callbacks.

FLEXIBLE PROOF Magic, social, government

Alternative entry methods still terminate inside the Auris control plane.

TENANT AWARE Realm + organization context

Branding, membership, and switching remain first-class runtime concerns.

VERIFIABLE ACCESS Permissions, FGA, JWKS

Decisioning and evidence stay explainable long after the login succeeds.

APPLICATION Client app redirect contract callback armed

ENTRY OIDC + PKCE hosted login challenge live

METHODS Magic / social / gov identity methods providers online

TENANT Realm + organizations active context tenant resolved

POLICY Permissions API checkOne + checkMany rules compiled

GRAPH Relationship graph FGA check + listObjects graph warm

TOKEN JWT + JWKS claims + validation signing ready

BRANDING Theme injection per-app identity surface theme resolved

EVIDENCE Audit evidence decision sealed proof sealed

AT A GLANCE

01 IDENTITY EDGE 99.99%

auth uptime SLO across hosted login surfaces

02 GOVERNED ACCESS 12 B+

permission and FGA checks evaluated each month

03 EU SOVEREIGN 100%

identity, sessions, and proof resident in EU regions

04 PROOF ON RECORD < 50 ms

p95 access decision latency, audit log included

WHY AURIS EXISTS

CHAPTER 01 · CONTROL PLANE THESIS

Europe cannot keep treating identity as rented infrastructure.

Every login is a sovereignty decision. Every authorization check is a policy decision. Every audit event is a trust decision. Auris keeps those three layers in one European control plane - multi-tenant governance, explainable decisions, operational evidence, on a surface product, security, and compliance teams can all read.

01 HOSTING MODEL

EU-resident identity control plane

02 DECISION MODEL

Permissions API and relationship graph

03 TRUST OUTPUT

JWT, JWKS, and sealed audit evidence

01 PILLAR

Europe should not rent its identity layer forever

Auris exists because login, authorization, and audit are not decorative features. They define who can act, what can be accessed, and what can be proven afterwards.
02 PILLAR

Every access decision should stay explainable

Hosted login is only the entry point. The real product is the control plane behind it: tenant policy, relationship checks, operator governance, and proof that survives audits.
03 PILLAR

Governance should feel operational, not ceremonial

Auris is designed to be run by product teams, security teams, MSP operators, and compliance owners who need one surface for identity, access, and trust posture.

DROP IN

One line.
Sign-in done.

Auris ships hosted login as a single component. EU-resident, MFA-aware, organization-aware. Same surface in React, Astro, Next, vanilla.

import { AurisProvider, AurisSignIn } from '@auris/react'

export default function App() {
  return (
    <AurisProvider
      clientId="<CLIENT_ID>"
      organization="acme"
    >
      <AurisSignIn
        redirectUri="/dashboard"
        providers={['google', 'microsoft', 'github']}
        theme="auto"
      />
    </AurisProvider>
  )
}

Open the docs →

Sign in to Acme

Welcome back. Continue to the workspace.

or

Work email

THE OPERATING SURFACES

HOSTED LOGIN
Branded entry without auth debt

Drop-in login surface with custom branding, standard OAuth2 Authorization Code + PKCE, discovery endpoints, and policy-aware MFA.
Own the experience without rebuilding identity from scratch.
FINE-GRAINED AUTHZ
Relationships instead of vague permission buckets

Zanzibar-style FGA lets teams model access as concrete relationships between users, orgs, and resources, which scales better than brittle role sprawl.
Access remains explicit, reviewable, and performant.
MULTI-TENANT GOVERNANCE
One control plane, many client realities

Per-tenant configuration, custom domains, branding, and user pools let MSPs and platform teams operate distinct identity surfaces from one governed system.
Isolation and shared operations do not have to conflict.
AUDIT + COMPLIANCE
Proof survives after the login succeeds

Auris treats the audit trail as a first-class product surface, not an afterthought. That matters for GDPR, NIS2, DORA, and internal reviews alike.
Identity, access, and evidence stay connected.
AI ADMIN
Operators can work through AI without losing control

The MCP server exposes Auris administration to AI-assisted workflows while keeping the control plane, tuples, org changes, and checks anchored in the same system.
Automation gains are useful only when trust remains observable.

BUILT FOR WHAT YOU'RE BUILDING

CHAPTER 01 · ENTERPRISE READY

Multi-tenant by default.

Organizations, roles, invitations and SAML SSO arrive already modelled. Nothing to bolt on when an enterprise customer asks for SCIM.

01 Organization & roles
02 SAML / OIDC SSO
03 SCIM provisioning
04 Exportable audit log

WHERE IT ACTUALLY FITS

CUSTOMER IDENTITY LAYER 01

Launch hosted identity as product infrastructure

Product teams get hosted login, tenant-aware identity, relationship-based authorization, and a credible EU posture without hand-building every auth surface.

Hours to first real integration

WORKFORCE + PARTNER ACCESS 02

Unify employee, partner, and customer access paths

Employee, partner, and customer portals can share one identity control plane while preserving per-surface policy, access boundaries, and audit visibility.

One plane for workforce and external access

TENANT GOVERNANCE STACKS 03

Operate many branded identity contexts from one plane

Service providers can manage many client organisations from one system while keeping tenant boundaries, delegated administration, and operator context legible.

Many tenants without identity sprawl

REGULATED ACCESS EVIDENCE 04

Keep access proof attached to the runtime decision

When regulated teams need to show how access decisions were made, Auris provides a better foundation than a login box glued to a separate reporting story.

Audit-ready identity and access evidence

INTEGRATIONS AND STANDARDS

CHAPTER 05 · INTEGRATION CONTRACT

Wire one governed plane into the stack you already run.

Browser, mobile, backend, and operator surfaces share the same identity, the same tenant context, and the same audit trail. Standards stay open: OAuth2 + PKCE, OIDC, SAML, SCIM, JWKS. Nothing is re-modelled per platform.

QUICKSTART CONTRACT app/contracts.tsx

import { AurisProvider, AurisSignIn, AuthGuard } from '@auris/react'

export default function ContractsApp() {
  return (
    <AurisProvider clientId="altovar-cloud" organization="eu-prod">
      <AuthGuard fallback={<AurisSignIn />}>
        <ContractsWorkspace />
      </AuthGuard>
    </AurisProvider>
  )
}

01 SDK LIBRARIES

AurisProvider
AuthGuard
AurisOrganizationSwitcher

02 EXTENSIBILITY

magic link
social login
government IdP

03 BACKEND TRUST

/oauth/token
JWKS
/auth/validate

01 QUICKSTARTS

Get the first redirect and callback working fast

Auris is shaped around the moment teams need first login in a real app, not around an abstract list of standards.
- Web, mobile, and desktop callback paths
- Hosted login and branded entry surfaces
- Sample flows for browser and API trust
02 EXTENSIBILITY

Plug tenant branding and federation into one governed plane

Alternative identity methods and tenant-specific presentation still land inside the same policy and audit path.
- Per-realm and per-app theming
- Enterprise, social, and government entry
- Operator-safe admin and automation surfaces
03 RUNTIME SURFACES

Keep control after the login box disappears

The useful part happens in-app: organization context, permission gates, graph queries, and token validation stay available.
- Organizations and active tenant context
- PermissionGate and license-aware controls
- Fine-grained authorization and server trust

AUTHENTICATION.USER RIGHTS.IDENTITY SYSTEM.

Europe cannot keep treating identity as rented infrastructure.

Europe should not rent its identity layer forever

Every access decision should stay explainable

Governance should feel operational, not ceremonial

One line.
Sign-in done.

Sign in to Acme

Branded entry without auth debt

Relationships instead of vague permission buckets

One control plane, many client realities

Proof survives after the login succeeds

Operators can work through AI without losing control

Multi-tenant by default.

Zero friction at sign-up.

Identity for agents too.

One login for everything inside.

Launch hosted identity as product infrastructure

Unify employee, partner, and customer access paths

Operate many branded identity contexts from one plane

Keep access proof attached to the runtime decision

Wire one governed plane into the stack you already run.

Get the first redirect and callback working fast

Plug tenant branding and federation into one governed plane

Keep control after the login box disappears

BRING IDENTITY
BACK TO EUROPE.

AUTHENTICATION.USER RIGHTS.IDENTITY SYSTEM.

Europe should not rent its identity layer forever

Every access decision should stay explainable

Governance should feel operational, not ceremonial

One line.Sign-in done.

Sign in to Acme

Branded entry without auth debt

Relationships instead of vague permission buckets

One control plane, many client realities

Proof survives after the login succeeds

Operators can work through AI without losing control

Launch hosted identity as product infrastructure

Unify employee, partner, and customer access paths

Operate many branded identity contexts from one plane

Keep access proof attached to the runtime decision

Get the first redirect and callback working fast

Plug tenant branding and federation into one governed plane

Keep control after the login box disappears

BRING IDENTITYBACK TO EUROPE.

One line.
Sign-in done.

BRING IDENTITY
BACK TO EUROPE.