A Customer Identity & Access Management platform that fits your customer journeys, your brand and your integrations. For B2C brands, B2B SaaS, banks and insurers who want more than what Auth0 or Microsoft Entra External ID offers out of the box.
IAM (Identity & Access Management) manages identities within your organisation: employees, Active Directory, SSO to Microsoft 365 and Salesforce. CIAM manages identities outside it: customers, citizens, partners. The numbers are many times larger, the UX requirements are much stricter, the regulation works differently, and the brand plays a part. A customer who forgets their password is a lost conversion, not an internal helpdesk ticket. A 401 error during checkout costs you revenue; a 401 on the employee VPN only costs you a Slack message.
The term Customer Identity today covers very different worlds: a loyalty account for a retailer, a customer portal for an insurer with BSN integration, a SaaS product that lets enterprise customers federate via SAML, a media service with a paywall and subscriptions, a fintech app with strong customer authentication. What they have in common: identity is not an internal department, it is a product feature with a direct impact on conversion, retention and compliance.
We have been building custom CIAM platforms since 2015 for organisations where off-the-shelf SaaS CIAM (Auth0, ForgeRock, Microsoft Entra External ID, Amazon Cognito, FusionAuth, Ping Identity) does not go far enough. Often based on Keycloak with a custom UX layer, sometimes fully built from scratch. Always integrated into your existing architecture and, where relevant, connected to Dutch identity schemes such as iDIN, DigiD, eHerkenning or the NL Wallet.
The scope of a CIAM project depends on the type of identity, the number of connected systems and the regulatory framework. We work within three patterns; in an initial conversation we determine which pattern suits your situation.
A customer account for your brand: registration, login (password, social login, magic link, passkey/WebAuthn), self-service profile and order history. Integrated with your CDP, e-commerce platform and marketing tools. Your customers see your brand, not a generic Auth0 pop-up. Progressive profiling spreads data collection across several visits so you are not asking for everything at registration, which is better for conversion and for compliance.
Organisation accounts with multiple users, roles and permissions. Customers bring their own identity provider (Azure AD, Okta, Google Workspace) via SAML or OIDC. Self-service onboarding for new tenants, automatic provisioning via SCIM, and an admin console where your customer success team can resolve tenant issues without developer involvement. Suited to SaaS vendors growing towards enterprise customers, similar to our vendor portal builds, but for your end customers.
High-assurance identity for customer portals in regulated sectors. iDIN, DigiD and eHerkenning for strong verification, BSN integration where legally permitted, KYC integration, audit logging in line with DNB/AFM and NEN 7510. Prepared for the EUDI Wallet and eIDAS 2.0, with OpenID for Verifiable Presentations (OpenID4VP) and SD-JWT credentials. Step-up authentication for high-risk transactions: a customer logs in lightly to view information, but must identify again via iDIN to make a change.
A complete CIAM platform combines authentication, authorisation, account management, consent and risk detection. We do not implement all of them by default; for each project we choose which are needed now and which can come later.
Password, social login (Google, Apple, Facebook, LinkedIn, Microsoft), email magic link, SMS OTP, passkey/WebAuthn, hardware keys (YubiKey, FIDO2), iDIN, DigiD, eHerkenning. For each user segment we select which methods are offered.
TOTP via authenticator apps, SMS OTP, push notifications, biometrics via mobile SDK, hardware keys. Risk-based: MFA is enforced when suspicious signals appear, not on every login, since the latter hurts conversion without adding security.
Edit profile, password reset, MFA settings, linked devices, revoke sessions, delete account (GDPR right), export data (data portability). All in your house style, without your customer service team having to handle every request manually.
Role-based access control for simple role models. Attribute-based for situations where context decides (location, time, transaction amount). Relationship-based for B2B tenants where permissions follow organisation membership. Built on Open Policy Agent or your own policy engine.
Granular consent per processing purpose, version control of privacy statements (who accepted what and when), cookie consent integration, channel preferences. APIs for access, correction and erasure requests so that your DPO doesn't have to search for them manually in databases.
Impossible-travel detection, device fingerprinting, velocity checks, IP reputation, behaviour analysis. Connectable to your existing fraud engine or vendors such as Sift, Castle or Auth0 Adaptive MFA. Signals lead to step-up or blocking, not automatically to lockout.
A production-ready CIAM platform that connects to your applications, plus the operational foundation to run it yourself or have us manage it for you.
With OneDayBuild, we turn your idea into something tangible in one day for €1,150, so you can see whether further development is worth the investment. Decide to go ahead with the full build? Then we credit the full cost.
Explore OneDayBuild →We actively recommend standard CIAM platforms (Auth0, Microsoft Entra External ID, Amazon Cognito, FusionAuth, Ping Identity) ourselves where they fit. Custom makes sense in these patterns.
You need strong customer verification with Dutch identity sources. Standard SaaS CIAM often doesn't support these, or only superficially. Custom lets you integrate iDIN or DigiD onboarding deeply into your flow.
With eIDAS 2.0 (mandatory for member states from 2026), the EUDI Wallet is on its way. Verifiable credentials, OpenID4VP and SD-JWT are standards that most off-the-shelf CIAM platforms are not yet ready for.
Risk-based authentication connected to your fraud engine, BSN (citizen service number) processing under a legal basis, AFM/DNB audit requirements, NEN 7510 for healthcare. Standard CIAM covers 80%, and the last 20% costs more than a custom solution. Often combined with KYC and AML compliance software in the same stack.
The identity layer needs to communicate bi-directionally with your core systems: profile changes, consent updates, segmentation. With standard CIAM you pay per API call and remain vulnerable to rate limits.
You provide a platform yourself and your partners want to bring their customers onto it. Multi-tenant, white-label, with each tenant having its own branding, federation configuration and consent regime. Related to our work on an employee portal and the broader vendor portal work, but focused on customer identities.
You grow into millions of identities and the vendor pricing scales with them, often faster than your revenue. Or you want to stop depending on a single supplier for such a critical component. Keycloak custom or from-scratch gives that control back to you.
A CIAM build isn't a feature you slot in alongside existing work; it touches every application that talks to customers. We work in five phases: first understand, then scope, then build, then migrate, then operate.
A conversation to map your current identity situation: which applications need to connect, which identity providers are in use, where customer data lives today, and which compliance requirements apply. No sales pitch, just sharp questions.
A workshop with your team plus interviews with security and compliance. We deliver a threat model, a data flow diagram and a concrete scope: which flows go into the MVP, which come later, and which a standard CIAM product could handle better. We often cut things here that don't need to be built.
A working build on staging every two weeks. We usually start with the most painful flow (registration, login and MFA), so you can test real usage quickly. An external penetration test runs in parallel during the final sprints, not as an afterthought.
The existing user base is migrated with zero disruption: password hashes are carried over, password rotation happens at the next login rather than through a bulk reset, and the rollout is phased by segment or brand.
Ongoing management after go-live: security patches, monitoring, dependency updates and audit log reviews. Plus continued development: adding new identity sources (the NL Wallet is on its way), expanding MFA methods and onboarding B2B tenants.
What clients usually want to know before we start.
A no-obligation introductory conversation of half an hour. We listen to your customer flow and the identity sources you are tied to, and give concrete direction, including if the outcome is that a standard CIAM platform is a better fit for you.
Appfront uses cookies and similar technologies to keep the website working properly, for analytics and for marketing. You choose what you allow. Read more in our privacy policy.
