What Phase Two does

Phase Two is a Seattle-based, privately held provider of managed Keycloak hosting and enterprise Keycloak support, founded in 2020 and operating with 11-50 employees across US and UK offices. The company commercializes an enhanced distribution of Keycloak — the open-source identity and access management project backed by Red Hat — augmented with 100+ proprietary open-source extensions including Organizations multi-tenancy, IdP Wizard, Admin Portal, Magic Link passwordless authentication, Events & Webhooks audit logging, runtime-configurable Themes built on Keycloakify and shadcn/ui, User Migration tooling, CockroachDB distributed storage support, and Redis/Valkey caching. The platform serves SaaS companies, ISVs, and enterprise organizations that need standards-based SSO, customer identity and access management (CIAM), user federation, and identity brokering without per-user pricing penalties or vendor lock-in.

The business generates revenue through subscription-based managed hosting priced by concurrent active sessions rather than registered users, structured across three tiers (free Starter up to 1,000 users, Premium with unlimited usage and 99.5% SLA, and Enterprise with multi-region deployment and 99.95% SLA), supplemented by enterprise support services including 24/7 incident response with named engineers, on-prem deployment assistance, zero-downtime upgrade management, and migration engagements from Auth0, Okta, Cognito, and other identity providers. Phase Two runs a dual go-to-market combining a product-led growth self-service dashboard (dash.phasetwo.io) for SMB and startup adoption with an enterprise field sales motion targeting Fortune 500 deployments, dedicated clusters, and complex multi-region rollouts. Named enterprise customers include Dexcom, Toppan Merrill, Alarm.com, Bosch, BrightSign, Continental, Fastly, Gusto, IDEMIA, Perforce, Teamworks, and Unstructured; the company is SOC 2 Type II and ISO/IEC 27001 certified.

Name

Phase Two

Legal name

Phase Two, Inc.

Website

https://phasetwo.io

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

Phase Two provides managed Keycloak hosting and enterprise support for SaaS companies, ISVs, and Fortune 500 organizations seeking to replace Auth0, Okta, or Ping Identity with cost-predictable, open-source SSO and identity management enhanced by proprietary extensions.

Ownership category

akta.pro rank

Headquarters

HQ city

Seattle

HQ country

United States

HQ region

North America

Offices2 records

Markets served

GTM type

B2B

Offering type

Software

Cost components

Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations

Revenue model

1. Managed Keycloak Hosting: Subscription-based managed Keycloak hosting with three tiers (Starter, Premium, Enterprise). Priced by concurrent active sessions rather than total registered users, offering predictable infrastructure pricing.
2. Enterprise Support: 24/7 production SLA, incident support with named engineers, on-call escalation, architecture review, zero-downtime upgrades, and migration assistance for enterprises running Keycloak.
3. Dedicated Clusters: Isolated infrastructure with audited SLA, multi-region deployment, and custom configurations for enterprise customers requiring dedicated resources.

Pricing tiers

Go-to-market motion2 records

Distribution channels4 records

Marketing channels7 records

Core offering

Phase Two provides managed Keycloak hosting and enterprise support for the open-source Keycloak identity and access management platform. The company enhances Keycloak with proprietary extensions including Organizations multi-tenancy, IdP Wizard, Admin Portal, Magic Link authentication, Events & Webhooks, and runtime-configurable Themes. It sells managed hosting subscriptions and expert support services for migrations, zero-downtime upgrades, and 24/7 incident response.

Product overview

Phase Two is a unified platform built on open-source Keycloak, offering two integrated service lines: Managed Keycloak Hosting (with Starter, Premium, and Enterprise tiers) and Enterprise Keycloak Support. The core offering provides enhanced Keycloak with popular open-source extensions including Organizations (multi-tenant B2B identity), IdP Wizard (self-service SSO setup), Admin Portal (customer-safe UI), Magic Link (passwordless auth), Events & Webhooks (audit logging), Themes (runtime-configurable UI), User Migration (zero-reset cutover), CockroachDB support (distributed storage), and Containers (Kubernetes deployment). Phase Two differentiates through load-based pricing by concurrent sessions (not user count), unlimited SSO connections at flat rates, and 100% open-source core ensuring no vendor lock-in. The platform integrates with major frameworks (React, Next.js, Angular, Vue, SvelteKit, Django, Spring) and federates with existing IdPs (Auth0, Okta, Azure AD, LDAP) to enable phased migration.

Differentiator

Problem solved

Functional benefit

Brands

• Phase Two Connect: On-prem software installation solution that helps vendors connect customer identity providers with guided onboarding wizards.
• Phase Two Organizations
• Phase Two Magic Link
• Phase Two Admin Portal
• Phase Two IdP Wizard
• Phase Two Events & Webhooks
• Phase Two Themes

Products and services

• Managed Keycloak Hosting Fully managed Keycloak hosting service for organizations, providing multi-region high-availability clusters, automatic version upgrades, 24/7 monitoring, and load-based pricing by concurrent sessions rather than user count.
• Enterprise Keycloak Support Expert technical support services for organizations adopting or running Keycloak, including on-premise deployments, infrastructure design, 24/7 on-call escalation, and migration assistance.
• Dedicated Clusters Isolated infrastructure deployment with audited SLA, dedicated resources, and enhanced security controls for enterprise customers.
• 24/7 Incident Support Enterprise support tier providing 24/7 production incident response with named engineers and paged escalation.
• Emergency Keycloak Assistance One-off rescue engagements for critical Keycloak issues requiring immediate expert intervention.
• Migration to Keycloak Migration services from Auth0, Okta, Cognito, and other identity providers to managed Keycloak with zero-downtime cutover.
• Zero-Downtime Upgrades Managed upgrade service keeping Keycloak instances current with the latest versions while maintaining production availability.
• Architecture Review and Scaling Expert consultation on Keycloak architecture and scaling planning for 10x growth scenarios.
• Phase Two Connect On-premises deployment solution with guided IdP onboarding wizards, enabling software vendors to bundle Phase Two with their applications deployed at customer sites.
• Phase Two Admin REST API Public REST API enabling programmatic management of Keycloak deployments, realms, clients, users, organizations, and identity providers.

Quantifiable outcome

• 80% average cost reduction on identity spend compared to Auth0, Okta, Ping, WorkOS, and FrontEgg
• +2 more outcomes

Named customers12 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration22 records

Feature9 records

Partnerships

Three partnerships are on record, tiered core.

• Keycloak (Red Hat/Open Source)coreTechnology or IntegrationPhase Two is built on and extends Keycloak, the open-source identity and access management solution backed by Red Hat. As active community contributors, Phase Two authors the most popular Keycloak extensions and sponsors projects they believe in.
• CockroachDB (Cockroach Labs)coreTechnology or IntegrationCockroachDB distributed storage option for Phase Two's enhanced Keycloak, enabling horizontal scalability beyond standard Keycloak Infinispan limitations. Official CockroachDB partner recognized by Cockroach Labs.
• KeycloakifycoreTechnology or IntegrationPartnership with Keycloakify for building Keycloak themes using React components, enabling unified theme experience across login, admin, account, and email.

Scale indicators6 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Auth0 (Okta): Auth0 is the most direct competitor in the CIAM space and is explicitly named in Phase Two's head-to-head pricing comparisons. Both target SaaS companies needing enterprise SSO, social login, and multi-tenant identity — but Auth0 bundles a broader platform while Phase Two competes on cost and open-source portability.
• WorkOS: WorkOS is a direct competitor focused on enterprise SSO, SCIM, and directory sync for B2B SaaS — the exact buyer Phase Two targets. Phase Two even publishes a WorkOS-to-Keycloak migration tool, signaling feature-set overlap. Both sell to engineering teams adding enterprise auth to their SaaS products.
• Okta: Okta is the largest pure-play identity vendor and parent of Auth0. Phase Two explicitly lists Okta in its pricing comparison and names it as a migration source. Both serve enterprise SSO and CIAM use cases; Okta competes on platform breadth while Phase Two competes on cost and lack of lock-in.
• Ping Identity: Ping Identity is an enterprise IAM incumbent (taken private by Thoma Bravo). Phase Two cites Toppan Merrill replacing Ping + Okta as a flagship customer. Both compete for enterprise SSO and CIAM at Fortune 500 scale; Ping bundles workforce + customer identity while Phase Two focuses on CIAM via Keycloak.

Broad incumbents

• AWS Cognito: AWS Cognito is the cloud-incumbent alternative for CIAM, deeply integrated with the AWS ecosystem. While not a specialized IAM vendor, it competes for the same developer-led SSO/auth use case and is selected by AWS-native customers for convenience — similar buyer persona to Phase Two's self-service Starter tier.
• Microsoft Entra ID (Azure AD): Microsoft Entra ID is the default identity provider for enterprises on Microsoft 365 and a frequent federation target for Phase Two. While it serves both workforce and customer identity at massive scale, Phase Two positions as a more affordable, open-source alternative for customers seeking to escape Azure AD lock-in or augment it for CIAM use cases.

Emerging players

• Clerk: Clerk is a developer-focused CIAM platform targeting SaaS and B2B use cases with a similar self-service onboarding motion to Phase Two's PLG funnel. Both compete for engineering teams adding auth quickly; Clerk offers a more polished hosted UI while Phase Two offers open-source extensibility and cost predictability.
• Stytch: Stytch is an emerging CIAM player with strong passwordless, MFA, and B2B authentication primitives. Both target SaaS developers with modern APIs; Stytch leads on consumer auth flows while Phase Two leads on B2B/enterprise SSO and multi-tenant Organizations use cases.
• FusionAuth: FusionAuth is a self-hostable identity platform positioned similarly to running Keycloak in-house — a primary alternative for buyers Phase Two is trying to convert from DIY Keycloak. Both share the open-source-first ethos and target privacy-conscious / regulated workloads.

Others

• Red Hat (Keycloak upstream): Keycloak is the open-source IAM project stewarded by Red Hat on which Phase Two's entire product stack is built. While not a direct commercial competitor in managed hosting, Keycloak's roadmap, governance, and Red Hat's commercial interests directly shape Phase Two's opportunity set and risk profile.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks6 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/p2-inc
• YouTubeyoutube.com/channel/UCUY2ZvxI0hxpTWO_8w7MjVw
• LinkedInlinkedin.com/company/phase-two-keycloak

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Phase Two