Your users' identity data stays in Europe. Full stop.
Passwordless sign-in, OIDC and sessions on EU-resident infrastructure with no US cloud — and the plane that holds the data can be brought in-house.
Magic link · TOTP 2FA · OIDC provider · No password table
Sign in
Check your inbox
A single-use link is on its way to you@acme.eu.
Signed in
Session opened on the data plane.
No password
Jurisdiction is a product feature.
A US-headquartered vendor can be compelled under US law to hand over data, wherever it physically sits. Timonier is an EU company, and your end-users' records are stored and processed under EU jurisdiction by architecture rather than by policy.
- Cloud Act
- Schrems II
- Adequacy decisions
-
EU residency
Identity records, sessions and tokens stored and processed inside the European Union. No third-country transfers.
-
Accountable by design
Every operator action that changes a user or a project is recorded: who did it, and what it touched.
-
No US cloud
No US-headquartered hyperscaler in the stack, and lean enough to run on a single modest machine.
Identity data does not cross this line.
The plane that holds your end-users lives on infrastructure you can own. The SaaS half configures it and never becomes its system of record.
The end-user browser and the operator dashboard both talk to the data plane directly; neither reaches end-user records through the control plane. The data plane holds users, sessions, tokens and attributes. Two things cross the boundary into the control plane: configuration, which the data plane reads from it, and an operator audit trail, which the data plane writes to it. Emails, session records and attributes do not cross.
Even on the hosted plan, your operators' browsers fetch end-user records from the data plane directly. The control plane holds configuration and an audit trail of who did what, and is not the system of record for end-user identity.
One attribute change, three domains.
Authentication is the way in. What your users do next flows to targeting and to automation — and when they ask to be forgotten, that flows too.
First flow: your application calls CDP with a subject's attributes. CDP
writes a subject.attributes.updated event, which is
delivered independently to feature flags and to automation —
the two are parallel consumers of the same event, and neither is
downstream of the other. Second flow: a self-serve account erasure in
auth calls CDP, which drops the subject and emits
subject.erased, again delivered independently to feature
flags and to automation.
Linking a subject to a signed-in user is a call your application makes, so you decide what Timonier ever learns about them. Everything downstream of that call is ours to deliver — including the erasure.
Scaffold your auth in one command.
The Next.js SDK writes the BFF route, your env file and the layout wrapper, so tokens stay server-side.
# Scaffold the BFF handler, env file, and layout wrapper
npx timonier-nextjs init
# Required env vars written by init:
# TIMONIER_PLATFORM_URL=https://auth.example.com
# TIMONIER_PROJECT_SLUG=acme
# TIMONIER_APP_SLUG=my-app
# TIMONIER_SESSION_SECRET=<generated 32-byte secret>
# server.ts — route handler
import { createAuthRouteHandlers } from "@timonier/nextjs/server";
export const { GET, POST } = createAuthRouteHandlers();import { createClient } from "@timonier/browser";
const client = createClient({
projectSlug: "acme",
appSlug: "my-spa",
clientId: "01234567-89ab-cdef-0123-456789abcdef",
baseUrl: "https://auth.example.com",
});The browser SDK is published but still early — token management, PKCE and session APIs are landing incrementally. For production SPAs today, point any OIDC client at the discovery document.
# Point any standard OIDC client at the discovery URL:
GET https://auth.example.com/.well-known/openid-configuration
# The document exposes authorization_endpoint, token_endpoint,
# jwks_uri, and userinfo_endpoint. Works with standard OIDC
# client libraries — no proprietary glue required.Or run the whole data plane yourself.
Hosted by default, yours to bring in-house when you need it. Same software either way.
Self-hosting will cost less.
Nothing is priced yet. Hosted or self‑hosted, we run the control plane — so neither is free. Write to us and we agree terms directly.
Questions people actually ask.
No new claims here: every answer restates something already on this site.
Where is end-user identity data stored?
End-user identity data is stored and processed inside the EU, whether you self-host it or we do. That covers users, sessions, tokens and attributes alike, with no third-country transfers.
Can I self-host it?
Yes. The data plane that holds your end-users' identity is built to run on your own infrastructure, on the same software as the hosted plan. That path isn't a self-serve download yet; write to us and we set it up with you directly.
Is it an OIDC provider, and will my existing OIDC integration work?
Yes, we're a standards-based OpenID Connect provider: discovery, JWKS and the authorization-code flow. If your app already talks to a generic OIDC client, pointing it at a new issuer with a new client ID and secret covers the protocol layer; anything built against a vendor-specific API is a separate piece of work.
Do you support social sign-in, like Google or GitHub?
No, and it's a deliberate choice, not a gap we're filling. Federating sign-in to a third-party identity provider would put that provider on the authentication path, which runs against keeping identity under EU jurisdiction, so if one-click social signup is central to your product, that alone may rule us out.
Is any US cloud provider part of the stack?
No. Hosting and every third-party provider are EU-based, with no US-headquartered hyperscaler anywhere in the stack.
Do you support passwords?
No. There's no password table at all: sign-in is a magic link plus optional TOTP two-factor. That means there are no password hashes to store, leak, or migrate.
How is this different from Auth0 or Clerk?
Differently for each: jurisdiction, integration shape and operational trade-offs are three separate arguments, not one argument three times. We've written a dedicated, sourced comparison for each vendor rather than a single verdict, and none of them claims we win on every point.
What does it cost?
Self-hosting will cost less than the hosted plan. Neither is free, and we run the control plane in both arrangements. Nothing beyond that is decided yet: no figure, no tier, no billing basis.
More detail, vendor by vendor: Timonier vs Auth0, Timonier vs Clerk, and Timonier vs Keycloak, or see all comparisons.
Keep authentication in Europe, by design.
EU jurisdiction is the default, not a setting.
Get started