bare.ID — German-built, German-hosted identity & access management
Authentication, authorisation, single sign-on and MFA — GDPR-native, German engineering. Implemented and operated by Passeca for buyers who cannot place identity data outside the EU.
bare.ID is an identity and access management (IAM) platform — authentication, authorisation, single sign-on and MFA — that is German-built, German-hosted and GDPR-native. Passeca implements, integrates and operates bare.ID, wiring identity context into PassIRP and PassAI-Guard so it enriches detection and response. For public sector, Mittelstand and BSI C5 buyers, the hosting is a purchasing criterion.
What does bare.ID do?
The identity layer of the Passeca stack — engineered and hosted in Germany.
bare.ID provides the identity and access management capabilities modern organisations need: single sign-on, multi-factor authentication, federated identity, role-based access control, and user provisioning. It authenticates users, authorises their access, and provides the identity context that other security controls rely on.
The defining characteristic is sovereignty. Identity data is among the most sensitive an organisation holds, and bare.ID keeps it in Germany under GDPR by architecture. For the buyers Passeca serves in the public sector and regulated industries, that is the prerequisite, not a feature.
Capabilities at a glance
Protocols & standards
- SAML 2.0: SSO and federation, signed and encrypted assertions, IdP-initiated SSO
- OpenID Connect and OAuth 2.0: Authorization Code with PKCE for web, SPA and mobile apps; Client Credentials for machine-to-machine and IoT
- SCIM 2.0 for user provisioning into bare.ID
- Kerberos for Windows desktop SSO, and RADIUS for network and legacy systems
MFA & passwordless
- Passkeys and FIDO2/WebAuthn security keys (e.g. YubiKey), with fingerprint or face verification on the user's device
- Authenticator-app TOTP and hardware TOTP tokens
- Email and SMS one-time codes, plus single-use recovery codes
- X.509 client certificates and smart cards
- Policy controls: mandatory or optional MFA, trusted-network exceptions, MFA after external IdP login, per-application step-up authentication
Directories & identity sources
- Built-in bare.ID directory, or Active Directory / LDAP (LDAPS, StartTLS) in read-only, writeable or unsynced mode
- On-premises AD connected over an outbound WireGuard tunnel, so the directory is not exposed to the internet
- Microsoft Entra ID federation and SCIM provisioning; Windows SSO via Kerberos or AD FS
- Any enterprise SAML or OIDC IdP; social logins (Microsoft, Google, Apple, GitHub, GitLab, LinkedIn); BundID, ELSTER Unternehmenskonto and BayernID for eligible public-sector organisations
Some capabilities, including SMS OTP, Kerberos, RADIUS, certificate login, SCIM and advanced authentication flows, depend on the bare.ID subscription or need activation. Passeca confirms availability during scoping.
What Passeca adds
Implementation, integration, tuning, and managed operation — plus identity context into PassIRP.
An IAM platform is only as good as its integration. Passeca deploys bare.ID, integrates it with the application estate and existing directories, configures the authentication and access policies, and operates the service day-to-day — onboarding, offboarding, access reviews, and policy tuning.
Identity context from bare.ID also enriches the Passeca stack. When PassIRP or PassAI-Guard handles an alert involving a user, the user's identity context, such as roles and group memberships, is available, making triage and response faster and more accurate. Identity becomes part of the detection and response picture, not a separate silo.
Who is bare.ID + Passeca for?
Buyers for whom a German-hosted, GDPR-native identity platform is a requirement.
- German public sector and BSI C5 scoped organisations, including citizen and business login through BundID, ELSTER Unternehmenskonto and BayernID.
- Mittelstand companies with data-residency obligations for identity data.
- Organisations re-platforming IAM onto a sovereign, GDPR-native provider.
How to buy bare.ID through Passeca
From identity-estate scoping to a managed IAM service.
Passeca scopes the identity estate and application portfolio, deploys bare.ID, configures authentication and access policies, integrates it with directories and applications, and offers ongoing managed operation of the IAM service.
bare.ID and Passeca, answered
The questions EU-regulated buyers ask about sovereign identity and access management.
What is bare.ID?
Why does 'German-built, German-hosted' matter for IAM?
What does Passeca add to bare.ID?
What IAM capabilities does bare.ID provide?
How does bare.ID integrate with Passeca platforms?
Who is bare.ID + Passeca for?
Can bare.ID replace Active Directory or Entra ID?
How do I buy bare.ID through Passeca?
Passeca scopes the identity estate and application portfolio, deploys bare.ID, configures authentication and access policies, and offers ongoing managed operation of the IAM service.
Request a demoIdentity and access management, hosted in Germany
Request a bare.ID demo and Passeca will scope your identity estate, show the authentication and access capabilities, and plan the integration with your applications and the PassIRP detection workflow.
Related