RECOMMENDATIONS
Tools We Use
This page is short on purpose. It holds two kinds of entry: tools we would use ourselves, and vendor lists that put names to a category an article deliberately leaves unnamed. Each section says which it is, and how we are paid when we are.
If a link on this page is an affiliate link, a note beside it says so. Signing up through one would earn us a commission at no extra cost to you, and it would not change what we recommend or what we say about it. We link to a tool because we think it is worth your time, not because of the link.
Proton
Encrypted email, VPN, a password manager, and storage from a company whose business model is subscriptions rather than your data. Proton is based in Switzerland and open source on the client side. Mail is end-to-end encrypted between Proton accounts and for password-protected messages; ordinary email to other providers is not, and Proton's own documentation says exactly what is and is not covered. For a security team that wants privacy tooling without an advertising engine attached, it is an easy first recommendation.
Identity providers
Our articles argue for buying authentication rather than building it, and they name the category instead of a product so the argument does not age with a pricing page. This is the list of names behind that category, for readers who want somewhere to start. Each name links to the vendor's own documentation. We hold no affiliate relationship with any of them, none of these links pays us, and the order below is alphabetical rather than a ranking.
- Amazon Cognito. AWS's managed user pools and federation. The natural fit if you already run on AWS, priced per monthly active user beyond a free tier.
- Auth0 (Okta). The long-standing developer-focused option, with broad protocol support. Check which enterprise connections and provisioning features sit in which plan, because the matrix changes.
- Clerk. Component-first, aimed at product teams who want prebuilt sign-in, user profile and organisation UI rather than an API alone.
- Keycloak. The open-source, self-hosted route. No per-user bill, but you run, patch and scale it, which is the cost the other five are charging you not to carry.
- Microsoft Entra External ID. Microsoft's customer identity service, the natural fit when your buyers already live in Microsoft 365 and expect Entra single sign-on.
- WorkOS. Built around the enterprise checklist: single sign-on, directory sync and audit logs as the product, for teams that already have a login and need the features an enterprise buyer will demand next.
Names only, not endorsements. Before you commit, check current pricing and in particular how each vendor bills the enterprise features (single sign-on, directory sync, audit logs), because that is where the cost of this decision lives, however the vendor slices it.