Skip to content
For B2B SaaS

Sell to companies. Their IT will ask for SSO.

Organisations, roles, enterprise SSO and SCIM are built in, so the security questionnaire stops being the thing that stalls the deal.

Start freeSee pricing
The problem

The enterprise checklist arrives with your first big customer

SAML, SCIM and per-customer roles take months to build and never feel finished.

Most providers keep SSO behind an enterprise contract you can't justify for one customer.

Customers want their own admins to invite people, change roles and enforce SSO, without filing tickets with you.

How Anchr.ing helps

Organisations from day one

Organisations and roles

Invites, org switching and custom org roles, with the active org and its role in the token.

Enterprise SSO and SCIM

SAML 2.0 or OpenID Connect per organisation, verified domains, enforced SSO with break-glass owners, SCIM 2.0.

A project per product

Separate projects for each product or region, each with a test and a production environment.

Your domain, your brand

Sign-in on auth.yourcompany.com with your logo and colours, and no Anchr.ing badge.

Isolation by design

Your users never share a database with anyone else's

Every Anchr.ing customer gets its own namespace, with test and production in separate databases. Our server reaches yours only through its own database user, so a bug in our code can't read across to another customer: the database refuses the query.

Security overview
How customers are kept apartEach customer has its own namespace with separate Test and Production databases. Each environment holds its own users, apps, sessions and tokens, signing key and database user. A request from customer A's production app reaches only A's production database: a query from it towards customer B is refused by the database itself, and test never trusts production. A's production app Anchr.ing server Customer Aown namespace TestUsersAppsSessions, tokensSigning keyDatabase user ProductionUsersAppsSessions, tokensSigning keyDatabase user Test never trusts production Customer Bown namespace TestUsersAppsSessions, tokensSigning keyDatabase user ProductionUsersAppsSessions, tokensSigning keyDatabase user The databaserefuses How customers are kept apartEach customer has its own namespace with separate Test and Production databases. Each environment holds its own users, apps, sessions and tokens, signing key and database user. A request from customer A's production app reaches only A's production database: a query from it towards customer B is refused by the database itself, and test never trusts production. A's production app Anchr.ing server Customer Aown namespace TestUsersAppsSessions, tokensSigning keyDatabase user ProductionUsersAppsSessions, tokensSigning keyDatabase user Test never trusts production Customer Bown namespace Test Production The database refuses
One token

Every check reads the same token

When a user signs in, their token carries who they are, their organisation and role, their plan and payment status, and what your flags target. Your API checks it in one guard, offline, and your UI reads the same answers.

Identitywho signed in, and howsub · amr
Rolesthe organisation and what it allowsorg.role
Billingthe plan and its payment statusbilling.plan
Flagswhat is switched on for this userflag()
In your code

Every customer is an organisation

SSO connections and SCIM are set up in the dashboard, by you or by the customer's own admin.

Read the guide
orgs.ts
// In your app: a customer's admin sets up their team
const org = await auth.orgs.create({ name: 'Northwind' });   // the user is its owner
await auth.switchOrg(org.id);                                // new tokens speak for Northwind
await auth.orgs.invite(org.id, { email: 'it@northwind.example', role: 'admin' });

// In your API: only that organisation's admins
app.put('/api/settings', auth.require('settings:write', { orgRole: 'admin' }), saveSettings);
The plan

Team in numbers

Prices in euros, excluding VAT. Test environments include every feature on every plan.

Compare all plans
€99

a month, or €990 a year (two months free)

1

enterprise SSO connections with SCIM, then €75 a month each

3

projects, each with test and production

50,000

monthly active users, then €2 per 1,000 more

Questions

Before you start

Can each customer's admins manage their own people?

Yes. Owners and admins of an organisation invite members, change roles and remove people. Members a directory provisions with SCIM stay the directory's.

Can we try a customer's SSO before it goes live?

Yes. Set up the connection in your test environment and run the dashboard's connection test before production.

What if we need more SSO connections?

Add them to Team as you sign more business customers, or move to Scale, which includes more. The numbers are below.

Be ready when the big customer says yes

Build organisations and SSO in test for free, and switch to Team when your first business customer signs.

Create your free accountGetting started
Free to start. No card needed.
Who it's for

For developers

The Free plan

For startups

The Startup plan

For agencies

The Team plan

For scale-ups

The Scale plan

For enterprise

The Enterprise plan

Sovereign and public sector

The Sovereign plan

Compare all plans

Every plan side by side, and the questions people ask before paying.