Security and compliance
SAML SSO, SCIM provisioning, MFA, audit logging, and whether a provider can be self-hosted — spanning auth, secrets management and observability, wherever a provider actually documents one of these. Every figure is sourced; a blank cell means undocumented, not "no."
Identity and access
| Provider | Category | SAML SSO | SCIM | MFA | Audit logs | Self-hostable |
|---|---|---|---|---|---|---|
| Auth0 | Authentication | Supported | Supported | Supported | Audit log streaming to Datadog, Splunk, AWS and Azure, from the Essentials plan up. Auth0 publishes no retention window on the pricing page. | — |
| Better Auth | Authentication | Supported | Supported | Supported | 10,000 audit log events a month with 1-day retention on the free Starter plan; 20,000 on Pro, then $0.0001 per event. | Supported |
| Clerk | Authentication | Supported | Supported | Supported | Application logs with 1-day retention on the free Hobby plan; longer retention is a paid-plan feature Clerk lists without publishing the window. | — |
| Doppler | Secrets management | — | — | — | 3 days of activity log retention on Developer (free), 90 days on Team, custom retention on Enterprise. | — |
| Elastic Cloud | Error tracking and observability | — | — | — | Not documented | Supported |
| GlitchTip | Error tracking and observability | — | — | — | Not documented | Supported |
| Grafana Cloud | Error tracking and observability | — | — | — | Not documented | Supported |
| Infisical | Secrets management | — | — | — | None on Free. 30-day retention on Pro, 90-day on Advanced, custom retention on Enterprise. | — |
| Kinde | Authentication | Supported | — | Supported | Not documented | — |
| OpenObserve | Error tracking and observability | — | — | — | Not documented | Supported |
| Sentry | Error tracking and observability | — | — | — | Not documented | Limited |
| SigNoz | Error tracking and observability | — | — | — | Not documented | Supported |
| Stytch | Authentication | Supported | Supported | Supported | Not documented | — |
| SuperTokens | Authentication | — | — | Supported | Not documented | Supported |
| WorkOS | Authentication | Supported | Supported | Supported | Billed rather than bundled: $125 per month per SIEM connection for log streaming, plus $99 per month per million events stored. | — |
Compliance certifications
Yes/No/— compresses each provider's own sourced wording — a self-certification reads differently from an audited report, and the full nuance is one click away on the provider's own page. "No" only appears where a provider explicitly documents the absence (Clerk's own page says plainly it is not ISO 27001 certified); a dash means undocumented, never assumed.
| Provider | Category | SOC 2 | ISO 27001 | HIPAA | GDPR | PCI DSS |
|---|---|---|---|---|---|---|
| Amazon S3 | Object storage | Yes | — | Yes | — | — |
| Auth0 | Authentication | Yes | Yes | Yes | Yes | Yes |
| AWS Secrets Manager | Secrets management | Yes | — | Yes | — | — |
| Clerk | Authentication | Yes | No | Yes | Yes | No |
| Doppler | Secrets management | Yes | Yes | — | — | — |
| Kinde | Authentication | Yes | Yes | Yes | Yes | — |
| Neon | Managed databases | Yes | Yes | Yes | Yes | Yes |
| Netlify | Frontend and serverless | Yes | Yes | Yes | Yes | Yes |
| Postmark | Transactional email | — | — | — | Yes | — |
| Railway | Application platforms | Yes | — | Yes | Yes | — |
| Resend | Transactional email | Yes | No | No | Yes | — |
| Sentry | Error tracking and observability | Yes | Yes | Yes | — | — |
| Supabase | Managed databases | Yes | Yes | Yes | Yes | — |
| Vercel | Frontend and serverless | Yes | Yes | Yes | No | Yes |
| WorkOS | Authentication | Yes | — | Yes | Yes | — |