Govern who can access what, and for how long.

Sign-in and access governance for your workforce, on one identity record. Use Galeo for sign-in with passkeys and PIV / CAC smart cards, or keep Entra ID or Okta and govern access here.

Start free Talk to sales

Commercial SaaS, with an on‑prem option.

Identity Platform

Verified: A. Rivera; Passkey, 9:02 AM

Identity Governance

Requested: Payroll · Approver; Finance, Region 4
Approved: Division lead; 9:14 AM, logged
Expires: In 90 days; Renew by request

Example credentialStep 1 of 4: Verified

One identity record behind sign-in and access.

On the card above, Identity Platform verified the sign-in and Identity Governance handled the request, approval, and expiry. Both work from the same user record, so access always reflects who someone is today.

Identity Platform

Secure sign-in for every app.

Single sign-on: SAML 2.0, OIDC, and OAuth 2.0 for any app that supports a standard protocol.
MFA: Passkeys, TOTP, and PIV / CAC smart cards on every plan, with risk-based step-up. SMS codes on Professional.
Directory sync: Microsoft Entra ID, Google Workspace, LDAP, and SCIM.

Identity Governance

The right access, for the right amount of time.

Requests: Self-service requests. Approvals branch by role, user type, or department, run in parallel, and show the requester every step ahead.
Reviews: Managers renew or revoke their team's access. Nobody can renew their own.
Expiry: Every application grant has an end date, and access that goes unused can be removed automatically.

Every feature, by plan

Already on Entra ID or Okta? Keep it.

Galeo works alongside the identity tools you already run. Start with governance, and move sign-in over when you're ready, or not at all.

Your directory: Sync people from Entra ID.; New hires, changes, and departures flow into Galeo, and an account turned off in Entra ID is turned off here. Google Workspace and LDAP work the same way.
Your sign-in: Sign in through Entra ID or Okta.; Galeo accepts sign-in from Microsoft Entra ID and from any SAML 2.0 or OpenID Connect provider, including Okta. People keep the sign-in they know.
Galeo: Govern access in one place.; Requests, approvals, reviews, and expiry for every app, with SCIM provisioning to the apps that support it.

See it in the admin console.

An approved access request in the Galeo admin console: Ana Rivera requested the Payroll Approver role, with her justification and an approval trail showing her manager and the app owner approving, each with a comment and time. — **Access requests.** Who asked, what for, and every approval with its reason.

The Finance system access workflow: a request form with a service desk ticket number, access end date, and justification, and a flow of manager approval, then app owner approval, then grant access. — **Approval workflows.** Custom request forms and multi-step approvals.

The Payroll application's User Access list: four people with their roles and expiry dates, two expiring soon, each with a Renew button. — **Role holders.** Everyone with access to an app, and when it expires.

Example organization with sample data.

Security built in.

Sign-in: Phishing-resistant sign-in with passkeys and PIV / CAC smart cards.
Encryption: TLS 1.3 on every endpoint, and AES-256 encryption at rest.
Audit: Audit entries can't be edited or deleted through any admin API.
Controls: Designed to SOC 2 controls and FedRAMP 20x Class C requirements.
FedRAMP 20x: Preparing for FedRAMP 20x (Class C), with continuous automated validation of our controls since September 2026.
SIEM: On Identity Governance, security events stream to Splunk, syslog, Amazon SNS, or any HTTPS endpoint.

Security overview