Signed DPA included on every paid plan

Authentication,
built in Europe.

Passura handles passwordless and password sign-in, MFA, API keys, and agent identity for EU teams that need GDPR by default — not by checkbox. Hosted in the EU, never anywhere else.

Start free Read the docs

2,000 monthly active users freePasswordless sign-in built inMinutes from cURL to first loginNo US sub-processors

// create a session — REST, no SDK required
const res = await fetch(
  'https://api.passura.dev/v1/acme/auth/login',
  {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email, password }),
  },
)

// 15-minute access token + rotating refresh
const { accessToken } = await res.json()

Built for EU teams shipping to regulated markets

GDPR by defaultEU-hostedSigned DPAArgon2idRefresh-token rotationData export & erasure

What you get

Three things we got tired of waiting for someone else to build.

GDPR is the default

Data stays in the EU because we run nowhere else. Signed DPA included on every paid plan, sub-processor list short and public, erasure and export built in.

OVHcloud · Gravelines, France

Easy on purpose

One tenant, one console, readable docs and an OpenAPI spec. Built by engineers who got tired of fighting Okta and Auth0 to do simple things.

cURL → live in minutes

Ready for AI

First-class agent identity over MCP, scoped API keys, and machine-to-machine flows. Auth that understands half your users are not people.

MCP · API keys

Passwordless authentication

The safest password is the one you never stored.

Passwordless login ships in Passura today: your user types their email, gets a six-digit code, and types it back. Nothing to reset, nothing to phish, nothing to leak in a dump. Two REST calls, and every attempt lands in the audit log.

Your policy, per workspace: Codes alongside passwords, or codes as the only way in. Off by default.
Codes that expire: Valid 10 minutes, burned after 5 wrong guesses, and rate-limited per email and IP.
MFA still applies: An emailed code is a first factor. Your TOTP policy is enforced on top of it.
Sign-up in the same step: Opt into just-in-time provisioning and a first code creates the account.

Read the passwordless guide

two calls

# 1. mail the user a 6-digit code
curl -X POST \
  https://api.passura.dev/v1/acme/auth/request-login-code \
  -d '{ "email": "[email protected]" }'

# 2. spend it — same token envelope as /login
curl -X POST \
  https://api.passura.dev/v1/acme/auth/verify-login-code \
  -d '{ "email": "[email protected]", "code": "482913" }'

Sovereignty by default

Your users' data does not leave the EU. Ever.

Passura runs on EU infrastructure, and only there. Backups are encrypted at rest in the same region that wrote them. No US parent company, no Schrems exposure, no quiet sub-processor in Virginia.

Hosted in

OVHcloud · Gravelines, France

Data residency

EU only

Sub-processors

Short, public list

Schrems II

N/A — no transfers

Map of Europe with the 27 EU member states highlighted — EU-27Rest of Europe

PENDING — confirm before launch

Founder, Passura

LinkedIn GitHub

Who is behind Passura

You should know who signs the DPA.

Passura is built by PENDING — confirm before launch, who spent five years as a Staff Software Engineer at Thoropass, a compliance automation platform, and before that worked at Globant.

Five years inside a GRC product is five years watching companies fail audits over their identity layer — access reviews nobody can evidence, audit trails with gaps, user data in regions the questionnaire did not expect. Passura exists because those problems are cheaper to solve at the authentication layer than to remediate afterwards.

Contracting entity

Passura is operated by PENDING — confirm before launch, NIF PENDING — confirm before launch, registered at PENDING — confirm before launch. That is the counterparty on the data processing agreement — not a holding company, and not a brand name with nobody behind it.

Capabilities

The auth you need. Nothing you didn't ask for.

Passwordless or password

A six-digit code by email, an Argon2id-hashed password, or Google sign-in — you pick which per tenant.

MFA

TOTP authenticator apps and email one-time codes, enforced or optional per tenant.

API keys

Scoped live and test keys for server-to-server calls, revocable from the console.

Audit log

Every auth event recorded, searchable in the console, and scoped to your tenant.

Agent identity

Connect Passura to Claude Desktop over MCP and drive scoped, read or write operations.

GDPR tooling

Right to erasure and JSON data export built in, with a 30-day grace period before hard delete.

Pricing

One number, no add-ons.

MFA, API keys, the audit log, and the signed DPA are in every paid tier.

Free

€0

Forever, up to 2,000 monthly active users

Passwordless, email & Google sign-in
TOTP + email OTP
API keys & audit log
EU hosting

Start free

StarterRecommended

€19

/ month · up to 10,000 MAU, then €0.015 / MAU

Everything in Free
Signed DPA, included
Data export & erasure
Email support