Soffid is a Spanish identity and access management vendor that gives organisations one platform to control who can access what. Its buyers include governments, multinationals, telecoms operators and universities that need to control access for staff, partners and machines across cloud, on-premises and legacy systems.
The problem it addresses is fragmentation: when sign-in, provisioning and privileged access are bought separately, no system holds a complete view of a person’s or a machine’s access.
At A Glance
| Vendor | Soffid |
|---|---|
| Category | Identity and access management, IGA, PAM, ITDR |
| Identities covered | Employees, administrators, partners, suppliers, customers, contractors, applications, APIs and services |
| Deployment | On-premises, Soffid cloud, customer cloud or hybrid |
| Market classification | Identity Verification |
What Soffid Does
Organisations often run access management, governance and privileged access as three products with three views of who a person is. Soffid replaces that with one identity model shared by every module, which sits on top of and around the directory a customer already has and governs access to cloud, on-premises and legacy applications from there.
The same platform covers people outside the organisation, such as suppliers and contractors, and privileged and non-human accounts, including administrator accounts, service accounts and infrastructure credentials.
Products
Access Management (AM)
Soffid AM gives users one sign-in for on-site and cloud systems through its Login-Once feature. It suits organisations that need to support many authentication methods at once, from passwords and certificates to OTP, TOTP, FIDO2, push, biometric, NFC, RFID, SMS, email and eCall.
Identity Governance Administration (IGA)
Soffid IGA takes the manual work out of joiners, movers and leavers by creating, changing and deleting accounts automatically. Administrators define and enforce access policies, apply role-based access control and keep users at least privilege. Identity Risk and Compliance (IRC) and Identity Analytics add reporting on access risk.
Privileged Access Management (PAM)
Soffid PAM controls the accounts that can do the most damage: internal administrators, system accounts and external vendor accounts. Access is granted on demand and removed when no longer needed, sessions are monitored and recorded in real time with every event audited, and the secrets used by service accounts, API keys and automation are stored and rotated.
Identity Threat Detection And Response (ITDR)
Soffid ITDR detects identity threats, responds automatically and assigns remediation tasks to the security team. It analyses the behaviour of employees, privileged accounts, third parties, bots and automated systems, and monitors hybrid Active Directory and cloud identity threats.
How It Works
Customers can run Soffid on their own servers or use Soffid’s cloud service, and can also deploy it in their own cloud or in a hybrid arrangement.
| Component | What it does |
|---|---|
| Shared identity model | All modules are parts of one product and work from the same identity model. |
| Connectors | Pre-built connectors link the platform to common directories, and a connector framework covers custom, homegrown and legacy applications. |
| Governance layer | IGA can sit on top of whatever provisioning or access management an organisation already runs. |
| Detection output | ITDR alerts feed existing SIEM and ticketing workflows. |
Identities And Systems Covered
| Internal users | Employees, administrators and partners. |
|---|---|
| External users | Suppliers, customers and contractors. |
| Non-human identities | Applications, APIs and other services, plus system accounts with privileged access to resources. |
| Secrets | Service account credentials, API keys and automation credentials. |
| Directories | Hybrid Active Directory and cloud identity sources. |
| Applications | Cloud, on-premises and legacy systems. |
Company Background
| Founded | 2013. |
|---|---|
| Headquarters | Palma de Mallorca, Spain. |
| Leadership | Josep Lluís Vidal (CEO). |
| Certification | Common Criteria EAL2 certificate issued by the Centro Criptológico Nacional (2025), and listed in the CCN STIC catalogue linked to the Spanish Esquema Nacional de Seguridad. |
| Recognition | Included in the KuppingerCole Leadership Compass for Identity Governance and Administration (August 2024). |
Note: This overview is compiled from Soffid’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.