Softwr

Developer Tools · head to head

Keycloak vs ThetaRay

Keycloak logo

Keycloak

Developer Tools

Open-source identity and access management server.

From
Free
Free plan
Yes
Full reviewWebsite
ThetaRay logo

ThetaRay

Cybersecurity

Unsupervised AI transaction monitoring for cross-border and correspondent banking

From
On request
Free plan
No
Full reviewWebsite

The short version

  • Only Keycloak has a free tier, so it costs nothing to try first.
  • Each has a real cost: Keycloak requires self-hosted deployment and operational expertise to install, configure and maintain; ThetaRay unsupervised models are harder to justify to an examiner than explicit rules, and some regulators still expect documented threshold logic, which can force you to run both systems.
  • Prices and features above were last checked on 1 September 2026.

Where they differ

Only the attributes on which Keycloak and ThetaRay actually diverge.

Attributes where Keycloak and ThetaRay differ
AttributeKeycloakThetaRay
Starting priceFreeOn request
Pricing modelopen-sourcequote
Free tierYesNo
PlatformsSelf-hosted, Docker, Kubernetes, Linux, Windows, APIWeb
CategoryDeveloper ToolsCybersecurity

Identical on both: user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in Keycloak

Nothing recorded that ThetaRay does not also cover.

Only in ThetaRay

  • Unsupervised detection
  • Cross-border focus
  • Sanctions screening
  • Alert triage
  • Customer risk scoring
  • Cloud native

What people use each for

The jobs each tool is most often brought in to do.

Keycloak

  • Organisations requiring self-hosted identity infrastructure for compliance or data residencynot ThetaRay
  • Companies with existing LDAP/Active Directory systems needing federated authenticationnot ThetaRay
  • Open-source projects and communities requiring free IAM without licensing costsnot ThetaRay
  • Enterprises building custom identity workflows requiring fine-grained authorisationnot ThetaRay
  • Teams with sufficient operational expertise to manage infrastructurenot ThetaRay

ThetaRay

  • A correspondent bank that cannot see the ultimate originator and needs behavioural signals rather than counterparty listsnot Keycloak
  • A cross-border payments fintech whose rules engine produces more alerts than its compliance team can clearnot Keycloak
  • A bank under a regulatory consent order needing demonstrable improvement in detection within a fixed periodnot Keycloak
  • A payment institution entering a high-risk corridor where existing thresholds were calibrated on domestic trafficnot Keycloak

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

Keycloak

  • Requires self-hosted deployment and operational expertise to install, configure and maintain
  • No managed cloud option provided by Red Hat; organisations must operate infrastructure themselves or use third-party distributions
  • Clustering and high-availability configurations require additional operational knowledge
  • Community support only; commercial support requires third-party vendors or distributions

ThetaRay

  • Unsupervised models are harder to justify to an examiner than explicit rules, and some regulators still expect documented threshold logic, which can force you to run both systems.
  • The alert reduction claim depends heavily on your data, so a parallel run is essential and adds months and cost before you can decommission the incumbent.
  • Coverage is strongest in cross-border and correspondent flows; institutions whose risk is domestic retail fraud will find the fit weaker than a general-purpose monitoring platform.
  • It is a smaller vendor than the incumbents, so integration connectors into legacy core banking systems are often bespoke work rather than a supported adapter.
  • Model retraining and tuning are vendor-led, which means changing detection behaviour is a support conversation rather than something your own analysts can do that afternoon.

Pricing, plan by plan

Keycloak

Free
  • Open-sourceFree
    • Full platform functionality
    • Self-hosted deployment
    • Community support

ThetaRay

On request
  • ThetaRay Sonar$undefined/year
    • Priced by monitored transaction volume and number of monitored entities
    • SaaS on Azure with regional data residency options
    • Parallel run and model tuning included in onboarding

Which should you pick?

Choose Keycloak if

  • You want to start without paying.
  • You work on Self-hosted, Docker, Kubernetes, Linux, Windows, API.
Keycloak review

Choose ThetaRay if

  • You need unsupervised detection.
  • You also want cross-border focus.
ThetaRay review

Questions people ask

Is Keycloak or ThetaRay better?
Neither clearly leads. Keycloak starts at Free and ThetaRay at On request, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, Keycloak or ThetaRay?
Keycloak has a free tier; the other does not. Paid plans start at Free for Keycloak and On request for ThetaRay.
Does Keycloak or ThetaRay run on more platforms?
Keycloak runs on Self-hosted, Docker, Kubernetes, Linux, Windows, API. ThetaRay runs on Web.
Can I use Keycloak for free?
Yes. Keycloak has a free tier, so you can try it without paying. ThetaRay starts at On request.
What is Keycloak best used for?
Keycloak is most often used for organisations requiring self-hosted identity infrastructure for compliance or data residency, companies with existing ldap/active directory systems needing federated authentication, open-source projects and communities requiring free iam without licensing costs, enterprises building custom identity workflows requiring fine-grained authorisation. Of those, organisations requiring self-hosted identity infrastructure for compliance or data residency and companies with existing ldap/active directory systems needing federated authentication are not what ThetaRay is typically brought in for.
What can Keycloak do that ThetaRay cannot?
ThetaRay covers Unsupervised detection, Cross-border focus, Sanctions screening, Alert triage.

Answered from the vendors’ own pages

Keycloak: What protocols does Keycloak support?

Keycloak supports OpenID Connect, OAuth 2.0 and SAML 2.0 protocols for authentication and authorisation.

Source
ThetaRay: Does it replace a rules engine entirely?

Rarely on day one. Most institutions run it alongside existing rules during a parallel period, and some keep specific regulator-mandated rules permanently.

Keycloak: Can Keycloak integrate with existing user directories?

Yes. Keycloak supports user federation with LDAP and Active Directory systems, allowing organisations to leverage existing user directories.

Source
ThetaRay: Where is the data processed?

SaaS runs on Microsoft Azure with regional deployment options, which is the mechanism for meeting data residency conditions in regulated markets.

Keycloak: Is Keycloak free?

Yes. Keycloak is fully open-source and free to deploy and use. No licensing fees are required.

Source
ThetaRay: Is sanctions screening included?

Screening is available on the same platform but licensed as part of the commercial package rather than bundled by default. Confirm it is in your quote.

Share

Related pages

More on Keycloak

More on ThetaRay

Keep looking

Other head to heads