The cost of production-ready software
Every time you move a side project toward production, the list of required infrastructure grows. An auth system. A place to keep secrets. A way to toggle features without a deploy. Something to record what happened when a request failed. Something to notice when a user stopped returning.
These are not optional. But each piece ships today as a separate product, with its own vendor relationship, its own runtime stack, and documented resource requirements that compound. Keycloak, a common IAM starting point, documents 1,250 MB base memory per pod, with a minimum of two pods.1 Infisical's self-hosting guide puts the baseline for secrets management at roughly 16 GB across three required services.2 Add observability, feature flags, and notifications, and a conventional stack reaches 18–21 containers and $540–640 per month on AWS before the first customer — derived from vendor-documented minimums.3
The monthly bill is not the real cost. The real cost is the operational surface: cross-service tokens to rotate, rate limits to track, per-tool onboarding for every new engineer, and vendor dashboards you cannot inspect. Auth tokens, secret material, and production telemetry live on servers under pricing terms that change on someone else's schedule.
The premise
SOMA's answer is to build the features those products actually need — the top 5–10 per category — in Rust, and add more only when real usage demands it. Less software means fewer moving parts, a smaller attack surface, and a bill proportional to actual work. The footprint is small because there is deliberately less software.
soma-control runs IAM, a secrets vault, feature flags, and a licensing engine from one port, one process, and one Postgres connection pool. These four services are not actually independent: IAM issues the tokens that vault and flags check on every request. Licensing meters the usage that flags gate. Combining them removes four connection pools and four orchestration targets without sacrificing tenant isolation.
The enterprise checklist
The most common objection when evaluating self-hosted IAM is the enterprise checklist: SAML, SCIM, WebAuthn, multi-tenant RBAC. soma-iam ships all of those. SAML 2.0 federation, SCIM 2.0 provisioning, WebAuthn/Passkeys with AES-256-GCM credential encryption, OIDC with JWKS-published ES256 keys, multi-tenant RBAC with deny overrides, M2M tokens, device authorization flow — none of it gated behind a tier. The checklist objection partially answers itself by reading the documentation.
What is honest to say: the production history is short. The code is correct and auditable; the deployment count is not yet large. That matters for evaluating risk, which is why the roadmap page shows the real state of every component rather than the state we wish it were.
What SOMA omits
SOMA does not implement every feature each incumbent offers. That is design, not immaturity. Incumbents cover niche protocols, legacy integrations, and configurations the majority of products never use. Adding all of it adds code, dependencies, and surface area. SOMA ships what recurring use cases actually require. When a feature is absent, the code is on GitHub.
The hosted track
Self-hosting is the primary model. A hosted track is also planned: small, focused API services — OTP and verification, transactional email, webhooks, cron, audit-log-as-API — built on the same Rust substrate and eventually deployed serverless. No pricing exists yet. A waitlist is open for teams that want early access.
The demonstration
This website runs on soma-control. The metrics in the status widget above are live readings from the process currently serving this page. The product claim is demonstrated by the page itself, not a screenshot and not a benchmark.
The code is on GitHub.
One more thing worth stating plainly: SOMA is in beta. The production history is short. Evaluate accordingly. Everything — every suite, every DevKit library, every SDK, this website — is Apache 2.0. There is no open-core split and no plan to relicense.
- keycloak.org/high-availability — 1,250 MB base per pod; minimum 2 services required for the external database dependency.
- infisical.com/docs — ~16 GB across 3 required services: app containers + PostgreSQL 8 GB + Redis 4 GB.
- Derived from the documented minimums above; AWS us-east-1 on-demand pricing. Vendor minimums are for idle/light load and grow with usage. SOMA targets are early-stage and pending production-scale validation.