Nova IAM, home
Request a demo
Request a demo

For IAM leads replacing SAP IDM

SAP IDM is being retired. Your audits are not.

Identity governance for SAP, Active Directory and Entra ID: Nova IAM shows what deviates from the target state for each user, with a severity rating and, where possible, a suggested fix. Your team decides.

Nova runs on your own infrastructure. You pay for the implementation and an annual maintenance fee by size class, with no per-user charges.

Request a demo How the 90-day pilot works ↓

30 minutes on the demo system via video call, with your questions.

Nova dashboard: key figures for users, pending requests, risk and systems, plus compliance posture, pending approvals, system health and HR integration (open enlarged view)
Nova dashboard (detail, tap to see the full image) · demo tenant of a fictitious insurer, fictitious people and data

News

Recent Nova IAM releases

  • 2026.08.2 · August 2026 · new

    AI healthcheck per user

    One run checks accounts, assignments, provisioning and reconciliation per user: 19 checks in four groups, each with a severity, 11 of them with a suggested fix.

  • v0.9.5 · August 2026

    New frontend on Vue 3

    The UI rebuilt from the ground up: Vue 3 with TypeScript, light and dark mode, redesigned views for dashboard, role mining and governance, at full feature parity.

  • v0.9.4 · August 2026

    AI agents as a first-class identity type

    AI agents with a mandatory owner, purpose and expiry date; ownership succession in the leaver process, a dedicated recertification scope and a delegation chain.

Changelog and release status →Product roadmap →

Four questions from day-to-day IAM

In day-to-day operation, these questions show whether IAM controls work. Nova is built for the four roles that ask them.

  • Admins

    “Are my users in sync?”

    Reconciliation compares Nova, SAP and LDAP/AD three ways and shows target, actual and drift for each system.

  • Managers

    “What exactly am I approving here?”

    SoD conflicts appear in the request before the decision, with severity and reasoning.

  • Business owners

    “Why does someone outside my area hold my role?”

    Recertification flags risks on every row and asks for one decision per assignment.

  • Users

    “I need access like my colleague.”

    The request shows each role’s description and risk class before it goes out; with AI switched on, it can start in your own words.

How Nova is built for these four roles →

For IAM teams and SAP Basis

Connect, reconcile, decide

Nova connects your target systems, compares the actual state with the target state and puts deviations in front of your team for a decision.

  1. Connect

    Nova connects SAP ERP and S/4HANA directly via RFC/BAPI, with no middleware, plus Active Directory, LDAP, Entra ID, SCIM and Keycloak. Department roles are inherited automatically; when someone leaves, deprovisioning reaches into SAP, LDAP and Entra ID.

    13 standard integrations, including 5 target-system connectors, with status per system →

  2. Reconcile

    Reconciliation shows target, actual and drift per system. The healthcheck checks accounts, assignments, provisioning and reconciliation for each user: 19 checks in four groups, each with a severity, 11 of them with a suggested fix.

    Healthcheck release notes →

  3. Decide

    Before approval, Nova checks each request for SoD conflicts. In recertification, every assignment gets its own decision, and the audit log records actor, timestamp and origin.

    Audit log and policies in the Trust Center →
Findings list in the Nova healthcheck: severity, subject, category, detail and suggested fix for each finding, such as an account that is still enabled after the leave date (open enlarged view)
Step 2 in the product: healthcheck findings (excerpt) · demo tenant of a fictitious insurer, fictitious people and data

For project leads and procurement

How the 90-day pilot works

Nova runs for 90 days alongside your existing tool, such as SAP IDM, which stays in operation throughout. The test involves your own approvers, owners and admins.

  1. Beforehand

    Live demo

    30 minutes via video call on the demo system, tailored to your use cases.

  2. Week 1

    Success criteria

    Together we define 3–5 measurable success criteria.

  3. Until day 90

    Parallel operation

    Nova runs next to your existing tool. Once systems are connected, the healthcheck shows what deviates from the target state there.

  4. Day 90

    Decision

    You decide: cutover, extension or withdrawal.

Pilot and maintenance terms → More on replacing SAP IDM →

AI is optional and off by default

The core of Nova works without AI. If you switch it on, you choose where the model runs.

  • Off, local or cloud

    Three modes: off, local (e.g. Ollama in your network) or cloud (Claude or OpenAI with your own API key and your own contract with the provider). In local mode, no data leaves your network. The AI analysis in the healthcheck is configured separately on the server.

  • No rights of its own

    The assistant acts in the signed-in user’s session. Since September 2026, the development version routes it through the same endpoints and checks as the user interface: around 100 actions classified as destructive run only after a preview and a server-side confirmation, and changes made via the chat carry the origin “AI chat” in the audit log. This ships with the next release after 2026.08.2.

Runs on your infrastructure

One Python process, one PostgreSQL database, one browser. Nova needs no Java app server, message bus or Kubernetes. Installation follows documented steps with Docker Compose on a single server behind a TLS proxy.

  • Shipped as containers: test and production can run on the same image.
  • Data, documents and credentials are stored outside the container; an update replaces only the application.
  • Rollback by switching back to the previous container image.
  • Connectors as standalone Python modules with a common interface; further systems as project integrations, guideline 1–2 weeks per integration, depending on the API and the test system.

Architecture in detail →

Editions
Nova IAM Standard On-premise, your infrastructure Available
Nova on BTP SAP Business Technology Platform Kyma deployment in trial
Nova Online Hosted service from 2027

All three editions share the same core and the same containers.

For CISOs, data protection and audit

What you can check before the first meeting

  • Trust Center

    13 public documents, readable without an NDA or sign-up: policies, audit log documentation and mappings for GDPR, NIS-2 and CRA. Plus the current status of ISO 27001 and the pentest.

  • Integrations

    Protocol and status for all 25 systems: 13 standard, 1 beta, 11 as project integrations on the connector SDK.

  • Changelog

    What changed in Nova IAM with each release, with the month of each release.

  • Roadmap

    What Nova contains today, what is planned and what Nova does not intend to be.

Ask your questions live on the system.

30 minutes via video call on the demo system: you name your use cases, we show the relevant functions.

Request a demo

What happens next

  1. ReplyWe usually get back to you on the same working day and agree a date with you.
  2. PreparationWe prepare the demo around the topics you name.
  3. 30 minutes via video callLive on the demo system with fictitious data: you ask, we show the relevant views.
Enlarged view