SAP IDM is being retired. Your audits are not.
Identity governance for SAP, Active Directory and Entra ID: Nova IAM shows what deviates from the target state for each user, with a severity rating and, where possible, a suggested fix. Your team decides.
30 minutes on the demo system via video call, with your questions.
- Self-hostedNova runs on your own infrastructure.
- No per-user feesMaintenance as a fixed annual fee by size class.
- AI optional, off by defaultYou decide whether and where the model runs.
- 13standard integrationsincluding 5 target-system connectors
- 19checks per userin the healthcheck, 11 of them with a suggested fix
- 25systems with protocol and statusof which 1 beta and 11 project integrations on the connector SDK
- 90days of pilot operationyour existing tool stays in operation; on day 90 you decide
News
Recent Nova IAM releases
-
Migration Workbench expanded
Imports from your legacy system, such as SAP IDM, selectable per object type, with a final report and rollback. Plus preview and confirmation in the admin chat and a change journal for all connectors.
-
AI healthcheck per user
One run checks accounts, assignments, provisioning and reconciliation per user; each finding has a severity and, where possible, a suggested fix.
-
New frontend on Vue 3
The UI rebuilt from the ground up: Vue 3 with TypeScript, light and dark mode, redesigned views for dashboard, role mining and governance, at full feature parity.
Four roles
Four questions from day-to-day IAM
In day-to-day operation, these questions show whether IAM controls work. Nova is built for the four roles that ask them.
-
Admins
“Are my users in sync?”
Reconciliation compares Nova, SAP and LDAP/AD three ways and shows target, actual and drift for each system.
-
Managers
“What exactly am I approving here?”
SoD conflicts appear in the request before the decision, with severity and reasoning.
-
Business owners
“Why does someone outside my area hold my role?”
Recertification flags risks on every row and asks for one decision per assignment.
-
Users
“I need access like my colleague.”
The request shows each role’s description and risk class before it goes out; with AI switched on, it can start in your own words.
For IAM teams and SAP Basis
Connect, reconcile, decide
Nova connects your target systems, compares the actual state with the target state and puts deviations in front of your team for a decision.
-
Connect
Nova connects SAP ERP and S/4HANA directly, with no middleware. Department roles are inherited automatically; when someone leaves, deprovisioning reaches into SAP, LDAP and Entra ID.
Nova IAM -
Reconcile
Reconciliation shows target, actual and drift per system.
The healthcheck checks for each user:
AccountsAssignmentsProvisioningReconciliation
-
Decide
- Before approval, Nova checks each request for SoD conflicts.
- In recertification, every assignment gets its own decision.
The audit log records:
ActorTimestampOrigin
For project leads and procurement
How the 90-day pilot works
Nova runs for 90 days alongside your existing tool, such as SAP IDM, which stays in operation throughout. The test involves your own approvers, owners and admins.
- Beforehand
Live demo
30 minutes via video call on the demo system, tailored to your use cases.
- Week 1
Success criteria
Together we define 3–5 measurable success criteria.
- Until day 90
Parallel operation
Nova runs next to your existing tool. Once systems are connected, the healthcheck shows what deviates from the target state there.
- Day 90
Decision
You decide: cutover, extension or withdrawal.
AI features
AI is optional and off by default
The core of Nova works without AI. If you switch it on, you choose where the model runs.
Off, local or cloud
-
OffDefault
Nova ships with this setting.
-
Local
For example Ollama in your network. In local mode, no data leaves your network.
-
Cloud
Claude or OpenAI with your own API key and your own contract with the provider.
The AI analysis in the healthcheck is configured separately on the server.
No rights of its own
The assistant acts in the signed-in user’s session.
Since release 2026.10.1
- It uses the same endpoints and checks as the user interface.
- Around 100 actions classified as destructive run only after a preview and a server-side confirmation.
- Changes made via the chat carry the origin “AI chat” in the audit log.
Architecture and editions
Runs on your infrastructure
One Python process, one PostgreSQL database, one browser. Installation follows documented steps with Docker Compose on a single server behind a TLS proxy.
- Shipped as containers Test and production can run on the same image.
- Data outside the container Data, documents and credentials; an update replaces only the application.
- Rollback By switching back to the previous container image.
- Connectors as Python modules Common interface; further systems as project integrations, guideline 1–2 weeks per integration, depending on the API and the test system.
Setup
Docker ComposeNova does not need: Java app server Message bus Kubernetes
Editions
All three editions share the same core and the same containers.
| Edition | Deployment | Status |
|---|---|---|
| Nova IAM Standard | On-premise, your infrastructure | Available |
| Nova on BTP | SAP Business Technology Platform | Kyma deployment in trial |
| Nova Online | Hosted service | from 2027 |
You pay for the implementation and the annual maintenance.
Pricing in detailFor CISOs, data protection and audit
What you can check before the first meeting
Trust Center
13 public documents, readable without an NDA or sign-up: policies, audit log documentation and mappings for GDPR, NIS-2 and CRA. Plus the current status of ISO 27001 and the pentest.
-
Integrations
Protocol and status for each system in one table, searchable and filterable by category and status.
-
Changelog
What changed in Nova IAM with each release, with the month of each release.
-
Roadmap
What Nova contains today, what is planned and what Nova does not intend to be.
Next step
Ask your questions live on the system.
30 minutes via video call on the demo system: you name your use cases, we show the relevant functions.
Request a demoWhat happens next
- ReplyWe usually get back to you on the same working day and agree a date with you.
- PreparationWe prepare the demo around the topics you name.
- 30 minutes via video callLive on the demo system with fictitious data: you ask, we show the relevant views.