diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..598e335
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,30 @@
+name: build
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.1'
+          bundler-cache: true
+
+      - name: Build site
+        run: bundle exec jekyll build --destination _site
+
+      # Internal links only: external URLs across 150+ posts go stale for reasons
+      # unrelated to a pull request, and would turn this into a flaky gate.
+      - name: Check internal links
+        run: |
+          gem install html-proofer -v '~> 5.0'
+          htmlproofer _site \
+            --checks Links \
+            --ignore-urls "/^https?:\/\//,/^mailto:/" \
+            --assume-extension .html
diff --git a/_data/vendors.yml b/_data/vendors.yml
new file mode 100644
index 0000000..486cd2b
--- /dev/null
+++ b/_data/vendors.yml
@@ -0,0 +1,43 @@
+# Approved commercial-support vendors for the Open Identity Platform.
+#
+# Source of truth: https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List
+# Keep this file in sync when that wiki page changes.
+# Order is strict alphabetical. Listing here is NOT an endorsement and implies no ranking.
+#
+# `region` is the vendor's HEADQUARTERS location (a verifiable fact), used by the region
+# filter and the timezone hint on /support. Most vendors serve clients worldwide.
+#
+# `email` is rendered as a plain mailto: link, so it must be an address the vendor is
+# happy to publish (a sales/info inbox, not a personal one).
+- name: "3A Systems LLC"
+  slug: "3a-systems"
+  country: "Russia"
+  region: "cis"
+  region_label: "CIS"
+  languages: "Russian, English"
+  website: "https://www.3a-systems.ru"
+  email: "sales@3a-systems.ru"
+- name: "Identity Fusion, Inc."
+  slug: "identity-fusion"
+  country: "United States / United Kingdom"
+  region: "americas"
+  region_label: "Americas"
+  languages: "English"
+  website: "https://www.identityfusion.com"
+  email: "info@identityfusion.com"
+- name: "Orchitech Solutions s.r.o."
+  slug: "orchitech"
+  country: "Czechia"
+  region: "europe"
+  region_label: "Europe"
+  languages: "Czech, English"
+  website: "https://orchi.tech"
+  email: "info@orchitech.cz"
+- name: "OSSTech Corporation"
+  slug: "osstech"
+  country: "Japan"
+  region: "apac"
+  region_label: "Asia-Pacific"
+  languages: "Japanese, English"
+  website: "https://www.osstech.co.jp"
+  email: "info@osstech.co.jp"
diff --git a/_includes/analytics-events.html b/_includes/analytics-events.html
new file mode 100644
index 0000000..6d1cd6f
--- /dev/null
+++ b/_includes/analytics-events.html
@@ -0,0 +1,27 @@
+<!-- GA4 conversion events. Delegated listener: any element with data-ga-event fires
+     that GA4 event, passing its remaining data-ga-* attributes as parameters
+     (data-ga-vendor -> vendor, data-ga-location -> location, ...).
+
+     Consent Mode is "basic" (see cookie-notice.html): until the visitor approves,
+     gtag.js is never downloaded, so an event has no destination — gtag() would only
+     append it to the in-memory dataLayer queue. We therefore gate on analyticsLoaded
+     rather than relying on the tag to discard the hit. Runs in the capture phase so
+     the event is queued before same-page navigation unloads the document. -->
+<script>
+(function () {
+  document.addEventListener('click', function (e) {
+    var el = e.target.closest ? e.target.closest('[data-ga-event]') : null;
+    if (!el) return;
+    var name = el.getAttribute('data-ga-event');
+    if (!name || !window.analyticsLoaded) return;
+    var params = {};
+    for (var i = 0; i < el.attributes.length; i++) {
+      var attr = el.attributes[i];
+      if (attr.name.indexOf('data-ga-') === 0 && attr.name !== 'data-ga-event') {
+        params[attr.name.slice(8).replace(/-/g, '_')] = attr.value;
+      }
+    }
+    gtag('event', name, params);
+  }, true);
+})();
+</script>
diff --git a/_includes/cookie-notice.html b/_includes/cookie-notice.html
new file mode 100644
index 0000000..3dcd89c
--- /dev/null
+++ b/_includes/cookie-notice.html
@@ -0,0 +1,119 @@
+<!-- Cookie notice + Google Analytics 4 (gtag.js) loader. Consent Mode "basic": nothing is
+     requested from Google and no data leaves the browser until the visitor approves. The
+     choice is stored in the `cookie-notice-dismissed` cookie as "true" (approved), "false"
+     (declined) or unset (not asked yet). Any element with a data-cookie-settings attribute
+     re-opens the notice, so consent can be changed or withdrawn as easily as it was given.
+
+     Lives at the end of <body>, not in <head>: a <div> in <head> makes the parser close
+     <head> early and silently relocate everything after it (see the note in header.html,
+     which keeps the styling). Styles are in <head>; the notice starts hidden, so it is
+     never shown unstyled. -->
+<div id="cookie-notice"><span>We would like to use third party cookies and scripts to improve the functionality of this website.</span><button type="button" id="cookie-notice-accept" class="btn btn-primary btn-sm">Approve</button><button type="button" id="cookie-notice-decline" class="btn btn-light btn-sm">Decline</button><a href="/privacy" class="btn btn-light btn-sm">More info</a></div>
+<script>
+  var GA_MEASUREMENT_ID = 'G-Q5PEKRFRH8';
+  var CONSENT_COOKIE = 'cookie-notice-dismissed';
+
+  function createCookie(name,value,days) {
+      var expires = "";
+      if (days) {
+          var date = new Date();
+          date.setTime(date.getTime() + (days*24*60*60*1000));
+          expires = "; expires=" + date.toUTCString();
+      }
+      document.cookie = name + "=" + value + expires + "; path=/";
+  }
+  function readCookie(name) {
+      var nameEQ = name + "=";
+      var ca = document.cookie.split(';');
+      for(var i=0;i < ca.length;i++) {
+          var c = ca[i];
+          while (c.charAt(0)==' ') c = c.substring(1,c.length);
+          if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
+      }
+      return null;
+  }
+  function eraseCookie(name) {
+      createCookie(name,"",-1);
+  }
+
+  // gtag is defined globally so any page can queue events before the library exists.
+  window.dataLayer = window.dataLayer || [];
+  function gtag(){dataLayer.push(arguments);}
+
+  // Loads gtag.js on demand. Called only once the visitor has approved, so no request
+  // reaches Google beforehand. This site runs no ads, so the ad_* signals stay denied.
+  // analyticsLoaded is a global: analytics-events.html reads it to decide whether an
+  // interaction event has anywhere to go.
+  var analyticsLoaded = false;
+  function loadAnalytics() {
+      if (analyticsLoaded) {
+          gtag('consent', 'update', { analytics_storage: 'granted' });
+          return;
+      }
+      analyticsLoaded = true;
+      gtag('consent', 'default', {
+          ad_storage: 'denied',
+          ad_user_data: 'denied',
+          ad_personalization: 'denied',
+          analytics_storage: 'granted'
+      });
+      gtag('js', new Date());
+      gtag('config', GA_MEASUREMENT_ID);
+      var tag = document.createElement('script');
+      tag.async = true;
+      tag.src = 'https://www.googletagmanager.com/gtag/js?id=' + GA_MEASUREMENT_ID;
+      document.head.appendChild(tag);
+  }
+
+  // Withdrawal: stop measuring and clear the analytics cookies Google has already set.
+  function disableAnalytics() {
+      if (analyticsLoaded) {
+          gtag('consent', 'update', { analytics_storage: 'denied' });
+      }
+      var host = document.location.hostname;
+      var labels = host.split('.');
+      var domains = ['', '; domain=' + host, '; domain=.' + host];
+      if (labels.length > 2) {
+          domains.push('; domain=.' + labels.slice(-2).join('.'));
+      }
+      var cookies = document.cookie.split(';');
+      for (var i = 0; i < cookies.length; i++) {
+          var name = cookies[i].split('=')[0].replace(/^\s+/, '');
+          if (name.indexOf('_ga') !== 0 && name.indexOf('_gid') !== 0) continue;
+          for (var d = 0; d < domains.length; d++) {
+              document.cookie = name + '=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/' + domains[d];
+          }
+      }
+  }
+
+  var cookieNotice = document.getElementById('cookie-notice');
+  function showCookieNotice() { cookieNotice.style.display = 'block'; }
+  function hideCookieNotice() { cookieNotice.style.display = 'none'; }
+
+  var storedConsent = readCookie(CONSENT_COOKIE);
+  if (storedConsent === 'true') {
+      loadAnalytics();
+  } else if (storedConsent !== 'false') {
+      showCookieNotice();
+  }
+
+  document.getElementById('cookie-notice-accept').addEventListener("click",function() {
+      createCookie(CONSENT_COOKIE,'true',31);
+      hideCookieNotice();
+      loadAnalytics();
+  });
+  document.getElementById('cookie-notice-decline').addEventListener("click",function() {
+      createCookie(CONSENT_COOKIE,'false',31);
+      hideCookieNotice();
+      disableAnalytics();
+  });
+
+  // "Manage cookie settings" links (see /privacy) re-open the notice.
+  document.addEventListener('click', function (e) {
+      var trigger = e.target.closest ? e.target.closest('[data-cookie-settings]') : null;
+      if (!trigger) return;
+      e.preventDefault();
+      showCookieNotice();
+  });
+
+</script>
diff --git a/_includes/footer.html b/_includes/footer.html
index 40f53f7..6c40f33 100644
--- a/_includes/footer.html
+++ b/_includes/footer.html
@@ -1,12 +1,47 @@
 <footer class="footer bg-primary text-white">
   <div class="container">
-    <div class="row">
-    <div class="col-8">
-      <a class="text-white text-center align-middle" href="{{site.repo_url}}">&copy;  {{site.title}}</a>
+    <div class="row footer-nav g-4 pb-2">
+      <div class="col-6 col-md-3">
+        <div class="footer-heading">Products</div>
+        <ul class="footer-list">
+          {% for product in site.data.products %}
+          <li><a href="{{ product.details_link }}">{{ product.name }}</a></li>
+          {% endfor %}
+        </ul>
+      </div>
+      <div class="col-6 col-md-3">
+        <div class="footer-heading">Resources</div>
+        <ul class="footer-list">
+          <li><a href="https://doc.openidentityplatform.org/" rel="noopener">Documentation</a></li>
+          <li><a href="/blog/">Blog</a></li>
+          <li><a href="/#projects">Downloads</a></li>
+          <li><a href="/privacy">Privacy</a></li>
+        </ul>
+      </div>
+      <div class="col-6 col-md-3">
+        <div class="footer-heading">Community</div>
+        <ul class="footer-list">
+          <li><a href="https://github.com/orgs/OpenIdentityPlatform/discussions" rel="noopener">Discussions</a></li>
+          <li><a href="{{ site.repo_url }}" rel="noopener">GitHub organization</a></li>
+          <li><a href="https://github.com/orgs/OpenIdentityPlatform/repositories" rel="noopener">Contribute</a></li>
+        </ul>
+      </div>
+      <div class="col-6 col-md-3">
+        <div class="footer-heading">Support</div>
+        <ul class="footer-list">
+          <li><a href="/support">Support &amp; Services</a></li>
+          <li><a href="/forgerock-alternative">ForgeRock Migration</a></li>
+        </ul>
+      </div>
     </div>
+    <div class="row align-items-center footer-bottom pt-3">
+      <div class="col-8">
+        <a class="text-white align-middle" href="{{site.repo_url}}">&copy; {{site.title}}</a>
+        <span class="footer-meta d-none d-md-inline">&middot; {{ site.data.products | size }} open-source products &middot; CDDL licensed</span>
+      </div>
       <div class="col-4 text-end">
         <a class="text-white pe-1" href="https://github.com/orgs/OpenIdentityPlatform/discussions" aria-label="Open Identity Platform Community Discussions"><svg style="fill:white;" height="36" role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"><path d="M8.501 4.001H10.5V24H8.501V4.001zm6.999 0V24h-2V4.001h2zM3.5 0h2.001v15H3.5V0zm15 4.001h2V15h-2V4.001z"/></svg></a>
-        <span target="_blank"  class="align-middle" style="font-size: 36px; display: inline-block;" >
+        <span class="align-middle" style="font-size: 36px; display: inline-block;">
           <a target="_blank" href="https://github.com/OpenIdentityPlatform" aria-label="Open Identity Platform GitHub"><i class="fa-brands fa-github"></i></a>
         </span>
       </div>
diff --git a/_includes/header.html b/_includes/header.html
index 469191d..72fa99d 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -27,7 +27,6 @@
 <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
 <link rel="icon" href="/favicon.ico" type="image/x-icon">
 
-<link rel="dns-prefetch" href="https://www.googletagmanager.com" />
 <link rel="dns-prefetch" href="https://cdn.jsdelivr.net" />
 <link rel="dns-prefetch" href="https://cdnjs.cloudflare.com" />
 <link rel="dns-prefetch" href="https://translate.google.com" />
@@ -44,54 +43,15 @@
 <link rel="stylesheet" href="{{'/assets/css/highlight.css'}}" >
 <link rel="stylesheet" href="{{'/assets/css/main.css'}}" >
 
-<!-- Global site tag (gtag.js) - Google Analytics -->
-
-<script async src="https://www.googletagmanager.com/gtag/js?id=G-Q5PEKRFRH8"></script>
+<!-- Cookie-notice styling. The notice markup and its consent logic live in
+     cookie-notice.html, included at the end of <body>: a <div> here would implicitly
+     close <head>, pushing everything after it — including the JSON-LD emitted by
+     structured-data.html — into the body. Only the styles belong in <head>. -->
 <style>
   #cookie-notice {padding: 0.5rem 1rem; display: none; text-align: center; position: fixed; bottom: 0; width: calc(100%); background: #222; color: rgba(255,255,255,0.8); z-index: 1;}
-  #cookie-notice a {display: inline-block; cursor: pointer; margin-left: 0.5rem;}
+  #cookie-notice a, #cookie-notice button {display: inline-block; cursor: pointer; margin-left: 0.5rem;}
   @media (max-width: 767px) {
       #cookie-notice span {display: block; padding-top: 3px; margin-bottom: 1rem;}
-      #cookie-notice a {position: relative; bottom: 4px;}
+      #cookie-notice a, #cookie-notice button {position: relative; bottom: 4px;}
   }
 </style>
-<div id="cookie-notice"><span>We would like to use third party cookies and scripts to improve the functionality of this website.</span><a id="cookie-notice-accept" class="btn btn-primary btn-sm">Approve</a><a href="/privacy" class="btn btn-primary btn-sm">More info</a></div>
-<script>
-  function createCookie(name,value,days) {
-      var expires = "";
-      if (days) {
-          var date = new Date();
-          date.setTime(date.getTime() + (days*24*60*60*1000));
-          expires = "; expires=" + date.toUTCString();
-      }
-      document.cookie = name + "=" + value + expires + "; path=/";
-  }
-  function readCookie(name) {
-      var nameEQ = name + "=";
-      var ca = document.cookie.split(';');
-      for(var i=0;i < ca.length;i++) {
-          var c = ca[i];
-          while (c.charAt(0)==' ') c = c.substring(1,c.length);
-          if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);
-      }
-      return null;
-  }
-  function eraseCookie(name) {
-      createCookie(name,"",-1);
-  }
-
-  if(readCookie('cookie-notice-dismissed')=='true') {
-      window.dataLayer = window.dataLayer || [];
-      function gtag(){dataLayer.push(arguments);}
-      gtag('js', new Date());
-      gtag('config', 'G-Q5PEKRFRH8');
-  } else {
-      document.getElementById('cookie-notice').style.display = 'block';
-  }
-  document.getElementById('cookie-notice-accept').addEventListener("click",function() {
-      createCookie('cookie-notice-dismissed','true',31);
-      document.getElementById('cookie-notice').style.display = 'none';
-      location.reload();
-  });
-
-</script>
diff --git a/_includes/navbar.html b/_includes/navbar.html
index ccf8b1b..d540ca6 100644
--- a/_includes/navbar.html
+++ b/_includes/navbar.html
@@ -23,7 +23,7 @@
               <script type="text/javascript" src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
           </li>
           <li class="nav-item dropdown">
-            <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" href="#" role="button" aria-haspopup="true" aria-expanded="false">Products <span class="visually-hidden">(current)</span></a>
+            <a class="nav-link dropdown-toggle" href="#" data-bs-toggle="dropdown" role="button" aria-haspopup="true" aria-expanded="false">Products</a>
             <div class="dropdown-menu">
               {% for product in site.data.products %}
                 <a class="dropdown-item" href="{{product.details_link}}">{{product.short_description}}</a>
@@ -32,12 +32,15 @@
           </li>
           <li class="nav-item">
             <a target="_blank" class="nav-link" href="https://doc.openidentityplatform.org">Documentation</a>
-          </li>          
+          </li>
+          <li class="nav-item {{page.navbar.support_active}}">
+            <a class="nav-link" href="/support"{% if page.navbar.support_active == 'active' %} aria-current="page"{% endif %}>Support</a>
+          </li>
           <li class="nav-item {{page.navbar.blog_active}}">
-            <a class="nav-link" href="/blog/">Blog <span class="visually-hidden">(current)</span></a>
+            <a class="nav-link" href="/blog/"{% if page.navbar.blog_active == 'active' %} aria-current="page"{% endif %}>Blog</a>
           </li>
           <li class="nav-item">
-            <a target="_blank" class="nav-link" href="{{site.repo_url}}"><i class="fa-brands fa-github"></i> Fork us<span class="visually-hidden">(current)</span></a>
+            <a target="_blank" class="nav-link" href="{{site.repo_url}}"><i class="fa-brands fa-github"></i> Fork us</a>
           </li>
         </ul>
       </div>
diff --git a/_includes/scripts.html b/_includes/scripts.html
index 3a51eab..680c0eb 100644
--- a/_includes/scripts.html
+++ b/_includes/scripts.html
@@ -1 +1,2 @@
 <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-YvpcrYf0tY3lHB60NNkmXc5s9fDVZLESaAA55NDzOxhy9GkcIdslK1eN7N6jIeHz" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
+{% include analytics-events.html %}
diff --git a/_includes/structured-data.html b/_includes/structured-data.html
index a1b6d6e..16c5322 100644
--- a/_includes/structured-data.html
+++ b/_includes/structured-data.html
@@ -16,6 +16,48 @@
 }
 </script>
 
+{% comment %}Service schema on the support page{% endcomment %}
+{%- if page.service_schema -%}
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "Service",
+  "serviceType": "Commercial support and consulting",
+  "name": {{ page.title | jsonify }},
+  "description": {{ page_description | jsonify }},
+  "url": "{{ page_url }}",
+  "provider": {
+    "@type": "Organization",
+    "name": "{{ site.title }}",
+    "url": "{{ site.url }}"
+  },
+  "areaServed": ["Europe", "Americas", "Asia-Pacific", "CIS"]
+}
+</script>
+{%- endif -%}
+
+{% comment %}FAQ schema on pages that declare a faq list{% endcomment %}
+{%- if page.faq -%}
+<script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "FAQPage",
+  "mainEntity": [
+    {%- for item in page.faq -%}
+    {
+      "@type": "Question",
+      "name": {{ item.q | jsonify }},
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": {{ item.a | jsonify }}
+      }
+    }{%- unless forloop.last -%},{%- endunless -%}
+    {%- endfor -%}
+  ]
+}
+</script>
+{%- endif -%}
+
 {% comment %}Product schema on product pages{% endcomment %}
 {%- if page.product -%}
 {%- assign product_data = site.data.products | where: "product", page.product | first -%}
diff --git a/_includes/support-cta.html b/_includes/support-cta.html
new file mode 100644
index 0000000..aef449b
--- /dev/null
+++ b/_includes/support-cta.html
@@ -0,0 +1,15 @@
+<!-- Commercial support CTA band. Built from Bootstrap utilities + the site's navy .bg-primary.
+     data-ga-* attributes are inert until the deferred GA event-tracking phase. -->
+<div class="support-cta bg-primary text-white p-4 rounded my-4">
+  <div class="row align-items-center">
+    <div class="col-md-8 mb-3 mb-md-0">
+      <h3 class="h5 mb-1">Running {{ page.reponame | default: "Open Identity Platform" }} in production?</h3>
+      <p class="mb-0">Community help is free on GitHub. When you need SLAs, consulting, implementation, or migration, independent approved vendors are ready.</p>
+    </div>
+    <div class="col-md-4 text-md-end">
+      <a href="/support" class="btn btn-support" data-ga-event="support_cta_click" data-ga-location="product_{{ page.product | default: page.reponame | downcase }}">
+        <i class="fa-solid fa-headset me-2"></i>Support options
+      </a>
+    </div>
+  </div>
+</div>
diff --git a/_includes/widgets.html b/_includes/widgets.html
index 342e4b8..4ba775a 100644
--- a/_includes/widgets.html
+++ b/_includes/widgets.html
@@ -9,7 +9,7 @@
   <div class="need-support-popover-container" style="display:none;">
     <div class="need-support-popover">
       <p>Open Identity Platform Community: <a href="https://github.com/orgs/OpenIdentityPlatform/discussions" target="_blank">Discussions</a></p>
-      <p>Commercial support: <a href="https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List">Approved Vendor List</a></p>
+      <p>Commercial support: <a href="/support" data-ga-event="support_cta_click" data-ga-location="widget_popover">SLAs &amp; approved vendors</a></p>
     </div>
   </div>
 </div>
diff --git a/_layouts/home.html b/_layouts/home.html
index 4d5ba6c..cf4bc4d 100644
--- a/_layouts/home.html
+++ b/_layouts/home.html
@@ -21,6 +21,7 @@
       </div>
     </section>
     {% include footer.html %}
+    {% include cookie-notice.html %}
     {% include scripts.html %}
     {% include widgets.html %}
   </body>
diff --git a/_posts/2025-12-18-openam-vs-keycloak.md b/_posts/2025-12-18-openam-vs-keycloak.md
index c6c9fb2..f5cb6b7 100644
--- a/_posts/2025-12-18-openam-vs-keycloak.md
+++ b/_posts/2025-12-18-openam-vs-keycloak.md
@@ -6,6 +6,7 @@ description: A detailed comparative review of OpenAM (Open Identity Platform) an
 keywords: 'OpenAM vs Keycloak, Keycloak vs OpenAM, OpenAM comparison, Keycloak comparison, open source IAM, identity access management open source, SSO solutions, single sign-on comparison, OAuth2 OIDC SAML, authentication modules, federation protocols, realms isolation, admin GUI customization, identity repositories, Kubernetes deployment IAM, Open Identity Platform, Red Hat Keycloak, IAM tools 2025, IAM tools 2026, best open source access management'
 imageurl: 'openam-og.png'
 share-buttons: true
+lastmod: 2026-07-28
 ---
 
 # OpenAM vs Keycloak
@@ -129,6 +130,15 @@ Realm support for isolation of identities and authentication processes
 | SNMP Monitoring | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-monitoring#monitoring-snmp) | ⛔️ |
 | JMX Monitoring | ✅ [doc](https://doc.openidentityplatform.org/openam/admin-guide/chap-monitoring#monitoring-jmx) | ⛔️ |
 
+## Summary
+
+Both OpenAM and Keycloak are mature, standards-based, open-source IAM platforms, and either can anchor a serious SSO deployment. The right choice depends on your context rather than a single winner:
+
+- **Choose OpenAM** if you need breadth of authentication modules and adaptive/chained authentication, protocols such as UMA 2.0, SNMP/JMX monitoring, policy agents for web/app servers, or a drop-in continuation of a ForgeRock-based architecture.
+- **Choose Keycloak** if you want a newer admin UI out of the box and are already invested in the Red Hat / Quarkus ecosystem.
+
+If you'd like help matching either platform to your requirements, or planning a migration, independent vendors offer paid consulting and implementation — see the [Support & Services](/support) page for options, while community help stays free on GitHub. Moving off a ForgeRock stack? OpenAM is a like-for-like open-source continuation — see the [ForgeRock alternative & migration path](/forgerock-alternative).
+
 ## Useful Links
 
 ### OpenAM:
diff --git a/_posts/2026-01-19-openig-promt-injection-mitigation.md b/_posts/2026-01-19-openig-promt-injection-mitigation.md
index acce329..63b17ff 100644
--- a/_posts/2026-01-19-openig-promt-injection-mitigation.md
+++ b/_posts/2026-01-19-openig-promt-injection-mitigation.md
@@ -12,7 +12,7 @@ share-buttons: true
 
 ## Introduction
 
-In this article, we will configure protection against prompt injection in AI systems using practical examples using the open source gateway [OpenIG](github.com/OpenIdentityPlatform/OpenIG).
+In this article, we will configure protection against prompt injection in AI systems using practical examples using the open source gateway [OpenIG](https://github.com/OpenIdentityPlatform/OpenIG).
 
 Proxying requests to an LLM through a special gateway has several advantages:
 
diff --git a/assets/css/main.scss b/assets/css/main.scss
index c9908ec..ceb1924 100644
--- a/assets/css/main.scss
+++ b/assets/css/main.scss
@@ -108,8 +108,7 @@ img {
 
 .footer {
   width: 100%;
-  height: 60px;
-  line-height: 60px;
+  padding: 2.5rem 0 1.25rem;
 }
 
 
@@ -129,6 +128,15 @@ td {
   border: 1px solid black;
 }
 
+.table-bordered {
+  --bs-table-border-color: #dee2e6;
+  th,
+  td,
+  tr {
+    border-color: #dee2e6;
+  }
+}
+
 a.blogpost  {
   color: inherit;
 }
@@ -188,4 +196,146 @@ a.blogpost  {
     background-color: $color4;
     border-color: $color4;
   }
-}
\ No newline at end of file
+}
+
+
+// ============================================================
+// Support page (/support)
+// ============================================================
+
+.support-hero h1 {
+  margin-bottom: 0.5rem;
+}
+
+.btn-support {
+  background-color: $color5;
+  border-color: $color5;
+  color: #fff;
+
+  &:hover, &:focus {
+    background-color: #6f008f;
+    border-color: #6f008f;
+    color: #fff;
+  }
+}
+
+.region-filter {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+
+  .btn {
+    background-color: #fff;
+    border: 1px solid #dee2e6;
+    color: $color1;
+    font-weight: 600;
+    font-size: 0.85rem;
+    padding: 0.35rem 1rem;
+    border-radius: 999px;
+
+    &:hover {
+      border-color: $color5;
+      color: $color5;
+    }
+
+    &.active {
+      background-color: $color5;
+      border-color: $color5;
+      color: #fff;
+    }
+  }
+}
+
+.region-badge {
+  display: inline-block;
+  align-self: flex-start;
+  background: rgba($color5, 0.1);
+  border: 1px solid rgba($color5, 0.25);
+  border-radius: 8px;
+  padding: 0.15rem 0.6rem;
+  font-size: 0.72rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: $color5;
+}
+
+.vendor-facts {
+  margin: 0.5rem 0 1rem;
+
+  li {
+    font-size: 0.88rem;
+    color: #495057;
+    line-height: 1.7;
+
+    i { color: $color4; width: 1.1rem; }
+  }
+}
+
+.vendor-neutrality-note {
+  font-size: 0.9rem;
+  color: #6c757d;
+  line-height: 1.6;
+  max-width: 820px;
+}
+
+.vendor-tz-ribbon {
+  background: $color5;
+  color: #fff;
+  font-size: 0.7rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  text-align: center;
+  border-radius: 6px;
+  padding: 0.2rem 0.5rem;
+  margin-bottom: 0.75rem;
+}
+// ForgeRock migration cross-links
+.fr-callout {
+  background: $color3;
+  border-left: 4px solid $color2;
+  border-radius: 6px;
+  padding: 0.75rem 1rem;
+  font-size: 0.92rem;
+  color: $color1;
+  margin-bottom: 1.5rem;
+
+  i { color: $color2; }
+  a { font-weight: 600; }
+}
+
+.footer-nav {
+  .footer-heading {
+    font-size: 0.78rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.06em;
+    color: rgba(255, 255, 255, 0.6);
+    margin-bottom: 0.75rem;
+  }
+
+  .footer-list {
+    list-style: none;
+    padding: 0;
+    margin: 0;
+
+    li { margin-bottom: 0.4rem; }
+
+    a {
+      color: #fff;
+      text-decoration: none;
+      font-size: 0.9rem;
+      opacity: 0.9;
+
+      &:hover { opacity: 1; text-decoration: underline; }
+    }
+  }
+}
+
+.footer-bottom {
+  border-top: 1px solid rgba(255, 255, 255, 0.15);
+  font-size: 0.9rem;
+
+  .footer-meta { color: rgba(255, 255, 255, 0.6); }
+}
diff --git a/blog/index.html b/blog/index.html
index 9bc3ec9..35ca5d9 100644
--- a/blog/index.html
+++ b/blog/index.html
@@ -33,7 +33,7 @@ <h4>
       </li>
     {% else %} 
       <li class="page-item disabled">
-        <a class="page-link">Back</a>
+        <span class="page-link">Back</span>
       </li>
     {% endif %}
     {% for page in (1..paginator.total_pages) %}
@@ -53,7 +53,7 @@ <h4>
       </li>
     {% else %}
       <li class="page-item disabled">
-        <a class="page-link">Next</a>
+        <span class="page-link">Next</span>
       </li>
     {% endif %}    
   </ul>
diff --git a/forgerock-alternative.md b/forgerock-alternative.md
new file mode 100644
index 0000000..7951f30
--- /dev/null
+++ b/forgerock-alternative.md
@@ -0,0 +1,150 @@
+---
+layout: home
+title: "ForgeRock Alternative & Migration Path — Open Identity Platform"
+description: "A free, open-source alternative to ForgeRock. Open Identity Platform continues the OpenAM, OpenDJ, OpenIDM, OpenIG and OpenICF line under the CDDL license — no license fees, no lock-in. Map your ForgeRock stack and plan a migration."
+keywords: "ForgeRock alternative, ForgeRock open source alternative, ForgeRock migration, migrate from ForgeRock, ForgeRock to open source, ForgeRock AM alternative, ForgeRock DS alternative, ForgeRock IDM alternative, ForgeRock IG alternative, OpenAM ForgeRock, OpenDJ ForgeRock, ForgeRock end of life, ForgeRock replacement, IAM migration"
+lastmod: 2026-07-17
+faq:
+  - q: "Is Open Identity Platform the same as ForgeRock?"
+    a: "No. Open Identity Platform is an independent community project. Its products — OpenAM, OpenDJ, OpenIDM, OpenIG and OpenICF — continue the open-source releases that ForgeRock's commercial products were built on, maintained under the CDDL license."
+  - q: "Do I have to pay license fees to move off ForgeRock?"
+    a: "No. Every Open Identity Platform product is free and open source under the CDDL license — no license fees and no vendor lock-in. Commercial support is entirely optional and comes from independent vendors, not a mandatory subscription."
+  - q: "Can I migrate my existing ForgeRock configuration and data?"
+    a: "Because the products share a common lineage, many concepts, configurations, and directory data map closely between ForgeRock and Open Identity Platform. The exact effort depends on your versions and customizations — read the documentation, ask the community, or engage an approved vendor for a migration assessment."
+  - q: "Where do I get help migrating from ForgeRock?"
+    a: "Free community help is available on GitHub Discussions, and full documentation is online. For SLAs, consulting, and hands-on migration work, independent approved vendors are listed on the Support & Services page."
+---
+
+<div class="bg-primary text-white p-4 p-md-5 rounded mb-5">
+  <h1>ForgeRock Alternative &amp; Open-Source Migration Path</h1>
+  <p class="lead mb-0">Open Identity Platform is the free, open-source continuation of the identity stack that ForgeRock was built on. Same lineage, CDDL licensed, no license fees, no vendor lock-in.</p>
+</div>
+
+<p>ForgeRock built its identity platform on a family of open-source projects covering access management, directory services, identity management, and an identity gateway. Over time those products moved to a closed, subscription-only model. The open-source line did not disappear: the community forked the last freely-licensed releases and has maintained, secured, and modernized them ever since as the <strong>Open Identity Platform</strong>.</p>
+
+<p>If you run a ForgeRock deployment — or you're weighing its roadmap and licensing — Open Identity Platform is a like-for-like path that keeps your architecture open. Community help stays free on GitHub; independent vendors offer paid migration and support when you want it.</p>
+
+<h2 class="mb-3">Map your ForgeRock stack to Open Identity Platform</h2>
+<p class="text-muted">Each ForgeRock product has a directly corresponding open-source project here.</p>
+<div class="table-responsive mb-5">
+  <table class="table table-bordered align-middle">
+    <thead>
+      <tr>
+        <th scope="col">ForgeRock product</th>
+        <th scope="col">Open Identity Platform</th>
+        <th scope="col">What it does</th>
+        <th scope="col">Get it</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>ForgeRock Access Management (AM)</td>
+        <td><a href="/openam"><strong>OpenAM</strong></a></td>
+        <td>Authentication, SSO, authorization, federation, OAuth2/OIDC/SAML</td>
+        <td><a href="https://github.com/OpenIdentityPlatform/OpenAM" target="_blank" rel="noopener">GitHub</a></td>
+      </tr>
+      <tr>
+        <td>ForgeRock Directory Services (DS)</td>
+        <td><a href="/opendj"><strong>OpenDJ</strong></a></td>
+        <td>LDAPv3-compliant, high-availability directory / identity store</td>
+        <td><a href="https://github.com/OpenIdentityPlatform/OpenDJ" target="_blank" rel="noopener">GitHub</a></td>
+      </tr>
+      <tr>
+        <td>ForgeRock Identity Management (IDM)</td>
+        <td><a href="/openidm"><strong>OpenIDM</strong></a></td>
+        <td>Identity management, provisioning, synchronization, compliance</td>
+        <td><a href="https://github.com/OpenIdentityPlatform/OpenIDM" target="_blank" rel="noopener">GitHub</a></td>
+      </tr>
+      <tr>
+        <td>ForgeRock Identity Gateway (IG)</td>
+        <td><a href="/openig"><strong>OpenIG</strong></a></td>
+        <td>Reverse proxy / identity gateway, session and credential handling</td>
+        <td><a href="https://github.com/OpenIdentityPlatform/OpenIG" target="_blank" rel="noopener">GitHub</a></td>
+      </tr>
+      <tr>
+        <td>ForgeRock connectors (ICF)</td>
+        <td><a href="/openicf"><strong>OpenICF</strong></a></td>
+        <td>Identity connector framework linking IDM to target systems</td>
+        <td><a href="https://github.com/OpenIdentityPlatform/OpenICF" target="_blank" rel="noopener">GitHub</a></td>
+      </tr>
+    </tbody>
+  </table>
+</div>
+
+<h2 class="mb-3">Why organizations move to Open Identity Platform</h2>
+<div class="row g-4 mb-5">
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-lock-open me-2"></i>Stay open source</h3>
+      <p class="card-text mb-0">Every product is CDDL-licensed and free to download, run, and modify. No per-user or per-server license fees.</p>
+    </div></div>
+  </div>
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-unlock me-2"></i>No vendor lock-in</h3>
+      <p class="card-text mb-0">Open code, open standards (OAuth2, OIDC, SAML, LDAP). You control your deployment and your data.</p>
+    </div></div>
+  </div>
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-code-branch me-2"></i>Same lineage</h3>
+      <p class="card-text mb-0">The projects share a common heritage with ForgeRock's, so your existing concepts, skills, and architecture carry over.</p>
+    </div></div>
+  </div>
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-shield-halved me-2"></i>Actively maintained</h3>
+      <p class="card-text mb-0">Regular releases and security fixes across all five products, published openly on GitHub.</p>
+    </div></div>
+  </div>
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-people-group me-2"></i>Community first</h3>
+      <p class="card-text mb-0">Free help on GitHub Discussions and open documentation — no support contract required to get started.</p>
+    </div></div>
+  </div>
+  <div class="col-md-6 col-lg-4">
+    <div class="card h-100"><div class="card-body">
+      <h3 class="h5 card-title"><i class="fa-solid fa-headset me-2"></i>Support when you need it</h3>
+      <p class="card-text mb-0">Independent approved vendors offer SLAs, consulting, and migration services — optional, and neutral by design.</p>
+    </div></div>
+  </div>
+</div>
+
+<h2 class="mb-3">How a migration typically works</h2>
+<p>Every environment is different, but migrations from a ForgeRock stack generally follow the same shape. Because the codebases share a lineage, much of your configuration maps across — but always validate against your own deployment.</p>
+<ol class="mb-5">
+  <li class="mb-2"><strong>Assess</strong> — inventory your ForgeRock components, versions, customizations, and integrations, and map them to the products above.</li>
+  <li class="mb-2"><strong>Stand up Open Identity Platform</strong> — deploy the matching products (start with the directory and access management) in a test environment.</li>
+  <li class="mb-2"><strong>Migrate configuration and data</strong> — move realms, policies, agents, connectors, and directory data; adapt customizations where needed.</li>
+  <li class="mb-2"><strong>Validate</strong> — test authentication flows, federation, provisioning, and integrations against your requirements.</li>
+  <li class="mb-2"><strong>Cut over</strong> — plan the switch, run in parallel if you can, and keep a rollback path.</li>
+</ol>
+
+<div class="bg-primary text-white p-4 p-md-5 rounded mb-5">
+  <div class="row align-items-center">
+    <div class="col-md-8 mb-3 mb-md-0">
+      <h2 class="h4 mb-1">Planning a move off ForgeRock?</h2>
+      <p class="mb-0">Start free on GitHub, or bring in an independent vendor for a migration assessment, SLAs, and hands-on help. The project stays neutral — vendors are listed alphabetically, with no endorsement.</p>
+    </div>
+    <div class="col-md-4 text-md-end">
+      <a href="/support" class="btn btn-support" data-ga-event="support_cta_click" data-ga-location="forgerock_migration">
+        <i class="fa-solid fa-headset me-2"></i>Support &amp; migration
+      </a>
+    </div>
+  </div>
+</div>
+
+<h2 class="mb-3">Frequently asked questions</h2>
+<div class="row g-4 mb-4">
+  {% for item in page.faq %}
+  <div class="col-md-6">
+    <div class="card h-100">
+      <div class="card-body">
+        <h3 class="h6 card-title">{{ item.q }}</h3>
+        <p class="card-text mb-0">{{ item.a }}</p>
+      </div>
+    </div>
+  </div>
+  {% endfor %}
+</div>
diff --git a/index.html b/index.html
index 578b4d8..497c1d4 100644
--- a/index.html
+++ b/index.html
@@ -60,16 +60,17 @@ <h3>Open Source Licensing</h3>
   <p>All source code and binaries are freely available under the <a href="https://github.com/OpenIdentityPlatform/OpenAM/blob/master/LICENSE.md">Common Development and Distribution License (CDDL)</a>. Contribute, fork, and deploy without restrictions.</p>
 </section>
 
+<section id="forgerock">
+  <h3>Coming from ForgeRock?</h3>
+  <p>ForgeRock has closed its open-source releases, but the open-source line lives on. Open Identity Platform continues OpenAM, OpenDJ, OpenIDM, OpenIG, and OpenICF under the CDDL license — no license fees, no lock-in. See the <a href="/forgerock-alternative">ForgeRock alternative &amp; migration path</a> to map your stack.</p>
+</section>
+
 <section id="contact">
   <h3>Join the Open Identity Platform Community</h3>
   <p>Connect with developers, share ideas, and collaborate on the future of IAM. Whether you're troubleshooting, contributing code, or seeking support - we're here.</p>
-  <p>Join discussions on <a href="https://github.com/OpenIdentityPlatform/discussions">GitHub Discussions</a>.</p>
+  <p>Join discussions on <a href="https://github.com/orgs/OpenIdentityPlatform/discussions">GitHub Discussions</a>.</p>
 </section>
 
 
 <h3>Commercial support</h3>
-<ul>
-  <li>
-    <a title="Approved Vendor List" href="https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List">Approved Vendor List</a>
-  </li>
-</ul>
+<p>Need SLAs, consulting, implementation, or migration help? See <a href="/support" data-ga-event="support_cta_click" data-ga-location="home_commercial">Support &amp; Services</a> for free community help and a directory of approved independent vendors. The canonical list lives in the <a href="https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List">Approved Vendor List</a> wiki.</p>
diff --git a/openam.md b/openam.md
index e8c656a..ccdbe2c 100644
--- a/openam.md
+++ b/openam.md
@@ -44,6 +44,8 @@ So, OpenAM can help you to solve all these issues. Key features of OpenAM are:
 
  {% include product-links.html %}
 
+ {% include support-cta.html %}
+
  {% include product-about.html %}
 
  {% include contributors.html %}
diff --git a/opendj.md b/opendj.md
index c55ece9..5a30a95 100644
--- a/opendj.md
+++ b/opendj.md
@@ -38,6 +38,8 @@ OpenDJ is an LDAPv3 compliant directory service, which has been developed for th
 
  {% include product-links.html %}
 
+ {% include support-cta.html %}
+
  {% include product-about.html %}
 
  {% include contributors.html %}
diff --git a/openicf.md b/openicf.md
index a0582ec..adb4691 100644
--- a/openicf.md
+++ b/openicf.md
@@ -40,6 +40,8 @@ This project is licensed under the [Common Development and Distribution License
 * [groovy-connector](https://github.com/OpenIdentityPlatform/OpenICF/releases) 
 * [kerberos-connector](https://github.com/OpenIdentityPlatform/OpenICF/releases) 
 
+ {% include support-cta.html %}
+
  {% include contributors.html %}
 
  {% include sponsors.html %}
\ No newline at end of file
diff --git a/openidm.md b/openidm.md
index e161e2d..bce3c1c 100644
--- a/openidm.md
+++ b/openidm.md
@@ -30,6 +30,8 @@ OpenIDM provides a modern UI experience that allows you to manage your data with
 
  {% include product-links.html %}
 
+ {% include support-cta.html %}
+
  {% include product-about.html %}
 
  {% include contributors.html %}
diff --git a/openig.md b/openig.md
index 03cfd25..3f8a838 100644
--- a/openig.md
+++ b/openig.md
@@ -41,6 +41,8 @@ modify the target application or the container that it runs in.
 
  {% include product-links.html %}
 
+ {% include support-cta.html %}
+
  {% include product-about.html %}
 
  {% include contributors.html %}
diff --git a/privacy.md b/privacy.md
index 36c9bd3..48d65cc 100644
--- a/privacy.md
+++ b/privacy.md
@@ -1,15 +1,212 @@
 ---
 layout: home
 title: Privacy Policy
-description: Privacy Policy
-keywords: Privacy Policy
+description: "How openidentityplatform.org handles data: a static, community-run open-source site with no accounts and no ads. Analytics stay off until you consent. What we collect, the cookies and third parties involved, and your rights."
+keywords: "privacy policy, cookies, Google Analytics, consent, Open Identity Platform, data protection, GDPR"
+lastmod: 2026-07-28
 ---
 <h1>Privacy Policy</h1>
 
-This privacy policy governs the use of Google Analytics on <a href="https://www.openidentityplatform.org/" target="_blank">openidentityplatform.org</a>.
+<p class="text-muted">Last updated: {{ page.lastmod | date: "%-d %B %Y" }}</p>
 
-Google Analytics is a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.
+<p>Open Identity Platform is a community-run, open-source project. Its website,
+<a href="https://www.openidentityplatform.org/" target="_blank" rel="noopener">openidentityplatform.org</a>,
+is a static site hosted on GitHub Pages. It has no user accounts, no login, no contact forms,
+and no advertising. We aim to collect as little data as possible, and analytics stay switched
+off until you explicitly consent.</p>
 
-Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google.
+<p>This policy explains what data is involved when you visit the site, the cookies and
+third-party services we rely on, and the choices and rights you have.</p>
 
-You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
\ No newline at end of file
+<h2 class="mt-4">At a glance</h2>
+<ul>
+  <li>The site is <strong>static</strong> — we don't ask you to register or submit personal data to us.</li>
+  <li>We use <strong>Google Analytics</strong> to understand usage, but only <strong>after you accept</strong> the cookie notice. Until then the Google Analytics script is never loaded, so no data at all is sent to Google.</li>
+  <li>You can <strong>change or withdraw</strong> your choice at any time from <a href="#" data-cookie-settings>cookie settings</a>.</li>
+  <li>We run <strong>no advertising</strong> and never enable advertising or personalization tracking.</li>
+  <li>A few third parties (a hosting provider, content delivery networks, and an optional translation widget) load as part of delivering the site and can see your IP address.</li>
+  <li>Commercial-support vendors listed on the site are <strong>independent companies</strong>; contacting them is directly between you and them.</li>
+</ul>
+
+<h2 class="mt-4">Who we are</h2>
+<p>"Open Identity Platform" is an open-source community organization, hosted on
+<a href="https://github.com/OpenIdentityPlatform" target="_blank" rel="noopener">GitHub</a>.
+The website is maintained by community members and served through GitHub Pages. It is not a
+commercial product, and there is no separate company operating it.</p>
+
+<h2 class="mt-4">What data is collected, and why</h2>
+<h3 class="h5">Data you actively provide</h3>
+<p>The site does not collect personal data from you directly — there are no accounts and no
+forms. If you email a listed support vendor using the links on the
+<a href="/support">Support &amp; Services</a> page, that email goes <strong>directly to that
+independent company</strong>; we do not receive, store, or broker it. See
+"Commercial-support vendors" below.</p>
+
+<h3 class="h5">Analytics (only with your consent)</h3>
+<p>With your consent, we use <strong>Google Analytics 4</strong> (measurement ID
+<code>G-Q5PEKRFRH8</code>), a service provided by Google. The Google Analytics script is only
+downloaded once you accept the cookie notice — if you decline, or simply ignore it, your browser
+never requests it and no measurement data of any kind is sent to Google Analytics. (The optional
+translation widget described under "Third-party services" is separate and unaffected.) It helps
+us understand, in
+aggregate, which pages and resources people find useful. When enabled, it may collect information
+such as your device and browser type, an approximate location derived from your IP address, the pages
+you view, referring links, and interactions on the page. Google Analytics 4 does not store your
+IP address.</p>
+<p>Beyond page views, we record a small number of non-identifying interaction events so we can
+see which content is helpful:</p>
+<ul>
+  <li><code>support_cta_click</code> — when a "Support" call-to-action is clicked, with a
+      <code>location</code> label (for example <code>home_commercial</code> or
+      <code>product_openam</code>).</li>
+  <li><code>generate_lead</code> — when a vendor email button is clicked, with a
+      <code>vendor</code> label and a <code>region</code> label.</li>
+</ul>
+<p>These labels are fixed categories, not personal data. Analytics data is processed by Google
+under <a href="https://policies.google.com/privacy" target="_blank" rel="noopener">Google's
+Privacy Policy</a>; retention is governed by our Google Analytics settings.</p>
+
+<h3 class="h5">Hosting and server logs</h3>
+<p>The site is delivered by <strong>GitHub Pages</strong> (GitHub, Inc., part of Microsoft).
+As with any web server, GitHub may process technical request information such as your IP address
+and user-agent to deliver the site and for security. This is described in the
+<a href="https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement" target="_blank" rel="noopener">GitHub Privacy Statement</a>.</p>
+
+<h2 class="mt-4">Cookies and similar technologies</h2>
+<p>We do not set analytics cookies until you accept the cookie notice. The cookies involved are:</p>
+<div class="table-responsive">
+  <table class="table table-bordered align-middle">
+    <thead>
+      <tr><th scope="col">Cookie</th><th scope="col">Set by</th><th scope="col">Purpose</th><th scope="col">Duration</th></tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td><code>cookie-notice-dismissed</code></td>
+        <td>This site (first-party)</td>
+        <td>Remembers your answer to the cookie notice — <code>true</code> if you approved, <code>false</code> if you declined — so it isn't shown again.</td>
+        <td>~31 days</td>
+      </tr>
+      <tr>
+        <td>Google Analytics cookies (e.g. <code>_ga</code>)</td>
+        <td>Google</td>
+        <td>Set only after you consent; used to measure site usage.</td>
+        <td>Up to ~2 years (per Google)</td>
+      </tr>
+      <tr>
+        <td>Google Translate cookies (e.g. <code>googtrans</code>)</td>
+        <td>Google</td>
+        <td>Set only if you use the optional page-translation widget, to remember your chosen language.</td>
+        <td>Session / short-lived</td>
+      </tr>
+    </tbody>
+  </table>
+</div>
+<p>You can clear or block cookies through your browser settings. You can also install the
+<a href="https://tools.google.com/dlpage/gaoptout" target="_blank" rel="noopener">Google Analytics
+opt-out browser add-on</a>. Blocking cookies may affect some functionality.</p>
+
+<h2 class="mt-4">Consent (how analytics is turned on and off)</h2>
+<p>The cookie notice offers <strong>Approve</strong> and <strong>Decline</strong>, and your choice
+takes effect immediately — no page reload, no dark patterns:</p>
+<ul>
+  <li>Until you approve, the Google Analytics script is <strong>not loaded at all</strong>. Declining
+      it, or ignoring the notice entirely, means no request is made for it and no measurement data
+      — not even a cookieless one — is sent.</li>
+  <li>When you approve, Google Analytics loads and Google Consent Mode v2 is set with analytics
+      storage granted.</li>
+  <li>Advertising storage, ad personalization, and ad user data are <strong>always denied</strong> —
+      this site runs no ads and never enables them.</li>
+</ul>
+<p>To <strong>change or withdraw</strong> your choice at any time, open
+<a href="#" data-cookie-settings>cookie settings</a> to bring the notice back. Choosing
+<strong>Decline</strong> there stops further measurement and deletes the Google Analytics cookies
+already set in your browser. Clearing this site's cookies has the same effect and makes the notice
+appear again on your next visit.</p>
+
+<h2 class="mt-4">Third-party services</h2>
+<p>To deliver the site, a few third-party services load in your browser. As a normal part of
+serving their content, these providers can receive your IP address and basic request information.
+We do not control their processing; their own privacy policies apply.</p>
+<div class="table-responsive">
+  <table class="table table-bordered align-middle">
+    <thead>
+      <tr><th scope="col">Service</th><th scope="col">Provider</th><th scope="col">Purpose</th><th scope="col">Privacy policy</th></tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>Google Analytics / Tag (gtag.js)</td>
+        <td>Google</td>
+        <td>Usage analytics — the script is downloaded only after you approve the cookie notice</td>
+        <td><a href="https://policies.google.com/privacy" target="_blank" rel="noopener">policies.google.com/privacy</a></td>
+      </tr>
+      <tr>
+        <td>Google Translate widget</td>
+        <td>Google</td>
+        <td>Optional on-page translation. If you use it, the page text is sent to Google to translate.</td>
+        <td><a href="https://policies.google.com/privacy" target="_blank" rel="noopener">policies.google.com/privacy</a></td>
+      </tr>
+      <tr>
+        <td>jsDelivr CDN</td>
+        <td>jsDelivr</td>
+        <td>Serves the Bootstrap stylesheet/scripts used for layout</td>
+        <td><a href="https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net" target="_blank" rel="noopener">jsdelivr.com privacy</a></td>
+      </tr>
+      <tr>
+        <td>cdnjs (Cloudflare)</td>
+        <td>Cloudflare</td>
+        <td>Serves the Font Awesome icon fonts</td>
+        <td><a href="https://www.cloudflare.com/privacypolicy/" target="_blank" rel="noopener">cloudflare.com/privacypolicy</a></td>
+      </tr>
+      <tr>
+        <td>GitHub Pages / avatars</td>
+        <td>GitHub (Microsoft)</td>
+        <td>Hosts the site and serves some images</td>
+        <td><a href="https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement" target="_blank" rel="noopener">GitHub Privacy Statement</a></td>
+      </tr>
+    </tbody>
+  </table>
+</div>
+
+<h2 class="mt-4">Commercial-support vendors</h2>
+<p>The <a href="/support">Support &amp; Services</a> page lists independent companies that offer
+paid support. They are separate businesses, not part of this project. Vendor email links open
+your own email program with the address pre-filled; the message is sent directly from you to that
+vendor. Any personal data you share with a vendor is handled under <strong>that vendor's</strong>
+privacy policy, not this one. We do not receive a copy of your message and do not track whether
+you send it.</p>
+
+<h2 class="mt-4">Links to other websites</h2>
+<p>The site links to external resources such as GitHub, project documentation, OpenCollective,
+Wikipedia, YouTube, and vendor websites. Once you follow a link, you are subject to the privacy
+policy of that destination. We are not responsible for the content or practices of external sites.</p>
+
+<h2 class="mt-4">International data transfers</h2>
+<p>Some third parties above (for example Google and GitHub) are global providers and may process
+data in countries outside your own, including the United States. Those transfers are governed by
+the providers' own safeguards and privacy policies.</p>
+
+<h2 class="mt-4">Your rights and choices</h2>
+<p>Depending on where you live, you may have rights over your personal data — including the right
+to access, correct, delete, restrict, or object to its processing, and to data portability.
+Because this site itself does not create user accounts or hold a personal profile about you, most
+choices are exercised directly:</p>
+<ul>
+  <li><strong>Analytics:</strong> decline the cookie notice (or simply ignore it) to keep Google Analytics off; open <a href="#" data-cookie-settings>cookie settings</a> to withdraw a consent you gave earlier; or use the Google Analytics opt-out add-on.</li>
+  <li><strong>Google-held data:</strong> exercise rights over Analytics/Translate data with Google, under their privacy policy.</li>
+  <li><strong>Hosting logs:</strong> exercise rights relating to server logs with GitHub, under their privacy statement.</li>
+  <li><strong>Everything else:</strong> contact us (below) with any privacy question or request.</li>
+</ul>
+
+<h2 class="mt-4">Children's privacy</h2>
+<p>This site is intended for a technical, professional audience and is not directed at children.
+We do not knowingly collect personal data from children.</p>
+
+<h2 class="mt-4">Changes to this policy</h2>
+<p>We may update this policy as the site or the services it uses change. The "Last updated" date
+at the top reflects the most recent revision. Material changes will be reflected on this page.</p>
+
+<h2 class="mt-4">Contact</h2>
+<p>Questions about privacy or this policy? Reach the maintainers through the Open Identity Platform
+community on GitHub — open a topic in
+<a href="https://github.com/orgs/OpenIdentityPlatform/discussions" target="_blank" rel="noopener">GitHub Discussions</a>
+or via the <a href="https://github.com/OpenIdentityPlatform" target="_blank" rel="noopener">project organization</a>.</p>
diff --git a/sitemap.xml b/sitemap.xml
index 0cc00e2..18f1267 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -4,6 +4,8 @@ layout: null
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9 http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd" xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   {% assign product_pages = "/opendj,/openam,/openig,/openicf,/openidm" | split: "," %}
+  {% assign key_pages = "/support,/forgerock-alternative" | split: "," %}
+  {% assign priority_pages = product_pages | concat: key_pages %}
   {% for post in site.posts %}
     <url>
       <loc>{{ site.url }}{{ post.url }}</loc>
@@ -33,7 +35,7 @@ layout: null
         {% if page.url == "/" %}
           <changefreq>weekly</changefreq>
           <priority>1.0</priority>
-        {% elsif product_pages contains page.url %}
+        {% elsif priority_pages contains page.url %}
           <changefreq>monthly</changefreq>
           <priority>0.9</priority>
         {% else %}
diff --git a/sponsor.md b/sponsor.md
index 4a5447e..d9db062 100644
--- a/sponsor.md
+++ b/sponsor.md
@@ -1,4 +1,4 @@
 ---
 layout: redirect
-redirect_to: 'https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List'
+redirect_to: '/support'
 ---
diff --git a/support.md b/support.md
new file mode 100644
index 0000000..e383daf
--- /dev/null
+++ b/support.md
@@ -0,0 +1,161 @@
+---
+layout: home
+title: "Commercial Support & Services"
+description: "Get support for OpenAM, OpenDJ, OpenIG, OpenIDM and OpenICF. Free community help on GitHub, plus SLAs, consulting, implementation and migration from approved independent vendors."
+keywords: "Open Identity Platform support, OpenAM commercial support, OpenDJ enterprise support, OpenAM SLA, OpenAM consulting, OpenIG support, OpenIDM support, IAM support vendors, OpenAM migration services, ForgeRock migration support"
+lastmod: 2026-07-28
+service_schema: true
+faq:
+  - q: "Is Open Identity Platform free to use?"
+    a: "Yes. Every product is open source under the CDDL license — no license fees and no vendor lock-in. Commercial support is entirely optional."
+  - q: "How do I get free help?"
+    a: "Ask the community on GitHub Discussions and read the documentation. There is no cost, and no account beyond a free GitHub login is required."
+  - q: "Who provides commercial support?"
+    a: "Independent, approved vendors listed on this page provide SLAs, consulting, implementation, and migration services. They are separate companies, not the project itself."
+  - q: "How are the vendors chosen and ordered?"
+    a: "Vendors come from the project's official Approved Vendor List and are shown here in alphabetical order. Listing is not an endorsement, and the order implies no ranking."
+navbar:
+  support_active: 'active'
+---
+
+<div class="support-hero bg-primary text-white p-4 p-md-5 rounded mb-5">
+  <h1>Support &amp; Services</h1>
+  <p class="lead mb-0">Open Identity Platform is free and open source. Get help the way that suits you — ask the community at no cost, or engage an approved independent vendor for SLAs, consulting, and migration. One platform, two paths to support.</p>
+</div>
+
+<p class="fr-callout"><i class="fa-solid fa-circle-info me-2"></i>Migrating from ForgeRock? See the <a href="/forgerock-alternative">ForgeRock alternative &amp; migration path</a> to map your stack to Open Identity Platform.</p>
+
+<h2 class="mb-1">Free community support</h2>
+<p class="text-muted">Start here — it's free, and most questions are answered by the people who build the software.</p>
+<div class="row g-4 mb-5">
+  <div class="col-md-4">
+    <div class="card h-100">
+      <div class="card-body">
+        <h3 class="h5 card-title"><i class="fa-solid fa-comments me-2"></i>GitHub Discussions</h3>
+        <p class="card-text">Ask questions, share deployments, and get help from maintainers and the wider community.</p>
+        <a href="https://github.com/orgs/OpenIdentityPlatform/discussions" target="_blank" rel="noopener">Open Discussions <i class="fa-solid fa-arrow-right"></i></a>
+      </div>
+    </div>
+  </div>
+  <div class="col-md-4">
+    <div class="card h-100">
+      <div class="card-body">
+        <h3 class="h5 card-title"><i class="fa-solid fa-book me-2"></i>Documentation</h3>
+        <p class="card-text">Guides, references, and how-tos for every product — from first install to production tuning.</p>
+        <a href="https://doc.openidentityplatform.org" target="_blank" rel="noopener">Read the docs <i class="fa-solid fa-arrow-right"></i></a>
+      </div>
+    </div>
+  </div>
+  <div class="col-md-4">
+    <div class="card h-100">
+      <div class="card-body">
+        <h3 class="h5 card-title"><i class="fa-brands fa-github me-2"></i>Issue trackers</h3>
+        <p class="card-text">Report a bug or request a feature directly in the product's repository on GitHub.</p>
+        <a href="https://github.com/OpenIdentityPlatform" target="_blank" rel="noopener">Browse repositories <i class="fa-solid fa-arrow-right"></i></a>
+      </div>
+    </div>
+  </div>
+</div>
+
+<h2 class="mb-1" id="vendors">Commercial support vendors</h2>
+<p class="text-muted">Independent companies offering SLAs, consulting, implementation, and migration services.</p>
+
+<p class="vendor-neutrality-note">
+  Vendors are independent companies from the project's official
+  <a href="https://github.com/OpenIdentityPlatform/.github/wiki/Approved-Vendor-List" target="_blank" rel="noopener">Approved Vendor List</a>,
+  shown in alphabetical order. Listing here is not an endorsement, and the order implies no ranking.
+  The location shown is each vendor's headquarters — most serve clients worldwide, so choose <strong>All</strong> to see everyone.
+</p>
+
+<div class="region-filter mb-4" role="group" aria-label="Filter vendors by headquarters region">
+  <button type="button" class="btn active" data-region="all" aria-pressed="true">All</button>
+  <button type="button" class="btn" data-region="europe" aria-pressed="false">Europe</button>
+  <button type="button" class="btn" data-region="americas" aria-pressed="false">Americas</button>
+  <button type="button" class="btn" data-region="apac" aria-pressed="false">Asia-Pacific</button>
+  <button type="button" class="btn" data-region="cis" aria-pressed="false">CIS</button>
+</div>
+
+{%- assign mail_subject = "Open Identity Platform commercial support enquiry" | uri_escape -%}
+<div class="row g-4 mb-4" id="vendor-grid">
+  {% for v in site.data.vendors %}
+  <div class="col-md-6 col-lg-3 vendor-col" data-region="{{ v.region | escape }}">
+    <div class="card h-100">
+      <div class="card-body d-flex flex-column">
+        <span class="region-badge mb-2">{{ v.region_label | escape }}</span>
+        <h3 class="h5 card-title">{{ v.name | escape }}</h3>
+        <ul class="vendor-facts list-unstyled">
+          <li><i class="fa-solid fa-location-dot me-2"></i>{{ v.country | escape }}</li>
+          <li><i class="fa-solid fa-language me-2"></i>{{ v.languages | escape }}</li>
+        </ul>
+        <div class="mt-auto">
+          <a class="btn btn-support w-100 mb-2"
+             href="mailto:{{ v.email | escape }}?subject={{ mail_subject }}"
+             data-ga-event="generate_lead" data-ga-vendor="{{ v.slug | escape }}" data-ga-region="{{ v.region | escape }}">
+            <i class="fa-solid fa-envelope me-2"></i>Email {{ v.name | escape }}
+          </a>
+          <a class="btn btn-outline-secondary w-100" href="{{ v.website | escape }}" target="_blank" rel="noopener">
+            <i class="fa-solid fa-globe me-2"></i>Visit website
+          </a>
+        </div>
+      </div>
+    </div>
+  </div>
+  {% endfor %}
+</div>
+
+<h2 class="mb-3">Frequently asked questions</h2>
+<div class="row g-4 mb-4">
+  {% for item in page.faq %}
+  <div class="col-md-6">
+    <div class="card h-100">
+      <div class="card-body">
+        <h3 class="h6 card-title">{{ item.q }}</h3>
+        <p class="card-text mb-0">{{ item.a }}</p>
+      </div>
+    </div>
+  </div>
+  {% endfor %}
+</div>
+
+<script>
+(function () {
+  // Region filter — toggles cards; never reorders.
+  var buttons = document.querySelectorAll('.region-filter .btn');
+  var cols = document.querySelectorAll('.vendor-col');
+  buttons.forEach(function (btn) {
+    btn.addEventListener('click', function () {
+      var region = btn.getAttribute('data-region');
+      buttons.forEach(function (b) {
+        var selected = b === btn;
+        b.classList.toggle('active', selected);
+        b.setAttribute('aria-pressed', selected ? 'true' : 'false');
+      });
+      cols.forEach(function (col) {
+        var show = region === 'all' || col.getAttribute('data-region') === region;
+        col.classList.toggle('d-none', !show);
+      });
+    });
+  });
+
+  // Timezone hint — flags the vendor whose HQ region matches the visitor's timezone.
+  // A hint only: it never hides or reorders anything.
+  try {
+    var tz = Intl.DateTimeFormat().resolvedOptions().timeZone || '';
+    var prefix = tz.split('/')[0];
+    var map = { 'Europe': 'europe', 'America': 'americas', 'Asia': 'apac', 'Australia': 'apac', 'Pacific': 'apac' };
+    var region = map[prefix];
+    // CIS zones report under Europe/Asia prefixes; refine the common ones.
+    if (/Moscow|Kaliningrad|Samara|Volgograd|Saratov|Astrakhan|Yekaterinburg|Minsk|Kyiv|Kiev|Simferopol/.test(tz)) {
+      region = 'cis';
+    }
+    if (region) {
+      document.querySelectorAll('.vendor-col[data-region="' + region + '"] .card-body').forEach(function (body) {
+        var ribbon = document.createElement('div');
+        ribbon.className = 'vendor-tz-ribbon';
+        ribbon.textContent = 'Closest to your timezone';
+        body.insertBefore(ribbon, body.firstChild);
+      });
+    }
+  } catch (e) { /* timezone hint is best-effort */ }
+})();
+</script>