I've given this quite some thought. I've made a list once here (it's in Dutch though) what you should do if you want a full fledged account management platform with login, and that's even before GDPR, and not handling what's available from other platforms, e.g. with OAuth or identity services from cloud providers that are available nowadays. I haven't worked with IntraWeb or TMS Web Core, but I've dabbled with a Delphi-(compiler-)based web-platform of my own, with an explicit emphasis on speed, security and portaility (between hosting environments), so yes if you want to build something serious you need user control and it takes some work. For a first big xxm application/website of my own: tx I for now stick to this list I created of everything I think a website with user accounts should have. But for new websites it's increasingly interesting to skip the hard work and make your website depend on a number of options you can expect your users to have an account with: Google, Facebook, Twitter, Microsoft, and if your public is somewhat tech savvy Github. (I should check if reddit has an OAuth api...)