Control, broker, rotate and audit every privileged credential and session across your estate.

Secure the secret

Every password, key and token is stored encrypted at rest and never exposed in the clear unless policy allows.

Broker the session

Admins connect to targets through PAM — it injects the credential, records the session, and they never see the password.

Rotate & prove it

Credentials rotate on schedule or after use; every action is written to a tamper-evident, exportable audit trail.

Credential Vault

Encrypted secret store with versioning & rollback, per-secret metadata, and policy-driven access.

• AES-256-GCM at rest, master-key custody (file / env / KMS)
• Secret versioning + one-click rollback of a bad rotation
• Password policy engine (complexity, history, max-age)
• Managed SSH keypairs

Privileged Session Manager

Browser-based brokered sessions — the operator never holds the credential.

• PuTTY-grade web SSH terminal (PTY over WebSocket)
• mstsc-grade RDP & VNC via the Guacamole gateway
• Full session recording + replay (and MP4 export)
• Live session monitoring + force-terminate
• Per-session risk scoring

Credential Rotation (CPM)

Scheduled & on-checkin rotation with verification and reconcile-on-failure.

• 30+ live managed rotators (see platform matrix)
• Read-only credential verification probes
• Cadence auto-verify + auto-reconcile
• Per-platform rotation-policy forms

Just-in-Time & Dynamic Secrets

Zero standing privilege — ephemeral credentials that auto-expire.

• JIT elevation with time-boxed grants
• Dynamic DB/queue users (Postgres, MySQL, Mongo, Redis, RabbitMQ, Elasticsearch) leased & auto-revoked
• Break-glass emergency access (audited)

Dual-Control & Approvals

Separation of duties on the most sensitive actions.

• Approve-to-reveal / approve-to-connect
• Access Groups (which devices) × Roles (which actions)
• Per-safe membership & scoping
• Hard SoD constraints

Application Access Manager

Secret retrieval for non-human identities (AAM / CCP).

• Apps fetch secrets via scoped tokens — no hard-coded passwords
• Per-application allow-lists (which safes / which secrets)
• Session-only secrets (PSM-brokered, no plaintext)

Cloud Privileged Access

One-click console + JIT CLI credentials for the big three.

• AWS console federation + JIT keys (STS)
• Azure JIT AAD tokens · GCP JIT SA tokens
• Google Workspace admin (domain-wide delegation)
• Long-lived keys never leave the vault

Governance & Compliance

Prove who accessed what, when, and why.

• Tamper-evident, hash-chained audit log
• Access certification / recertification campaigns
• Policy engine + "who accessed what & how long" reports
• Exportable reports (XLSX / JSON)

Authentication & Identity

Strong auth on the front door, federated to your IdP.

• MFA / TOTP with QR enrolment + backup codes
• SSO via OpenID Connect
• LDAP / Active Directory login + group→role mapping
• Cluster-wide session revocation

Discovery & Onboarding

Find privileged accounts and bring them under management.

• Network discovery scans (dual-control gated)
• Guided add-device wizard + live supported catalog
• Bulk server onboarding (CSV → vault import)

Monitoring & SIEM

Feed every privileged event to your SOC.

• Real-time event stream (SSE) + notifications
• SIEM / Syslog (RFC5424) audit egress — Splunk, QRadar, Sumo Logic
• Outbound webhooks with circuit-breaker

Updates & Licensing

Ship and govern the product itself, securely.

• Air-gapped, Ed25519-signed offline updates + rollback
• Cloud licensing control plane (signed entitlements, grace-then-lock)
• Content-pack OTA (zero-restart, signed)