AuthGuard Request a demo

PAM · privileged access

Full access, only when it is needed, and recorded.

AuthGuard keeps privileged credentials in a vault, grants access on request and for a limited time, and records every session: SSH in the browser or your own client, remote desktop and databases. Applications and pipelines get their secrets without storing passwords.

Talk to us about PAM See how it works
  • Just-in-time
  • Vault and rotation
  • SSH · RDP · PostgreSQL
  • Application secrets
PAM · active accessillustrative example
  • SSH · db-prod-01recordedWeb terminal · Rui Matos · 00:12:48
  • RDP · srv-app-02recordedDesktop in the browser · credential never shown
  • PostgreSQL · financestatementspsql with a one-time ticket · result rows not recorded
  • Secret · deploy pipeline5 minGitHub Actions · sealed to the job’s key
Recordings sealedanchored in the audit chain
  1. Request
  2. Approved 2 of 2
  3. Session recorded
  4. Sealed

Watch

Full access, only when it’s needed.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

Request, time limit, recording.

Sessions run through an Edge appliance in your network; the vault, decisions and audit log stay in AuthGuard.

  1. 01 · Request

    Just-in-time

    A recorded session, a credential checkout or a temporary account, with a duration, justification and ticket. Up to three approvals from approver groups, in the console or on the phone, with a comparison code.

  2. 02 · Vault

    Credentials nobody sees

    A write-only vault encrypted with AES-256-GCM under an organisation key protected by KMS, with optional offline escrow. Rotation on a schedule, on check-in, after a reveal or after break-glass.

  3. 03 · Session

    SSH, RDP and databases

    The gateway signs in to the server with the vaulted credential. People use the web terminal or their own SSH client, the desktop in the browser or mstsc, and their own PostgreSQL client.

  4. 04 · Evidence

    Sealed recordings

    Recordings are encrypted, hash-chained, signed by the gateway and anchored in the audit log. SSH and RDP sessions can be watched live and terminated.

Applications and pipelines Rolling out

Secrets without passwords stored in the pipeline.

A GitHub Actions or GitLab pipeline, or a Kubernetes service account, proves who it is with the token its own platform issues. Servers outside those platforms sign with their own Ed25519, ES256 or ML-DSA-65 key.

AuthGuard exchanges that proof for a 5-minute token, bound through DPoP to a key that never leaves the job, and delivers the secrets sealed with hybrid post-quantum encryption (X25519 + ML-KEM-768). If any requested name is not allowed, nothing is delivered. Every read is logged and, after a rotation, the previous version keeps working for 7 days.

Illustrative example

Break-glass at 3 a.m.: two officers, one hour, one review.

The payments server fails and the usual approvers do not answer. Inês, from the break-glass group, requests break-glass access with the incident reference; a second officer confirms with a passkey within 15 minutes.

Access lasts at most 60 minutes. Afterwards the credential rotates automatically, and an administrator outside the group has 72 hours to review what happened.

Modules

Every privileged access, under control.

Just-in-time access

Request, approval, time limit

  • Recorded session, credential checkout and temporary account
  • Up to 3 approvals and 16 approver groups
  • Activation, reveal and decision confirmed with a passkey
  • Policy rules for pam.session, pam.checkout and pam.jit
See details: Privileged access
Vault and rotation

Credentials nobody memorises

  • Connectors for Linux, SSH keys, Windows local accounts, MySQL, PostgreSQL and HTTP
  • Temporary accounts created and removed at the end
  • Rotation with retries and alerts
  • Offline escrow with X25519 + ML-KEM-768
SSH

Web terminal and your own client

  • Web terminal with a 1-minute ticket
  • Your own SSH client with the person’s registered key
  • SFTP per profile, with operations logged
  • A command index rebuilt from keystrokes (best effort)
RDP Rolling out

In the browser and with mstsc

  • Desktop in the browser, no plug-ins
  • mstsc with a one-time credential for the gateway
  • The server credential is never shown
  • Clipboard to the server only, if the profile allows it
Databases Rolling out

PostgreSQL sessions

  • Your usual client: psql, DBeaver, DataGrip
  • One-time ticket and fully verified TLS
  • Statements recorded; result rows are not
  • Up to 64 rules to alert, block or terminate
Retention

Recordings with an end date

  • Retention from 30 days to 10 years
  • Legal hold released only with a second administrator
  • GDPR erasure destroys recordings not on hold
  • Integrity shown: anchored, incomplete or failed

Worth knowing

  • RDP in the browser and with mstsc, PostgreSQL sessions and application secrets are in final integration. The rest of PAM is available today.
  • RDP: no Kerberos, no multiple monitors and no drive, printer, audio, smart-card or USB redirection. With mstsc there is no clipboard.
  • Databases: PostgreSQL only for now, and these sessions cannot be watched live.
  • Approval at connection time, Kubernetes and web-application sessions are not available yet.
  • Recordings make any later change visible; a gateway compromised at capture time remains a risk to consider.
  • Sessions need an Edge appliance in your network.

In the help centre

Pilot

Start with one critical server.

One server, its privileged accounts and one approver group. We install the Edge appliance with you and define the first access profile.

geral@authguard.pt