Server Operating System
Windows Server 2019 or later.
Deployment Model
On-premises.
System Sizing
4+ cores, 16 GB RAM, and 50 GB disk per application server. Additional resources may be required based on deployment scale and workload.
Multi-Tenant Architecture
Centralized management of multiple client organizations with client-specific administration and segregated data.
Backend Database
PostgreSQL bundled by default; Microsoft SQL Server supported as an optional backend. Database selection occurs during installation. Migration between databases is supported through Securden support.
Supported Browsers
Chrome, Edge, Firefox, and Safari.
Client Applications
Desktop applications for Windows, macOS, and Linux; mobile applications for iOS and Android; browser extensions for Chrome, Firefox, Edge, and Safari.
Primary Authentication
Local accounts, Active Directory, Microsoft Entra ID, LDAP, RADIUS, and smart card authentication.
Single Sign-On
SAML 2.0 support for Okta, Microsoft Entra ID, ADFS, OneLogin, Ping Identity, Google Workspace, and other SAML identity providers.
MFA and Passwordless Login
MFA through TOTP apps such as Google Authenticator and Microsoft Authenticator, Securden Authenticator, Duo Security, RSA SecurID, YubiKey, email OTP, and RADIUS-based MFA. Passwordless login through FIDO2 and WebAuthn-based passkeys.
Data Encryption and Key Management
Sensitive vault data is encrypted at the application level using AES-256 before database storage. Unique per-installation encryption key stored separately from the encrypted database. HSM support available.
Certificate Support
Self-signed certificate by default; CA-signed certificates supported.
Privileged Account Discovery
Agentless discovery across Windows, Linux, macOS, databases, network devices, cloud applications, SSH-enabled devices, virtual machines, services, scheduled tasks, and IIS application pools.
Password Rotation
Agentless rotation scheduled per folder or policy. Dependent services, scheduled tasks, and IIS application pools are updated as part of the same rotation.
Remote Connections and Session Management
RDP, SSH, and SQL through web-based and native client access, without revealing passwords to users. Supports session monitoring, recording, and playback. Recording requires a remote gateway and is enabled globally, then per account or folder.
Client-Side Remote Connector
Lightweight connector within the client network that establishes outbound-only connectivity with the MSP-hosted PAM server and securely routes remote operations.
Shared Remote Gateway
Centralized MSP Remote Gateway that brokers privileged remote sessions across multiple client organizations.
Integrations and API Access
Active Directory, Microsoft Entra ID, LDAP, Google Workspace, SAML SSO, SIEM solutions, ticketing systems, MFA providers, SDKs, and CLI access. REST API with token-based authentication for credential retrieval and management. An MSP-generated token can be reused to access APIs for individual client organizations.
High Availability and Database Clustering
Secondary application server with automatic failover; read-only database replica on a separate subnet. SQL clusters supported with the Microsoft SQL Server backend.
Disaster Recovery
Scheduled full database backups to a remote destination, with a minimum hourly interval.
Offline Access
Offline access through the desktop application or an encrypted HTML export protected by a passphrase.