SignInSecure
Book a demo Launch console
Home / Features

Enterprise-grade PAM, without the enterprise weight.

Everything below ships in one platform, across every tenant you manage — the controls auditors ask for, the ergonomics your operators actually want, and an honest list of what we decided not to build.

The security model

Credentials and recordings never leave the edge

The gateway holds each target's login in a disk-sealed vault (AES-256-GCM, key never leaves the customer environment) and injects it into the brokered session — operators are handed a session, never a password. Recordings are edge-encrypted, and the audit trail is a per-tenant hash chain no one can quietly rewrite.

0protocols brokered
0sessions recorded
0secrets stored in the cloud
network topology · outbound-only
INSIDE YOUR BUSINESS 0 inbound ports Operator SignInSecurecontrol plane Gatewaydials out Servers Databases Desktops
Checked, not assumed

The figures that can go the wrong way

A number that can only ever be green is worse than no number, because somebody trusts it. These move when something is wrong — which is the only reason to put them next to a claim.

100%
Recording coverage Sessions that should have been recorded, against what arrived
96%
Seals re-verified Stored recordings re-read and checked against the hash they were sealed with
100%
Evidence delivered Audit events confirmed as reaching your SIEM, not merely sent
88%
Rotations landed Credential rotations that completed, rather than being asked for and lost

Illustrative figures from a healthy estate. In your console they are counted from your own rows, and every one of them has a finding attached when it slips.

The honest part

What SignInSecure deliberately doesn’t do

Every product page is a list of things that work. Here is the other list — the trade-offs we made on purpose, so you find them now rather than during an incident.

  • There is no key escrow, and no recovery path. If you hold your own metadata key and lose it, the sealed command text is gone — for you and for us. Adding a way back would mean we hold something that decrypts your data, at which point the promise is marketing.
  • It is not end-to-end encryption of the whole product. A control plane has to route, schedule, bill and authorize, so who connected, to what, as which role and for how long stay legible to us. The words people typed do not.
  • Ending a session takes a few seconds, not zero. The relay asks every few seconds which sessions are finished. We would rather say “about five seconds” than imply an instant we cannot deliver.
  • A revoked gateway cannot be un-revoked. The only honest replacement for a leaked gateway credential is a new gateway. Bringing one back would make “is this dead?” depend on who has been in the console since.
  • Least-privilege controls ship switched off. A control whose first act is an outage is one that gets turned off for good, so the tighter settings are opt-in per customer — and the console shows how many requests each would have blocked before you decide.
  • An asset group does not yet narrow to particular machines. A rule grants a role across a customer. We would rather say so on the screen than let somebody believe production is fenced off from staging.
  • Desktop sessions cannot be joined part-way through. A watcher arriving mid-session would see a blank canvas, so we say so instead of handing over a token that produces one.
  • We back up network configurations; we do not push them back yet. Restoring a config to a live router is the most dangerous button in the product. It waits for a change gate, a dry run and automatic rollback — built properly, not quickly.
  • Removing someone from a group does not revoke a ticket they already hold. A Kerberos ticket or cloud token issued during a just-in-time window keeps working until it expires. We say so on the screen, and tell you which setting shortens it.
  • The customer, not us, decides what can be granted just-in-time. The groups and cloud roles we may touch are listed on their own gateway. However our side is configured — or compromised — it cannot grant anything else.
  • Search cannot look inside sealed text. Holding the key to make that possible would undo the point, so a search says how many rows it could not read rather than returning an empty list that reads as “nothing matched”.
Questions

Answers before you ask

Put it on your own stack

Start free trial See pricing →