Tanflow PAM
Secure. Control. Audit.
Zero-agent Privileged Access Management: a browser-based gateway between your people and your most critical systems - every credential vaulted, every session recorded, every command policed.
The privileged access challenge
Privileged credentials are the primary target in modern attacks
Shared root passwords
The same superuser credential in a dozen engineers' heads - and in their notes app. Nobody can say who used it last night.
No session visibility
An admin connects to a production database. What did they run? Without session recording, the honest answer is: nobody knows.
Standing privileges
Access granted for one incident, still active a year later. Standing privilege is standing risk.
Unmanaged vendor access
Third-party engineers with VPN credentials and no supervision - the entry point in some of the most damaging breaches on record.
Audit blind spots
The regulator asks for privileged session evidence. The team starts grepping terminal histories and hoping.
The Tanflow answer
Put a recording, policy-enforcing gateway between every human and every privileged target - with nothing to install on either side.
See it live →Zero-trust access architecture
Five steps between a user and a root shell
No direct network path to targets. Every privileged session flows through the gateway - authenticated, authorised, injected, recorded.
Protocol coverage
One gateway for every privileged doorway
Web-rendered sessions to your servers, desktops, network devices and databases - from any modern browser.
Command audit engine
Policy verdicts for every command
Command control isn't just block-or-allow. Four graduated verdicts let you match control strength to risk.
| Verdict | What happens | Typical use |
|---|---|---|
| BLOCK + TERMINATE | Command is stopped, the session is killed instantly, and the SOC is alerted. | Destructive operations on production: rm -rf, DROP DATABASE, destructive changes on network devices. |
| BLOCK + NOTIFY | Command is stopped, session continues, administrators are notified. | Risky-but-recoverable actions: service restarts, config edits outside change windows. |
| JUSTIFY | User must enter a business justification before the command executes; justification is logged. | Sensitive reads: exporting customer tables, accessing payment logs. |
| ALLOW + WARN | Command runs, user sees a caution, event is highlighted in the audit trail. | Discouraged patterns you still permit: sudo to shared accounts, legacy tooling. |
Time-based & JIT access
Privilege that expires by itself
Change-window access
The DBA team gets production database access every Saturday 22:00-02:00 - outside the window, the door doesn't exist.
Incident JIT elevation
An on-call engineer requests emergency root for one hour; approval arrives on the approver's phone; access self-destructs at minute sixty.
Vendor time-boxing
A hardware vendor gets RDP to one jump-target for Tuesday's maintenance - recorded, watermarked, and gone by Wednesday.
Enterprise SSO & federation
Plugs into the identity you already have
Tanflow PAM federates with SAML 2.0 identity providers - including the Tanflow IAM Suite, Azure AD / Entra ID, Okta, Keycloak and ADFS - so privileged access inherits your existing authentication and MFA posture.
How Tanflow PAM compares
Feature parity, without the legacy baggage
The honest comparison prospects ask us for - against open-source assemblies and legacy on-premises suites.
| Capability | Tanflow PAM | Open-source stack | Legacy on-prem PAM |
|---|---|---|---|
| Zero-agent, browser-based access | ✔ Built-in | Partial - assembly required | ✘ Agents/clients typical |
| Credential vault with rotation & injection | ✔ Built-in | Separate tools to integrate | ✔ Available |
| Real-time command control (4 verdicts) | ✔ Built-in | ✘ Not available | Premium add-on |
| Full session recording & replay | ✔ Built-in | Basic logging only | ✔ Available |
| Just-in-time / time-based access | ✔ Built-in | ✘ Manual scripting | Complex to configure |
| Database session control (SQL/NoSQL) | ✔ Built-in | ✘ Not available | Limited coverage |
| SAML 2.0 SSO federation | ✔ Built-in | DIY integration | ✔ Available |
| Scales across the whole organisation | ✔ Built-in | DIY engineering | Limited by licence tiers |
| Deployment time | 2-4 weeks | Months of engineering | 3-6 months typical |
| Vendor support & accountability | 24×7 local OEM | ✘ Community forums | Offshore ticket queues |
| Total cost of ownership | Low - infra-based | Low licence, high labour | High licence + services |
Deployment & economics
On your infrastructure, in production fast
See command control in action, live
The 30-minute Tanflow PAM demo: vault a credential, record a session, block a command, replay the evidence.