Access to critical systems: who, when, and what they did.
Admins and third-party support teams connect to servers, database hosts and firewall consoles without ever seeing the password. Every session is recorded and every action lands in a tamper-evident audit chain.
Why now
Privileged accounts are where attackers and auditors look first.
Shared admin passwords
The same “Administrator” password on dozens of servers, unchanged for years.
VPN for every vendor
Your support partner is inside over VPN — and no one sees what they connect to or what they do.
“Who did this?”
A setting changed or data was deleted. A shared account was used, so nobody can be held to it.
Passwordless sessions
The password stays in the vault and is never shown.
Users pick the system they need from “My access”. Piservo takes the credential from the vault and opens the session. RDP, SSH, VNC and Telnet run in the browser; web admin consoles open without the password ever reaching the user’s browser.
- RDP, SSH, VNC and Telnet in the browser; native RDP client via the desktop app
- Web sessions for firewall and application consoles; a browser extension fills credentials without revealing them
- File upload and download during sessions
- Live list of active sessions and one-click termination
Session recording
Watch it like video, search it like text.
Every session is recorded encrypted and played back in a protocol-aware player. Keystrokes become a searchable transcript, so finding the session where someone typed “pg_dump” doesn’t take hours of video.
- Recordings are stored encrypted, on your own storage or in the cloud
- Per-tenant retention from 0 to 3650 days; deletion of expired recordings is audited too
- Transcript search that jumps straight to the moment
Access requests
No standing privilege. Time-boxed, approved access when needed.
Users request access and state a reason. If the policy requires approval, the request goes to approvers; once approved, access opens for a set time and number of sessions and closes on its own.
- Approval strategies: none, single, sequential, four-eyes (at least two distinct approvers), role-based
- Route approval to the requester’s manager; delegate approvals
- Policies by asset, asset group or tag, for users or roles
Password rotation
Passwords change on schedule — and are verified when they do.
Piservo changes the password on the target system itself and tests that the new one works. Nobody knows the new password; it isn’t written down anywhere but the vault.
- Active Directory domain accounts, Windows local accounts, Linux SSH, MSSQL and Oracle
- Schedules: manual, every N days, a day of the month, on check-in, at session end
- Applications fetch credentials from the vault instead of hard-coding them; every access is audited
Architecture
No bastion, no VPN, no inbound ports.
The Edge Connector in your network opens an encrypted tunnel outbound only. It works behind NAT, and you can manage several sites with separate Edges. Setup takes a few steps from the portal.
- Each organisation’s data is encrypted with its own key
- If you prefer, encryption keys stay entirely on your own infrastructure
- Paper backup option for the on-prem vault’s master key
Audit & integrations
Ready when the auditor asks.
Tamper-evident audit log
Entries are chained together, so deleting or altering a single one shows up immediately on verification.
Streaming to your SIEM
Events flow to the SIEM you use in real time.
Active Directory sign-in
Users sign in with their company account; bulk import from AD. Single sign-on with Microsoft Entra.
Two-step verification
Second factor with an authenticator app; enrolment by QR code in seconds.
Admin actions kept separate
Changes to users, policies and settings are listed on their own screen, with who made them.
Desktop app
For Windows and Linux; native RDP client connections and automatic updates.
Deployment options
Two models, both connecting from the inside out.
Piservo Cloud + Edge
The management portal runs with us, the Edge Connector in your network. Quick to set up, maintained by us.
On-Prem Enterprise
Portal and vault run in your data centre; keys and recordings stay entirely with you.
Can users see the password of the server they connect to?+
No. The credential is taken from the vault and Piservo opens the session. Even for web consoles, the password is never sent to the user’s browser.
Do we need to open ports on our network?+
No. The Edge Connector only makes outbound connections; it works behind NAT and needs no VPN or bastion host.
Which systems can it rotate passwords on?+
Active Directory domain accounts, Windows local accounts, Linux (SSH), Microsoft SQL Server and Oracle. The new password is tested after every change.
How long are recordings kept?+
You decide: anywhere from 0 to 3650 days, 90 by default. Deleting expired recordings is written to the audit log as well.
How does it help with data protection compliance?+
It records who used privileged accounts that can reach personal data, when and why — a key part of the technical measures required by KVKK Article 12 and similar regulations.
How is it priced?+
By number of managed assets, number of sites and recording retention. Write to sales@piservo.com for a quote.
More from Piservo
Let’s put your first server in the vault today.
In a demo call we install the Edge Connector together and record your first session.