Tanflow PAM
Secure. Control. Audit.
Zero-agent Privileged Access Management: a browser-based gateway between your people and your most critical systems - every credential vaulted, every session recorded, every command policed.
The privileged access challenge
Privileged credentials are the primary target in modern attacks
Shared root passwords
The same superuser credential in a dozen engineers' heads - and in their notes app. Nobody can say who used it last night.
No session visibility
An admin connects to a production database. What did they run? Without session recording, the honest answer is: nobody knows.
Standing privileges
Access granted for one incident, still active a year later. Standing privilege is standing risk.
Unmanaged vendor access
Third-party engineers with VPN credentials and no supervision - the entry point in some of the most damaging breaches on record.
Audit blind spots
The regulator asks for privileged session evidence. The team starts grepping terminal histories and hoping.
The Tanflow answer
Put a recording, policy-enforcing gateway between every human and every privileged target - with nothing to install on either side.
See it live →Capabilities
Everything privileged access, in one platform
The modules of Tanflow PAM, grouped by capability area. Explore any capability in detail.
Sessions & Connectivity
Access Control & Governance
Credentials & Identity
Credential Vault
Encrypted vaulting, rotation and injection - no exposure.
Learn more →Multi-Factor Authentication
TOTP, email/SMS OTP and FIDO2 keys on the gateway.
Learn more →SSO & SAML Federation
Log in through your corporate SAML identity provider.
Learn more →Roles & Access Control
Least-privilege administrative tiers and delegated roles.
Learn more →Zero-trust access architecture
Five steps between a user and a root shell
No direct network path to targets. Every privileged session flows through the gateway - authenticated, authorised, injected, recorded.
Protocol coverage
One gateway for every privileged doorway
Web-rendered sessions to your servers, desktops, network devices and databases - from any modern browser.
Command audit engine
Policy verdicts for every command
Command control isn't just block-or-allow. Four graduated verdicts let you match control strength to risk.
| Verdict | What happens | Typical use |
|---|---|---|
| BLOCK + TERMINATE | Command is stopped, the session is killed instantly, and the SOC is alerted. | Destructive operations on production: rm -rf, DROP DATABASE, destructive changes on network devices. |
| BLOCK + NOTIFY | Command is stopped, session continues, administrators are notified. | Risky-but-recoverable actions: service restarts, config edits outside change windows. |
| JUSTIFY | User must enter a business justification before the command executes; justification is logged. | Sensitive reads: exporting customer tables, accessing payment logs. |
| ALLOW + WARN | Command runs, user sees a caution, event is highlighted in the audit trail. | Discouraged patterns you still permit: sudo to shared accounts, legacy tooling. |
Time-based & JIT access
Privilege that expires by itself
Change-window access
The DBA team gets production database access every Saturday 22:00-02:00 - outside the window, the door doesn't exist.
Incident JIT elevation
An on-call engineer requests emergency root for one hour; approval arrives on the approver's phone; access self-destructs at minute sixty.
Vendor time-boxing
A hardware vendor gets RDP to one jump-target for Tuesday's maintenance - recorded, watermarked, and gone by Wednesday.
Enterprise SSO & federation
Plugs into the identity you already have
Tanflow PAM federates with SAML 2.0 identity providers - including the Tanflow IAM Suite, Azure AD / Entra ID, Okta, Keycloak and ADFS - so privileged access inherits your existing authentication and MFA posture.
How Tanflow PAM compares
Feature parity, without the legacy baggage
The honest comparison prospects ask us for - against open-source assemblies and legacy on-premises suites.
| Capability | Tanflow PAM | Open-source stack | Legacy on-prem PAM |
|---|---|---|---|
| Zero-agent, browser-based access | ✔ Built-in | Partial - assembly required | ✘ Agents/clients typical |
| Broad protocol coverage (SSH, RDP, K8s, 15+ DB clients) | ✔ Built-in | Per-protocol setup | Varies by module |
| Full session recording & replay | ✔ Built-in | Basic logging only | ✔ Available |
| Live session sharing (read-only / interactive) | ✔ Built-in | ✘ Not available | Rarely native |
| Credential vault with rotation & injection | ✔ Built-in | Separate tools to integrate | ✔ Available |
| Multi-factor authentication (TOTP, OTP, FIDO2) | ✔ Built-in | External IdP required | ✔ Available |
| SAML 2.0 SSO federation | ✔ Built-in | DIY integration | ✔ Available |
| Role-based access control (granular tiers) | ✔ Built-in | DIY configuration | ✔ Available |
| Real-time command control (4 verdicts) | ✔ Built-in | ✘ Not available | Premium add-on |
| Database session control (SQL/NoSQL) | ✔ Built-in | ✘ Not available | Limited coverage |
| Just-in-time / time-based access | ✔ Built-in | ✘ Manual scripting | Complex to configure |
| Change management & access approvals | ✔ Built-in | ✘ Manual / external | ✔ Available |
| Audit reporting & attestation (regulator-ready) | ✔ Built-in | Basic logs only | Reporting add-on |
| External access monitoring (bypass detection) | ✔ Built-in | ✘ Not available | ✘ Not available |
| Scales across the whole organisation | ✔ Built-in | DIY engineering | Limited by licence tiers |
| Deployment time | 2-4 weeks | Months of engineering | 3-6 months typical |
| Vendor support & accountability | 24×7 local OEM | ✘ Community forums | Offshore ticket queues |
| Total cost of ownership | Low - infra-based | Low licence, high labour | High licence + services |
Deployment & economics
On your infrastructure, in production fast
See command control in action, live
The 30-minute Tanflow PAM demo: vault a credential, record a session, block a command, replay the evidence.