Brokered access
Browser-native RDP, SSH, HTTP and VNC. No client, no open ports, no agents.
01 Privileged Access Management · NIS2 Art. 21
every server access.
authenticated, recorded,
and provable.
VaultPAM brokers who can reach your servers and records everything they do — so you walk into any audit with evidence, not explanations.
- Hosting
- GCP Warsaw · EU-only
- Deploy
- 5 minutes · 0 agents
- Controls
- NIS2 Art. 21 · SOC 2 · ISO 27001
02 Capabilities
Everything compliance needs. Nothing it doesn't.
Credential vault
Encrypted at rest, auto-rotated. Users connect without ever seeing the password.
Session recording
Every privileged session captured and write-protected. Replay or export in two clicks.
Signed policy engine
Ed25519-signed, deny-by-default, just-in-time access with automatic expiry.
Multi-factor auth
TOTP, WebAuthn (YubiKey, Touch ID), SMS OTP. Step-up for sensitive operations.
Audit & compliance
50+ event types, append-only, immutable. Evidence for SOC 2, ISO 27001, NIS2.
03 The record
The audit log writes itself.
Append-only, SHA-256 chained, beyond anyone's reach to edit — including ours.
audit_log
| Time | Actor | Proto | Target | Verdict | Seal |
|---|---|---|---|---|---|
| 09:41:02 | m.kowalski | RDP | rdp-prod-01 | GRANTED | 7f3a…e1 |
| 09:41:02 | svc-deploy | SSH | ssh-bastion | GRANTED | b90c…4d |
| 09:40:55 | contractor-22 | RDP | db-master | DENIED | cc04…91 |
| 09:40:31 | a.nowak | VNC | vnc-jump | GRANTED | 91fa…2d |
| 09:39:58 | ops-lead | SSH | app-srv-03 | GRANTED | 2d88…e0 |
| 09:38:47 | unknown | SSH | ssh-deploy | DENIED | e07b…5c |
SOC 2 ready
04 Why teams choose it
No 12-month runway.
Enterprise PAM is built for Fortune 500 teams with dedicated PAM engineers. VaultPAM is built for the two-person IT team that needs compliant access before the next audit — not after the next hire.
Data stays in the EU.
US-hosted PAM is a GDPR and NIS2 residency problem the moment you sign. VaultPAM runs entirely in GCP Warsaw — logs, recordings and credentials never leave EU jurisdiction.
Complexity is the breach.
Legacy PAM is so complex teams under-deploy it. The agentless model covers every privileged path from day one — not the 20% you got around to configuring.
05 Is it for you?
Built for some teams — not all. The honest cut.
A good fit if…
- You have 10–500 servers and a small IT team
- You share admin passwords between team members today
- An auditor or regulator has asked about privileged access controls
- You need to know exactly what your IT contractor did — and when
- You want this running in a day, not a six-month project
Probably not the right fit if…
- You need a PAM solution for 5,000+ users with dedicated PAM engineers
- Your compliance framework requires on-premise deployment with no cloud component
- Your primary use case is database or mainframe access (not server/RDP/SSH access)
- You need a solution your legal team can audit before any data leaves your own infrastructure
Not sure? Talk to us — we'll tell you honestly if VaultPAM is the right tool for your situation.
NIS2 Art. 21 — mandatory, not optional