Open one door for your vendor, not your network
Time-boxed, passkey-authenticated, recorded access to one internal app or one remote desktop. No VPN, no inbound port, no shared password.
Today it is usually one of two things
Either the vendor gets a VPN — broad access to the network, a standing credential and an endpoint to defend — or an account password is handed over in a chat message. Neither is scoped, neither expires itself, and neither shows you what the vendor actually touched.
How it works
1. Install the connector
A small connector runs inside your network and dials OUT. Nothing has to be opened inbound on your firewall.
2. Invite the vendor
The vendor enrols with a passkey. No shared password, no standing credential.
3. Grant a time window
Access is granted to one app or one machine, with a start and an end. When the window closes, the access ends itself.
4. Watch and record
Every request is checked as it happens and written down. Sessions can be watched live or replayed later.
What you get
- Internal web apps and remote desktops (RDP / SSH / VNC) — both in the browser, with nothing to install
- Passkey authentication; no shared passwords and no standing credentials
- Time-boxed grants, an approval flow and recurring schedules; access closes itself when the window ends
- An outbound-only tunnel — nothing is opened inbound on your firewall
- Session recording, live watch, take-control and terminate
- A hash-chained, tamper-evident audit trail with RFC 3161 timestamping
- An isolated browser for the riskiest access, with clipboard limits and a screen watermark
- Apache 2.0 open source — runs on your own server, and your traffic crosses nobody else's infrastructure
Remote desktops, in the browser too
Not only web apps: RDP, SSH and VNC sessions open in the browser, are recorded, and can be watched live. Nothing is installed on the vendor's machine and no separate bastion host is needed.
Frequently asked questions
How is this different from a VPN?
A VPN puts the vendor on your network and leaves a standing credential behind; it is neither scoped nor self-expiring. Captivo Access grants one app or one machine for a set window, and records every request the vendor makes.
Do I have to open a port on my firewall?
No. The connector inside your network dials out, so no inbound endpoint is created.
Where does it run, and where does my data go?
On your own server. There is no hosted version; sessions and recordings stay on your infrastructure.
How does it relate to Captivo Portal?
Both are Captivo products, but they do different jobs: Captivo Portal is for guest WiFi and corporate network access, Captivo Access is for letting outside vendors reach internal systems. Either can be used on its own.
How mature is it?
Development is ongoing. Everything described here works today, and because it is open source you can read the code and the security model yourself. We recommend reviewing it before putting it in front of something critical.