Open one door for your vendor, not your network
Time-boxed, passkey-authenticated, recorded access to one internal app or one remote desktop. No VPN, no inbound port, no shared password.
Today it is usually one of two things
Either the vendor gets a VPN — broad access to the network, a standing credential and an endpoint to defend — or an account password is handed over in a chat message. Neither is scoped, neither expires itself, and neither shows you what the vendor actually touched.
Two ways to run it
Hosted — we run it
Nothing to install, nothing to maintain, updates are ours. Passkey sign-in, time-boxed grants, session recording and the audit trail all work the same.
- Free tier: 1 connector, 5 resources
- Opening a Captivo account brings the Access free tier with it
- We provision your console: <your-org>.cloud.captivo.io
Cloud consoles are provisioned by hand today; requests are answered the same day.
On your own server
Apache 2.0, no limits. Sessions and recordings never leave your infrastructure; you run the install and the upgrades.
How it works
1. Install the Connector
A small connector runs inside your network and dials OUT. Nothing has to be opened inbound on your firewall.
2. Invite the vendor
The vendor enrols with a passkey. No shared password, no standing credential.
3. Grant a time window
Access is granted to one app or one machine, with a start and an end. When the window closes, the access ends itself.
4. Watch and record
Every request is checked as it happens and written down. Sessions can be watched live or replayed later.
What you get
- Internal web apps and remote desktops (RDP / SSH / VNC) — both in the browser, with nothing to install
- Passkey authentication; no shared passwords and no standing credentials
- Time-boxed grants, an approval flow and recurring schedules; access closes itself when the window ends
- An outbound-only tunnel — nothing is opened inbound on your firewall
- Session recording, live watch, take-control and terminate
- A hash-chained, tamper-evident audit trail with RFC 3161 timestamping
- An isolated browser for the riskiest access, with clipboard limits and a screen watermark
- Apache 2.0 open source — run it on your own server if you prefer; in that deployment your traffic crosses nobody else's infrastructure
Remote desktops, in the browser too
Not only web apps: RDP, SSH and VNC sessions open in the browser, are recorded, and can be watched live. Nothing is installed on the vendor's machine and no separate bastion host is needed.
Frequently asked questions
How is this different from a VPN?
A VPN puts the vendor on your network and leaves a standing credential behind; it is neither scoped nor self-expiring. Captivo Access grants one app or one machine for a set window, and records every request the vendor makes.
Do I have to open a port on my firewall?
No. The connector inside your network dials out, so no inbound endpoint is created.
Where does it run, and where does my data go?
Two options. Hosted, which we run: nothing to install, and sessions and recordings are held on our infrastructure. Self-hosted, where no data leaves your network at all. Either way the connector dials out, so no inbound endpoint is created on your firewall.
How does it relate to Captivo Portal?
Both are Captivo products, but they do different jobs: Captivo Portal is for guest WiFi and corporate network access, Captivo Access is for letting outside vendors reach internal systems. Either can be used on its own.
How mature is it?
Development is ongoing. Everything described here works today, and because it is open source you can read the code and the security model yourself. We recommend reviewing it before putting it in front of something critical.