Which open-source privileged access management tool fits your environment
If your team must broker SSH, Kubernetes, database and Windows sessions and record them, shortlist Teleport first when access is certificate-based and centred on infrastructure engineers, and shortlist JumpServer first when you need one web workspace covering many asset types with password rotation and ticketed approvals. Apache Guacamole is the choice when the need is clientless remote desktop access through a browser, with session recording added through an extension. The licence limit that most often decides the choice is Teleport Community Edition, which the distributed builds allow only for organizations with fewer than 100 employees and less than $10,000,000 in annual revenue. Confirm that threshold against the current license text before you plan around it, because a larger company will need a commercial Teleport license from the start.
Teleport is the stronger fit where engineers already work through SSH and kubectl and you want short-lived certificates instead of shared keys. Its identity-aware proxy, certificate authority and tunneling system reach resources behind the firewall from a single binary. The advantage matters most for a small, cloud-native group. Moderated sessions, dual authorization, Device Trust and HSM support, and Just-in-time access requests with reviews are Enterprise features, and Community Edition limits single sign-on to GitHub. If you need Okta, Microsoft Entra ID or SAML for administrators, price the Enterprise tier before you commit. JumpServer is the stronger fit where a broad asset inventory matters more than certificate workflows. Its Community edition covers SSH, RDP, Kubernetes, databases and websites, and its free tier is limited to 5,000 assets in a standalone topology. Oracle and SQL Server access, password rotation, ticket and just-in-time approval workflows, SSO, and LDAP high availability are Enterprise features. Ask FIT2CLOUD which of these you need, then compare the Standard and Pro tiers that add active-standby high availability.
Apache Guacamole is the stronger fit when users are on Windows or Linux desktops and need VNC, RDP or SSH from a browser without installing a client. Its Apache-2.0 license carries no user or revenue thresholds, and its manual covers Active Directory, LDAP, Duo, TOTP, SAML and OpenID Connect extensions. Guacamole does not provide the password vaulting, approval workflows or Kubernetes brokering that the other two offer, so you must add those controls yourself or through another tool. Whichever option you choose, confirm session recording, approval steps and high availability against the vendor documentation for your exact edition before you sign a quote.
Which option to choose by scenario
This table maps common environments to the platform that fits best, with the reason tied to supplied facts for Teleport, JumpServer and Apache Guacamole. Read each row against your protocols, team size and approval needs, and confirm any row marked as depending on Enterprise features before you rely on it.
| Scenario | Best fit | Reason and condition |
|---|---|---|
| Small team on SSH and Kubernetes | Teleport Community Edition | Certificate-based access with short-lived certificates covers SSH and Kubernetes. Distributed Community builds are limited to organizations with fewer than 100 employees and under $10,000,000 in annual revenue, so check eligibility first. |
| Small team, over the Community size limit | Teleport Enterprise or JumpServer Community | Teleport Community is not licensed for larger organizations. JumpServer Community is free for self-hosting up to 5,000 assets in a standalone topology. Confirm current terms with each vendor. |
| Regulated enterprise needing approvals and HA | JumpServer Enterprise (Pro or Ultimate) or Teleport Enterprise | Ticket and just-in-time approval workflows and active-standby or full HA are listed as Enterprise features by JumpServer. Teleport moderated sessions and dual authorization are Enterprise-only. Confirm tier, HA topology and support terms with the vendor. |
| Windows and RDP-heavy estate | Apache Guacamole | Guacamole is clientless and reaches RDP and VNC hosts from an HTML5 browser through guacd plugins, with Active Directory and LDAP authentication. Teleport also lists Windows hosts, so compare session recording and approval needs before choosing. |
| Web-browser-only admin model | Apache Guacamole | Guacamole requires no client software and runs from any HTML5 browser, under Apache-2.0. Confirm which protocols and recording features your administrators need before committing. |
| Enterprise SSO with Okta or Entra ID | Teleport Enterprise | Teleport Community limits single sign-on to GitHub, while Enterprise supports Okta, Microsoft Entra ID, Google Workspace, OIDC and SAML. JumpServer lists SSO as an Enterprise feature. Confirm connector support for your identity provider. |
| Database-heavy access | Teleport or JumpServer | Teleport protects PostgreSQL, MySQL, MongoDB and CockroachDB. JumpServer lists Oracle and SQL Server access as Enterprise features. Confirm the database engines you need in the current release. |
What each option is built for and under which license
Teleport, JumpServer and Apache Guacamole all sit in front of servers and sessions, but they start from different places. Their licenses differ in ways that decide what a free deployment can legally and practically do, so check the license and edition before you check the feature list.
Teleport
Teleport is an identity-aware access platform that combines an access proxy, a certificate authority issuing short-lived certificates, unified access control and a tunnel to resources behind the firewall. It protects SSH nodes, Kubernetes clusters, PostgreSQL, MongoDB, CockroachDB, MySQL, MCP servers, internal web apps and Windows hosts. Its Community Edition builds are source-available, not OSI open source, because they carry a modified Apache 2.0 license limited to organizations with fewer than 100 employees and under $10,000,000 in annual revenue. Confirm your headcount and revenue against that license before you deploy. Current release: 18.11.4.
JumpServer
JumpServer is a bastion host and privileged access platform that covers SSH, RDP, Kubernetes, databases, websites, RemoteApp and VirtualApp access from one workspace. It is licensed under GPL-3.0, which is OSI-approved open source. The Enterprise tier adds private components such as the Panda Linux connector, Razor RDP proxy, Magnus database proxy and Nec VNC proxy, along with Oracle and SQL Server access, password rotation, approval workflows and SSO. Community supports up to 5,000 assets in a standalone topology, so check the high availability and approval needs against that tier. Current release: v5.1.0.
Apache Guacamole
Apache Guacamole is a clientless remote desktop gateway that serves VNC, RDP and SSH sessions to any HTML5 browser. The Java web application handles authentication and the interface, while the guacd daemon loads protocol plugins that connect to the target. It is licensed under Apache-2.0, which is OSI-approved open source, and it has no paid edition. It does not provide a certificate authority, approval workflows or privileged credential vaulting, so plan those controls separately. Current release: 1.6.0, released June 22, 2025.
How the three options compare on protocols, recording, approvals and SSO
This table compares Teleport, JumpServer and Apache Guacamole on protocols, session recording, approvals, SSO, multi-factor options, database support and high availability. Where a cell depends on the edition you run, the edition is named, and cells the supplied facts do not settle say what to confirm with the vendor. Read it as a shortlist filter: the edition you can afford to run often decides the answer.
| Capability | Teleport | JumpServer | Apache Guacamole |
|---|---|---|---|
| Protocols covered | SSH, Kubernetes, PostgreSQL, MongoDB, CockroachDB, MySQL, MCP servers, internal web apps and Windows hosts | SSH, RDP, Kubernetes, databases, websites, RemoteApp and VirtualApp access | Clientless access over VNC, RDP and SSH from an HTML5 browser, with new protocols added through plugins |
| Session recording | Included in both editions with playback | Session recording is part of the platform; confirm the transcoding worker is available in your edition | Session recording player extension documented in the manual; confirm recording scope with your deployment |
| Moderated sessions and dual authorization | Enterprise only | Confirm with the vendor which approval and review controls each edition includes | Not covered in the supplied facts; confirm with the Apache project or your own build |
| Access request workflows | Community: roles can only be requested through the CLI. Enterprise: just-in-time access requests and reviews | Ticket and just-in-time approval workflows are listed as Enterprise features | Not covered in the supplied facts; confirm whether approvals exist and how they are built |
| SSO and identity providers | Community: GitHub only. Enterprise: Google Workspace, Microsoft Entra ID, Okta, SailPoint, OIDC and SAML | SSO is listed as an Enterprise feature; confirm which identity providers the edition supports | Extensions documented for Active Directory and LDAP, CAS, OpenID Connect, SAML and smart card SSO |
| Multi-factor options | Confirm MFA methods per edition with the vendor | Confirm MFA methods per edition with the vendor | Duo and TOTP multi-factor authentication extensions documented |
| Database support | PostgreSQL, MongoDB, CockroachDB and MySQL protected | Databases in scope; Oracle and SQL Server access is an Enterprise feature | Authentication backends on MariaDB or MySQL, PostgreSQL and SQL Server; database access is through remote sessions |
| High availability | Confirm HA topology and edition requirements with the vendor | Community runs standalone up to 5,000 assets; active-standby HA starts at Standard, full HA cluster at Ultimate | Confirm high availability design for the web application and guacd with your own deployment architecture |
What the free editions limit before you deploy
The free tiers of these tools are not all limited in the same way, and the limits that matter most are the ones that trigger a license change, not a technical failure. Teleport Community Edition distributed builds are available only to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, with an exception for designated critical security patch versions, according to the Teleport Community Edition license. An organization that grows past either threshold needs a commercial agreement with Teleport, so check headcount and revenue against the license before rollout, not after. Confirm with Teleport in writing what happens to existing deployments when a threshold is crossed and whether a commercial license can be added without a migration.
JumpServer's free Community edition is capped at 5,000 assets in a standalone topology, according to the JumpServer pricing page. The Enterprise tiers step up from 50 assets (Basic) to 500 (Standard, with active-standby high availability), 5,000 (Pro, also active-standby) and unlimited (Ultimate, with a full HA cluster). The features most teams ask for sit behind paid tiers: Oracle and SQL Server access, password rotation, ticket and just-in-time approval workflows, custom roles, multi-tenancy, SSO, RADIUS, LDAP high availability and cloud asset sync. If you need approvals, SSO or HA in the first year, price those tiers in your quote and count assets with the asset types JumpServer uses, since a single database or cloud account can represent many assets.
Apache Guacamole is licensed under Apache-2.0 and the supplied facts list no paid edition, so its limits are operational rather than licensed. Its constraints are the ones you build yourself: the guacd daemon and web application must be deployed and patched, the authentication backend (MariaDB or MySQL, PostgreSQL or SQL Server) must be sized and backed up, and high availability, recording storage and multi-factor policy are assembled from extensions and infrastructure. Ask your own team to size these components for your asset count. For any vendor, get written license terms, check every threshold against your own headcount, revenue and asset count, and confirm which features are gated before you commit.
Verdict by environment: cloud, on-premises, air-gapped and Windows estates
Cloud estates usually mix SSH hosts, Kubernetes clusters and managed databases across several accounts, so the first test is whether one access layer can reach all of them. Teleport is the likely starting point where Kubernetes and database access carry the most weight, since its pricing page says it can be deployed in the cloud, on premises or in a hybrid environment. JumpServer suits teams that want one web workspace over a large asset inventory. Cloud identity is the main constraint: Teleport Community Edition limits single sign-on to GitHub, so providers such as Okta or Microsoft Entra ID depend on Enterprise.
- Likely start: Teleport for mixed SSH, Kubernetes and database access; JumpServer where an asset-centric workspace matters more.
- Identity provider: Confirm your provider. Teleport Enterprise lists Google Workspace, Microsoft Entra ID, Okta, SailPoint, OIDC and SAML, while Community Edition covers GitHub only.
- Network path: Test connectivity from targets to the proxy inside your VPC or cloud network, including any load balancer and security group rules.
- Asset scale: JumpServer Community covers up to 5,000 assets in a standalone topology. Confirm your count and whether you need the active-standby or full HA tiers.
- Licensing check: Teleport Community Edition distributions are limited to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue.
Confirm the identity provider, network path and asset count against your account layout before requesting a quote.
On-premises estates often run a data center with existing directory services, network segments that cannot be reached from outside, and change windows set by the operations team. JumpServer is a common starting point for asset-heavy environments because it runs on a clean 64-bit Linux server with at least 4 CPU cores and 8 GB of RAM, and it installs with a quick_start.sh script. Guacamole fits teams that want clientless browser access to SSH, RDP and VNC and already run MariaDB, MySQL, PostgreSQL or SQL Server. Teleport remains an option where certificate-based access to SSH and Kubernetes is the priority.
- Likely start: JumpServer for asset management with approvals; Guacamole for browser-only access to desktops and SSH.
- Directory integration: Guacamole documents Active Directory and LDAP extensions. JumpServer lists LDAP HA and SSO as Enterprise features, so confirm which directory features you need in Community Edition.
- High availability: Community Edition runs standalone. Plan for active-standby HA at the Standard tier or a full HA cluster at the Ultimate tier if downtime matters.
- Database backend: Guacamole needs its own supported database. Confirm the version your team can patch and back up.
- Installer and images: JumpServer publishes container images on Docker Hub and maintains an installer project. Confirm your change process accepts both.
Confirm directory, database and HA requirements with each vendor before you commit to an architecture.
Air-gapped networks change the evaluation because installation media, container images, license checks and updates must all move across a controlled boundary. None of the three sources supplied confirms whether any of these platforms installs or runs fully offline, so each item below is a question to answer through a proof of concept in your own environment. Teleport is packaged as a single Go binary, which simplifies staging artifacts, and its feature matrix lists FIPS binaries only for self-hosted Enterprise. Guacamole runs from native packages or Docker, and its server components are Apache-2.0 licensed.
- Artifact staging: Confirm how each platform's packages, container images and updates are transferred and verified inside your boundary.
- Offline installation: JumpServer's quickstart script fetches from GitHub releases, so ask how the install works without outbound access.
- Teleport binaries: Teleport's single binary helps with staging, but confirm whether your build choice and license terms fit a self-hosted deployment.
- Enterprise controls: Teleport lists FedRAMP controls and FIPS binaries only for self-hosted Enterprise. These are listed capabilities, not compliance outcomes, so confirm what your assessor will require.
- Session recording storage: Confirm where recordings are written and how they are retained inside the enclave.
Run a proof of concept inside the isolated network before scoping, because offline behavior is the most common gap between a demo and production.
Windows estates usually rely on Active Directory Domain Services for users and groups, and their main access need is RDP to servers and workstations. Active Directory Domain Services stores directory objects and replicates them across domain controllers, so the access platform must map cleanly to those identities. Guacamole is a likely starting point for browser-based RDP with Active Directory or LDAP login, since its guacd daemon loads the RDP client plugin on the user's behalf. JumpServer suits teams that also need account management and approval workflows for Windows assets, and Teleport covers Windows hosts with certificate-based access.
- Likely start: Guacamole for browser RDP with directory logins; JumpServer where approvals and account handling matter.
- Directory fit: Confirm group mapping from Active Directory into each platform's roles, and test a user who belongs to several groups.
- RDP proxying: JumpServer lists its RDP protocol proxy, Razor, as an Enterprise component, while the Tinker Windows application connector is free for Community Edition. Confirm which component your RDP path uses.
- Identity provider: Teleport Enterprise lists Microsoft Entra ID, so confirm whether your estate is on-premises AD, Entra ID or both.
- Platform lifecycle: Windows Server 2025 became available on November 1, 2024, with mainstream support ending November 14, 2029. Check your server versions against vendor support dates.
Confirm the directory model, RDP path and Enterprise components with each vendor before scoping a pilot.
High availability and operating effort for each option
High availability is the first thing to pin down, because the three products reach it in different ways and the free tiers differ sharply. JumpServer gates HA behind paid tiers: the Community edition is listed as a free standalone deployment up to 5,000 assets, while Enterprise Standard offers active-standby HA, Pro offers active-standby HA at 5,000 assets, and Ultimate offers a full HA cluster with unlimited assets. Confirm with JumpServer exactly which HA topology each tier includes, and whether the recording storage and the database tier are also made redundant, using the JumpServer pricing page. Teleport is different: it ships as a single Go binary that can run as a Linux daemon or as a Kubernetes Helm deployment, so redundancy is a deployment design you build yourself, not a licensed tier. Guacamole separates the Java web application from the guacd daemon, which means you can scale or replace the web tier and the protocol tier independently, but you must design the load balancing, session stickiness and shared database yourself.
Operating work differs even more than HA. JumpServer bundles a web interface, web terminal, protocol proxy and database connector, and its installer project handles install and management, so most day-two work is platform upgrades and checking the Enterprise protocol proxies if you use them. Teleport's certificate authority issues short-lived certificates, so the recurring duties are CA backup and rotation, keeping the cluster version current and managing roles and access requests as people change. Guacamole's operating load sits in the database backend (MariaDB or MySQL, PostgreSQL or SQL Server), the extension configuration for SSO and MFA, and the session recording player if you deploy it. Ask every vendor or partner how recordings are stored, how long they are retained, and how they are restored after a node failure.
Effort rises with four drivers: user count, asset count, protocol mix and the number of approval workflows. A large user base multiplies access requests and reviews, which matters most where Teleport's just-in-time requests or JumpServer's ticket and just-in-time approval workflows are in use. Asset count drives sizing and licensing against the JumpServer tier limits, while Teleport prices on active users and protected resources. Each additional protocol, such as Windows RDP through Guacamole's guacd plugins or database protocols in JumpServer, adds components to upgrade and test. Before committing, build a written test plan that covers a node failure, a CA rotation and a recording restore, and ask each vendor to quote against your real user, asset and workflow counts.
How to choose and pilot a PAM tool in four steps
This sequence turns a shortlist of Teleport, JumpServer and Apache Guacamole into a documented decision, backed by a pilot on real but low-risk targets and a written list of license and high availability answers before any purchase.
Inventory protocols and target systems in scope
Start by listing every system a privileged user must reach: SSH hosts, Windows servers reached over RDP, Kubernetes clusters, databases, internal web applications and any network devices. For each target, record the protocol, the operating system, the number of assets and which teams need access. Count assets per environment, because edition limits in the Community and Enterprise tiers depend on asset counts. Note which targets need Oracle, SQL Server or other less common database access, since that affects where JumpServer's Enterprise features matter. Confirm with each option's vendor which protocols its current edition supports for your exact targets. The step is done when a signed-off table maps every target to a protocol, an owner and a candidate tool.
Map approval and recording requirements to editions
Write down what your policy requires: whether privileged sessions must be recorded, whether recordings need playback or moderated sessions, whether access requests need approval, and whether password rotation or just-in-time elevation is required. Then check each requirement against the feature lists for Teleport Community and Enterprise, JumpServer Community and Enterprise, and Guacamole's extensions. Teleport's Community Edition includes session recording with playback, but moderated sessions and dual authorization are listed only in Enterprise, and JIT requests sit under Identity Governance in Enterprise. Any requirement that falls outside the free edition becomes a line item for quote. The step closes when each requirement is marked as met by the free edition, met only by a paid edition, or unconfirmed.
Confirm identity provider and SSO fit
Document your identity provider, the protocols it speaks (OIDC, SAML, LDAP or RADIUS), whether it is Active Directory or another directory, and how MFA is enforced. Check which single sign-on connectors each candidate offers in the edition you plan to use. Teleport Community limits SSO to GitHub, so an Entra ID or Okta deployment would need Enterprise. Guacamole's extensions cover Active Directory, LDAP, OpenID Connect and SAML, but the operator must build and maintain the surrounding setup. Ask each vendor to confirm in writing how group or role mapping works with your directory. The step is done when you have a tested login path for each candidate, or a written gap that needs an Enterprise feature or custom work.
Set recording retention and storage needs
Decide how long session recordings must be kept, who may view them, where they must be stored, and how they are exported to your SIEM or evidence store. Recording storage grows with session volume and length, so estimate sessions per day from your own access logs rather than from any vendor example. Confirm where each candidate stores recordings, whether recordings can be encrypted and exported, and whether a player is included in your edition. Guacamole's manual documents a session recording player extension, which you would install and maintain yourself. The step closes with a retention schedule approved by your compliance owner and a list of the storage and export features each candidate provides in the edition you are testing.
Run a pilot in a non-production network
Deploy the shortlisted tools in a non-production network that mirrors your production routing and identity setup, then connect a small set of real but low-risk targets such as a test database, a staging Kubernetes namespace and a non-critical Windows host. Have a named administrator and a named user test login, approval, session recording, password handling and offboarding. Keep a log of each failed step, the fix applied and the time it took, so you can compare operating effort across tools. Teleport can run as a Linux daemon or a Kubernetes Helm deployment, JumpServer installs with a quick_start.sh script from its GitHub releases on a clean 64-bit Linux server, and Guacamole runs natively or in Docker. The pilot is complete when each candidate has passed the same scripted test cases and the gaps are recorded.
Check license terms and high availability design
Before purchase, read the license for the edition you intend to run. Teleport's Community Edition license limits distributed builds to organizations under specific employee and revenue thresholds, so confirm your eligibility with the vendor and your counsel. JumpServer is GPL-3.0 and its paid tiers differ in asset limits and high availability, with active-standby HA in some tiers and a full HA cluster in the top tier. Guacamole is Apache-2.0, so HA and clustering must be designed by your team. Ask each vendor how its HA works, what state must be shared, how failover is tested and what the recovery procedure looks like. The step closes with a written license summary and an HA design that your architects have reviewed against the pilot results.
Get written answers before purchase
Send each vendor a written question list that covers license eligibility, edition feature coverage for your requirements, support channels and response commitments, HA topology and tested failover, recording storage and export, upgrade cadence and how security patches are delivered, and the pricing basis. JumpServer's pricing page says Community is supported through GitHub and the forum, while Enterprise adds email and ticket support with an SLA and an account manager, so confirm what your chosen tier includes. Teleport's pricing page says customers pay for active users and protected resources and does not publish prices, so ask for the unit definitions in writing. Store the answers next to the pilot record. The step is complete when every requirement has a written answer, and any unanswered item is treated as a blocker before the quote is signed.
What buyers ask before choosing or hiring help for open-source PAM
Are the free editions of Teleport and JumpServer enough for my team?
It depends on your organization size and asset count, and the license terms decide it before features do. Teleport Community Edition distributed builds are available only to organizations with fewer than 100 employees and less than $10,000,000 in annual revenue, with an exception for designated critical security patch versions (Teleport Community Edition license). JumpServer's free self-hosted Community edition covers up to 5,000 assets in a standalone topology, and its Enterprise tiers add SSO, ticket and just-in-time approval workflows, and active-standby high availability. Check whether your organization fits the Teleport license limits and whether you need the approval, SSO or high availability features that sit only in paid tiers.
What drives the cost of open-source PAM beyond the license?
The license is often the smallest line item. Cost splits into the subscription or quote from the vendor, the implementation work (architecture, identity integration, protocol coverage, session recording storage), hosting for the proxy and database tiers, and ongoing support and upgrades. Teleport states that customers pay for active users and protected resources and does not publish prices, and JumpServer prices its Enterprise tiers by quote. Asset count, user count, the number of protocols you need and high availability requirements move the price up. Ask every vendor for the pricing basis in writing.
Which costs are one-time and which recur?
Implementation, integration with your identity provider, policy design and the initial session recording setup are generally one-time costs. Subscriptions, support contracts, hosting, storage for recorded sessions, backups and periodic upgrades recur for as long as you run the platform. Retainers for ongoing support, upgrades and continuous testing are an option for teams that want a fixed monthly commitment instead of ad hoc work. When you compare quotes, separate the one-time work from the recurring lines so the three-year cost is visible.
Can an internal team run a PAM rollout without outside help?
Yes, if the team already runs Linux servers, SSH, certificate management and directory services, and has time to test approval flows and recording before go-live. The work that tends to take longer is mapping existing privileged accounts, integrating SSO and MFA, deciding which sessions must be recorded or moderated, and training administrators to use the bastion instead of direct access. Start with a small set of production targets and a written access model. Use the Teleport feature matrix and the JumpServer pricing comparison to confirm which controls your edition includes before you commit.
How long does a pilot take, and what sets that duration?
No researched figure is available for a typical pilot, so confirm the timeline with each vendor and with any implementation partner. The duration depends on the number of target systems, the protocols you need (SSH, RDP, Kubernetes, databases), how many identity sources you connect, whether approval workflows must be configured, and how much internal review the access model needs. A fixed-scope engagement sets the deliverables and timeline in writing before work starts, which makes the pilot length easier to hold to.
What should I check about session recording and approvals before buying?
Confirm which recording and approval features exist in your edition. Teleport includes session recording with playback in both editions, but moderated sessions and dual authorization are Enterprise features. JumpServer lists ticket and just-in-time approval workflows as Enterprise features, and its session recording transcoding worker is a private Enterprise component. Apache Guacamole documents a session recording player extension. Check retention, storage location, who can view recordings and whether your auditors need a specific evidence format before you finalize the design.
Can an external partner help implement PAM without favoring one product?
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own infrastructure, and most engagements are fixed-scope with scope, deliverables and timelines agreed in writing before work starts. DeployOpen is a Chainscore Labs company and is not an official partner or reseller of any vendor named on this page. Ask any partner to state which platform they recommend and why, to explain the license and edition trade-offs for your environment, and to put the evaluation criteria in writing before they quote.
How DeployOpen scopes and delivers PAM selection and implementation
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For privileged access work, that means the chosen bastion is delivered as a written, fixed-scope engagement that your security and operations teams can audit.
How we scope
- Scope covers the platform choice, protocols, target systems and user groups agreed in writing before work starts.
- Written scope states which edition, licensing terms and high availability topology the deployment will use.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing; a quote follows from that scope.
How we build
- Installation runs inside your own infrastructure, with session recording, approval workflows and SSO configured to your policies.
- Integration covers your directory, identity provider and target systems, with hardening applied to the bastion host itself.
- Security testing of the deployed access path is available as a separate written scope, not bundled by default.
How we hand over
- Handover includes configuration, runbooks, backup and upgrade procedures and evidence your compliance team can review.
- Documentation records which controls and logs exist, so your auditors can judge them. DeployOpen prepares evidence but does not issue audit reports or certifications.
- Your operators are walked through access requests, session review and recovery steps before the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, scoped separately from the build.
- Upgrade planning follows the vendor release cycle, so you confirm supported versions and licensing before each change.
- Ask for a retainer scope that names response expectations, upgrade windows and which vendor support contracts you hold directly.
