THIRD-PARTY ACCESS

Give vendors a door, not the keys.

Browser-based access to exactly the apps in scope. Nothing installed on their devices. Every session recorded. One click ends it all.

Book a demo

A woman approves an access request while a contractor, a vendor and a partner in three countries wait on scoped, recorded sessions into internal apps and dev environments.

The third-party problem

the plain answer

Third parties are structurally your riskiest users: you don't control their devices, you can't set their security standards, and you often can't even name every individual using the credentials you issued. The traditional answers are all bad. A VPN account is network access for strangers, shared credentials destroy attribution, screen-sharing tools carry no policy at all, and anything with enough friction to feel safe gets routed around by the business. What works instead is a scoped grant: the vendor gets an application, for a stated period, with MFA (multi-factor authentication) in front of it and a recording behind it.

admin · vendor offboardingAMC vendor

$ disable user r.kulkarni@amc-partner.example
→ user disabled · 3 active sessions terminated
→ tiles revoked: SAP-PRD, RDP-BILLING-02
→ engagement window 12 Sep to 30 Sep cancelled
→ session recordings retained for audit
→ systems now reachable by this vendor: none

The InstaSafe pattern, start to end.

SCOPEThe vendor sees tiles for in-scope systems only. Not your network. Not the adjacent applications. The SAP support vendor sees SAP.
DELIVERClientless: their browser, their device, nothing installed, and no MDM negotiation with another company's IT.
CONSTRAINTime-boxed windows for engagement dates and working hours, geo conditions where they are relevant, and watermarking, clipboard and download policy on by default for external users.
RECORDPrivileged third-party sessions are recorded for replay. That is the literal answer to “what did they do on that server?”
ENDContract over, one deprovisioning action. No orphaned VPN account discovered eight months later.

Use cases

Give vendors a door, not the keys.

IT AMC vendor

Named servers, named hours

RDP/SSH to named servers, recorded, weekday business hours, engagement-dated. The vendor sees tiles for in-scope systems only — not your network, not adjacent apps.