One architecture. Every privileged session.

The three-layer provider architecture

Three independent, swappable, auditable layers. This is what lets one platform speak natively to AD, Linux, Kubernetes, databases, and cloud — without bolt-ons.

Each surface is reached through identity-aware protocol mediation — not a thin connector. The mediation layer speaks each system's native protocol and carries identity, role, authorization, and ticket context all the way to the target. That is why the same model holds whether the surface is Oracle, a Kubernetes cluster, or a Windows host: the authorization that issued the ticket stays bound to the action through to the audit record.

Coverage

First-class support — not screen scraping, not generic SSH.

Database coverage by environment

Every major engine — on-prem and across AWS, Azure, and GCP. Same proxy. Same JIT identity model. Same audit trail.

Coverage on every engine includes JIT database identities, certificate-based or short-TTL credential issuance, proxy-enforced sessions, and full SQL-level query capture.

Three ways to connect. One audit trail.

Operators find the asset they need in the Veqtorix catalog and pick how they want to work. Every path enforces the same JIT identity, the same proxy, the same recording — so the operator's tool of choice never costs you control.

# The catalog → ticket → native tool path

operator opens Veqtorix catalog
        │
        ├─ searches for asset             e.g. prod-db-finance
        ├─ picks role                     policy enforced at proxy
        └─ chooses "Download session ticket"
                │
                ▼
        Veqtorix issues:
          • short-lived certificate / wallet / kubeconfig
          • proxy endpoint to point the tool at
          • session TTL (e.g. 60 minutes)
                │
                ▼
        operator opens SSMS / Toad / PuTTY / DBeaver / mstsc
        and connects through the proxy — JIT identity created,
        full session recorded, identity torn down at disconnect.

DBAs and sysadmins keep their tooling. That is the difference between PAM that gets deployed and PAM that gets reverted.

Authorization that lives in your change-management system.

Veqtorix integrates with the change-management system you already run — ServiceNow, Jira Service Management, BMC Remedy — as the authorization layer for privileged access. The CR ticket is the source of truth. No parallel approval graveyard inside the product.

# When a role requires authorization

operator requests access to prod-db-finance
        │
        ▼
Veqtorix queries ServiceNow (or your CR system)
        │
        ├─ is there an active change ticket?
        ├─ does it cover this server / asset?
        ├─ does it cover this user?
        └─ are we inside the approved time window?
        │
        ▼
   all four → access granted, JIT identity issued, session recorded
   any one fails → access denied, denial logged against ticket lookup

Proxy-enforced — by design

Every privileged session flows through a Veqtorix proxy. The target system never sees a user-held credential. The auditor never has to trust a client agent.

# What actually happens, on every session

operator ──▶ [ Veqtorix proxy ] ──▶ target
              │
              ├─ enforces policy at protocol layer
              ├─ injects short-lived credential
              ├─ records keystrokes / queries / commands
              ├─ signs the session record
              └─ tears down identity on disconnect

• No standing credentials — nothing in a vault to steal, rotate, or forget.
• No client-side trust — enforcement happens at the proxy, not on the operator's laptop.
• Inbound ports closed — targets dial out to the proxy mesh; no privileged ports exposed.
• Cryptographic chain of custody — every session record signed and verifiable.
• Post-session deviation analysis becomes possible — because the proxy captures everything that happened, the platform can compare actual operator activity against the authorizing change ticket after the fact. No proxy, no ground truth.

Database audit — answer the auditor in one query

For SOX, PCI, HIPAA — every privileged query, every JIT identity, every session, across every engine and environment listed above. End-to-end.

# Auditor question
"Who altered the customers table on prod-db-postgres in the last 90 days?"

# Veqtorix answer
▸ User:        jane.doe@bank.example
▸ JIT account: jit-jdoe-7f3a (existed 09:00 → 10:00 UTC, 2026-04-12)
▸ Path:        proxy-east-1
▸ Statement:   ALTER TABLE customers ADD COLUMN ssn VARCHAR(11);
▸ Auth:        cert-based, ADCS-issued, 30-min TTL
▸ Recording:   available · cryptographically signed