At a Glance
Safous Privileged Remote Access at a Glance
Safous Privileged Remote Access is an RPAM solution that addresses the top attack vectors simultaneously. Designed for IT, OT, and IoT environments, Safous integrates into existing SASE/SSE stacks and provides secure remote access for employees and third-party vendors through a unified zero-trust platform.
Safous Privileged Remote Access is a remote privileged access management (RPAM) platform developed by Internet Initiative Japan Inc. (IIJ) under the Safous brand. It gives administrators, OT engineers and third-party vendors secure access to specific IT, OT and IoT systems without VPNs, endpoint agents or inbound firewall ports, and combines identity management, Zero Trust access and privileged access management in one platform. This page summarizes the key facts about Safous Privileged Remote Access in one place.
Download the At-a-Glance PDF (A4, 2 pages)
Fact Sheet
| Product | Safous Privileged Remote Access |
|---|---|
| Category | Remote privileged access management (RPAM) / privileged remote access (PRA) / secure remote access for OT |
| Developer | Internet Initiative Japan Inc. (IIJ) |
| Users | IT administrators, OT engineers, third-party vendors and contractors, MSPs |
| Environments | IT, OT and IoT; on-premises, cloud and air-gapped industrial networks |
| Key industries | Manufacturing, critical infrastructure, oil and gas, mining, banking and financial services, healthcare, telecommunications, public sector |
| Access methods | Agentless browser-based access (Windows, macOS, Linux, Android, iOS) and optional agent-based access (Windows, macOS, Linux) |
| Supported protocols | Agentless: HTTP/HTTPS, RDP, SSH, Telnet, VNC and SMB. Agent-based: any TCP/UDP protocol. Also PostgreSQL databases and native applications through SSH tunnels |
| Architecture | Users connect through Safous Global Access Points (16 points of presence across Asia, the Americas and Europe). Traffic reaches the Safous AppGateway installed on the customer’s Linux server, virtual machine or cloud instance over an outbound TLS tunnel, so no inbound firewall ports are opened. Credentials, logs and recordings stay within the customer’s environment. |
| Deployment options | Safous cloud points of presence, a private point of presence for data sovereignty, and an isolated AppGateway for air-gapped OT environments |
| Identity | Built-in identity provider or IdP proxy; MFA via TOTP, email, SMS and WhatsApp; SSO; integration with LDAP, Active Directory, SAML, OpenID Connect and RADIUS |
| Access control | Application-level least-privilege access; role- and attribute-based access control; just-in-time access; zero standing privileges; access approvals with up to five levels; device posture checks; blocking of connections from VPNs, proxies, Tor and hosting networks |
| Privileged account management | Personal and shared vaults; credential injection for RDP, SSH, Telnet, VNC and SMB; automated password rotation |
| Session control and audit | Live session monitoring and termination; supervised and collaborative sessions; clipboard and file-transfer controls; SSH command control; session recording for RDP, SSH, VNC and Telnet; command-level logging with keyword search; activity reports; SIEM integration (e.g. Splunk, ELK) |
| Application security | WAF, DDoS and malware protection for published applications; file scanning (including ICAP integration); secure file transfer |
| Encryption | Post-quantum hybrid key exchange (X25519 + ML-KEM-768) |
| Compliance support | Helps meet access-control and audit requirements in SOC 2, ISO 27001, NIST, HIPAA, ISA/IEC 62443, PCI DSS and regional regulations across ASEAN |
| Related offerings | Industrial Secure Remote Access, OT IDS by OsecT, External Attack Surface Assessment, Internal Vulnerability Assessment |
| Documentation | Safous Docs · Trust Center |
Awards
From 2024 to 2026, Safous received awards in 16 categories across the Global InfoSec Awards and the Cybersecurity Excellence Awards.
| Year | Award categories |
|---|---|
| 2026 | Secure Remote Access; Privileged Access Management (PAM); Post-Quantum PAM; OT Cyber Risk Management |
| 2025 | Industrial Cybersecurity; Remote Privileged Access Management; Zero Trust Platform; Privileged Access Management; OT Security |
| 2024 | Zero Trust Platform; Zero Trust BYOD; SMB Zero Trust; Zero Trust Application Protection; Zero Trust Security; Identity and Access Management; API Security |
Milestones
How Safous Privileged Remote Access Works
- A user signs in through a web browser (or the optional Safous agent) at a Safous Global Access Point, where MFA, identity and access policies are checked and WAF and DDoS protection are applied.
- Approved traffic is forwarded over an outbound TLS tunnel to the Safous AppGateway inside the customer’s network.
- The AppGateway connects the user only to the specific application or system they are authorized to use, injecting credentials where configured.
- The session is monitored, can be recorded and supervised, and ends when the approved time window closes.
Frequently Asked Questions
What is Safous Privileged Remote Access?
Safous Privileged Remote Access is a remote privileged access management (RPAM) platform developed by Internet Initiative Japan Inc. (IIJ). It provides agentless, application-level access to IT, OT and IoT systems with MFA, just-in-time access, credential vaulting and session recording.
Who makes Safous Privileged Remote Access?
Safous Privileged Remote Access is developed and operated by Internet Initiative Japan Inc. (IIJ). Safous is IIJ’s access security brand.
Does Safous Privileged Remote Access require agents or a VPN?
No. Most capabilities work through a web browser without installing anything, and the Safous AppGateway connects outbound so no inbound firewall ports are opened. An optional agent adds access to any TCP/UDP protocol and device-based features.
Which protocols does Safous Privileged Remote Access support?
Agentless access supports HTTP/HTTPS, RDP, SSH, Telnet, VNC and SMB. Agent-based access supports any TCP/UDP protocol.
Can Safous Privileged Remote Access be used in air-gapped OT environments?
Yes. Safous offers a private point of presence and an isolated AppGateway for air-gapped industrial networks, giving vendors time-bound access to specific assets with session recording.
Learn more in the Privileged Remote Access Guide or get started with Safous.