USE CASE | THIRD-PARTY & VENDOR ACCESSSecure Third-Party and Vendor Remote Access

The problem with vendor VPNs and shared accounts

• VPN access puts an unmanaged device on your network, not just on one system.
• Shared vendor accounts make it hard to know who did what.
• Access granted for one job is often never removed.
• Audits ask for proof of who accessed which system, when and why.

How Safous controls third-party access

1. Onboard: invite the vendor through your IdP or the Safous IdP, with MFA (TOTP, email, SMS or WhatsApp).
2. Request and approve: the vendor asks for access to a specific system; a supervisor approves it, with up to five approval stages.
3. Connect: the vendor works from a browser over RDP, SSH, VNC, Telnet or web, with no client and no VPN. Vaulted credentials are injected, so passwords are never shared.
4. Watch and record: sessions can be monitored live and ended at any time. Every session is recorded with command-level logs.
5. Expire: just-in-time access ends automatically when the window closes.

Where customers use it

• OEM and machine-builder maintenance of PLCs, robots and production lines. See Industrial Secure Remote Access.
• IT outsourcing and managed services for servers, databases and network devices.
• Supply-chain partners who need one application, not the network.
• Contractors and temporary staff using their own devices.

Proof for auditors

Session recordings, access logs and approval records give evidence for ISO/IEC 27001, ISA/IEC 62443, NIST CSF and APAC regulations. See the third-party access white paper and the ISO/IEC 27001 checklist.

What customers say

“Safous freed us from cumbersome VPN management and on-site access from outside vendors.”
— Global Automaker

“Safous offers access management that is easy to use and doesn’t sacrifice UX while reducing attack risk.”
— Global Food Manufacturer

Frequently Asked Questions

What is third-party remote access?

It is remote access for people outside your company, such as vendors, contractors and OEMs. Good control limits each person to the systems they support and records what they do.

How is this different from giving vendors a VPN?

A VPN connects the vendor's device to your network. Safous connects the vendor to one approved application or asset, through a browser, and records the session.

Do vendors need to install software?

No for RDP, SSH, VNC, Telnet, web apps and SMB. An agent is available for other TCP/UDP protocols.

Can vendors see our passwords?

No. Credentials stay in the vault and are injected into the session.

How do we remove access when a job is finished?

Use just-in-time, time-limited access. It ends when the approved window closes, and you can end any live session.

Related: Remote privileged access (RPAM) · Regulatory compliance · Privileged remote access guide