GSR Access Gatewayby GSR
Book a POC
Platform

One gateway between your people and every system.

Users open a browser tab. GSR Access Gateway checks who they are and what they may reach, connects with credentials they never see, applies your policies as they work, and keeps a sealed, searchable record of everything.

Book a POC

How a session flows

  1. 01

    Sign in. Through your identity provider (OIDC, SAML or Active Directory) or a local account with multi-factor sign-in. Groups come from your directory.

  2. 02

    Authorize. Standing grants, or a just-in-time request approved by a named approver. Schedules and session limits apply. Users only see what they may reach.

  3. 03

    Verify the system. The pinned SSH host key or desktop certificate is checked. If it changed, the connection is refused and logged.

  4. 04

    Connect with vaulted credentials. From the built-in vault, your external vault, the user's personal stored account, or one-time credentials for an ephemeral environment. Rotated on schedule or after each session.

  5. 05

    Work under policy. Command, query, file-transfer and clipboard policies apply live. Colleagues can join, and reviewers can watch.

  6. 06

    Seal, index, review. At session end the recording is sealed, indexed for search and summarized by AI review. Events stream to your SIEM.

Architecture

  • PostgreSQL
  • Redis
  • Recording storage (local or S3-compatible with Object Lock)
  • Identity provider
  • Your vault (optional)
  • Your SIEM (optional)

All internal traffic is encrypted.

Edge
TLS termination and the single HTTPS entry point.
Web app
Sign-in, resource list, terminal, desktop, SQL and Kubernetes consoles, sharing, live sessions, search, replay, AI review, audit, admin console. Light, dark or automatic theme.
Gateway nodes
Authentication, authorization, protocol bridges, policy enforcement, recording, the credential vault, the API. Run one, or several for high availability.
Desktop & app streaming
Renders RDP and VNC desktops and isolated apps on an internal network only the gateway can reach. The browser never talks to it directly.
Ephemeral environment controller(optional module)
Creates and destroys just-in-time environments on Docker, Kubernetes, AWS, Azure or VMware vSphere.
PostgreSQL
Resources, users, access rules, policies, audit log, session metadata and the search index.
Redis
Sign-in sessions, throttling, the cross-node session directory and the event queue.
Recording storage
Local disk, or S3-compatible storage with write-once (Object Lock) retention.
Identity provider
Yours (Entra ID, Okta, Google Workspace, any OIDC/SAML, Active Directory), or the optional bundled Keycloak.
Deployment

Runs where your systems are.

Single VM
Docker Compose on one Linux host, up in an afternoon.
Highly available
several gateway nodes behind your load balancer, or our Helm chart on Kubernetes, with external PostgreSQL and Redis if you prefer.
Air-gapped
a complete offline package for x86-64 or ARM64, including local-model AI review.

Always

  • one HTTPS port for users
  • no agent on any system
  • every container runs unprivileged
  • database migrations run automatically on upgrade

What stays inside your network

  • recordings
  • audit log
  • credentials
  • configuration
  • search index
  • AI review (with a local model)
Admin console

Run everything from the browser.

  • Resources, users, identity, access rules, requests and approvals, schedules, policies, integrations, retention and backup are all managed in Settings. Changes apply instantly, with no restart, and are recorded in the audit log.
  • Test connection checks reachability, sign-in and the host key or certificate before go-live, and pins it in one click.
  • Safeguards: you can't remove your own admin access, two admins can't overwrite each other's edits, and a command-line break-glass recovery is available.
  • Back up the full configuration (credentials optional, still encrypted) and restore it with a preview of every change.

Test connection checks the host key and pins it in one click.

Integrations

Fits the tools you already run.

Identity
Microsoft Entra ID, Okta, Google Workspace, Keycloak, any OIDC or SAML 2.0 provider, Active Directory / LDAP
SIEM & logging
Syslog (RFC 5424, CEF, JSON over UDP/TCP/TLS), Splunk HEC, Microsoft Sentinel, Elastic, IBM QRadar
Notifications & approvals
Slack and Microsoft Teams (with approve/deny), email, signed webhooks
Secrets
Built-in vault, HashiCorp Vault, CyberArk, AWS Secrets Manager, Azure Key Vault
Automation
REST API with scoped tokens (OpenAPI) and an MCP server for SOC tooling and AI agents
Ephemeral environments
Docker, Kubernetes, AWS EC2, Azure VMs, VMware vSphere
AI session review

Know what happened without watching every minute.

  • Each session gets a plain-language summary and flags for what deserves a second look: destructive commands, privilege escalation, credential access, unusual data movement, policy incidents.

  • Ask questions about a session. Answers cite timestamps that open the replay at that moment.

  • Use Anthropic's Claude, or a local model for air-gapped sites. It's off until you turn it on, and only people allowed to view a recording can review it.

For engineers

A terminal engineers would choose anyway.

  • Your own shell on a shared account. When a team signs in as the same account, each person still gets their own history, prompt, aliases, variables and git author, from their sign-in. Nothing is installed on the server.
  • Production looks like production. Administrators tag hosts. Tagged terminals and desktops get a coloured frame, label and banner that users can't change.
  • Several systems side by side. Keep several sessions open, each in the sidebar in its environment's colour. Access rules set how many, across tabs and devices.
  • A modern terminal. GPU-accelerated rendering, themes and bundled fonts, keyword highlighting, find with Save output, clickable links and inline images. Settings are saved to your account and follow you to every device.
  • Reload without losing your place. Open terminals reattach to the same shell with the screen restored, and desktops reconnect.

Production is framed in red, and your own prompt, aliases and highlighting come with you.

Built for daily work

  • Live status: see what's online before connecting.

  • Connection log: each connection step, with plain-language hints when something fails.

  • Several sessions at once: keep several systems open, each in the sidebar, while you browse the app.

  • Survives a reload: open terminals reattach with the screen restored.

  • Clear session endings: idle, time limit, schedule, revoked, or ended by an administrator, with who and why.

  • Any language: 50 character encodings and right-to-left display for terminals.

  • Notifications: in the app and by email, for shares, requests, approvals and incidents.

Prove it on your own systems.

A proof of concept runs inside your environment, on the systems you choose, with success criteria agreed up front.

Book a POC
  1. 01Scope call
  2. 02Deploy & connect your systems
  3. 03Review the evidence together