GSR Access Gatewayby GSR
Book a POC
Security

Security that fails closed.

Explicit authorization, verified connections, vaulted credentials and tamper-evident records, all inside your own infrastructure.

Book a POC

1. Authorization

  • Deny by default. Nothing is allowed until granted. Grants are per system (Connect, View recordings) plus capabilities (Audit log, Clipboard contents, Administrator), for users or groups.
  • No implicit bypass. Administrator doesn't include connecting to systems or viewing their recordings. Those must be granted, and every grant is audited.
  • Just-in-time access. Systems can require an approved request. Grants expire on their own, and live sessions end when they do.
  • Schedules and limits. Allowed days and hours, idle timeouts and maximum session length, per system and per group.
  • Effective-access preview shows the combined result of user and group rules before you save.

2. Identity & sign-in

  • Single sign-on: OIDC (authorization code flow with PKCE, state and nonce), SAML 2.0, or Active Directory/LDAP over LDAPS. Groups come from your directory.
  • Local accounts: bcrypt-hashed passwords, plus multi-factor sign-in with authenticator apps or passkeys/security keys, enforceable per role.
  • Throttling: per-IP rate limiting and per-account lockout. If the throttle store is unavailable, sign-in is refused rather than unchecked. Responses and timing don't reveal which accounts exist.
  • Session tokens live only in an HttpOnly, Secure, SameSite=Strict cookie. They're never in a URL, page script or browser storage. They're short-lived and renewed while the browser is open, up to a 12-hour maximum.
  • Revocation: signing out, or disabling, deleting or resetting an account, ends that user's live sessions within seconds. Removing a grant ends the sessions it allowed.

3. Verified systems

  • SSH host keys and RDP certificates are pinned (SHA-256), either up front with Test connection or on first connect.
  • A changed key or certificate is refused and logged as a possible man-in-the-middle.
  • Desktop certificates are enforced inside the desktop proxy itself.
  • Turning verification off, or enabling legacy compatibility, is an explicit per-system choice with a visible warning.

4. Credentials

  • Built-in vault: passwords, private keys, passphrases and identity-provider secrets are encrypted with AES-256-GCM, each bound to its slot. The key is held outside the database, so a database dump alone reveals nothing.
  • Or your vault: check credentials out per session from HashiCorp Vault, CyberArk, AWS Secrets Manager or Azure Key Vault.
  • Rotation: on a schedule and after sessions, for Linux, Windows and network-device accounts.
  • Never exposed: the API never returns stored secrets. Users never see them, and ephemeral environments get one-time credentials.

5. Recordings, logs & integrity

  • Every session is recorded: terminals in asciicast v2, desktops and apps in the Apache Guacamole format, databases query by query. Open formats, no lock-in on your evidence.
  • Sealed: each recording and log file gets an HMAC-SHA256 digest, keyed from the gateway's secret. Interrupted sessions are recovered and sealed too. Integrity is verified whenever a recording is opened, and any mismatch is shown and audited.
  • Write-once storage: keep recordings on S3-compatible storage with Object Lock, so they can't be altered or deleted before their retention ends.
  • Passwords stay out of the record: input typed at hidden password prompts is excluded from replays, keystroke logs and the search index.
  • Retention you control: set periods for recordings, audit log, sign-in events and clipboard text in the console, with legal hold for individual sessions.
  • Recording files are readable only by the gateway's service account.
In the product

Controls you can verify.

  • Pinned host keys, verified on every connection.
  • Recordings sealed at session end and verified when opened.
  • Effective access checked before you save.

Pinned host keys, verified on every connection.

6. Web edge & internal traffic

  • TLS 1.2/1.3 from browser to gateway, with HSTS, Content-Security-Policy, anti-framing and no-sniff headers.
  • Traffic between gateway components is encrypted (TLS on every internal hop).
  • Cross-site request protection on API calls, and the origin is checked on live connections.
  • Source IPs are logged in a way clients can't spoof.
  • Request size limits, and sign-in codes kept out of proxy access logs.

7. Deployment & data residency

  • Self-hosted: recordings, logs, configuration, credentials and the search index stay in your infrastructure. AI review can run on a local model, so transcripts never leave.
  • A single HTTPS port is exposed. The desktop and app streaming service sits on an internal network only the gateway can reach.
  • Every container runs unprivileged.
  • Air-gapped installation is supported, from an offline package.

8. Assurance

  • Independent penetration testing of the gateway's authentication, live-session, desktop, sharing and admin paths.
  • Security pack: architecture, data flows, trust boundaries, cryptography and a control mapping, available on request →
  • Responsible disclosure: report vulnerabilities to security@gsr-it.com. We acknowledge every report and keep reporters informed.

These controls support evidence requirements common to ISO 27001, SOC 2, PCI DSS and financial regulators. They do not constitute certification. A framework-specific mapping is available on request.

Prove it on your own systems.

A proof of concept runs inside your environment, on the systems you choose, with success criteria agreed up front.

Book a POC
  1. 01Scope call
  2. 02Deploy & connect your systems
  3. 03Review the evidence together