Sales: +91 9600 70 3224
- Support
AkkuArka mints a credential per session and revokes it at close, and holds the ones that have to persist.
Most privileged access management is a password locker. A credential sits in a vault, an administrator checks it out, uses it, checks it back in. The credential still exists, and somebody now knows it. AkkuArka generates a credential for each session instead, injects it into the proxy, and revokes it permanently when the session closes.
At session start AkkuArka generates a cryptographically random credential for the target and holds it transiently with a session-scoped time to live. It is injected into the AkkuReka proxy at the protocol layer, so it is never transmitted to the user's device and never appears on their screen. On close, whether the user disconnected, an administrator terminated the session, or the window expired, AkkuArka revokes it and it cannot be reused. Generation, injection and revocation are each written to the audit log with timestamps.
Not every credential can be ephemeral. SSH private keys, API keys, database logins, Kubernetes tokens and application secrets are held in AkkuArka's vault under AES-256-GCM, which gives integrity as well as confidentiality, with keys managed separately from the data they protect. Vault contents are reachable only through the AkkuArka API. There is no path for a person to read raw vault data.
Credentials drift. Someone changes a password on the target directly and the stored one no longer matches. Password reconciliation detects that drift and corrects it, so the vault and the target stay in step without anyone auditing them by hand. SSH keys are rotated in place with their own audit trail.
Application secrets are vaulted as part of PAM rather than as a separate module, and the REST API injects them into CI and CD pipelines.
