Self-Managed Keeper (SMK) is an on-premises, air-gapped identity security platform built for isolated Operational Technology (OT), Information Technology (IT) and defense environments. Secure critical infrastructure, manage privileged access and meet strict regulatory compliance mandates.
When the organization needs zero-trust privileged access management inside OT perimeters, securing critical assets, preventing downtime and ensuring compliance completely offline without cloud dependencies.
Secure privileged access to industrial control systems, plant networks and field infrastructure without routing credentials through an external service.
Secure privileged access to pipelines and production systems with session management that remains operational even when internet connectivity goes down.
Enforce least privilege across generation, transmission and distribution networks while maintaining your own data boundary.
Meet strict data sovereignty and hosting requirements by deploying Keeper inside agency-controlled infrastructure.
Run PAM in fully isolated environments with zero external dependencies.
Self-Managed Keeper runs as containers in your environment. Keeper's implementation team helps with deployment and updates.
Deploy in your infrastructure
Install SMK on a 64-bit Linux-based virtual machine using Docker, compatible with on-premises, private cloud or air-gapped environments.
Control the access point
Your users and applications connect to an internal address you manage, not an external service. All encrypted data resides in the VM and containers.
Coordinated updates under Keeper guidance
Keeper's implementation team coordinates all product updates, ensuring security and stability across every deployment. Changes follow Keeper's security guidance and testing protocols.
Run the full identity security platform
SMK is built on Keeper's core architecture and functional capabilities, with the same vault, privileged access management features and Admin Console as the cloud-hosted version.
Self-Managed Keeper includes the complete credential and privileged access management capabilities your organization needs.
Store, share and control access to credentials in the Keeper Vault, with role-based permissions and granular sharing controls.
Remove hardcoded credentials from scripts, applications and infrastructure with Keeper Secrets Manager.
Launch secure privileged sessions to critical systems through the KeeperPAM Gateway, without exposing credentials to the end user's device.
Connect to enterprise databases through KeeperDB, with vault-managed credentials and governed privileged sessions.
Enforce policies, manage users and review activity from the Keeper Admin Console.
Integrate Self-Managed Keeper with your internal tools and workflows through Keeper's APIs.
What happens if your cloud environment goes down or your internet connection is cut? Self-Managed Keeper runs independently within your own environment, so your teams keep access to critical credentials and privileged sessions during outages, network isolation and connectivity disruptions.
For organizations operating critical infrastructure, that continuity is the difference between a contained incident and a prolonged shutdown.
Organizations can use Keeper's cloud platform for corporate IT and Self-Managed Keeper for their OT or restricted networks. Each deployment runs as an independent, fully-isolated tenant.
Privileged access continues even if the cloud or internet is unavailable.
All data stays in your infrastructure, under your control.
Data is encrypted and decrypted on the user's device.
Fully functional in disconnected networks with zero external dependencies.
Meets data residency, hosting and security requirements for federal and regulated industries.
Your team controls each release and applies updates during approved change windows.
Government agencies and public-sector organizations often need to run security tools inside infrastructure they own and operate. Self-Managed Keeper lets agencies deploy Keeper's privileged access management, secrets management, endpoint privilege management and credential management within agency-controlled environments, including disconnected networks, while keeping full authority over hosting, access and updates.
Self-Managed Keeper is a self-hosted, container-based deployment of the Keeper platform. It lets organizations run Keeper's password management, secrets management and privileged access management entirely within their own infrastructure, including on-premises data centers, private clouds and air-gapped networks.
Yes, Self-Managed Keeper is a complete, self-contained platform that runs entirely within your infrastructure. It requires zero connectivity to Keeper's cloud service to function. It's ideal for air-gapped and disconnected networks.
Both provide the same core Keeper capabilities: credential management, secrets management, session management and database access. The difference is infrastructure: Self-Managed Keeper runs on your environment; Keeper Cloud runs on Keeper-managed infrastructure.
Yes, Self-Managed Keeper has no dependency on Keeper's cloud service, so it can operate in fully air-gapped and disconnected networks.
Yes, many organizations deploy Keeper Cloud for corporate IT and Self-Managed Keeper for OT or restricted networks. Each deployment operates as an independent tenant with separate users and data.
Self-Managed Keeper runs as a set of Docker containers on a Linux virtual machine with an AMD64 chipset. You can host it on-premises, in a private cloud or in an isolated network.
Because Self-Managed Keeper runs inside your own environment, your teams can continue accessing critical credentials and privileged sessions even if your internet connection or cloud services become unavailable.
Self-Managed Keeper doesn't update automatically. Keeper's team works with you to coordinate and deploy all product updates to ensure changes follow our security guidance and testing protocols.
Self-Managed Keeper follows the same licensing model as Keeper's cloud platform. Each self-managed deployment is licensed as its own tenant. Request a demo to discuss your environment with our team.
Yes, like every Keeper product, Self-Managed Keeper is built on Keeper's zero-trust, zero-knowledge architecture. Data is encrypted and decrypted on the user's device, so Keeper never has access to your credentials or data, whether you use Keeper's cloud platform or host it yourself.
Request a demo to see Self-Managed Keeper in action and talk with our team about your deployment requirements.
You must accept cookies to use Live Chat.
