Self-Hosted Privileged Access Management for Federal & OT networks

Self-Managed Keeper (SMK) is an on-premises, air-gapped identity security platform built for isolated Operational Technology (OT), Information Technology (IT) and defense environments. Secure critical infrastructure, manage privileged access and meet strict regulatory compliance mandates.

When self-hosted PAM is essential

When the organization needs zero-trust privileged access management inside OT perimeters, securing critical assets, preventing downtime and ensuring compliance completely offline without cloud dependencies.

Operational technology (OT)

Secure privileged access to industrial control systems, plant networks and field infrastructure without routing credentials through an external service.

Energy and natural gas

Secure privileged access to pipelines and production systems with session management that remains operational even when internet connectivity goes down.

Power and utilities

Enforce least privilege across generation, transmission and distribution networks while maintaining your own data boundary.

Federal agencies and public sector

Meet strict data sovereignty and hosting requirements by deploying Keeper inside agency-controlled infrastructure.

Air-gapped networks

Run PAM in fully isolated environments with zero external dependencies.

How Self-Managed Keeper works

Self-Managed Keeper runs as containers in your environment. Keeper's implementation team helps with deployment and updates.

  1. Deploy in your infrastructure

    Install SMK on a 64-bit Linux-based virtual machine using Docker, compatible with on-premises, private cloud or air-gapped environments.

  2. Control the access point

    Your users and applications connect to an internal address you manage, not an external service. All encrypted data resides in the VM and containers.

  3. Coordinated updates under Keeper guidance

    Keeper's implementation team coordinates all product updates, ensuring security and stability across every deployment. Changes follow Keeper's security guidance and testing protocols.

  4. Run the full identity security platform

    SMK is built on Keeper's core architecture and functional capabilities, with the same vault, privileged access management features and Admin Console as the cloud-hosted version.

Keeper security graphic showing Linux, server, device and rotation icons connected to a central vault.

Core PAM capabilities, fully self-hosted

Self-Managed Keeper includes the complete credential and privileged access management capabilities your organization needs.

Password and credential management

Store, share and control access to credentials in the Keeper Vault, with role-based permissions and granular sharing controls.

Gestion des secrets

Remove hardcoded credentials from scripts, applications and infrastructure with Keeper Secrets Manager.

Gestion privilégiée des sessions

Launch secure privileged sessions to critical systems through the KeeperPAM Gateway, without exposing credentials to the end user's device.

Accès sécurisé à la base de données avec KeeperDB

Connect to enterprise databases through KeeperDB, with vault-managed credentials and governed privileged sessions.

Centralized administration

Enforce policies, manage users and review activity from the Keeper Admin Console.

APIs and integrations

Integrate Self-Managed Keeper with your internal tools and workflows through Keeper's APIs.

Break-glass access when the internet is down

What happens if your cloud environment goes down or your internet connection is cut? Self-Managed Keeper runs independently within your own environment, so your teams keep access to critical credentials and privileged sessions during outages, network isolation and connectivity disruptions.

For organizations operating critical infrastructure, that continuity is the difference between a contained incident and a prolonged shutdown.

Run Self-Managed Keeper independently from Keeper's cloud

Organizations can use Keeper's cloud platform for corporate IT and Self-Managed Keeper for their OT or restricted networks. Each deployment runs as an independent, fully-isolated tenant.

Keeper access control graphic showing blocked actions flowing through a key shield to a lock.

Why organizations choose Self-Managed Keeper

True resilience

Privileged access continues even if the cloud or internet is unavailable.

Data sovereignty

All data stays in your infrastructure, under your control.

Zero trust, zero knowledge

Data is encrypted and decrypted on the user's device.

Air-gap ready

Fully functional in disconnected networks with zero external dependencies.

Compliance ready

Meets data residency, hosting and security requirements for federal and regulated industries.

Controlled updates

Your team controls each release and applies updates during approved change windows.

Self-hosted access management for government agencies

Government agencies and public-sector organizations often need to run security tools inside infrastructure they own and operate. Self-Managed Keeper lets agencies deploy Keeper's privileged access management, secrets management, endpoint privilege management and credential management within agency-controlled environments, including disconnected networks, while keeping full authority over hosting, access and updates.

Keeper PAM Configurations list showing AWS GovCloud, Azure Government, Domain Controller and Google Government resources with last-seen times.

Bring Keeper into your own environment

Foire aux questions

What is Self-Managed Keeper?

Self-Managed Keeper is a self-hosted, container-based deployment of the Keeper platform. It lets organizations run Keeper's password management, secrets management and privileged access management entirely within their own infrastructure, including on-premises data centers, private clouds and air-gapped networks.

Can Self-Managed Keeper function completely offline?

Yes, Self-Managed Keeper is a complete, self-contained platform that runs entirely within your infrastructure. It requires zero connectivity to Keeper's cloud service to function. It's ideal for air-gapped and disconnected networks.

How does Self-Managed Keeper compare to Keeper Cloud?

Both provide the same core Keeper capabilities: credential management, secrets management, session management and database access. The difference is infrastructure: Self-Managed Keeper runs on your environment; Keeper Cloud runs on Keeper-managed infrastructure.

Can Self-Managed Keeper run in an air-gapped environment?

Yes, Self-Managed Keeper has no dependency on Keeper's cloud service, so it can operate in fully air-gapped and disconnected networks.

Can I use both cloud and self-managed simultaneously?

Yes, many organizations deploy Keeper Cloud for corporate IT and Self-Managed Keeper for OT or restricted networks. Each deployment operates as an independent tenant with separate users and data.

What are the system requirements for Self-Managed Keeper?

Self-Managed Keeper runs as a set of Docker containers on a Linux virtual machine with an AMD64 chipset. You can host it on-premises, in a private cloud or in an isolated network.

How is Self-Managed Keeper used for break-glass access?

Because Self-Managed Keeper runs inside your own environment, your teams can continue accessing critical credentials and privileged sessions even if your internet connection or cloud services become unavailable.

How are updates handled?

Self-Managed Keeper doesn't update automatically. Keeper's team works with you to coordinate and deploy all product updates to ensure changes follow our security guidance and testing protocols.

How is Self-Managed Keeper licensed?

Self-Managed Keeper follows the same licensing model as Keeper's cloud platform. Each self-managed deployment is licensed as its own tenant. Request a demo to discuss your environment with our team.

Is Self-Managed Keeper still zero knowledge?

Yes, like every Keeper product, Self-Managed Keeper is built on Keeper's zero-trust, zero-knowledge architecture. Data is encrypted and decrypted on the user's device, so Keeper never has access to your credentials or data, whether you use Keeper's cloud platform or host it yourself.

How do I get started with Self-Managed Keeper?

Request a demo to see Self-Managed Keeper in action and talk with our team about your deployment requirements.

Retirer l'autorisation d'utilisation de cookiesNous accordons de l'importance à votre vie privée

Nous utilisons des cookies sur notre site pour vous offrir la meilleure expérience de navigation possible, vous proposer des publicités personnalisées sur nos produits et notre contenu, et analyser le trafic sur le site Web. Pour en savoir plus, veuillez consulter notre politique de confidentialité.

Inscrivez-vous pour bénéficier d'un essai gratuit

Acheter maintenant