Concepts

Connection containment

Operators connect from a browser, but plaintext credentials never pass through it: credentials are stored encrypted on the server, decrypted in backend memory at connection time, and injected into the protocol handshake. The operator has one less secret to guard; the auditor knows every connection made through Custodexa necessarily passed through the same gate — within the product there is no second path around the audit. Making the gateway the only reachable path to a target host still requires network isolation on the deployment side (allowing only the gateway to reach the target ports).

This red line is uniform across protocols — SSH, RDP, VNC, database CLIs, and Kubernetes exec alike. Database connections run a local CLI subprocess managed by the backend, and the real credential never enters the subprocess; graphics protocols complete the handshake in the backend before the channel is upgraded to pure forwarding.

The audit evidence chain

While a connection runs, the system leaves evidence at several layers — and the evidence can show it has not been tampered with:

• Session recording: graphical and text sessions are recorded end to end, with variable-speed playback and deep links to timestamps. Recording failure is never silent — detection, labeling, and alerting come together, and you can configure refuse-if-not-recording.
• Command auditing: terminal output is reconstructed through a virtual screen to recover the commands actually executed, preserved in full.
• Integrity protection: every audit row carries an HMAC seal; periodic checkpoints are Ed25519-signed into a chain and anchored off-host via syslog, so “a segment pulled out of the middle” or “a stretch deleted and smoothed over” becomes a detectable event.
• The audit system alerts on its own failure: database write failures, syslog disconnection, recording failures, and chain verification anomalies each carry a machine code and raise alerts.

The checkpoint verification page — per-interval chain integrity status, honestly labeling the protection gap when off-host backup is not yet enabled.

Two honest boundaries to weigh in your evaluation: command text is an index; the recording is the source of truth — text reconstructed from the output stream can be wrong for some program shapes, and disputes are settled by the recording. Keys without echo are not audited — agentless auditing records what appeared on the terminal, not what was pressed; kernel-level facts would require an agent on the audited host, which is not what 1.0 is.

Policy governance

Once identity is proven, policy decides whether you connect and what you may do:

• Three-tier access policy: each asset can be set to connect-directly, state-a-reason, or require-approval; requests carry deduplication, expiry, and a hard block on self-approval.
• In-session control: dangerous commands matching rules are blocked on the spot, not discovered afterward; clipboard and file transfer have global policy keys, and denied actions are themselves audited.
• Credential rotation: scheduled, account-level rotation (SSH domain, covering passwords and SSH keys), with new secrets delivered over the SSH session rather than command-line arguments, and automatic backoff and alerting on failure.
• After-the-fact review: periodic access reviews, alert triage, and daily sign-off, with immutable sign-off records.

Every allow and deny, along with its reason and approver, is part of the audit record.