FAQ
Do I need to install an agent on target hosts?
Section titled “Do I need to install an agent on target hosts?”No. Custodexa is an agentless gateway: nothing is installed on target hosts, and all control happens at the gateway the connection passes through. One boundary to state honestly — command auditing is reconstructed from terminal output, so it records what appeared on the terminal; kernel-level facts would require an agent, which is not what 1.0 is. The compensation is full-session recording: disputes are settled by the recording.
Does it map to compliance baselines?
Section titled “Does it map to compliance baselines?”Yes. The access control and security policy pages ship with PCI DSS reference values built in (a subset of PCI DSS, not the full standard): policy tiers are labeled with the corresponding requirement numbers, deviations are summarized on the page, and reference values can be applied in one click. Every policy key also stays tunable — compliance is not an all-or-nothing switch; set your own baseline and the system honestly shows the gap.
Which protocols are supported?
Section titled “Which protocols are supported?”SSH (native terminal), RDP and VNC (graphics), MySQL / PostgreSQL / Redis / MSSQL (database web CLIs), Kubernetes exec, and SFTP file management for SSH assets.
Can it use our existing identity systems?
Section titled “Can it use our existing identity systems?”Yes. LDAP / AD directory authentication and OIDC single sign-on (one integration covering Azure AD, Okta, and Google, with multiple providers side by side), managed by administrators in the UI. Local accounts coexist with external identities, and TOTP two-factor authentication supports policy-enforced enrollment.
Where are recordings and audit data stored?
Section titled “Where are recordings and audit data stored?”Under the single directory root set by DATA_PATH at deployment (audit records,
recordings, and database share the root), so the backup scope collapses to one
directory plus the environment file. Expired data is deleted in batches by
checkpoint interval, and the deletion itself is audited.
How do I prove audit records were not tampered with?
Section titled “How do I prove audit records were not tampered with?”Three layers: every audit row carries an HMAC seal; periodic checkpoints are Ed25519-signed into a chain anchored off-host via syslog; exported evidence bundles carry a bundle signature plus per-file SHA-256, verifiable offline. The UI has a dedicated checkpoint verification page showing per-interval chain status. The prerequisite is an off-host syslog collector — see Operations.
Is Windows account rotation supported?
Section titled “Is Windows account rotation supported?”Not yet. Scheduled rotation covers the SSH domain (passwords and SSH keys); Windows / AD rotation is on the roadmap for a later release. Today, non-SSH assets in a rotation schedule are explicitly marked skipped.
What languages does the UI support?
Section titled “What languages does the UI support?”Traditional Chinese, English, and Japanese, in full, with the preference persisted per account.
Can I deploy it highly available (multi-replica)?
Section titled “Can I deploy it highly available (multi-replica)?”Not yet. The current design assumes a single backend instance; multi-replica deployment is an unscheduled roadmap item.
What is the license?
Section titled “What is the license?”Custodexa is open source under AGPL-3.0; the LICENSE file in the main repository is authoritative.
Is it ready for production?
Section titled “Is it ready for production?”Custodexa is under active development. Validate fully in a test environment before considering production.