Blog

How PDAccess SaaS works: central platform + your proxies

The PDAccess SaaS architecture — a central platform that brokers sessions through proxies you install.

Back to Blogs

The Architecture in One Sentence

PDAccess SaaS is a central PDAccess platform that brokers every privileged session through proxies you install in your own systems, network, or cloud — your infrastructure stays yours, and the sessions are enforced, brokered, and recorded in between.

That’s the whole architecture. Everything else is detail.

The Central PDAccess Platform

The platform is the brain. It holds:

  • Identities and policy — who may access what, under what conditions, with forced MFA and optional Google login.
  • Credentials — held and brokered zero-knowledge; users authenticate and the credential is injected into the session, never exposed.
  • The audit trail — every session, text and video, attached to a named identity.
  • The portal — https://<customer_name>.pdaccess.com, where users log in (credentials or Google login, MFA always forced) and administrators manage access.

The platform is hosted by PDAccess. You get a tenant, a portal URL, and a policy console — provisioned quickly, managed centrally.

The Proxies You Install

The proxies are the hands, and they live in your environment — your cloud instance, your network, your VPC. They’re provisioned from the customer’s cloud instance, so they sit inside your trust boundary, not behind someone else’s perimeter.

Proxy type What it brokers
Access — Web Based Terminal Browser-based privileged shell sessions
Access — Native SSH Native SSH sessions
Access — Native RDP/VNC Native desktop sessions
Access — Database (SQL client) SQL client sessions
Identity — TACACS Network device access (Cisco, Huawei, and any TACACS+ device)
Identity — RADIUS Wireless, VPN, and RADIUS-based access
Identity — LDAP Directory-based identity
Identity — OAuth2 Application and platform identity
Web content proxy Secure browsing sessions
Client Local port forwarding for direct-connection tools

The split matters: access proxies carry the session, identity proxies carry the identity. Together they mean every privileged session is admitted by a policy decision, carried by a broker, and recorded end to end.

Your Cloud, Your Network, Your Data

Because the proxies are yours and they run in your cloud instance:

  • You never expose management endpoints. SSH, RDP, and database ports don’t face the world — they face your own proxy.
  • Sessions are brokered, not tunneled through a black box. The proxy enforces policy at the point of connection, inside your environment.
  • Sessions are recorded. Text and video, attached to the named user who authenticated.
  • Your data stays in your footprint. The platform brokers the session; the workload and the secrets’ targets remain where you put them.

This is the same proxy model that on-prem deployments use — SaaS just means PDAccess operates the platform side, and you operate the proxy side.

The Portal Experience

The user experience is deliberately simple:

  1. Go to https://<customer_name>.pdaccess.com.
  2. Log in with credentials or Google login — MFA is always forced, no exceptions.
  3. Request or receive access to a target (terminal, RDP/VNC, database, network device, web console).
  4. Connect — the session is brokered through your proxy, the credential is injected zero-knowledge, and the session is recorded.
  5. When the session ends, the recording and the audit record are already in the platform.

No client installs for the common paths (Web Based Terminal, RDP/VNC, database via SQL client), no local secrets, no shared accounts.

The Bottom Line

PDAccess SaaS is a central platform plus your proxies: a hosted brain that holds identity, policy, credentials, and audit — and a set of proxies in your own environment that broker every privileged session through it. Your infrastructure stays yours; the sessions are enforced, recorded, and tied to a real person.

That’s why SaaS is the natural fit for small and mid-size companies and MSSPs — the platform is hosted, the portal is ready at your *.pdaccess.com domain, and the proxies are provisioned from your cloud instance. Large enterprises with datacenter, air-gapped, or ICS/OT requirements run the same architecture on-prem instead.

That’s the architecture, and that’s the point.

#PDAccess #SaaS #PAM #IAM #ProxyModel #Architecture