Outcome · Private Access

Let partners in for the project, not for good.

Contractors need a few systems for a few weeks. Put them in a group, grant that group only what the project needs, and let access expire when the work does.

Start free Take the product tour
Private Access›Access PolicyEXAMPLE
GroupCan ReachAction
Engineering10.20.0.0/16Allow
Financeledger.internalAllow
Contractorsgit.internalApprove
Everyone ElseanythingDeny
Before and after

What changes on day one.

Contractor access today

  • A VPN account that puts them on the whole network
  • Accounts that outlive the contract
  • No control over what they copy out of a session
  • Their own devices, in whatever state they are in

With Fowlguard

  • A Contractors group that reaches only the project systems
  • Grants with an end date, and requests that need approval
  • Clipboard and file transfer off for their sessions
  • Device posture checked before they connect
How it works

Scoped, timed and recorded.

Joining

Approve people before they get anything.

If join rules require administrator approval, anyone who signs up lands in a queue and holds no access until approved.

Access Requests›People Waiting To JoinEXAMPLE
PersonSigned Up WithAction
Nia Brooksnia@harborpine.exampleApprove
Omar Haddadomar@harborpine.exampleApprove
Session Privilege Policy

Control what leaves a session.

Every way data leaves a session is off until you turn it on, per group. Contractors can have clipboard and file transfer off while your engineers keep them.

Private Access›Session Privilege PolicyEXAMPLE
PrivilegeContractorsEngineering
ClipboardOffOn
File TransferOffOn
Port ForwardingOffOff
Screen RecordingOnOn
Access Logs

A record of what they reached.

Every connection and every block, filterable by person, device and host.

Logs›Access LogsEXAMPLE
TimePersonDeviceHostResult
14:02Maria OkaforHP-FIN-014ledger.internalAllow
13:58Sam ReyesLNX-CON-011db-prodDeny
13:51Lena ParkMBP-ENG-022git.internalDeny
Get it running

A contractor working safely today.

Invite, scope, time-box.

  1. Invite them

    Invite by email. They set their own password, or sign in with their own provider.

  2. Put them in a group

    Grant the Contractors group the project systems and nothing else.

  3. Time-box it

    Use just-in-time grants so access ends when the work does.

What it uses

The parts that do the work.

Private Access

Zero-trust access to your own servers and subnets.

Private Access Fowlguard Remote

RDP, SSH and WinRM to a granted machine, with no open port.

Fowlguard Remote Device Posture

Check the machine before it connects.

Device Posture
Questions

Questions people ask.

More in the guides

Do contractors count as users?

Yes, per user per month. A person consumes a licence the first time they sign in on a device, so an invitation that is never used costs nothing.

Can they use their own laptops?

Yes. Device posture can require encryption or antivirus before they connect.

What stops them copying data out?

Session privileges. Clipboard, file transfer, drive redirection and port forwarding are each off until you turn them on.