Built for teams that have to prove control.

Self-hosted by design

Praxis runs entirely in your infrastructure. Host inventory, patch history, audit logs, and session recordings live in your deployment, on your network. Cytech Labs never receives or has access to your operational data.

This also means Praxis fits environments where SaaS tooling cannot go: regulated networks, private clouds, and airgapped or offline segments.

Identity: OIDC / SSO

Praxis authenticates operators through your existing identity provider via OIDC. Single sign-on and unlimited users are included in every edition, including Free. Identity is not a paid gate.

Because every operator acts under their own identity, every action in the audit trail is attributable to a person.

Short-lived SSH identity via OpenBao

OpenBao, a Vault-compatible secrets service, is the custody boundary for credentials and certificate-authority material: the Praxis database stores metadata and references, not secret values. Praxis bundles OpenBao for secrets and PKI, or connects to an external OpenBao / Vault-compatible service.

OpenBao is an open-source fork of HashiCorp Vault stewarded by the Linux Foundation, developed in the open under the MPL 2.0 license.

Operators connect with short-lived SSH user certificates whose lifetime is bounded by session policy, instead of long-lived shared keys. Host trust is established with a trust-on-first-use workflow, and certificate-authority state can be rotated to force fresh identity across the fleet.

Governed server access

Operators reach servers through a full terminal built into the app, or run on-demand one-off commands with command whitelists and validation rules deciding what may run. File transfers go through governed upload and download operations. Access is requested, approved, and expires (just-in-time rather than standing), and privileged fleet roles can require TOTP step-up authentication.

Paid editions add session locks, session approvals, command approvals with multi-approval execution, and formal access reviews for environments that need a second set of eyes and periodic re-certification of access rights.

Least privilege, no break-glass

Praxis has no in-product root grant and no break-glass path. Managed accounts are created with no standing sudo, and Praxis never adopts or deletes Linux accounts it didn't create; your existing users are left untouched.

Privileged work still happens, but through the governed path: the operator runs the command through Praxis, where command whitelists and validation rules decide what's allowed and sensitive commands route to approval before they execute. Every command carries the operator's identity into the audit trail.

Access grants recompute atomically and deterministically. Change a role, a user, or an OIDC claim and Praxis recomputes the resulting access and revokes what no longer applies. Expiry and revocation are enforced at authorization time: a revoked or expired grant is denied on the next connection and the host's state is reconciled to match. A read-only effective-access summary shows who can reach what across the fleet at any moment.

Session recordings, stored locally

SSH sessions are captured as asciicast recordings and stored locally within your deployment. Recordings never leave your network and can be played back inside the app for incident review and operational history.

Recording is a record of activity, not an enforcement control. In 1.0 it is best-effort: a session is not blocked if recording fails, and recordings are not a tamper-proof audit boundary.

Two transports, one policy authority

Hosts are reached over SSH by default. For hosts that cannot accept inbound SSH, an optional thin agent connects outbound-only over mTLS with certificate fingerprint validation and explicit capability negotiation. The agent owns no policy; the backend remains the sole authority for authorization, orchestration, and audit on both transports.

Audit logs and evidence

Fleet operations (sessions, commands, file transfers, patch runs, approvals, reboots, rollbacks, and OpenBao and PKI activity) are written as structured audit events with actor, source, target, action, outcome, and timestamp. Events can be delivered to HTTP, RFC 5424 syslog, or file sinks for your SIEM, with event UUIDs for deduplication.

Evidence accumulates continuously, and paid editions add bulk compliance exports and scheduled reports for handing it to auditors.

Compliance posture, honestly stated

Praxis evaluates versioned compliance policies against host evidence and routes failing findings into a governed remediation workflow with separation of duties between requester and approver. A supplied evidence map helps relate Praxis events to SOC 2, PCI DSS, and HIPAA discussions.

Praxis produces evidence and change-control history; it does not attest that your organization is compliant. Certification remains between you and your auditor.

Supply chain

Praxis ships as versioned container images operated with Docker Compose. Releases include CycloneDX software bills of materials, images are scanned with Trivy, and CI blocks critical known vulnerabilities from shipping.

Offline license validation

Purchase and license key delivery may require internet access, but after delivery Praxis validates the license locally. The self-hosted application requires no ongoing runtime call-home to operate, including in fully airgapped deployments.

Reporting a vulnerability

If you believe you have found a security issue in Praxis, contact us at support@praxisfleet.com. We appreciate responsible disclosure and will respond promptly.