Lire en français
A Modern Alternative to Legacy PAM, VPNs and Shared Admin Passwords
Privileged access that runs in the browser, deploys in minutes, and can sit alongside what you have today.
Why teams replace their current access setup
Privileged access in most mid-sized companies grew by accretion: a VPN for the IT team, a few shared administrator accounts, vendors who kept the access they were given years ago. Where a bastion exists, it is often an appliance that is costly to run and that nobody wants to touch.
The result is the same: no clear answer to who connected, when, and to do what. That is exactly what NIS2, cyber insurers and auditors now ask for. Heimlane Realm is a browser-based access bastion (PAM) designed to answer that question without the weight of a traditional deployment.
Signs it is time for an alternative
If one of these sounds familiar, your privileged access deserves a second look.
Shared administrator accounts
Several people use the same admin password, so no action can be tied to a person, and every departure means rotating passwords everywhere.
Vendors with standing access
External providers connect through a VPN account that stays open between interventions, with no record of what they did.
No evidence for audits
When an auditor, an insurer or an incident asks what happened on a server, there are no session recordings to show.
An expensive bastion nobody maintains
An on-premise appliance with licence and platform fees, that needs dedicated skills, opened firewall rules and a client install on every admin laptop.
What a modern alternative should provide
The capabilities that matter, regardless of the tool.
Access from the browser
SSH, RDP and VNC in a browser tab: no client software on admin machines, no VPN to hand out.
Credential injection
Passwords are injected into the session from a vault, so administrators and vendors never see them and cannot reuse them.
Session recording and audit trail
Every session recorded by default, replayable like a video, with an audit log that cannot be edited.
Just-in-time vendor access
Access granted for one machine and one time window, approved, then closed automatically.
No inbound firewall rules
Nothing exposed to the internet. Private networks connect through outbound tunnels only.
European hosting
Recordings and audit data hosted in Europe, under European law.
How Heimlane Realm answers it
Realm and Vault work together: Vault holds the credentials, Realm uses them without revealing them.
Heimlane Realm
Browser-based access bastion (PAM), hosted in France and Germany
- SSH, RDP and VNC in the browser, no VPN, no client
- Sessions recorded by default, replay and audit trail
- Just-in-time vendor access and live session watching
- Optional Realm Connect agent for private networks: outbound only
- Priced per user: no platform fee, no appliance, no minimum commitment for MSPs
Heimlane Vault
Where the privileged credentials live
- Zero-knowledge storage of admin credentials
- Injected into Realm sessions, never displayed
- Shared vaults with roles, policies and audit log
Frequently Asked Questions
Can Realm run alongside our current bastion or VPN?
Yes, whether your current access goes through WALLIX Bastion, Rubycat PROVE IT, CyberArk, a jump server or a VPN. Migration happens target by target, with no forced cutover: your existing access path and Realm can run side by side for as long as the transition takes.
Do we have to install an agent?
Not necessarily. For machines on a private network, a lightweight agent, Realm Connect, can be installed to open an outbound tunnel to the platform, so no inbound firewall rule is needed. It can be pushed silently from your RMM tool.
How do we give vendors access without sharing passwords?
With just-in-time access: you invite the vendor to a single machine, right now or on a schedule. The access is approved, tied to the vendor's email address, recorded, and closes when the window ends. The password is injected, never handed over.
Is Realm relevant for NIS2?
Yes. Article 21 of NIS2 lists access control, the management of privileged access and the security of suppliers among the required measures. Realm's access policies, session recordings and audit trail provide the evidence auditors and insurers ask for.
Who deploys Realm?
Realm is deployed and supported by Heimlane partners (MSPs, MSSPs and resellers), and managed through the Prism platform, where each customer keeps its own targets, policies and recordings.
How is Realm priced compared with a traditional bastion?
Realm is a subscription priced per user and per month, with volume pricing. There is no platform fee, no appliance or server to buy and run, and no minimum commitment for MSPs, so you can start with a handful of administrators and grow from there. Contact sales for a quote.
See Realm on your own infrastructure
Request a demo or a trial through our partner network.
Priced per user. No platform fee, no minimum commitment for MSPs.