In short: KeeperPAM is Keeper Security's privileged access management platform. It vaults and rotates privileged credentials, brokers RDP, SSH, database and web sessions without revealing passwords, records sessions and discovers privileged accounts. It is licensed per user and billed annually, either as KeeperPAM or as a PAM add-on for the admins on a Keeper Business or Enterprise plan.
What KeeperPAM is
Privileged access management (PAM) controls the accounts that can do the most damage: domain admins, server root accounts, database owners, cloud consoles and the service accounts behind applications. KeeperPAM brings those under the same zero-knowledge vault Keeper uses for everyday passwords, then adds the controls a PAM tool needs:
- Password rotation for service accounts and other privileged credentials on-premises and in the cloud, on a schedule or on demand
- Privileged sessions over RDP, SSH, VNC, HTTPS, Kubernetes and the MySQL, PostgreSQL and SQL Server database protocols, launched from the vault without the user ever seeing the password
- Tunnels so admins can use their own native tools through an encrypted connection
- Session recording and playback, with KeeperAI analysing activity and able to end sessions that look risky
- Discovery of privileged accounts, machines and databases across on-premises infrastructure, AWS and Azure
- Just-in-time access with time-limited sessions and ephemeral accounts
What the PAM licence includes
| Included in KeeperPAM | Notes |
|---|---|
| Keeper Secrets Manager | Secrets management for applications and pipelines |
| Privileged sessions and connections | Cloud-brokered through the Keeper Gateway |
| Keeper Connection Manager | The self-hosted version, for networks that need it |
| Remote Browser Isolation | Isolated access to web apps |
| Password rotation, tunnels and discovery | Core PAM features |
| Session recording and PAM audit reporting | For audit and investigation |
Keeper Endpoint Privilege Manager is a separate product for removing local admin rights on laptops and desktops, licensed by endpoint.
How KeeperPAM is licensed
KeeperPAM is licensed per user: you license the people who need privileged features, not the servers or gateways. There are two ways to buy it:
- PAM add-on on top of Keeper Business or Enterprise. Everyone keeps their vault licence and only your admins take the add-on. Keeper's documented example is 100 Enterprise licences with ten PAM add-ons.
- A KeeperPAM licence, which Keeper sells through its sales team rather than online. We arrange it for you.
If you already pay for the Secrets Manager or Connection Manager add-ons, both are included in the PAM add-on, so moving to PAM replaces them. Keeper bills PAM annually; we confirm the term and quantities on your quote. Ask us for a quote.
Requirements and deployment
KeeperPAM is cloud-delivered. To reach internal systems you install the Keeper Gateway, a lightweight service on a server or container in your network or in each cloud region you use. It only makes an outbound connection to Keeper, so no inbound firewall rules are needed. Admins work from the Keeper Web Vault in a browser; tunnels use the Keeper Desktop app on Windows, macOS or Linux. Keeper Connection Manager can still be self-hosted for isolated or air-gapped networks.
Typical rollout: deploy a gateway per site or cloud network, run discovery, move privileged credentials into PAM records, switch on rotation, then replace direct RDP and SSH access with brokered sessions.
Who it suits and how we help
KeeperPAM suits organisations that already use Keeper or want password management and PAM in one console, and IT teams or outsourced providers who need to prove who accessed which server and when. It can also help answer cyber insurance questions about privileged accounts and admin MFA.
We scope the number of PAM users, design gateway placement, set up rotation and recording, and manage licences as your admin team changes. For the wider picture see identity, MFA and privileged access and secure remote access.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is KeeperPAM licensed per user or per server?
Per user. You license the people who use privileged features. Servers, databases and gateways are not counted separately.
Does KeeperPAM need a VPN?
No. Sessions are brokered through the Keeper Gateway, which connects outbound to Keeper, so admins can reach internal systems from the vault without a VPN or inbound firewall rules.
Does KeeperPAM include Keeper Secrets Manager?
Yes. The PAM licence includes Secrets Manager, the self-hosted Keeper Connection Manager and Remote Browser Isolation, alongside rotation, sessions, tunnels, recording and discovery.
Can KeeperPAM record admin sessions?
Yes. Screen and keyboard activity can be recorded across SSH, RDP, VNC, database and web sessions and played back later, and session events can be sent to a SIEM.