Keeper Security has launched Self-Managed Keeper, a self-hosted version of its privileged access management (PAM) platform built for organisations that can’t rely on an external cloud connection — government agencies, critical infrastructure operators and other highly regulated enterprises among them.
Key Takeaways
- Self-Managed Keeper runs entirely within an organisation’s own infrastructure, including fully air-gapped networks with no cloud dependency.
- It brings credential, secrets and privileged session management to government, defence, energy and other critical infrastructure environments.
- The platform runs in Docker containers on customer-controlled Linux infrastructure and keeps Keeper’s zero-knowledge encryption model.
Built for networks that can’t touch the cloud
Organisations in government, defence, energy, utilities, financial services and industrial operations often run restricted or fully disconnected networks to meet security and regulatory requirements. Self-Managed Keeper lets security teams run their privileged access infrastructure inside those networks — on-premises, in a private cloud, or in an air-gapped or Operational Technology (OT) environment — without any dependency on Keeper’s own cloud services.
The deployment includes the KeeperPAM Gateway, KeeperDB, the Keeper Admin Console and Keeper APIs, all running in Docker containers on infrastructure the customer controls. Credentials and secrets are encrypted and decrypted on users’ own devices, keeping Keeper’s zero-knowledge architecture intact even when nothing is hosted in Keeper’s cloud.
“For organisations operating in disconnected or highly restricted environments, dependence on external cloud connectivity can create unacceptable operational risks,” said Craig Lurey, CTO and Co-founder of Keeper Security. “Self-Managed Keeper brings enterprise-grade privileged access management to these environments while enabling organisations to maintain complete control over their security infrastructure.”
Keeping access when the network goes down
For critical infrastructure operators, staying able to reach privileged credentials during a connectivity outage can matter as much as keeping the system secure in the first place. Keeper says Self-Managed Keeper is designed to maintain that access independently of external cloud or internet connectivity, while still letting organisations choose exactly where their encrypted credentials and secrets are stored.
“Organisations operating complex OT and defence networks face a unique challenge: maintaining strict security and operational requirements while keeping pace with modern cybersecurity capabilities,” said Shane Barney, CISO of Keeper Security. “Self-Managed Keeper bridges that gap, bringing advanced privileged access management to highly restricted environments where conventional cloud deployments are not an option.”
An addition, not a replacement
Self-Managed Keeper sits alongside Keeper’s existing cloud-native PAM offering rather than replacing it, giving the company a deployment option for customers whose networks can’t use a cloud-hosted platform at all. More details and a demo request are available at keepersecurity.com/self-managed-keeper.
