Overview

The Cross Vendor Management Platform is a desktop application for administrators who manage several software vendors and online services from one place. It gives each vendor its own isolated sign-in session and keeps administrative access under one locked workspace.

Key capabilities

• One locked workspace. Access to vendor portals and connected services sits behind a single lock.
• A separate session for each vendor. Each vendor portal keeps its own isolated sign-in session.
• Your organisation's identity. Sign in to supported business services using your organisation's existing identity provider.
• Status at a glance. Summary information from connected services, such as user, licence and tax-return summaries.
• Sessions that do not linger. Sessions for selected services can be kept for a limited period, then removed automatically.
• Clean closure. Closing a vendor portal removes its retained session.
• Optional activity record. A sign-in activity record for support and diagnosis. It is off unless enabled, and it does not record credentials.

Security by design

Stored data is protected by a passphrase and a second factor. Neither alone is enough. Repeated failed unlock attempts are slowed down.

• Credentials for connected services are held in memory only and are cleared when the application locks.
• Only the application's own window can request protected operations.
• Vendor portals are restricted to secure web addresses and cannot request device permissions.

Approach to public guidance

The platform is designed with reference to recognised public guidance, including:

• Password and key-protection guidance from the Open Worldwide Application Security Project (OWASP), in its Password Storage Cheat Sheet.
• Digital identity guidance from the US National Institute of Standards and Technology (NIST), Special Publication 800-63B.
• Security guidance for desktop applications.
• Internet standards for multi-factor codes (RFC 6238) and for sign-in from desktop applications (RFC 8252).

This is a self-assessment against public guidance. The platform does not hold a third-party security certification at this time.

Data and governance

• Data is kept on your own device.
• Connected services are accessed only with your organisation's own permission, and only for the purposes you select.
• Access is controlled by your organisation's own administrators.
• Changes to the platform are made through version-controlled source code.

Important limitations

• The platform is a management aid. It does not replace the security controls of the connected services.
• Organisations remain responsible for their own data protection, lawful basis and records.
• No warranty is given beyond the terms agreed with the supplier.

Availability and enquiries

The platform is at an early stage and is not yet generally available. Further detail is available under a separate agreement.

Contact us through the contact page or at contact@aegitassystems.co.uk.