A bodyguard for your most powerful accounts.
Angkorak is privileged access management that we host for you. Your administrators sign in with a passkey, get extra rights only when someone approves them, and are stopped within seconds if their access is misused.
Credential dumping caught in 2 seconds. The session was cut, the person locked out, and the client admin got the alert with a link to the recording.
What changes on the first day
Most breaches turn serious when an attacker gets an administrator's access. Angkorak is built for that moment.
| Situation | Without Angkorak | With Angkorak |
|---|---|---|
| An admin password is phished | The attacker logs in like the real admin. | A password alone opens nothing: every sign-in needs the person's passkey, which cannot be phished. |
| A stolen session is misused | It runs until someone notices, often weeks later. | Reading password files, creating accounts or copying whole tables locks the person within seconds. |
| Someone needs root for an hour | They keep root forever, because removing it is forgotten. | They ask, you approve in one click, and the right disappears by itself after one hour. |
| A contractor works on a server | They get an account and a shared password. | They get one server for one hour; you can watch the session live and replay it later. |
| The auditor asks who did what | Logs are scattered across servers, if they exist. | Every session is recorded and kept, and a monthly access review is one download. |
| Your servers face the internet | Ports are opened so admins can reach them. | Your servers open no inbound port: they connect out to Angkorak. |
What you get
Your own private PAM at yourname.angkorak.me, run by us, managed by your own admin.
Sign in with a passkey
Fingerprint, phone or security key, at sign-in and again for every production session. No codes to steal.
NBC TCRMG 4.3.10Rights that expire
Elevated access is requested with a ticket number, approved by your admin, and ends after one hour at most.
NBC TCRMG 4.3.11Misuse stopped automatically
Six detection rules watch every session, login and database query. A match locks the person and alerts you on Telegram.
NBC TCRMG 4.10.8Every session on record
Commands, database queries and web app visits are recorded and stored away from your servers, ready for an audit.
NBC TCRMG 4.10.10Your own dashboard
Add and remove staff, approve requests, connect a new server with one command. You cannot accidentally make anyone an admin.
We are watched too
Our own staff reach your PAM only through the same PAM: read-only by default, full control only with a colleague's approval, visible in your audit log.
From sign-up to protected
No hardware and no visit from us.
Sign up
Request a trial and choose your address, for example mybank.angkorak.me. We set up your private PAM.
Connect your servers
Run one command on each server. It connects out on port 443; no firewall change.
Invite your staff
Give each person their job role. They set a passkey on first sign-in.
Approve and relax
Approve elevated access when asked. Angkorak watches the rest and locks misuse.
Made for the NBC Technology and Cyber Risk Management Guidelines 2026
Banks and MFIs in Cambodia must supervise privileged users and keep evidence. Angkorak covers these points out of the box.
Plans
Paid per administrator per month. Every plan includes the full PAM; plans differ in support and retention.
Trial
- Your own PAM and dashboard
- Up to 5 administrators
- All detection rules
Business
- Unlimited servers and databases
- Telegram alerts
- 1-year recording retention
- Support 9 to 5, Monday to Friday
Regulated
- Everything in Business
- 3-year retention (NBC 4.10.10)
- Monthly access review report
- Export to your own SIEM
- 24/7 support