Humans, service accounts, vendors and AI agents. One map, one policy envelope, one ledger.
One vault, one map and one policy, reached from every surface a person or a system works on.
The extension for Chrome and Firefox is the primary access point: it fills, signs in with passkeys and shows what is shared with you. The iOS and Android apps approve, share and hold the vault on the move; the desktop client does the same at a workstation. Credentials are encrypted on the device with AES-256 and per-user, per-device keys before they sync. Nothing arrives at Sequrely’s servers in plaintext.
Passkeys and WebAuthn by default; TOTP and SMS where a target still needs them. Sign-in is bound to authorized devices.
Share a credential to a person or a collection for a bounded window. Every share, view and revocation is recorded and expired shares rotate.
Owner, Admin, Manager and User roles, enforced server-side. Collections and groups scope who sees what, by team and by system.
Each device holds its own keypair. A master device authorizes or revokes the others, and the inventory lists every authorized endpoint with platform, last-active and status.
Dashboard, SOC view, agentic reports, organization and policy editors in one web console. Every admin action lands in the sealed ledger.
Share requests, approvals, checkpoints and revocations reach the right person as they happen, on the device they hold.
Ends idle sessions, rotates expired shares, contains drifting identities and grants just-in-time access with a named approver. It never executes a human-gated action.
The extension fills and signs in. The phone approves, shares and carries the vault. The keys stay on the device that made them.
Users, services, roles and devices in one admin view, with every admin action on the record.
Owner, Admin, Manager and User. Collections and groups narrow each role to the systems a team touches.
A master device authorizes or revokes the rest. Revocation takes effect at the next sync and is written to the ledger.
Role changes, invitations, revocations and policy edits are sealed into the same hash-chained ledger as the agent’s decisions.
You cannot enforce what you cannot see. The map comes before the policy, and the policy before the agent.
Endpoints, cloud, identity logs and non-human accounts collapse into one authoritative map: every identity, human or agent, and the systems it can reach. Fragmentation is where access hides. The map is where it stops.
Non-human identities are identified explicitly, so service accounts and AI agents are mapped to least privilege instead of inherited access.
Maintain, rotate or revoke the credentials you hold in Sequrely from one place, by hand or by the agent, with each action recorded.
Knowledge, possession, likeness, location and behavior score the session while it runs. Risk steps up authentication or ends the session.
Grants carry an expiry. Vendors and auditors get just-in-time, task-scoped access that revokes itself when the task ends.
A login is a point. A session is a line. Five signals keep scoring the line.
A PIN or secret only the person holds. Never the only factor.
An authorized device or hardware key, bound by a keypair that never leaves it.
Biometrics through the device’s own secure hardware. Sequrely never sees the template.
Network, geography and device context. A valid token from the wrong place is still wrong.
Drift from the identity’s digital twin: timing, scope, volume. The signal attackers cannot copy.
Every action class is assigned a mode in a versioned policy envelope. The agent cannot promote itself.
The digital twin learns each identity’s normal before anything is enforced. Observe mode is the default for a new identity.
The response is looked up in the policy envelope. The mode comes from the policy, never from the agent.
Machine-speed runs now. Checkpoint waits for a named approver. Human-gated produces a recommendation and stops.
Decision, evidence and mode are hashed into the ledger with the hash of the entry before.
Read the ledger, tighten or loosen the envelope. Changing the envelope is itself a logged, human-gated event.
Sample data: investigation ledger. Example row: 14:02:11, Sequrely agent, New non-human identity found · ci-runner-7 · unmapped, status Watching.
Sample data. Identifiers are fictional. Every row is sealed with the hash of the row before it.
{"ts":"2026-10-23T09:42:14Z",
"actor":"agent","mode":"machine_speed",
"action":"end_session","target":"svc-payroll-bot",
"rule":"idle>30m","seal":"sha256:7f3a…c91e",
"prev":"sha256:b02d…4e77"}
{"ts":"2026-10-23T09:43:31Z",
"actor":"human:org.owner","mode":"checkpoint",
"action":"grant_jit_access","target":"vendor-auditor",
"ttl":"2h","seal":"sha256:1e8c…a0f3",
"prev":"sha256:7f3a…c91e"}
Sample data. The JSONL export: one record per decision, each carrying its seal and the hash of the entry before. Exports map to SOC 2 and ISO 27001 controls.
Enforcement sits beside your identity provider and your cloud IAM; it does not replace them.
System categories, not endorsements. The connector list is available on request.
Every capability on this page is in the product today.