Fudo ShareAccess

Why Fudo ShareAccess?

In cybersecurity, access for external companies is often broader than anyone would like, for a purely practical reason: if setting up narrow access takes a week and broad access takes a moment, broad access wins. The choice of tool is therefore about making the secure option the most convenient one as well.

Access granted to a contractor usually outlives the job it was granted for.

Fudo ShareAccess is Fudo Security’s solution for third-party access management: a cloud platform through which vendors, contractors and partners connect to your resources from a web browser — without VPN, without agents and without infrastructure changes. According to the vendor, this shortens the time needed to grant access, because complex VPN and firewall configuration is no longer required. At the same time, the vendor notes that ShareAccess reduces reliance on VPN in specific scenarios but does not replace all of its functions.

How does it work?

Fudo Enterprise gateway

• Sharing resources requires a Fudo Enterprise instance, which acts as the gateway: the access point to resources and the place where access is configured
• Fudo Enterprise itself initiates the connection to ShareAccess and sets up a reverse SSH tunnel — the platform needs no direct access to the internal network
• On the organization’s side, outbound connections are enough: the API over HTTPS (port 443) and the tunnel (port 65522)
• SSH, RDP and VNC sessions are stored in Fudo Enterprise in your network — neither ShareAccess nor its operator has access to session data

User access

• The built-in browser client or your own SSH or RDP client
• RDP and SSH; VNC in the browser client only
• HTTP in the browser client only, as a beta feature (a rendered view of the web application)
• Access requests can be accepted, rejected and revoked in the Fudo Officer mobile app (iOS, Android)

Threat detection

• ShareAccess uses Fudo Enterprise AI capabilities: a quantitative model (number, duration and timing of sessions), mouse biometrics, keyboard biometrics and a semantic model
• When a threat is detected: e-mail notification, SNMP trap, pausing the session, terminating the connection or blocking the user
• Zero-trust principles for external access: continuous verification, least privilege, dynamic policies

Key Features

Onboarding external users

• An e-mail invitation sent from Fudo Enterprise or from ShareAccess; until acceptance the user has the Pending status
• Users can also sign up on their own — if the e-mail domain matches your organization, the account stays inactive until the organization owner activates it
• Two-factor authentication (TOTP) is required at registration
• Only users with the Trusted status see resources; before granting it, the administrator can compare the user’s key fingerprint (SHA256) received through another channel
• The “Invite and Trust” option grants access at once, without verification — the vendor warns that this means immediate, unattended sharing of resources

Access control

• Resource-level permissions: access is granted through Fudo Enterprise objects — users, servers, accounts and safes
• Request approval, time-based restrictions and instant revocation of access
• Blocking a user in Fudo Enterprise automatically disables their access to resources shared through ShareAccess
• The administrator can revoke the Trusted status or end the user’s membership

Session supervision and recording

• Real-time monitoring and full recording of external sessions
• A searchable archive of recordings for compliance and security forensics
• Reporting on login times and user activity
• Immutable audit logs

Compliance

According to the vendor, detailed audit logs and reporting support adherence to GDPR, HIPAA and PCI DSS requirements.

Access on request (Just-in-Time)

Mode	How it works
Immediate Access	After the request is approved, access for a set duration, up to 24 hours
Scheduled Access	Access within a specified time window — with a start and end date

Every request requires a justification, and the decision is made by the organization owner. In Fudo Enterprise, the Just in time option in a safe requires a number of voters, who accept or reject requests in the admin panel.

Licensing model

• A free plan for third parties that use resources of other organizations
• An organization sharing its own resources buys a license covering the number of active members and the number of other organizations it shares access with
• Pricing per active user and per organization on a monthly basis; the license is purchased for a year in advance
• The ShareAccess license is separate from the Fudo Enterprise license and is managed exclusively in Fudo Enterprise
• A deactivated user still occupies a license in the given month, and reactivating them in the same month counts as a new user

Use cases

The vendor describes ShareAccess as a way of working with vendors, contractors and partners without exposing internal systems. In nFlo’s assessment, this most often applies to:

• External administrators and IT service providers — ongoing system maintenance without a permanent account in the network
• Software vendors — application support and implementation work within a defined time
• Consultants and auditors — temporary access with a full session recording
• Hardware and industrial system service — work in scheduled time windows, always recorded

Who is it for?

In nFlo’s assessment, ShareAccess makes sense where:

• Many external vendors connect to systems, and each of them currently has a separate VPN account or a shared password
• The organization already uses Fudo Enterprise or plans to deploy it — without it, ShareAccess cannot share resources
• Audits require showing who connected to critical systems from outside, and when

Benefits

For security: no VPN for vendors, MFA for all external users, session recordings stored in your network, automated responses to threats

For IT: no agents to install and maintain, management in the Fudo Enterprise panel under consistent policies for internal and external users

For business: third parties use your resources under the free plan, and the license depends on the number of active members and organizations

Specifications

Model	Cloud platform on AWS (EU: Frankfurt, US: California) + Fudo Enterprise as the gateway
Access	Browser client (Chrome and Firefox recommended) or a native SSH/RDP client
Protocols	RDP, SSH; VNC and HTTP (beta) in the browser client only
Authentication	Password, TOTP (required at registration), Trusted status with key fingerprint verification
Access on request	Immediate Access (up to 24 hours), Scheduled Access
Network	Outbound connections from Fudo Enterprise: 443 (API), 65522 (tunnel)
Platform security	End-to-end encryption (zero-knowledge), ECDSA request signatures, WAF, AWS Shield
Recordings	Stored in Fudo Enterprise in the organization’s network

FAQ

How are external users licensed? Third parties that use resources of other organizations are on a free plan. The organization sharing resources pays for active members and for the number of organizations it shares access with.

What does onboarding a vendor look like? The administrator sends an e-mail invitation from Fudo Enterprise. The vendor creates an account with two-factor authentication and accepts the invitation, and the administrator grants the Trusted status — optionally after comparing the key fingerprint.

Is VPN really not needed? The vendor connects from a browser or with a native SSH or RDP client, without VPN. The vendor notes that ShareAccess reduces reliance on VPN in specific scenarios but does not replace all of its functions.

How does request approval work? The vendor chooses Immediate Access (for a set duration, up to 24 hours) or Scheduled Access (a time window) and gives a justification. The organization owner accepts or rejects the request — also in the Fudo Officer app.

Can I monitor sessions live? Yes. External sessions are monitored in real time and recorded, and when a threat is detected, a policy can pause the session, terminate the connection or block the user.

Does ShareAccess work without Fudo Enterprise? An organization sharing resources needs Fudo Enterprise — it is the gateway to resources and the place where access is configured. A third party invited by another organization uses ShareAccess alone.

Where does session data go? Recordings of SSH, RDP and VNC sessions stay in Fudo Enterprise in your network. Session data is encrypted end-to-end between the user’s device and Fudo Enterprise, and the ShareAccess operator has no insight into it. The platform runs on AWS — in the Frankfurt region for EU users.

What does a compliance audit look like? Full recordings, immutable audit logs and reporting which, according to the vendor, supports adherence to GDPR, HIPAA and PCI DSS requirements.

Can I restrict access to specific resources? Yes. Access is granted through Fudo Enterprise safes and accounts — a vendor sees only the servers assigned to their safe.

How quickly can I revoke access? Blocking a user in Fudo Enterprise automatically disables their access to resources shared through ShareAccess. You can also revoke the Trusted status or end the membership.

Why deploy Fudo ShareAccess with nFlo?

• Inventory of external vendor access — we establish which external companies connect today, with which accounts and to which systems.
• Access policy design for external companies — we choose safes, access-on-request modes, approval and recording rules to match your vendor contracts.
• Deployment and integration — we launch or extend Fudo Enterprise as the gateway, pair it with ShareAccess and configure the outbound connections.
• Maintenance and reviews — we review vendor members and permissions, revoke access after completed jobs and handle incidents.

The stages and scope of work are described on the PAM Implementation service page.

You will find more about privileged access management in the identity and PAM knowledge base.

To talk about your environment, use the contact form.