Stop redoing each client's server work by hand. Run it as plans, with the record each client receives.
For hosting and managed hosting teams. The work for each client stops depending on one person's shell: onboard a client from a template, and let anyone on the team run the routine jobs with a preview on each host and an approval where you want one. The record each run leaves is what you hand your clients, and it backs your own ISO 27001. Ansible and git already run your changes. Opafra adds the approval and the record that your clients and the EU regulation ask for.
Show who reached which client server, on whose approval, and for how long.
Your engineers and your suppliers ask for access with a reason. A named approver says yes, the grant runs for the window it was given and ends without anyone remembering to undo it, and every connection under it is on the record.
Access record /grant #a91c on prod
- Requested
- Alex Moreau @alex at 13:58:12, for patch nginx across prod
- Approved
- Dana Okafor @dana at 14:02:40
- Window
- 14:05:00 to 16:05:00, 2h
- Ended
- Expired on its own
| Time | Server | Through | Certificate |
|---|---|---|---|
| 14:32:11 | web-01 | run #4f2a | 5 min |
| 14:32:11 | web-02 | run #4f2a | 5 min |
| 14:32:12 | web-03 | run #4f2a | 5 min |
The requirement it answersRegulation (EU) 2024/2690, point 6.7.2(h)
“allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation”
The record is evidence for this point: the request, the approver, the window and how it ended.
Each client's servers, plans, runs and records, seen one client at a time.
Work across every client from one place. A new client starts from a template, so you do not rebuild by hand what you built for the last one.
84 servers across 4 clients, each with its own keys, members and record.
- Kessel Bank24 serversManaged Linux, regulatedPatch nginx across prod, Awaiting approval14:301 waiting on the client
- Halden Logistics41 serversManaged LinuxWeekly restore test, Completed03:04Nothing waiting
- Brightwater Clinics12 serversManaged Linux, regulatedRotate TLS certificates, Scheduled22:00Nothing waiting
- Orchard Media7 serversManaged web hostingPatch PHP across web, Completed11:12Nothing waiting
Selling a managed platform on your client's servers?
Running a platform for each client on their own servers is the same per-client work. It runs as the same plans, with the same approval and the same record.
Five questions every client eventually asks. Each has a record.
They arrive as a questionnaire, a contract clause or an auditor’s sample. The evidence page shows each record, and the answer pack shows the questionnaire answers.
- Who had access to our servers?
- Each grant is listed with who asked, why, who approved, the window and every connection made under it.
- On whose approval, and for how long?
- Access starts only after an approval by a named person, and it ends on its own at the time that was set.
- Is that access reviewed?
- The access review lists everyone with access to an environment, what the reviewer decided and when it was signed.
- Can you restore what you host?
- A scheduled restore test records the result and the time it took, each time it runs.
- What changed on our servers?
- Each change is recorded with the chain from request to outcome, and the approval covers the exact revision that ran.
Your clients approve the changes on their servers.
A change to a client’s servers can wait for that client’s own approver. The approval is recorded with the approver’s name and the revision it covers, so “the client agreed” is a record and not an email you search for. Client-side viewers and approvers are included in every plan, so your clients do not pay to approve (see pricing).
Ansible and git already run your changes. Opafra adds the approval and the record.
Keep the repository and the playbooks you trust. Opafra syncs plans from git, runs Ansible playbooks as a step in a plan, previews the change on each host, holds it for the approval of one exact revision, and writes the record.
What Opafra does not record.
Opafra records what goes through Opafra. Work done on a client server by another route is not in these records, and accounts that exist on the servers themselves are reviewed where they live.
A browser terminal opened through Opafra is logged as opened, with who opened it and when, but the session is not recorded. Opafra connects over SSH, so it is built for Linux servers.
Show your clients the record.
Tell us how many servers you run for clients. You get a demo and your price in writing within one business day, with no call.