TigerTrust is a unified control plane for every non-human identity in your estate. Four cooperating modules share the same workspace, RBAC, audit trail, and API surface:

Certificate Lifecycle (CLM)

Discover, issue, renew, deploy, and revoke every X.509 certificate — plus SSH keys, code-signing, and TPM-attested device identity. Runs on the internal PKI Core or against any external CA.

Privileged Access Management (PAM)

Broker SSH, Kubernetes exec, database, RDP, and HTTP-app sessions with short-lived credentials, keystroke recording, joins for live moderation, and per-request approvals.

Secrets Manager (SM)

HashiCorp-Vault-compatible engine for KV, transit, PKI, and database dynamic secrets. Wrapped delivery, leases, rotation policies, and audit devices.

NHI Governance (NHIG)

Inventory every service account, workload identity, API key, and OAuth app. Owner attestations, access reviews, drift findings, and lifecycle policies.

​
What each module ships

ModuleServer sideOn-host / on-cluster
CLMPKI Core, Collector, Discovery WorkerAgent (one binary, polls the Collector)
PAMtigeraccess-server (session broker + proxy)tash (user CLI), tash-admin (admin CLI), tbot (machine-identity bot)
SMVault-compatible engine served by the backendVault-compatible CLI, tt secrets CLI, agent-side templating
NHIGBackend + discovery workersAgent (cloud/K8s discovery), read-only cloud roles
See the module-specific install pages for the exact binary, package, and enrollment flow:

Install CLM agent

One binary. Enrolls to the Collector over outbound HTTPS.

Install PAM

Server daemon, admin CLI, user CLI, machine bot.

Install Secrets Manager

CLI, agent, Vault-compat binary layout.

Install NHI Governance

Cloud-discovery agent and read-only roles.

​
Who uses TigerTrust

  • Platform / SRE teams consolidating certs from Let’s Encrypt, DigiCert, ACM, Vault, and everywhere else into one operational plane.
  • Security teams enforcing key/algorithm policies, gating privileged sessions behind approvals, and rotating secrets on a schedule.
  • Manufacturers and OEMs provisioning strong identity to IoT/edge devices via TPM-backed attestation.
  • Compliance owners producing audit trails for SOC 2, ISO 27001, PCI-DSS, HIPAA, and eIDAS 2.

​
Where to start

Quickstart

Sign in, connect a CA, and issue your first certificate in 15 minutes.

Platform concepts

Workspaces, RBAC, policies, and the agent/collector model that every module shares.

API reference

Every HTTP endpoint across CLM, PAM, SM, and NHIG.

Integrations

AWS, Azure, GCP, DNS providers, SSO, webhooks, notifications.