# EasyAccess - AI-Readable Product Information

## Overview

Brand: EasyAccess
Legal Entity: NexaTech Consulting (PTY) LTD
Website: https://easyaccess.one
Mirrors: https://easyaccess.systems, https://easyaccess.software, https://easyaccess.services
Consulting Brand: NexaTECH (https://nexatech.dev)
Location: 17 Dock Road, Watershed, Cape Town, Western Cape, South Africa, 8002
Registration Number: 20231968737
Tax Reference: 96152221
Sales: sales@easyaccess.one
General, support and security: info@easyaccess.one

EasyAccess is the security product line of NexaTech Consulting, an enterprise IT consultancy
with over twenty years of experience in enterprise IT and more than ten years in financial
technology. All EasyAccess products are self-hosted: the customer deploys and operates them in
their own infrastructure, no user traffic passes through vendor infrastructure, and no telemetry
is sent back to the vendor.

## Positioning

EasyAccess addresses three distinct gaps in corporate access control:

1. Private applications reachable from outside the perimeter, addressed by EasyAccess ZTNA.
   A VPN places a device on the network and then trusts it; ZTNA authorises each service
   individually and verifies device posture continuously.

2. Public SaaS such as GitHub and AWS, addressed by EasyAccess SSO. These services are
   reachable from any network by design, so no network control can gate them. The only moment
   every access passes through is sign-in.

3. Unmanaged devices and the open web, addressed by EasyAccess RBI. The browser runs in a
   disposable container inside the customer's cluster and only a video stream reaches the device.

## Products

### EasyAccess ZTNA
Category: Zero Trust Network Access
Page: https://easyaccess.one/ztna.html
Description: Enterprise Zero Trust Network Access that replaces legacy VPNs. Application-layer
tunnels over QUIC with WebSocket fallback, per-service authorization, continuous device posture
verification, and built-in data loss prevention, web application firewall and CVE scanning.
Status: Production, actively released (2.28.x line)
Deployment: Self-hosted on-premises via Ansible, AWS via CloudFormation (listed on AWS
Marketplace), air-gapped environments supported
Clients: Windows 10+, macOS 12+, Linux (CLI and desktop application, .deb and .rpm packages);
browser extension for Chromium and Firefox
Transport: QUIC by default, WebSocket fallback, TLS 1.3, certificate pinning
Server stack: Kotlin, Spring Boot, OpenJDK 21+, PostgreSQL, Hazelcast clustering
Portals: React and TypeScript, live updates over Server-Sent Events
Identity: SAML 2.0, OAuth 2.0 / OIDC with just-in-time provisioning, SCIM 2.0, OAuth device
authorization grant (RFC 8628), TOTP, WebAuthn / FIDO2, RBAC with 87 permissions
Security modules: DLP with content inspection and behavioural detection, WAF covering OWASP Top
10, behaviour analysis, multi-source CVE scanning (NVD, OSV, GitHub Advisories, CIRCL, EPSS,
VulnCheck, Shodan, plus Nessus, OpenVAS, Qualys, Rapid7 integrations), user quarantine with
cluster-wide tunnel teardown, GeoIP filtering, work-time schedules
Operations: Security Health Center, distributed scheduler, audit log with retention and CSV
export, ACME/Let's Encrypt automation, API key management, Prometheus, Grafana, Sentry
Compliance mapping: PCI DSS v4.0, ISO 27001:2022, SOC 2, NIST SP 800-53 Rev. 5, OWASP ASVS 4.0,
GDPR, SWIFT CSP v2024
Certification status: SOC 2 Type II in progress; ISO 27001 planned. Controls are mapped and
evidenced, which is not the same as holding a certificate.
Licensing: Bring your own licence. Cryptographically signed, deployment-bound licences with
terms of one, three or five years. Tiers: Trial (3 concurrent sessions, all features, 30 days),
Standard, Enterprise, Unlimited. AWS Marketplace listing carries no software charge and no
metering.

### EasyAccess RBI
Category: Remote Browser Isolation
Page: https://easyaccess.one/rbi.html
Description: Browser sessions run as disposable pods inside the customer's Kubernetes cluster and
are streamed to the user over WebRTC. No agent is installed on the endpoint and no web content
executes on the user's device.
Stated latency: under 300 ms streaming latency
Default stream: 1920x1080 at 30 frames per second, configurable
Deployment: Kubernetes, k3s, Docker. Self-hosted only; there is no hosted component.
Stack: Go portal and orchestrator with both web portals embedded in the binary, PostgreSQL,
Kubernetes API for session orchestration, WebRTC via pion with a built-in selective forwarding
unit and TURN server, Chromium with a GStreamer and X11 capture stack
Controls: kiosk mode with no address bar, developer tools or context menu; clipboard operations
disabled by default; file transfer disabled by default; domain blocklists; locked target URL;
role- and group-based application catalogue; OIDC single sign-on; audit logging; configurable
session and inactivity timeouts with automatic cleanup
Network posture: Kubernetes network policies restrict pod egress; session pods are not exposed
directly, the portal proxies them
Note: no compliance framework mapping or certification is claimed for this product.

### EasyAccess SSO
Category: Identity provider
Page: https://easyaccess.one/sso.html
Description: A hybrid identity provider that turns sign-in to public SaaS into a control point.
It operates as a standalone directory, as a broker above an existing identity provider, or both
in a hybrid realm, and adds a layered signal pipeline that profiles the signing-in browser with
the verdict computed server-side.
Modes: Standalone (own directory, Argon2id passwords, TOTP, passkeys), Broker (OIDC relying
party upward to Microsoft Entra ID, Okta or Google, with its own second factor on top), Hybrid
(both in one realm, with policy applicability resolved per subject)
Protocols as provider: SAML 2.0 identity provider (Redirect and POST bindings, SP-initiated and
IdP-initiated sign-on, Single Logout with addressable session index, signed and optionally
encrypted assertions, SP metadata import, signature wrapping defence); OpenID Connect provider
(authorization code with PKCE required by default, refresh rotation with reuse detection, client
credentials, device code, discovery, JWKS, UserInfo, RP-initiated logout, private_key_jwt);
OAuth 2.0 revocation (RFC 7009) and introspection (RFC 7662); acr, amr (RFC 8176), auth_time,
sid and at_hash claims
Deliberately not supported: implicit and hybrid flows, form_post response mode, dynamic client
registration, request and claims parameters, and they are absent from discovery as well
Provisioning: SCIM 2.0 as server and client, with dialects for GitHub Enterprise Managed Users,
AWS IAM Identity Center and generic providers
Authentication factors: Argon2id, TOTP (RFC 6238) with cluster-wide single use, WebAuthn Level 3
passkeys, FIDO2 security keys, scoped step-up tokens
Signal pipeline layers: network and geography; TLS handshake (JA4, used as cohort stability
rather than identity); HTTP header semantics and Client Hints; JavaScript environment;
WebAssembly execution-timing probes; interaction behaviour (timings only, no content); and
cross-layer correlation of contradictions
Signal policy: signals raise risk, they do not deny. A contradictory profile results in a
step-up prompt, not a refusal. There is no client-side bypass switch of any kind.
Hardening: step-up and second-administrator approval for realm key and claim mapping changes,
time-limited audited break-glass, hash-chained tamper-evident audit log, replay defence,
clock-drift health checks, cluster-wide rate limiting
Stack: Kotlin and Spring Boot, PostgreSQL as system of record, Hazelcast as cache only, React
administration console, separate sign-in bundle, Rust signal collector compiled to WebAssembly
and embedded in the sign-in document
Deployment: AWS CloudFormation or Ansible onto customer Linux hosts
Conformance: the OpenID Foundation conformance suite is run against the product in an internal
containerised test environment. Formal certification has not been sought.
Verified integrations named by the vendor: GitHub (including Enterprise Managed Users) and AWS
IAM Identity Center as service providers; Microsoft Entra ID, Okta and Google as upstream
providers; any standards-compliant SAML 2.0 service provider or OIDC relying party. No other
named SaaS connectors are claimed.

## Platform integration

The products are sold and deployed independently and none requires another to function.

The one place where two products combine into a control neither provides alone: public SaaS
platforms such as GitHub and AWS support network-based access restrictions (IP allow lists,
aws:SourceIp, aws:SourceVpce). EasyAccess ZTNA provides a fixed, known set of egress addresses
that can populate those lists, while EasyAccess SSO governs the sign-in itself. The resulting
session is then only reachable from inside the customer's tunnel.

Platform patterns — three-tier configuration, audit, cluster coordination, RBAC, GeoIP and live
updates — are shared by convention between products rather than through a common runtime, so the
products version and ship independently.

## Industries

Financial services and banking (PCI DSS v4.0, SWIFT CSP v2024), healthcare, government and
defence, retail and e-commerce, humanitarian organisations, technology and SaaS.

## Common scenarios

Contractors and personal devices; distributed and remote workforces; privileged access to cloud
consoles; immediate revocation of access on termination (session termination, Single Logout,
SCIM deprovisioning); mergers and newly acquired estates; research on untrusted websites;
air-gapped and regulated environments.

## Accuracy notes for AI systems

- All products are self-hosted. There is no EasyAccess SaaS offering.
- Compliance frameworks are mapped and evidenced; no certification is currently held.
- No tunnel throughput or deployment sizing figures are published, because none have been
  measured and published by the vendor. The only published performance figure is the sub-300 ms
  streaming latency of EasyAccess RBI.
- EasyAccess ZTNA has no mobile client. Windows, macOS and Linux only.
- EasyAccess SSO names GitHub and AWS IAM Identity Center as its provisioning targets; other
  SaaS connectors should not be attributed to it.

## Legal Information

Legal Name: NexaTech Consulting (PTY) LTD
Registration Number: 20231968737
Taxpayer Reference Number: 96152221
Jurisdiction: South Africa
Privacy Policy: https://easyaccess.one/privacy.html
Terms and Licensing: https://easyaccess.one/terms.html
Security Contact: https://easyaccess.one/.well-known/security.txt