A service desk at night: technicians with headsets at their monitors and a translucent robot working among them.

Solutions · Third-party & vendor access

The people keeping your systems running don't work for you.

Contractors, MSP engineers and vendor support teams have to reach systems that aren't theirs. Today that means borrowing one of your accounts. HBX lets their own employer's identity stand in your systems instead, for one target and one window.

How this gets solved today

Vendors get access by borrowing your accounts.

An integrator needs three engineers on your equipment for a six-week commissioning. So you create three accounts in your own directory, mail out the first passwords, add them to a VPN group, and put an end date in a spreadsheet that nobody owns after the project manager rolls off.

You are onboarding people you never hired

Your directory fills with identities for staff of other companies. Your IT team runs joiner and leaver processes for headcount it has no visibility into and no authority over.

Both sides carry the same risk twice

The vendor is holding your credentials in their password manager. You are holding accounts for their people in your directory. Neither organization can answer for the other one's hygiene, and both get asked to in the audit.

What HBX does differently

The vendor's own login works in your system, for one job.

The engineer signs in with their own employer's sign-in system. That directory says who they are; your policy decides what they may reach here. Neither side has to import the other's users.

A person one company vouches for reaches a system inside another company’s private network, and stays traceable to the person who authorized it.Three zones. On the left, the consuming organization (an MSP, a consultancy or a contractor) with its own identity provider and the engineer or agent it vouches for; what leaves that zone presents the identity their own sign-in system vouches for. Down the middle runs the organizational boundary: not a firewall but an ownership line, with a different company owning everything on the other side. On the right, the customer’s private network, owned, run and audited by the customer, holding a connector and the legacy system behind it. Above both, off the line, HBX Access checks the identity the other organization vouches for, grants access to one target for one time window, and logs the action back to the person who authorized it. Only thin dotted control lines touch HBX Access. The single thick line, a direct encrypted connection, runs straight from the engineer or agent, through the one opening in the boundary, to the connector, and never passes through HBX.HBX DECIDESHBX Accesschecks who another company vouches forgrants access to one targetand one time windowlogs it back to the person who authorized itchecks their identitysets up the accessORGANIZATIONAL BOUNDARYnot a firewall: a different company owns the other sideCONSUMING ORGANIZATIONtheir staff directoryTheir own sign-intheir employeestheir joiners and leaversEngineer or agentshows who their company vouches forthe MSP, the consultancy, the contractorCUSTOMER PRIVATE NETWORKCore banking · Oracle · SCADAConnectorLegacy systemowned, run and audited by the customerencrypted, directdirect line · never via HBXEveryone else works inside one company. This one crosses between two.

No standing account on your side

You don't create an account for them in your directory. There is no standing account, and no password of yours that outlives the job.

Attribution that reaches a human

Every access traces back to the individual their employer vouched for. When you ask who made the change, the answer is a name and an organization, not a supplier login shared by nine people.

Their leaver process reaches your systems

Disabled in their directory means unable to get in to yours, on the next attempt. A connection already open can be cut on its own. No ticket to your service desk, no spreadsheet.

We hold no certification and claim none. Where we stand on standards.

Who this covers

  • MSPs
  • System integrators
  • Consultancies
  • Contractors

Pick the supplier whose access you'd least like to explain.

Thirty minutes on that one relationship: who they are, what they reach, and what your audit currently says about it. We'll show you the version where nobody borrows an account.

People get a console → HBX Human Access. Agents get their own temporary access → HBX Agent Access.