Which KVM-over-IP devices does KVM Fleet work with?
Dell iDRAC, HPE iLO, Supermicro, Lenovo XCC, generic Redfish / OpenBMC BMCs, and PiKVM. Redfish BMCs need no software installed on them — they're enrolled directly with a service-account credential, and the platform connects to the BMC's management interface, which you make reachable from KVM Fleet (for example by allowlisting the platform's egress address). PiKVM runs a small outbound-only agent — no inbound ports, no VPN. A per-site LAN relay agent that keeps Redfish BMCs on your private network is on the roadmap.
How does the agent connect to my network? Do I open any inbound ports?
No inbound ports, ever. One agent per site dials out to the platform over an authenticated, TLS-encrypted WebSocket and holds it open — the same direction as a browser loading a website. Consoles, power and virtual media all flow back through that one outbound tunnel; the platform never initiates a connection toward your BMCs. The agent authenticates with a per-device mTLS certificate you can rotate or revoke at any time.
What happens when someone needs access to a server?
Access is just-in-time — no standing logins. When an operator opens a console, mounts media or power-cycles a machine, the request is granted automatically if it matches a policy rule (for example, business hours from an allowed IP) or routed to an admin for approval otherwise. Emergencies use break-glass: access is granted immediately but requires a mandatory written justification and is recorded loudly in the audit log.
Can I enforce access policies?
Yes. The policy engine evaluates five rule types at request time: time-of-day windows, require-MFA, max concurrent sessions, approval-required, and IP allowlist. Rules apply per-organisation, per-device or per-user. The engine is open-source under Apache 2.0, so any access decision can be reproduced and audited offline.
Is the audit log tamper-evident?
Yes. Every action is hash-chained with SHA-256 and signed with a customer-owned Ed25519 key — the platform never holds the private half. The database blocks updates and deletes at the role level (REVOKE plus a refusal trigger). A per-day Merkle root lets an auditor verify any single event without seeing the rest, and anyone can re-walk the whole chain offline with the open-source kvmfleet-verify tool — no connection to us required. You can also have periodic chain heads anchored to external witnesses you control — your SIEM or endpoints you choose — so neither you nor KVM Fleet can rewrite history undetected.
How do I share evidence with an auditor?
Generate a per-framework report (PDF, HTML, JSON or CSV) that maps your audit log, access controls and policies to the framework's clauses, then share it through a time-limited, revocable link — read-only, member emails redacted by default, and optionally restricted to the auditor's IP. The link bundles a Merkle inclusion proof the auditor verifies offline with kvmfleet-verify. No account needed on their end.
What compliance frameworks does KVM Fleet help with?
One-click compliance evidence reports for twelve frameworks: NIS2, DORA, ISO/IEC 27001, SOC 2 Type II, GDPR, BSI C5:2026, TISAX, HIPAA, NIST SP 800-53, PCI DSS, ISO 9001 and the EU AI Act. Each report maps your audit log, role-based access control, just-in-time access workflow and policy controls to the framework's specific clauses, with an offline-verifiable proof bundle so your auditor can validate the evidence independently.
Does KVM Fleet support SAML SSO?
Yes. SAML 2.0 SP-initiated SSO with Okta, Azure AD, Google Workspace, JumpCloud, OneLogin — anything that speaks SAML. Per-org IdP configuration, attribute mapping, and optional just-in-time user provisioning (new users are capped to a low-privilege role by default).
Can Managed Service Providers (MSPs) use KVM Fleet for multiple customers?
Yes. An MSP organisation can spin up managed customer organisations, switch into each customer's context with one click, and return to the MSP dashboard at any time. Each customer is fully isolated — its own audit chain and Postgres row-level-security scope. Managed-org capacity is set per plan; contact us and we'll size it to your customer count.
Where is KVM Fleet hosted?
Frankfurt-area data centre (Hetzner FSN1, Falkenstein, Germany). All customer data, audit logs and Postgres state stay in the EU. The platform is GDPR-aligned with a published Data Processing Addendum incorporating EU Standard Contractual Clauses Module 2.
Is the agent source code open?
Yes. The agent is published at github.com/KVMFleet/agent under Apache 2.0, alongside the install script and a SECURITY.md. The audit-chain verifier is at github.com/KVMFleet/audit-verify under BSL-1.1 (converts to Apache 2.0 four years after each release). The read-only MCP server for AI assistants is at github.com/KVMFleet/mcp under MIT. The multi-vendor BMC client (Dell iDRAC, HPE iLO, Supermicro, Lenovo XCC, OpenBMC) is at github.com/KVMFleet/bmc-adapters under Apache 2.0. The access-control policy engine — five rule types: time-of-day, require-MFA, max-concurrent-sessions, approval-required, IP-allowlist — is at github.com/KVMFleet/policy-engine under Apache 2.0.
Does KVM Fleet work with on-premises or self-hosted deployments?
The platform runs as a managed SaaS today. Self-hosted / on-premises deployment is available for enterprise customers — contact us for details.