> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/self-managed-keeper/self-managed-keeper-overview.md). # Self-Managed Keeper Overview Self-hosted identity security and privileged access management for Government, Operational Technology (OT), financial services and air-gapped environments. **Self-Managed Keeper** (SMK) is a self-hosted, container-based deployment of Keeper's identity security platform. It provides credential management, secrets management and privileged access management within infrastructure your organization owns and operates, including on-premises data centers, private clouds and fully air-gapped networks. SMK is designed for organizations that need to secure critical infrastructure and manage privileged access inside isolated Operational Technology (OT), Information Technology (IT) and defense environments. The platform operates without connectivity to Keeper's cloud service, allowing organizations to maintain their own data boundary and continue accessing credentials and privileged sessions during internet or cloud outages. {% hint style="info" %} Keeper's cloud platform remains the recommended deployment for most use cases. It provides a zero-knowledge vault, enterprise administration, secrets management and privileged access management without requiring your organization to host or patch the platform. Self-Managed Keeper provides an alternative when hosting, isolation or operational requirements call for a deployment inside your own environment. {% endhint %} ### When to use Self-Managed Keeper Use Self-Managed Keeper when privileged access must remain within your network or continue operating without external connectivity. Common use cases include: * **Operational technology:** Manage privileged access to industrial control systems, plant networks and field infrastructure without routing credentials through an external service. * **Energy and natural gas:** Maintain access to pipelines and production systems when internet connectivity is unavailable. * **Power and utilities:** Enforce least privilege across generation, transmission and distribution networks while maintaining your own data boundary. * **Federal agencies and public sector:** Deploy credential and access management within agency-controlled infrastructure to support data sovereignty, residency and hosting requirements. * **Air-gapped and restricted networks:** Run credential management and PAM in fully isolated environments without a dependency on Keeper's cloud service. ### Security and data control Self-Managed Keeper uses Keeper's zero-trust, zero-knowledge architecture. Vault data is encrypted and decrypted on the user's device. Keeper does not have access to your credentials or vault data, whether the platform is cloud-hosted or self-managed. Your organization controls the hosting environment and the internal addresses used by users and applications. Deployment data remains within your infrastructure, allowing you to maintain the data boundary required by your security and regulatory policies. ### Core capabilities Self-Managed Keeper provides Keeper's core credential and privileged access management capabilities: * **Password and credential management:** Store and share credentials in the Keeper Vault, with role-based permissions and granular sharing controls. * **Secrets management:** Use Keeper Secrets Manager to remove hardcoded credentials from scripts, applications and infrastructure. * **Privileged session management:** Launch secure sessions through the KeeperPAM Gateway without exposing credentials to the end user's device. PAM capabilities include Connections, Tunnels and session recording. * **Database access:** Use KeeperDB to connect to enterprise databases with vault-managed credentials and governed privileged sessions. * **Centralized administration:** Manage users, enforce policies and review activity through the Keeper Admin Console. * **APIs and integrations:** Connect the deployment to internal tools and workflows through Keeper's APIs. ### Architecture and system requirements Self-Managed Keeper runs as a set of Docker containers on a 64-bit Linux AMD64 host or virtual machine. The deployment can reside on-premises, in a private cloud or within an isolated network. See [System Requirements](/keeperpam/self-managed-keeper/self-managed-keeper-overview/installation/system-requirements.md) for host prerequisites and sizing guidance. A single reverse proxy terminates TLS and routes browser, API and PAM traffic to the vault, Admin Console and routing services behind it. Keeper Relay (KRelay) session traffic is the exception: it is reached directly on its own ports rather than through the reverse proxy. ### Offline operation and break-glass access SMK operates independently within your environment. Users can continue accessing critical credentials and privileged sessions when the internet connection or external cloud services are unavailable, provided the local deployment and required internal infrastructure remain operational. This supports break-glass access during outages, network isolation and connectivity disruptions without relying on an external service for access to the self-managed tenant. ### Keeper Cloud and self-managed deployments Organizations can use Keeper Cloud for corporate IT and Self-Managed Keeper for OT or restricted networks. Each deployment operates as an independent, isolated tenant with separate users and data. The self-managed deployment does not depend on the cloud tenant to function. ### Deployment and updates Keeper's implementation team assists with deployment and coordinates product updates with your organization. Self-Managed Keeper does not update automatically. Updates follow Keeper's security guidance and testing protocols and are applied during approved change windows. ### Licensing Each Self-Managed Keeper deployment is licensed separately from Keeper's cloud platform and requires a license issued by Keeper. See [Licensing](/keeperpam/self-managed-keeper/self-managed-keeper-overview/licensing.md) for activation and renewal details. ### Getting Started Review [System Requirements](/keeperpam/self-managed-keeper/self-managed-keeper-overview/installation/system-requirements.md), then proceed to [Installation](/keeperpam/self-managed-keeper/self-managed-keeper-overview/installation.md) to prepare and deploy Self-Managed Keeper. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.keeper.io/keeperpam/self-managed-keeper/self-managed-keeper-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.