Compliance with Next Terminal

Next Terminal is a self-hosted bastion host. For teams that face internal audit or external compliance requirements, this page maps product capabilities to common controls. It is not legal advice — validate against your specific framework (e.g., ISO 27001, SOC 2, internal audit).

What auditors typically ask

Control	Question
Access control	Who can access which asset, from where, and when?
Authentication	How is identity verified before access?
Session accountability	Can every operation be traced to a person?
Evidence retention	Are recordings and logs retained and tamper-evident?
Least privilege	Can high-risk actions be blocked before execution?

How Next Terminal addresses each control

1. Access control and least privilege

• Asset authorization by user, group and asset (Assets, Asset Access); time/source constraints via sign-in policies.
• Access policies (Access Policies) and command filtering (SSH Proxy) for high-risk commands — block or require approval before execution.
• Security Gateway (Security Gateway) for VPC/multi-site assets — single entry, no direct public ports.

2. Strong authentication

• Passkey/WebAuthn (Passkey), TOTP (OTP), LDAP and OIDC (OIDC) — bring remote access into the corporate IdP.
• mTLS client certificates (mTLS, strict/ca_only) — verify identity before the reverse proxy forwards to the business system.
• SSH Gateway (SSH Gateway) keeps ssh user@host workflows under bastion authentication.

3. Session audit, recording and replay

• Online sessions plus offline recording and transcoding — retain text and graphical sessions for replay; see RDP Proxy and Pricing — enhanced audit.
• File operation logs and SQL audit (Database Audit) — who did what, when.
• Access log analytics — aggregate access events for review and alerts (enhanced edition).

4. Evidence retention and separation

• Recordings to local or S3 (App.Recording.Type: s3); data on shared storage only for the demo HA path — see Primary/Standby HA and Production HA Checklist for S3 migration.
• System backup (Backup) — PostgreSQL + data (or S3 versioning) with restore drills.

Suggested policy set (starter)

1. Require MFA (Passkey or TOTP) + mTLS for Web assets exposed via reverse proxy.
2. Block high-risk commands (e.g., rm -rf /, drop database) via command rules; exempt only via approval workflow.
3. Retain recordings ≥180 days (or per policy), store in S3 with object lock/versioning.
4. Quarterly HA and restore drills (see Checklist) and retain drill logs as audit evidence.

What to show an auditor

• User/asset authorization matrix export
• Sample session replay + file/SQL audit log
• Access log analytics report
• mTLS/IdP configuration and sign-in policy
• Backup/restore drill record and HA checklist sign-off

Questions about a specific framework? Open an issue with your control list at GitHub or contact via License Portal.