Preparing for first start
Setting up storage and offline tools. This can take a bit longer after installing the app or clearing app data.
One Platform. Complete Control.
Powered byTotal Access Platform
Preparing for first start
Setting up storage and offline tools. This can take a bit longer after installing the app or clearing app data.
One Platform. Complete Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
One password. Every device. No Active Directory required.
Cloud directory, endpoint security, patch management, and session control — without Active Directory.
Total Cloud Directory is the agent-first identity and device-management layer of the Total Access platform. A lightweight Go agent on each workstation — Windows, macOS, or Linux — manages local accounts, enforces policies, filters DNS, reports Defender posture, streams live inventory, and patches the OS — all controlled from the portal. Users can even approve Windows sign-ins from their phone. No domain controller, no Kerberos, no AD complexity. The self-hosted JumpCloud and Scalefusion alternative built for South African businesses.
Microsoft itself told IT admins to “choose Entra ID over AD” in August 2026. AD requires a domain controller, Kerberos, DNS, certificate renewal, and a dedicated VM — all for features that most SMBs never use. There is a better way.
A domain controller VM, plus WireGuard transport, FreeRADIUS, DNS, and Kerberos infrastructure — all running 24/7 just to manage logins.
When the DC goes down, users are locked out of Windows AND the portal. A single DC is a single point of failure for your entire workforce.
AD uses Organizational Units for tenant isolation — a soft boundary. Total Cloud Directory uses hard client_id scoping in the portal database, already enforced.
“We replaced our AD domain controller with the Total Connect Agent. Same single-sign-on experience, zero DC infrastructure, and our users didn’t notice anything changed except their password now works everywhere.”
— IT Manager, Midrand logistics company
A lightweight agent on each Windows workstation connects to the portal via WireGuard, manages local accounts, enforces policies, and reports compliance — all without a domain controller.
Install the agent on Windows, macOS, or Linux — manually with a connect key, via QR code on mobile, or at fleet scale with GPO/RMM deploy scripts from a named enrollment configuration. The agent registers with the portal, establishes its WireGuard tunnel, and picks up group policies on first fetch.
An admin binds a user identity (their client-specific email account) to the device in the IAM Console. The agent creates or takes over the local Windows account and syncs the password from the portal — one password, applied everywhere.
Users log on through the Total Connect tile on the Windows sign-in screen — with their portal password, or by approving the logon on their phone: tap, biometric, or full face verification on an enrolled device. Cached verifiers keep logon working even when the device is offline.
GPO policies are pushed to the agent: Windows Update schedules, startup/shutdown scripts, BitLocker key escrow, password change restrictions, and local admin group membership. Compliance is evaluated every 60 seconds.
WireGuard routes all DNS queries through Blocky on the gateway. Per-client blocklists, category filtering (ads, malware, social media), custom allowlists, and full query logging — enforced at the network level, not bypassable.
Admins can lock workstations, sign users out everywhere, or disable accounts remotely. Commands are delivered via heartbeat response (60-second gap closed) and WebSocket session control channel — browser, mobile, and Windows all respond.
Local account management, GPO policies, DNS filtering, MFA, session control, and device trust — all in one agent-first platform.
The agent creates, takes over, sets passwords, enables, disables, and deletes local Windows accounts via PowerShell — running as NT AUTHORITYSYSTEM. No domain join, no Kerberos. Existing profiles and files are preserved during takeover.
The portal database is the authoritative credential store. When a password changes (admin reset, self-service, or Ctrl+Alt+Del intercepted by the agent), it is encrypted with AES-256-GCM and pushed to all bound devices. One password per person, everywhere.
Push registry-based policies to Windows workstations: startup/shutdown/logon/logoff scripts, Windows Update schedules (WSUS, restart, approval), BitLocker key escrow, and password change restrictions. Compliance evaluated every 60 seconds.
Userspace WireGuard tunnel (wireguard-go + gVisor netstack) — no kernel TUN, no admin privileges. Always-on VPN carries DNS filtering and future network security services. Persists across restarts via agent.env. Terminates on OPNsense.
Per-client DNS filtering via Blocky. Block ad, malware, and social media categories. Custom block/allow lists. Full query logging to Postgres with source IP → client resolution. Enforced at the network level — not bypassable by end users.
When a user logs in from a compliant, bound TCA device, MFA is automatically skipped. The agent bridges MFA approval/denial from the Windows system tray to the portal. Trust is revoked when a device transitions to non-compliant.
Lock workstations, sign users out everywhere, or disable accounts remotely. Commands delivered via heartbeat response (lock_workstation, disable_user) and WebSocket session control channel (lock_now, sign_out_everywhere). Browser, mobile, and Windows all respond.
FCM data-only pushes handle session_terminated, account_disabled, and remote_lock on Capacitor mobile apps and installed PWAs. Auth state is cleared, offline credentials are wiped, and the user is redirected to login — immediately.
Newly enrolled devices enter a review queue pending admin approval. The agent polls enrollment status every 60 seconds and displays “Pending Admin Approval” in the system tray. Admins can approve, reject, or escalate from the IAM Console.
Registry watchdog flags detect tampering attempts. The system tray displays agent status. Uninstall requires a verification code from the portal or the local bridge — preventing users from removing the agent to bypass policies.
ACME DNS-01 certificates issued per-device via Cloudflare DNS. The agent serves HTTPS over its WireGuard IP. Certificates are renewed automatically via a daily River schedule. Per-client hostnames derived from the client’s totalhub subdomain.
The agent monitors Windows lock/unlock events (WTSRegisterSessionNotification) and user activity (GetLastInputInfo). When the OS locks, the portal session locks. When the user is active, the portal session stays alive — no premature logouts.
Client-specific identity, one password per person, and device trust — the foundation of a cloud directory without the directory server.
Each user gets a client-specific identity email on the client's managed subdomain (e.g., [email protected]). One user can belong to multiple clients with separate local accounts on each client's devices — same password, different usernames.
The portal password is the password for: Windows logon (local account on every bound device), Total Access portal, VPN, Wi-Fi (RADIUS), SaaS SSO (SAML IdP), and email. Change it once, it changes everywhere.
Trusted browser, trusted native mobile, and TCA device trust form a three-tier MFA skip hierarchy. Mobile trust is durable in mobile_sessions.device_trust_level — surviving app reinstalls, revoked on sign-out-everywhere.
If a local Windows account with the same username exists, the agent takes it over by setting the password — preserving the user's profile, files, and settings. The user doesn't notice anything changed except their password now matches the portal.
Passwords are encrypted with AES-256-GCM using a device-specific key derived via HKDF-SHA256 from the device API key. The master encryption key is stored in the Secret Manager. The agent decrypts locally before PowerShell execution.
A Total Connect credential provider adds a sign-in tile to the Windows logon screen. The portal verifies the password as a verifier — never storing a reversible copy — while each account gets a random device-held machine credential protected by DPAPI and locked to SYSTEM.
Approve a Windows logon from a phone instead of typing a password. Policy-configured modes: tap-to-approve, biometric unlock verified by Play Integrity or App Attest attestation, or full face verification on an enrolled install. The tile shows a QR code and polls until the phone approves or denies.
After each successful online sign-in the agent caches a PBKDF2 verifier protected by DPAPI. If the portal is unreachable, users still log on — but explicit denials never fall back, so a revoked or unbound user stays locked out.
Users request temporary administrator elevation from their device page; admins approve, reject, or revoke from the IAM Console with a full audit trail. A managed break-glass admin credential is held on-device and revealed only to admins.
FreeRADIUS authenticates against the portal REST API — for VPN, Wi-Fi, and 802.1X without AD. Managed from the Security Hub in the IAM Console; the portal database is the auth source, not AD NT hashes.
SAML IdP and OIDC provider backed by the portal database. Federate to SaaS applications with the same identity used for Windows logon. No AD, no ADFS, no Azure AD Connect.
The agent adds a BitLocker recovery protector, captures the 48-digit recovery key, and reports it via heartbeat. Keys are stored in the devices table — recoverable by admins when users forget their PIN or hardware changes.
Every action — device enrollment, user binding, password sync, policy change, session lock, sign-out, account disable — is audit logged with user, timestamp, and context. Exportable for POPIA compliance and security reviews.
Remote commands, consent-gated remote support, update management, and a live inventory of hardware, software, and security posture — the RMM capabilities other platforms charge extra for.
Technicians view the screen and take full mouse and keyboard control over an encrypted LiveKit session — gated by an on-device consent dialog and a 30-minute session TTL. Users without the agent can share their screen view-only from the browser. Every session is audit logged end-to-end.
Run scripts as SYSTEM on any enrolled device and read back stdout/stderr within seconds — or queue one-click reboot, shutdown, and maintenance actions from the device page. Offline devices pick commands up on their next check-in.
A fleet-wide OS Updates view fans every pending update out across devices — per-update and per-device views, severity badges, and pending-reboot tracking. Deploy everything or approve specific KBs to specific devices; devices rescan on demand or every ~2 hours.
Every heartbeat ships a system snapshot: OS build, hardware, disks, installed software, hotfixes, local accounts, BitLocker volume state, and pending updates — plus deep Microsoft Defender health (signatures, real-time protection, exclusions, tamper state).
Group devices and target policies at client, group, or individual-device scope — device overrides group, group overrides client-wide. The same groups can drive BitLocker scope, RMM visibility, and patching rings.
Optionally disable every unmanaged local admin account on enrolled devices — closing the personal-admin backdoor that bypasses portal authentication. Self-gating per device, fully reversible, with allowlist and break-glass exceptions.
The agent syncs a per-user folder to cloud storage over an offline BoltDB outbox — files changed offline upload on reconnect. Sync state is visible per device in the IAM Console.
Every Capacitor app, installed PWA, and browser profile registers as a managed install with a durable identity that survives reinstall. Wipe your organisation's data from a single install — on termination, reassignment, or loss — without touching other clients or devices.
Removing access unbinds the device, disables the local Windows account, locks the workstation, purges synced files, and clears that client's cached data on every mobile install — one action, delivered over push, WebSocket, and heartbeat for defence in depth.
Agents check in every 60 seconds over an authenticated heartbeat — carrying commands down and compliance, inventory, and sync results up. Last-seen and WireGuard handshake staleness are surfaced per device.
Assign the location policy and the agent fixes OS coordinates on an interval. Draw circle geofences on a map and get SIEM alerts when a device enters or leaves — plus a last-known-fix view across the fleet. An office-gateway UDP beacon also tells the platform when a device is physically on-premises.
Mint a named enrollment configuration — expiry, max uses, auto-approval, target device group — and download ready-made deploy scripts for GPO startup scripts, PDQ Deploy, SCCM, Intune, Jamf, or any RMM. Watch the rollout counter climb as devices land.
Fan a named action or a PowerShell script out to every enrolled device, a device group, or a hand-picked set — one click, per-device result history. Offline devices pick the command up on their next check-in.
Grant IT staff module roles — IT Administrator, IT Support, or Viewer — without handing over owner access. Delegated admins manage users, devices, policies, and deployments, but can never disable or lock the owner tier.
The agent self-updates from a signed manifest — minisign-verified releases on the update channel, with logon-screen components staged for the next boot. No manual patching of the management layer itself.
The OS already ships a world-class engine — Microsoft Defender, XProtect, and the platform AVs. Total Cloud Directory turns that into a managed security surface: posture drives compliance, telemetry streams to the SIEM, and admins get one-click response actions.
Every heartbeat reports full Defender posture — real-time protection, signature age, tamper state, exclusions — plus any third-party AV registered with Windows. The require-antivirus policy can mark a device non-compliant the moment AV is missing or disabled, which revokes its MFA trust.
Trigger quick, full, or custom AV scans and signature updates remotely. Kill a process by PID or name. Isolate a device from the network with a single click — all outbound traffic blocked except the WireGuard management tunnel — and lift it just as easily.
Installed-software inventory is matched against OSV.dev and the NVD on a daily scan — CVE, CVSS severity, and fixed-version hints per device, a fleet severity summary, top CVEs by coverage, and a SIEM alert when a new vulnerability appears.
Each heartbeat snapshots listening ports, persistence mechanisms (Run keys, scheduled tasks, services, launchd, systemd, cron), and logged-in sessions — diffed on the server so a new persistence item or unexpected listener raises a SIEM event.
Point the agent at a .yar ruleset and a path — IOC sweeps run on demand with match results in the command history and a critical SIEM alert on any hit. The yara binary is SHA-256 pinned before it is executed.
AV disabled, stale signatures, threat detections, new persistence, new listeners, YARA matches, and geofence transitions all land as SIEM events — with tunable alert rules that can email admins on critical severity.
Total Cloud Directory does what JumpCloud and Scalefusion do — agent-based local account management, cloud directory, MFA, endpoint posture, and policy enforcement — but self-hosted on South African infrastructure, integrated with your business platform.
| Feature | Feature | Total Cloud Directory TotalAccess | JumpCloud | Active Directory |
|---|---|---|---|---|
| No domain controller required | ||||
| Agent-based local account management | ||||
| Cloud-native directory (no LDAP server) | ||||
| Windows, macOS & Linux agents | Add-on | |||
| Hard multi-tenant isolation | ||||
| Integrated business platform (CRM, finance, ops) | ||||
| Self-hosted (SA data residency) | On-prem | |||
| Pricing in Rands (no FX risk) | On-prem | |||
| DNS filtering included | Add-on | Add-on | ||
| WireGuard VPN included | Add-on | |||
| Antivirus posture → compliance enforcement | Add-on | Add-on | ||
| Device network isolation (quarantine) | ||||
| Vulnerability management (CVE scanning) | Add-on | Add-on | ||
| Patch management (per-KB fleet deploy) | Add-on | Add-on | ||
| YARA IOC scanning | ||||
| Device geofencing & location alerts | ||||
| Endpoint telemetry (ports, persistence, sessions) | Add-on | |||
| Session control (lock, sign-out everywhere) | ||||
| Phone-approved Windows sign-in (tap / biometric / face) | Add-on | |||
| Offline Windows logon (cached verifier) | ||||
| Remote support & control built in (RMM) | Add-on | Add-on | ||
| Remote PowerShell scripting | Add-on | |||
| App install management & per-client wipe | ||||
| MFA with device trust | Add-on | |||
| GPO policy enforcement | ||||
| BitLocker key escrow | Add-on | |||
| Delegated IT admin roles | ||||
| Device TLS certificates (ACME) | Add-on | |||
| Local SA support team | ||||
| No per-device licensing complexity |
For clients who contractually require Kerberos, file shares, or hard AD-level isolation, the AD Bridge addon provisions a per-client Samba4 domain controller. The portal directory remains the master — AD is a downstream consumer, not the foundation.
A dedicated Samba4 domain controller is provisioned per client — not a shared AD with OU isolation. Each client gets their own domain, their own policies, and their own Kerberos realm. The portal syncs users and passwords to the DC.
Even with the AD Bridge, the portal database remains the authoritative directory. Password changes flow portal → TCA (local account) → AD (via sync). Disable a user in the portal and it cascades to TCA and AD simultaneously.
AD Bridge is only provisioned when a client contractually requires it. Most SMBs never need it.
“We were about to buy a Windows Server license just to run Active Directory for 15 workstations. Total Cloud Directory gave us the same single-sign-on experience with zero server infrastructure. The agent just works.”
“The DNS filtering alone justified the switch. Every workstation on WireGuard, every DNS query filtered through Blocky, and full query logs in Postgres. We can see exactly what domains our staff are hitting.”
“Remote lock and sign-out-everywhere are game changers. When an employee leaves, we disable their account in the portal and their Windows account is disabled on every bound device within 60 seconds. No more chasing down workstations.”
Total Cloud Directory is a core module — free tier included, 30-day trial available. No credit card required.
One password. Every device. No Active Directory required.
Cloud directory, endpoint security, patch management, and session control — without Active Directory.
Total Cloud Directory is the agent-first identity and device-management layer of the Total Access platform. A lightweight Go agent on each workstation — Windows, macOS, or Linux — manages local accounts, enforces policies, filters DNS, reports Defender posture, streams live inventory, and patches the OS — all controlled from the portal. Users can even approve Windows sign-ins from their phone. No domain controller, no Kerberos, no AD complexity. The self-hosted JumpCloud and Scalefusion alternative built for South African businesses.
Microsoft itself told IT admins to “choose Entra ID over AD” in August 2026. AD requires a domain controller, Kerberos, DNS, certificate renewal, and a dedicated VM — all for features that most SMBs never use. There is a better way.
A domain controller VM, plus WireGuard transport, FreeRADIUS, DNS, and Kerberos infrastructure — all running 24/7 just to manage logins.
When the DC goes down, users are locked out of Windows AND the portal. A single DC is a single point of failure for your entire workforce.
AD uses Organizational Units for tenant isolation — a soft boundary. Total Cloud Directory uses hard client_id scoping in the portal database, already enforced.
“We replaced our AD domain controller with the Total Connect Agent. Same single-sign-on experience, zero DC infrastructure, and our users didn’t notice anything changed except their password now works everywhere.”
— IT Manager, Midrand logistics company
A lightweight agent on each Windows workstation connects to the portal via WireGuard, manages local accounts, enforces policies, and reports compliance — all without a domain controller.
Install the agent on Windows, macOS, or Linux — manually with a connect key, via QR code on mobile, or at fleet scale with GPO/RMM deploy scripts from a named enrollment configuration. The agent registers with the portal, establishes its WireGuard tunnel, and picks up group policies on first fetch.
An admin binds a user identity (their client-specific email account) to the device in the IAM Console. The agent creates or takes over the local Windows account and syncs the password from the portal — one password, applied everywhere.
Users log on through the Total Connect tile on the Windows sign-in screen — with their portal password, or by approving the logon on their phone: tap, biometric, or full face verification on an enrolled device. Cached verifiers keep logon working even when the device is offline.
GPO policies are pushed to the agent: Windows Update schedules, startup/shutdown scripts, BitLocker key escrow, password change restrictions, and local admin group membership. Compliance is evaluated every 60 seconds.
WireGuard routes all DNS queries through Blocky on the gateway. Per-client blocklists, category filtering (ads, malware, social media), custom allowlists, and full query logging — enforced at the network level, not bypassable.
Admins can lock workstations, sign users out everywhere, or disable accounts remotely. Commands are delivered via heartbeat response (60-second gap closed) and WebSocket session control channel — browser, mobile, and Windows all respond.
Local account management, GPO policies, DNS filtering, MFA, session control, and device trust — all in one agent-first platform.
The agent creates, takes over, sets passwords, enables, disables, and deletes local Windows accounts via PowerShell — running as NT AUTHORITYSYSTEM. No domain join, no Kerberos. Existing profiles and files are preserved during takeover.
The portal database is the authoritative credential store. When a password changes (admin reset, self-service, or Ctrl+Alt+Del intercepted by the agent), it is encrypted with AES-256-GCM and pushed to all bound devices. One password per person, everywhere.
Push registry-based policies to Windows workstations: startup/shutdown/logon/logoff scripts, Windows Update schedules (WSUS, restart, approval), BitLocker key escrow, and password change restrictions. Compliance evaluated every 60 seconds.
Userspace WireGuard tunnel (wireguard-go + gVisor netstack) — no kernel TUN, no admin privileges. Always-on VPN carries DNS filtering and future network security services. Persists across restarts via agent.env. Terminates on OPNsense.
Per-client DNS filtering via Blocky. Block ad, malware, and social media categories. Custom block/allow lists. Full query logging to Postgres with source IP → client resolution. Enforced at the network level — not bypassable by end users.
When a user logs in from a compliant, bound TCA device, MFA is automatically skipped. The agent bridges MFA approval/denial from the Windows system tray to the portal. Trust is revoked when a device transitions to non-compliant.
Lock workstations, sign users out everywhere, or disable accounts remotely. Commands delivered via heartbeat response (lock_workstation, disable_user) and WebSocket session control channel (lock_now, sign_out_everywhere). Browser, mobile, and Windows all respond.
FCM data-only pushes handle session_terminated, account_disabled, and remote_lock on Capacitor mobile apps and installed PWAs. Auth state is cleared, offline credentials are wiped, and the user is redirected to login — immediately.
Newly enrolled devices enter a review queue pending admin approval. The agent polls enrollment status every 60 seconds and displays “Pending Admin Approval” in the system tray. Admins can approve, reject, or escalate from the IAM Console.
Registry watchdog flags detect tampering attempts. The system tray displays agent status. Uninstall requires a verification code from the portal or the local bridge — preventing users from removing the agent to bypass policies.
ACME DNS-01 certificates issued per-device via Cloudflare DNS. The agent serves HTTPS over its WireGuard IP. Certificates are renewed automatically via a daily River schedule. Per-client hostnames derived from the client’s totalhub subdomain.
The agent monitors Windows lock/unlock events (WTSRegisterSessionNotification) and user activity (GetLastInputInfo). When the OS locks, the portal session locks. When the user is active, the portal session stays alive — no premature logouts.
Client-specific identity, one password per person, and device trust — the foundation of a cloud directory without the directory server.
Each user gets a client-specific identity email on the client's managed subdomain (e.g., [email protected]). One user can belong to multiple clients with separate local accounts on each client's devices — same password, different usernames.
The portal password is the password for: Windows logon (local account on every bound device), Total Access portal, VPN, Wi-Fi (RADIUS), SaaS SSO (SAML IdP), and email. Change it once, it changes everywhere.
Trusted browser, trusted native mobile, and TCA device trust form a three-tier MFA skip hierarchy. Mobile trust is durable in mobile_sessions.device_trust_level — surviving app reinstalls, revoked on sign-out-everywhere.
If a local Windows account with the same username exists, the agent takes it over by setting the password — preserving the user's profile, files, and settings. The user doesn't notice anything changed except their password now matches the portal.
Passwords are encrypted with AES-256-GCM using a device-specific key derived via HKDF-SHA256 from the device API key. The master encryption key is stored in the Secret Manager. The agent decrypts locally before PowerShell execution.
A Total Connect credential provider adds a sign-in tile to the Windows logon screen. The portal verifies the password as a verifier — never storing a reversible copy — while each account gets a random device-held machine credential protected by DPAPI and locked to SYSTEM.
Approve a Windows logon from a phone instead of typing a password. Policy-configured modes: tap-to-approve, biometric unlock verified by Play Integrity or App Attest attestation, or full face verification on an enrolled install. The tile shows a QR code and polls until the phone approves or denies.
After each successful online sign-in the agent caches a PBKDF2 verifier protected by DPAPI. If the portal is unreachable, users still log on — but explicit denials never fall back, so a revoked or unbound user stays locked out.
Users request temporary administrator elevation from their device page; admins approve, reject, or revoke from the IAM Console with a full audit trail. A managed break-glass admin credential is held on-device and revealed only to admins.
FreeRADIUS authenticates against the portal REST API — for VPN, Wi-Fi, and 802.1X without AD. Managed from the Security Hub in the IAM Console; the portal database is the auth source, not AD NT hashes.
SAML IdP and OIDC provider backed by the portal database. Federate to SaaS applications with the same identity used for Windows logon. No AD, no ADFS, no Azure AD Connect.
The agent adds a BitLocker recovery protector, captures the 48-digit recovery key, and reports it via heartbeat. Keys are stored in the devices table — recoverable by admins when users forget their PIN or hardware changes.
Every action — device enrollment, user binding, password sync, policy change, session lock, sign-out, account disable — is audit logged with user, timestamp, and context. Exportable for POPIA compliance and security reviews.
Remote commands, consent-gated remote support, update management, and a live inventory of hardware, software, and security posture — the RMM capabilities other platforms charge extra for.
Technicians view the screen and take full mouse and keyboard control over an encrypted LiveKit session — gated by an on-device consent dialog and a 30-minute session TTL. Users without the agent can share their screen view-only from the browser. Every session is audit logged end-to-end.
Run scripts as SYSTEM on any enrolled device and read back stdout/stderr within seconds — or queue one-click reboot, shutdown, and maintenance actions from the device page. Offline devices pick commands up on their next check-in.
A fleet-wide OS Updates view fans every pending update out across devices — per-update and per-device views, severity badges, and pending-reboot tracking. Deploy everything or approve specific KBs to specific devices; devices rescan on demand or every ~2 hours.
Every heartbeat ships a system snapshot: OS build, hardware, disks, installed software, hotfixes, local accounts, BitLocker volume state, and pending updates — plus deep Microsoft Defender health (signatures, real-time protection, exclusions, tamper state).
Group devices and target policies at client, group, or individual-device scope — device overrides group, group overrides client-wide. The same groups can drive BitLocker scope, RMM visibility, and patching rings.
Optionally disable every unmanaged local admin account on enrolled devices — closing the personal-admin backdoor that bypasses portal authentication. Self-gating per device, fully reversible, with allowlist and break-glass exceptions.
The agent syncs a per-user folder to cloud storage over an offline BoltDB outbox — files changed offline upload on reconnect. Sync state is visible per device in the IAM Console.
Every Capacitor app, installed PWA, and browser profile registers as a managed install with a durable identity that survives reinstall. Wipe your organisation's data from a single install — on termination, reassignment, or loss — without touching other clients or devices.
Removing access unbinds the device, disables the local Windows account, locks the workstation, purges synced files, and clears that client's cached data on every mobile install — one action, delivered over push, WebSocket, and heartbeat for defence in depth.
Agents check in every 60 seconds over an authenticated heartbeat — carrying commands down and compliance, inventory, and sync results up. Last-seen and WireGuard handshake staleness are surfaced per device.
Assign the location policy and the agent fixes OS coordinates on an interval. Draw circle geofences on a map and get SIEM alerts when a device enters or leaves — plus a last-known-fix view across the fleet. An office-gateway UDP beacon also tells the platform when a device is physically on-premises.
Mint a named enrollment configuration — expiry, max uses, auto-approval, target device group — and download ready-made deploy scripts for GPO startup scripts, PDQ Deploy, SCCM, Intune, Jamf, or any RMM. Watch the rollout counter climb as devices land.
Fan a named action or a PowerShell script out to every enrolled device, a device group, or a hand-picked set — one click, per-device result history. Offline devices pick the command up on their next check-in.
Grant IT staff module roles — IT Administrator, IT Support, or Viewer — without handing over owner access. Delegated admins manage users, devices, policies, and deployments, but can never disable or lock the owner tier.
The agent self-updates from a signed manifest — minisign-verified releases on the update channel, with logon-screen components staged for the next boot. No manual patching of the management layer itself.
The OS already ships a world-class engine — Microsoft Defender, XProtect, and the platform AVs. Total Cloud Directory turns that into a managed security surface: posture drives compliance, telemetry streams to the SIEM, and admins get one-click response actions.
Every heartbeat reports full Defender posture — real-time protection, signature age, tamper state, exclusions — plus any third-party AV registered with Windows. The require-antivirus policy can mark a device non-compliant the moment AV is missing or disabled, which revokes its MFA trust.
Trigger quick, full, or custom AV scans and signature updates remotely. Kill a process by PID or name. Isolate a device from the network with a single click — all outbound traffic blocked except the WireGuard management tunnel — and lift it just as easily.
Installed-software inventory is matched against OSV.dev and the NVD on a daily scan — CVE, CVSS severity, and fixed-version hints per device, a fleet severity summary, top CVEs by coverage, and a SIEM alert when a new vulnerability appears.
Each heartbeat snapshots listening ports, persistence mechanisms (Run keys, scheduled tasks, services, launchd, systemd, cron), and logged-in sessions — diffed on the server so a new persistence item or unexpected listener raises a SIEM event.
Point the agent at a .yar ruleset and a path — IOC sweeps run on demand with match results in the command history and a critical SIEM alert on any hit. The yara binary is SHA-256 pinned before it is executed.
AV disabled, stale signatures, threat detections, new persistence, new listeners, YARA matches, and geofence transitions all land as SIEM events — with tunable alert rules that can email admins on critical severity.
Total Cloud Directory does what JumpCloud and Scalefusion do — agent-based local account management, cloud directory, MFA, endpoint posture, and policy enforcement — but self-hosted on South African infrastructure, integrated with your business platform.
| Feature | Feature | Total Cloud Directory TotalAccess | JumpCloud | Active Directory |
|---|---|---|---|---|
| No domain controller required | ||||
| Agent-based local account management | ||||
| Cloud-native directory (no LDAP server) | ||||
| Windows, macOS & Linux agents | Add-on | |||
| Hard multi-tenant isolation | ||||
| Integrated business platform (CRM, finance, ops) | ||||
| Self-hosted (SA data residency) | On-prem | |||
| Pricing in Rands (no FX risk) | On-prem | |||
| DNS filtering included | Add-on | Add-on | ||
| WireGuard VPN included | Add-on | |||
| Antivirus posture → compliance enforcement | Add-on | Add-on | ||
| Device network isolation (quarantine) | ||||
| Vulnerability management (CVE scanning) | Add-on | Add-on | ||
| Patch management (per-KB fleet deploy) | Add-on | Add-on | ||
| YARA IOC scanning | ||||
| Device geofencing & location alerts | ||||
| Endpoint telemetry (ports, persistence, sessions) | Add-on | |||
| Session control (lock, sign-out everywhere) | ||||
| Phone-approved Windows sign-in (tap / biometric / face) | Add-on | |||
| Offline Windows logon (cached verifier) | ||||
| Remote support & control built in (RMM) | Add-on | Add-on | ||
| Remote PowerShell scripting | Add-on | |||
| App install management & per-client wipe | ||||
| MFA with device trust | Add-on | |||
| GPO policy enforcement | ||||
| BitLocker key escrow | Add-on | |||
| Delegated IT admin roles | ||||
| Device TLS certificates (ACME) | Add-on | |||
| Local SA support team | ||||
| No per-device licensing complexity |
For clients who contractually require Kerberos, file shares, or hard AD-level isolation, the AD Bridge addon provisions a per-client Samba4 domain controller. The portal directory remains the master — AD is a downstream consumer, not the foundation.
A dedicated Samba4 domain controller is provisioned per client — not a shared AD with OU isolation. Each client gets their own domain, their own policies, and their own Kerberos realm. The portal syncs users and passwords to the DC.
Even with the AD Bridge, the portal database remains the authoritative directory. Password changes flow portal → TCA (local account) → AD (via sync). Disable a user in the portal and it cascades to TCA and AD simultaneously.
AD Bridge is only provisioned when a client contractually requires it. Most SMBs never need it.
“We were about to buy a Windows Server license just to run Active Directory for 15 workstations. Total Cloud Directory gave us the same single-sign-on experience with zero server infrastructure. The agent just works.”
“The DNS filtering alone justified the switch. Every workstation on WireGuard, every DNS query filtered through Blocky, and full query logs in Postgres. We can see exactly what domains our staff are hitting.”
“Remote lock and sign-out-everywhere are game changers. When an employee leaves, we disable their account in the portal and their Windows account is disabled on every bound device within 60 seconds. No more chasing down workstations.”
Total Cloud Directory is a core module — free tier included, 30-day trial available. No credit card required.