Preparing for first start
Setting up storage and offline tools. This can take a bit longer after installing the app or clearing app data.
One Platform. Complete Control.
Powered byTotal Access Platform
Preparing for first start
Setting up storage and offline tools. This can take a bit longer after installing the app or clearing app data.
One Platform. Complete Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
Loading products
Finding the right tools for your business
Total Solutions. Total Control.
One password. Every device. No Active Directory required.
Cloud directory, device management, DNS filtering, and session control — without Active Directory.
Cloud Directory is the agent-first identity layer for Total Connect. A lightweight Go agent on each Windows workstation manages local accounts, enforces GPO policies, filters DNS traffic, and bridges MFA — all controlled from the portal. No domain controller, no Kerberos, no AD complexity. The self-hosted JumpCloud alternative built for South African businesses.
Microsoft itself told IT admins to “choose Entra ID over AD” in August 2026. AD requires a domain controller, Kerberos, DNS, certificate renewal, and a dedicated VM — all for features that most SMBs never use. There is a better way.
A domain controller VM, plus WireGuard transport, FreeRADIUS, DNS, and Kerberos infrastructure — all running 24/7 just to manage logins.
When the DC goes down, users are locked out of Windows AND the portal. A single DC is a single point of failure for your entire workforce.
AD uses Organizational Units for tenant isolation — a soft boundary. Cloud Directory uses hard client_id scoping in the portal database, already enforced.
“We replaced our AD domain controller with the Total Connect Agent. Same single-sign-on experience, zero DC infrastructure, and our users didn’t notice anything changed except their password now works everywhere.”
— IT Manager, Midrand logistics company
A lightweight agent on each Windows workstation connects to the portal via WireGuard, manages local accounts, enforces policies, and reports compliance — all without a domain controller.
Install the Total Connect Agent via NSIS installer with an enrollment token. The agent generates a WireGuard keypair, registers with the portal, and establishes a secure tunnel. No domain join, no AD credentials required.
An admin binds a user identity (their client-specific email account) to the device in the IAM Console. The agent creates or takes over the local Windows account and syncs the password from the portal — one password, applied everywhere.
GPO policies are pushed to the agent: Windows Update schedules, startup/shutdown scripts, BitLocker key escrow, password change restrictions, and local admin group membership. Compliance is evaluated every 60 seconds.
WireGuard routes all DNS queries through Blocky on the gateway. Per-client blocklists, category filtering (ads, malware, social media), custom allowlists, and full query logging — enforced at the network level, not bypassable.
Admins can lock workstations, sign users out everywhere, or disable accounts remotely. Commands are delivered via heartbeat response (60-second gap closed) and WebSocket session control channel — browser, mobile, and Windows all respond.
Local account management, GPO policies, DNS filtering, MFA, session control, and device trust — all in one agent-first platform.
The agent creates, takes over, sets passwords, enables, disables, and deletes local Windows accounts via PowerShell — running as NT AUTHORITYSYSTEM. No domain join, no Kerberos. Existing profiles and files are preserved during takeover.
The portal database is the authoritative credential store. When a password changes (admin reset, self-service, or Ctrl+Alt+Del intercepted by the agent), it is encrypted with AES-256-GCM and pushed to all bound devices. One password per person, everywhere.
Push registry-based policies to Windows workstations: startup/shutdown/logon/logoff scripts, Windows Update schedules (WSUS, restart, approval), BitLocker key escrow, and password change restrictions. Compliance evaluated every 60 seconds.
Userspace WireGuard tunnel (wireguard-go + gVisor netstack) — no kernel TUN, no admin privileges. Always-on VPN carries DNS filtering and future network security services. Persists across restarts via agent.env. Terminates on OPNsense.
Per-client DNS filtering via Blocky. Block ad, malware, and social media categories. Custom block/allow lists. Full query logging to Postgres with source IP → client resolution. Enforced at the network level — not bypassable by end users.
When a user logs in from a compliant, bound TCA device, MFA is automatically skipped. The agent bridges MFA approval/denial from the Windows system tray to the portal. Trust is revoked when a device transitions to non-compliant.
Lock workstations, sign users out everywhere, or disable accounts remotely. Commands delivered via heartbeat response (lock_workstation, disable_user) and WebSocket session control channel (lock_now, sign_out_everywhere). Browser, mobile, and Windows all respond.
FCM data-only pushes handle session_terminated, account_disabled, and remote_lock on Capacitor mobile apps and installed PWAs. Auth state is cleared, offline credentials are wiped, and the user is redirected to login — immediately.
Newly enrolled devices enter a review queue pending admin approval. The agent polls enrollment status every 60 seconds and displays “Pending Admin Approval” in the system tray. Admins can approve, reject, or escalate from the IAM Console.
Registry watchdog flags detect tampering attempts. The system tray displays agent status. Uninstall requires a verification code from the portal or the local bridge — preventing users from removing the agent to bypass policies.
ACME DNS-01 certificates issued per-device via Cloudflare DNS. The agent serves HTTPS over its WireGuard IP. Certificates are renewed automatically via a daily River schedule. Per-client hostnames derived from the client’s totalhub subdomain.
The agent monitors Windows lock/unlock events (WTSRegisterSessionNotification) and user activity (GetLastInputInfo). When the OS locks, the portal session locks. When the user is active, the portal session stays alive — no premature logouts.
Client-specific identity, one password per person, and device trust — the foundation of a cloud directory without the directory server.
Each user gets a client-specific identity email on the client's managed subdomain (e.g., [email protected]). One user can belong to multiple clients with separate local accounts on each client's devices — same password, different usernames.
The portal password is the password for: Windows logon (local account on every bound device), Total Access portal, VPN, Wi-Fi (RADIUS), SaaS SSO (SAML IdP), and email. Change it once, it changes everywhere.
Trusted browser, trusted native mobile, and TCA device trust form a three-tier MFA skip hierarchy. Mobile trust is durable in mobile_sessions.device_trust_level — surviving app reinstalls, revoked on sign-out-everywhere.
If a local Windows account with the same username exists, the agent takes it over by setting the password — preserving the user's profile, files, and settings. The user doesn't notice anything changed except their password now matches the portal.
Passwords are encrypted with AES-256-GCM using a device-specific key derived via HKDF-SHA256 from the device API key. The master encryption key is stored in the Secret Manager. The agent decrypts locally before PowerShell execution.
FreeRADIUS with rlm_rest module authenticates against the portal REST API — for VPN, Wi-Fi, and 802.1X without AD. The portal database is the auth source, not AD NT hashes.
SAML IdP and OIDC provider backed by the portal database. Federate to SaaS applications with the same identity used for Windows logon. No AD, no ADFS, no Azure AD Connect.
The agent adds a BitLocker recovery protector, captures the 48-digit recovery key, and reports it via heartbeat. Keys are stored in the devices table — recoverable by admins when users forget their PIN or hardware changes.
Every action — device enrollment, user binding, password sync, policy change, session lock, sign-out, account disable — is audit logged with user, timestamp, and context. Exportable for POPIA compliance and security reviews.
Cloud Directory does what JumpCloud does — agent-based local account management, cloud directory, MFA, and policy enforcement — but self-hosted on South African infrastructure, integrated with your business platform.
| Feature | Feature | Cloud Directory TotalAccess | JumpCloud | Active Directory |
|---|---|---|---|---|
| No domain controller required | ||||
| Agent-based local account management | ||||
| Cloud-native directory (no LDAP server) | ||||
| Hard multi-tenant isolation | ||||
| Integrated business platform (CRM, finance, ops) | ||||
| Self-hosted (SA data residency) | On-prem | |||
| Pricing in Rands (no FX risk) | On-prem | |||
| DNS filtering included | Add-on | Add-on | ||
| WireGuard VPN included | Add-on | |||
| Session control (lock, sign-out everywhere) | ||||
| MFA with device trust | Add-on | |||
| GPO policy enforcement | ||||
| BitLocker key escrow | Add-on | |||
| Device TLS certificates (ACME) | Add-on | |||
| Local SA support team | ||||
| No per-device licensing complexity |
For clients who contractually require Kerberos, file shares, or hard AD-level isolation, the AD Bridge addon provisions a per-client Samba4 domain controller. The portal directory remains the master — AD is a downstream consumer, not the foundation.
A dedicated Samba4 domain controller is provisioned per client — not a shared AD with OU isolation. Each client gets their own domain, their own policies, and their own Kerberos realm. The portal syncs users and passwords to the DC.
Even with the AD Bridge, the portal database remains the authoritative directory. Password changes flow portal → TCA (local account) → AD (via sync). Disable a user in the portal and it cascades to TCA and AD simultaneously.
AD Bridge is only provisioned when a client contractually requires it. Most SMBs never need it.
“We were about to buy a Windows Server license just to run Active Directory for 15 workstations. Cloud Directory gave us the same single-sign-on experience with zero server infrastructure. The agent just works.”
“The DNS filtering alone justified the switch. Every workstation on WireGuard, every DNS query filtered through Blocky, and full query logs in Postgres. We can see exactly what domains our staff are hitting.”
“Remote lock and sign-out-everywhere are game changers. When an employee leaves, we disable their account in the portal and their Windows account is disabled on every bound device within 60 seconds. No more chasing down workstations.”
Cloud Directory is included with Total Connect Professional and above. Start your 30-day free trial — no credit card required.
One password. Every device. No Active Directory required.
Cloud directory, device management, DNS filtering, and session control — without Active Directory.
Cloud Directory is the agent-first identity layer for Total Connect. A lightweight Go agent on each Windows workstation manages local accounts, enforces GPO policies, filters DNS traffic, and bridges MFA — all controlled from the portal. No domain controller, no Kerberos, no AD complexity. The self-hosted JumpCloud alternative built for South African businesses.
Microsoft itself told IT admins to “choose Entra ID over AD” in August 2026. AD requires a domain controller, Kerberos, DNS, certificate renewal, and a dedicated VM — all for features that most SMBs never use. There is a better way.
A domain controller VM, plus WireGuard transport, FreeRADIUS, DNS, and Kerberos infrastructure — all running 24/7 just to manage logins.
When the DC goes down, users are locked out of Windows AND the portal. A single DC is a single point of failure for your entire workforce.
AD uses Organizational Units for tenant isolation — a soft boundary. Cloud Directory uses hard client_id scoping in the portal database, already enforced.
“We replaced our AD domain controller with the Total Connect Agent. Same single-sign-on experience, zero DC infrastructure, and our users didn’t notice anything changed except their password now works everywhere.”
— IT Manager, Midrand logistics company
A lightweight agent on each Windows workstation connects to the portal via WireGuard, manages local accounts, enforces policies, and reports compliance — all without a domain controller.
Install the Total Connect Agent via NSIS installer with an enrollment token. The agent generates a WireGuard keypair, registers with the portal, and establishes a secure tunnel. No domain join, no AD credentials required.
An admin binds a user identity (their client-specific email account) to the device in the IAM Console. The agent creates or takes over the local Windows account and syncs the password from the portal — one password, applied everywhere.
GPO policies are pushed to the agent: Windows Update schedules, startup/shutdown scripts, BitLocker key escrow, password change restrictions, and local admin group membership. Compliance is evaluated every 60 seconds.
WireGuard routes all DNS queries through Blocky on the gateway. Per-client blocklists, category filtering (ads, malware, social media), custom allowlists, and full query logging — enforced at the network level, not bypassable.
Admins can lock workstations, sign users out everywhere, or disable accounts remotely. Commands are delivered via heartbeat response (60-second gap closed) and WebSocket session control channel — browser, mobile, and Windows all respond.
Local account management, GPO policies, DNS filtering, MFA, session control, and device trust — all in one agent-first platform.
The agent creates, takes over, sets passwords, enables, disables, and deletes local Windows accounts via PowerShell — running as NT AUTHORITYSYSTEM. No domain join, no Kerberos. Existing profiles and files are preserved during takeover.
The portal database is the authoritative credential store. When a password changes (admin reset, self-service, or Ctrl+Alt+Del intercepted by the agent), it is encrypted with AES-256-GCM and pushed to all bound devices. One password per person, everywhere.
Push registry-based policies to Windows workstations: startup/shutdown/logon/logoff scripts, Windows Update schedules (WSUS, restart, approval), BitLocker key escrow, and password change restrictions. Compliance evaluated every 60 seconds.
Userspace WireGuard tunnel (wireguard-go + gVisor netstack) — no kernel TUN, no admin privileges. Always-on VPN carries DNS filtering and future network security services. Persists across restarts via agent.env. Terminates on OPNsense.
Per-client DNS filtering via Blocky. Block ad, malware, and social media categories. Custom block/allow lists. Full query logging to Postgres with source IP → client resolution. Enforced at the network level — not bypassable by end users.
When a user logs in from a compliant, bound TCA device, MFA is automatically skipped. The agent bridges MFA approval/denial from the Windows system tray to the portal. Trust is revoked when a device transitions to non-compliant.
Lock workstations, sign users out everywhere, or disable accounts remotely. Commands delivered via heartbeat response (lock_workstation, disable_user) and WebSocket session control channel (lock_now, sign_out_everywhere). Browser, mobile, and Windows all respond.
FCM data-only pushes handle session_terminated, account_disabled, and remote_lock on Capacitor mobile apps and installed PWAs. Auth state is cleared, offline credentials are wiped, and the user is redirected to login — immediately.
Newly enrolled devices enter a review queue pending admin approval. The agent polls enrollment status every 60 seconds and displays “Pending Admin Approval” in the system tray. Admins can approve, reject, or escalate from the IAM Console.
Registry watchdog flags detect tampering attempts. The system tray displays agent status. Uninstall requires a verification code from the portal or the local bridge — preventing users from removing the agent to bypass policies.
ACME DNS-01 certificates issued per-device via Cloudflare DNS. The agent serves HTTPS over its WireGuard IP. Certificates are renewed automatically via a daily River schedule. Per-client hostnames derived from the client’s totalhub subdomain.
The agent monitors Windows lock/unlock events (WTSRegisterSessionNotification) and user activity (GetLastInputInfo). When the OS locks, the portal session locks. When the user is active, the portal session stays alive — no premature logouts.
Client-specific identity, one password per person, and device trust — the foundation of a cloud directory without the directory server.
Each user gets a client-specific identity email on the client's managed subdomain (e.g., [email protected]). One user can belong to multiple clients with separate local accounts on each client's devices — same password, different usernames.
The portal password is the password for: Windows logon (local account on every bound device), Total Access portal, VPN, Wi-Fi (RADIUS), SaaS SSO (SAML IdP), and email. Change it once, it changes everywhere.
Trusted browser, trusted native mobile, and TCA device trust form a three-tier MFA skip hierarchy. Mobile trust is durable in mobile_sessions.device_trust_level — surviving app reinstalls, revoked on sign-out-everywhere.
If a local Windows account with the same username exists, the agent takes it over by setting the password — preserving the user's profile, files, and settings. The user doesn't notice anything changed except their password now matches the portal.
Passwords are encrypted with AES-256-GCM using a device-specific key derived via HKDF-SHA256 from the device API key. The master encryption key is stored in the Secret Manager. The agent decrypts locally before PowerShell execution.
FreeRADIUS with rlm_rest module authenticates against the portal REST API — for VPN, Wi-Fi, and 802.1X without AD. The portal database is the auth source, not AD NT hashes.
SAML IdP and OIDC provider backed by the portal database. Federate to SaaS applications with the same identity used for Windows logon. No AD, no ADFS, no Azure AD Connect.
The agent adds a BitLocker recovery protector, captures the 48-digit recovery key, and reports it via heartbeat. Keys are stored in the devices table — recoverable by admins when users forget their PIN or hardware changes.
Every action — device enrollment, user binding, password sync, policy change, session lock, sign-out, account disable — is audit logged with user, timestamp, and context. Exportable for POPIA compliance and security reviews.
Cloud Directory does what JumpCloud does — agent-based local account management, cloud directory, MFA, and policy enforcement — but self-hosted on South African infrastructure, integrated with your business platform.
| Feature | Feature | Cloud Directory TotalAccess | JumpCloud | Active Directory |
|---|---|---|---|---|
| No domain controller required | ||||
| Agent-based local account management | ||||
| Cloud-native directory (no LDAP server) | ||||
| Hard multi-tenant isolation | ||||
| Integrated business platform (CRM, finance, ops) | ||||
| Self-hosted (SA data residency) | On-prem | |||
| Pricing in Rands (no FX risk) | On-prem | |||
| DNS filtering included | Add-on | Add-on | ||
| WireGuard VPN included | Add-on | |||
| Session control (lock, sign-out everywhere) | ||||
| MFA with device trust | Add-on | |||
| GPO policy enforcement | ||||
| BitLocker key escrow | Add-on | |||
| Device TLS certificates (ACME) | Add-on | |||
| Local SA support team | ||||
| No per-device licensing complexity |
For clients who contractually require Kerberos, file shares, or hard AD-level isolation, the AD Bridge addon provisions a per-client Samba4 domain controller. The portal directory remains the master — AD is a downstream consumer, not the foundation.
A dedicated Samba4 domain controller is provisioned per client — not a shared AD with OU isolation. Each client gets their own domain, their own policies, and their own Kerberos realm. The portal syncs users and passwords to the DC.
Even with the AD Bridge, the portal database remains the authoritative directory. Password changes flow portal → TCA (local account) → AD (via sync). Disable a user in the portal and it cascades to TCA and AD simultaneously.
AD Bridge is only provisioned when a client contractually requires it. Most SMBs never need it.
“We were about to buy a Windows Server license just to run Active Directory for 15 workstations. Cloud Directory gave us the same single-sign-on experience with zero server infrastructure. The agent just works.”
“The DNS filtering alone justified the switch. Every workstation on WireGuard, every DNS query filtered through Blocky, and full query logs in Postgres. We can see exactly what domains our staff are hitting.”
“Remote lock and sign-out-everywhere are game changers. When an employee leaves, we disable their account in the portal and their Windows account is disabled on every bound device within 60 seconds. No more chasing down workstations.”
Cloud Directory is included with Total Connect Professional and above. Start your 30-day free trial — no credit card required.