One agent instead of
sixteen separate tools.
1Key brings passwordless sign-in, web filtering, device management and remote support into one agent — across Windows, macOS, Linux and ChromeOS, managed from one console and priced as one product.
Set up in minutes · No credit card · Your own workspace at yourname.1key.tech
Every computer, in one place
Windows, Macs and Chromebooks side by side — each one reporting live, from one screen.
Computers
5 onlineAn illustration of the console. Your real one fills in as you add computers.
Three parts, one install
They divide by when they run, which is the easiest way to keep them straight.
Guard
The service that runs all the time. Inventory, patching, software deployment, posture and health monitoring, plus remote support when someone needs help.
Always runningGate
Sign-in itself. Replaces the Windows and macOS login screen with passwordless multi-factor — a phone tap, a passkey, a code — before anyone reaches the desktop.
Before they get inGuardian
After sign-in. Keeps a session honest: re-checks who is there, locks on the conditions you set, and hands control back when the right person returns.
After they log inA sign-in without a password
The login screen waits. A tap on the phone — a passkey, a face, a code — and the desktop opens.
An illustration of Gate, the sign-in step. No password is ever typed or stored.
And the real thing
A Windows sign-in through Gate, recorded as it happened. The lock screen sends an approval request; the phone shows who, where, which device and when; one tap and the desktop opens. The same app holds rolling codes for every account, for when the network is down.
Push approval is one of nine ways to sign in — passkeys, QR, voice, Bluetooth proximity, ultrasonic, offline codes and picture sign-in appear as tiles on the same screen.
What runs where
One agent, four desktop operating systems — but not the same on each. Here is exactly what you get today.
| Capability | Windows | macOS | Linux | ChromeOS |
|---|---|---|---|---|
| Device managementInventory, posture, patching, software | ✓ | ✓ | ✓ | ✓ |
| Sign-in MFABefore the desktop | ✓ | ✓ | SSH & sudo | — |
| Web filteringDNS and HTTPS, by category | ✓ | ✓ | — | ✓ |
| Remote supportWith a full audit trail | Full desktop | Full desktop | Terminal | Live view |
| VPN & Zero Trust accessPer-app, posture-gated | ✓ | ✓ | — | ✓ |
| Backup & immutable recoveryTo a vault you run | ✓ | — | — | — |
Windows is the most mature. Linux and macOS are newer and still filling in — we would rather tell you now than on day one.
The line items it removes
Most organisations buy these separately, from five or six vendors, and wire them together themselves.
1Key
One agent. One console. One bill.
And then we kept going
The newer half of the sixteen. All included — not one of them a separate line item.
Backup you cannot quietly delete
Files and SQL databases, captured from a volume snapshot so open files copy cleanly, encrypted on the machine before they leave it, and written to a vault you own. The vault has no delete command: a restore point can be made to live longer, never shorter — so an attacker holding your console still cannot destroy it.
Badger VaultBadger Wire
Packet capture and protocol analysis, inside the console. Capture from any machine you manage, filter it with the query syntax a packet analyst expects, colour the rows that matter, and watch a live 3D map of what is talking to what. No SPAN port, nothing extra to install.
Network analysisHardening that ships with the agent
Application allowlisting, so only approved programs run. USB storage blocked fleet-wide — enforced, not advisory. And a kernel-level network default-deny: the machine reaches only what you permit, so ransomware cannot reach its key server and an infostealer cannot ship.
Badger GuardA help desk that files its own tickets
People raise tickets, admins raise them on someone's behalf — and so do machines. When a monitor trips, it opens its own ticket with that device's posture already attached.
SupportCompliance reporting
NIST 800-53, SOC 2, PCI-DSS, CJIS and NIST CSF 2.0 — scored by domain, printable and branded, plus an evidence pack for the cyber-insurance renewal.
AuditData loss prevention
Pattern matching on the traffic already passing through the filter — card numbers and national ID numbers out of the box, plus expressions of your own.
Badger SentryPrivileged access that expires
A different local admin password on every machine, rotated, revealed only with an audit record. Plus admin and SSH rights granted just in time — and taken back on their own.
LAPS & JITMonitors, alerting, conditional access by IP, country, time and geofence, rogue Wi-Fi detection, device posture and an event feed your own SIEM can poll are in here too — same agent, same console.
Standards & technologies
The protocols and standards 1Key speaks, so you can check it against what you already run.
Identity & access
Authentication
Endpoint management
Network & Zero Trust
Data protection
Device identity & crypto
Operations & integration
Compliance mapping
Compliance means 1Key maps its controls to these frameworks and produces the evidence an auditor asks for. It is not a certification, and we do not claim to hold one.
Built for people who run everything
Small teams responsible for a lot of devices, and the providers who look after them.
Schools & districts
One person often covers identity, filtering, devices and the help desk. 1Key puts those in one place, with the classroom in mind.
- Cub Key — a five-year-old signs in by tapping their picture. No password, and no biometric taken: the strong factor is the teacher's own approval.
- Live classroom console: see the room, help a student, approve a sign-in from anywhere
- Classrooms, rosters and attendance — on a floor plan showing where each machine sits
- A substitute gets a QR code to that room, not a shared password
- Chromebooks, Windows and Macs managed side by side
- Filtering by category, per group or per site
IT providers & MSPs
Manage every client from one console, each with their own workspace, branding and web address — and switch between them without signing out.
- One health view across every organisation you manage
- Each client stays fully separated — data never mixes
- Clients keep their own address and branding
- Add a client that already signed up, with their permission
From here to a managed computer
The whole path, start to finish.
Create your workspace
Name, email, and the address you want. You get yourname.1key.tech — yours, with your logo and colours.
Add your first computer
Download your installer and run it. The machine appears in your console within a minute, reporting live.
Turn on what you need
Sign-in, filtering, monitoring — switched on when you are ready, not all at once on day one.
Start with one computer
Create a workspace, install the agent, and see it reporting. If it is not obviously better than what you have, you have lost ten minutes.
Create your workspace