Security & admin
Enterprise controls without enterprise drag.
Granular RBAC, audit logs with diffs, SSO, 2FA, passkeys, feature gates, and quotas — multi-tenant by design.
No card · Live in minutes
Tenant
isolated by design
Every
mutation audited
Audit log · last 24h
Sound familiar
Three questions worth asking first.
Where Kestrio differs
Most PSAs treat admin as a settings screen. Kestrio enforces permissions on every route and audits every mutation.
Granting access by job title because the tool cannot be more precise?
Being asked who changed a rate last quarter, and having no answer?
Chasing password resets because SSO never got wired in?
What's included
What you get.
Access is checked, never assumed.
Permission engine on every route
Every change answers who and what.
Audit logs with computed diffs and CSV export
People sign in the way you require.
SSO/SAML, TOTP 2FA, and WebAuthn passkeys
Plans and usage stay inside their limits.
Plan feature gates and usage quotas
Controls in the box
- Granular RBAC
- Permission engine per route
- Audit logs
- Computed diffs
- CSV export
- SSO / SAML
- TOTP 2FA
- WebAuthn passkeys
- Plan feature gates
- Usage quotas
- Multi-tenant isolation
In the same layer
Keep going.
Executive summary
Margin
32%
Utilization
84%
DSO
19d
Analytics & reports
Dashboards, alerts, decision surfaces
Automations
Runs today
212
Failed
0
Timesheet submitted
Notify approver
Ticket breaches SLA
Escalate + Slack
Invoice overdue 7d
Send reminder
Automations
No-code rules and approval chains
Automations
Runs today
212
Failed
0
Timesheet submitted
Notify approver
Ticket breaches SLA
Escalate + Slack
Invoice overdue 7d
Send reminder
Approvals
One inbox across the firm
How granular is the permission model?
The permission engine runs on every route, so access is enforced per action rather than per screen.
Can I export an audit trail?
Yes. Audit logs carry computed diffs of what changed and export to CSV.
Which sign-in methods are supported?
SSO/SAML, TOTP two-factor, and WebAuthn passkeys.
Put security & admin on your ledger.
Set it up on a real engagement and see it against your own numbers. Start free, or [email protected]