Keeper for UK schools

Who else knows the office login?

Every school has passwords living in a spreadsheet, on a card inside a drawer, or in one person’s head. Keeper gives them somewhere to live that survives a leaver, an audit, and a bad Tuesday.

Ceidwad supplies it, helps you work out who actually needs what, and sets it up so the answer to the question above stops being “I’m not sure”.

Keeper

The passwords nobody owns

The office mailbox

Four people can open it, and none of them changed the password when the fifth one left. Nobody is quite sure who the fifth one was.

The MIS admin account

Shared once, for reports, in a week when somebody was off. It is still shared, and the audit trail says one name for three people.

The password on a poster

It had to live somewhere everyone could find it, and a laminated card by the printer was the only place that worked.

The contractor's login

Set up when the cameras went in, by a company that may not still hold the contract. It has never been used by anybody at the school.

None of this is negligence. It is what happens when a school runs more systems than it has people to run them, and has never been given an agreed place to put a password.

What Keeper actually is

Enterprise Password Management
The vault. Passwords, files and the notes that go with them, shared by role rather than by telling somebody in a corridor.
KeeperPAM
Privileged access: elevation granted when it is needed, sessions recorded, and an audit trail for the accounts that can change everything.
Endpoint Privilege Manager
Local administrator rights handed out for a task and taken back afterwards, instead of granted permanently to whoever asked first.
Secrets Manager
API keys and application credentials kept out of scripts, spreadsheets and configuration files.
Remote Browser Isolation
Risky web sessions run away from the device, so what happens in the browser stays in the browser.

Product names are Keeper’s own. A school buys some of these and not others; most start with the vault and add privileged access when they are ready.

Two ways to hold an admin account

The account that can change everything is the one nobody should hold permanently. KeeperPAM hands it over for the job in front of somebody, records what happened, and takes it back afterwards — which is the difference between an audit trail and a shrug.

TODAYThe account nobody closedgranted once — still openWITH KEEPERPAMAccess that closes itselfAsked forGrantedRecordedClosedopen for as long as the job takes, and no longer

Where this meets the DfE standards

The DfE’s digital and technology standards expect a school to control privileged accounts and to know who holds access to what.

What Keeper says about itself

Keeper publishes a zero-knowledge architecture — their claim that they cannot read what you store — and states certification against FedRAMP High, ISO 27001, 27017 and 27018, SOC 2, FIPS 140-3 and PCI DSS Level 1.

Those are Keeper’s published claims about Keeper, quoted so you can check them at source. Ceidwad has not audited any of them, and shows no certification marks — ours or theirs.

Ceidwad
Accreditations
Police CyberAlarm member
Partners
UbiquitiHeimdalRedstorKeeper