Service desk
Tickets arrive from your Microsoft 365 mailbox. Reply from the hub, organise with categories, and assign technicians.
Keepstone with Remoat
The stronghold for your IT.
Service desk, devices, toner, custody and secure remote desktop in one hub, deployed just for your company.
- Single-tenant by design
- Approval-gated remote access
- Every action audited
- Built for Microsoft 365 & Active Directory
Platform
Everything IT runs on, in one keep.
Devices & fleet
Device inventory from Entra and Active Directory, endpoint agents, and installed software per machine.
Toner & printers
Scan barcodes to book toner in and out, see stock by site, and draft reorder emails when levels run low.
Device custody
Sign-out sheets with e-signature and PDF records, so you always know who holds which device.
Analytics
Reports and exports on tickets and your fleet, ready for the next review.
Admin & permissions
Roles and per-user permissions keep each technician to the parts of the hub they need.
Remoat
Remote access, with a moat.
Remoat is the moat around your keep: the only way in from outside is approved, short-lived and audited.
Approval before access
Agents enroll with expiring tokens, then wait. A head admin must approve each PC before it can be connected to.
Browser RDP through your gateway
Sessions run in the browser via a gateway on your own network, or open a .rdp file on the LAN or VPN.
Remote Assist with consent
See or control a user's live screen only after they click Allow. They see who is connected, a red border, and can end it any time.
Short-lived, encrypted tokens
Connection tokens use AES-256-GCM, last 60 seconds and work once. Windows passwords never touch Keepstone.
MFA on privileged actions
Connecting needs a recent second factor and a dedicated permission: one for remote desktop, a separate one for Remote Assist.
Alerts and a full audit trail
Tamper, stopped agents and rejected connections raise alerts. Approvals, sessions, Remote Assist requests and downloads are logged: who, what, when and from where.
The agent is a signed installer you deploy by Group Policy, with separate test and production channels. It reports inventory and cannot run commands on your PCs. The only thing Keepstone can ask it to do is show the signed-in user a Remote Assist prompt; whether that is allowed, and which gateway a screen may go to, are set on the PC by your Group Policy.
Security
Your keep. Nobody else's.
Keepstone is never a shared multi-tenant service. Your company gets its own deployment, so there is no neighbour's data to leak into yours.
- Your own database
- Your own sign-in
- Your own keys
- Your own gateway
- MFA through Clerk
- Least-privilege permissions
How it works
From first call to go-live.
- 01
Consultation
Tell us about your team, your devices and what you want to retire. We scope a fit and quote it.
- 02
We stand up your private Keepstone
Your own deployment, database, sign-in, keys and gateway, connected to your Microsoft 365.
- 03
Roll out agents and go live
Deploy the signed Remoat installer by Group Policy, approve your PCs, and your team starts working.
FAQ
Questions, answered.
Who is Keepstone for?
Internal IT teams at growing businesses that run on Microsoft 365 and Active Directory and want one tool for tickets, devices, assets and remote access instead of several.
Is it hosted per company?
Yes. Every customer gets its own single-tenant deployment with its own database, sign-in, keys and remote-access gateway. Data never mixes between customers.
Does it replace tools like ManageEngine?
For many teams it covers the day-to-day: service desk, inventory, toner, custody and remote access. During the consultation we will tell you honestly where it fits and where an existing tool should stay.
What does remote access need on-premises?
Remoat uses a small hardened gateway on your network, plus the signed agent on each PC. PCs only make outbound connections and never open a port for Remote Assist, and RDP is reachable only from the gateway and your internal network.
How does pricing work?
Pricing is quoted per company after a consultation, based on your size and the modules you need.
How do migration and onboarding work?
We set up your deployment, connect your mailbox and directory, and help you roll out the agents by Group Policy. Your devices appear from your directory, so there is little to retype.
Book a consultation
Let's see if Keepstone fits.
Tell us a little about your team. We'll reply within one business day.