Platform & Company Statement

Suggested one-line pitch: Hybrid identity governance for AD and Entra ID — access reviews that actually revoke access, day-2 identity operations, and governance your auditors can evidence.

• Govern every identity. Prove every access.
• Hybrid IAM for AD & Entra — reviews, requests, and operations in one console.
• Identity governance that closes the loop — from request to revoke.

Rivitan is not only a software vendor. The website and commercial model present three offerings.

A. Rivitan Platform (software) — Customer-deployed IAM/IGA application. Runs in the customer's environment (on-prem VM, customer VPC, or dedicated pilot host). Not a multi-tenant public SaaS where customer directory data sits next to other tenants' data.

B. Identity Advisory (consulting) — Senior-led engagements: Entra/hybrid migration, AD health and architecture, directory cleanup, IAM governance design, privileged access, fractional identity leadership.

C. Custom IAM Tools (professional services) — Custom portals, approval flows, HR/ITSM/Secret Server integrations, PowerShell/Graph automation, and workflows that extend Rivitan Platform or ship standalone — source-controlled and customer-owned.

The public site at rivitan.com markets:

• Rivitan Platform — ten portals interactive previews (IAM Console, Group Portal, App Access, Identity Analysis, AWS IAM, File Governance, Reporting, Licenses, Infrastructure, App Owner).
• Zero Trust narrative — identity-in-motion storytelling (Entra, Conditional Access, MFA, least privilege). Positioning and advisory design language, not a full ZTNA product.
• Rivitan AI — marketed as portal-aware, role-scoped, audited AI assistant. Important: legacy AI assistant code was retired from the platform codebase; treat as roadmap unless a separate AI build is verified live.
• Advisory services — migration, AD health, cleanup, governance, PowerShell automation.
• Custom IAM tools — bespoke portals and integrations.
• Knowledge base — articles on Entra, AD, governance, automation.
• Free self-assessment — 8-question identity maturity quiz.
• CTAs — demo, custom tooling discussion, advisory consultation.

Core concept: A FastAPI monolith (~100+ registered application pages) with role-based access control, modular licensing (11 sellable modules + always-on core admin), connector framework with honest verified vs declared capability reporting, audit logging, multi-portal UX, and white-label branding.

Enterprise Integrations Hub (/connections → “Integrations”) — single control plane for all connections:

• Dashboard — health/status of connected systems
• Directories — multi-domain Active Directory
• Cloud Identity — multi-tenant Microsoft Entra ID
• Data & Vaults — databases, Secret Server, Jamf
• Connector Catalog — 30+ connector types (SaaS, vaults, HR, etc.)
• Secret Backends — Delinea, Azure Key Vault, AWS Secrets Manager, HashiCorp KV2, GCP Secret Manager, local encrypted store, 1Password Connect
• Notifications — Teams, Slack, email configuration
• Deployment Defaults — org-wide naming, attribute maps, OU paths, license groups
• Per-domain overrides — each AD domain can override deployment defaults with inherited vs overridden UI
• Inline drawers — configure AD, Entra, DB, Secret Server, Jamf without leaving the page

Module 1: Identity & User Management — User search, create, filter across multi-domain AD and Entra; account creation from templates; account mirroring (employeeID correlation); Credential Reset (AD password, Entra password, Entra TAP, multi-vault handoff, single-use reveal links, configurable complexity profiles); admin unlock and password reset (operator-facing; not end-user self-service SSPR yet).

Module 2: Group & Access Management — Group membership (AD + Entra); membership requests with multi-step approvals, SLA, escalation, delegation; group creation requests; group owners portal; group security policies; automated rules; group tags; Group Access Portal; time-bound/temporary membership support (models and scheduler exist; activation path being hardened).

Module 3: Directory Management (AD) — Organizational Units; computer/device management; domain controller management.

Module 4: File & NTFS Governance — NTFS permission lookup and editing; advanced NTFS tools; path explorer; folder security policies; NTFS audit trail; dedicated portal shell.

Module 5: Infrastructure Operations — DNS zones and records; DHCP scopes and leases; domain controller health; cross-system address lookup; IP address management; infrastructure change history; monitoring; dedicated infrastructure portal.

Module 6: Azure / Entra Services — App registrations and enterprise apps lifecycle; secret and certificate management; App Owner self-service portal; Microsoft 365 license management; dedicated licenses portal.

Module 7: AWS IAM — AWS connections (AssumeRole + External ID, Identity Center); account inventory and org multi-account view; access key hygiene; permission-set grants and reviews; SoD and evidence export; dedicated AWS IAM portal.

Module 8: Access Reviews & Compliance — Entitlement review campaigns (v1 and v2 with auditor workflows); owner keep/revoke; auditor verification; dry-run preview then live apply removals; privileged-group guards; SoD toxic-combination policies; Zero Trust identity governance overlay (/zero-trust) with Entra Graph signals, grant policies, JIT inventory, posture score; evidence pack export.

Module 9: Identity Lifecycle (JML) — Joiner/Mover/Leaver automation; identity sources; lifecycle policies and cases; 18+ step types including secure PowerShell lifecycle hooks; account templates; access roles and entitlements catalog.

Module 10: Application Access — Business application catalog with owners/operators; access levels (AD, Entra, connectors, licenses, manual); self-service requests with fulfillment; auto-grant policies for joiner paths.

Module 11: Identity Analysis — On-demand hygiene scans (~40 finding categories); health score with PDF assessment report; Kerberoast, delegation, AD CS, Entra MFA/CA findings; remediation with dry-run; role discovery; dedicated analysis portal.

Module 12: Reporting & Analytics — Security, user, and operational reports; audit log search and export; user activity and session reports; group membership analytics; metrics dashboards; custom report builder.

Always-on platform administration — Role & permission management; Integrations hub; Security configuration (enforced session timeouts, lockout, concurrent sessions, UI IP allow-list, force-logout); Deployment configuration; Branding; Module enable/disable; Account reconciliation; Approval workflow designer; Task scheduler (30+ handlers); API keys; Service status; Help & documentation; Product licence management.

Connector catalog (available / varying maturity): 30+ declared types including ServiceNow, Workday, BambooHR, SuccessFactors, Google Workspace, GitHub, GitLab, Salesforce, Slack, Teams, Zoom, Duo, Intune, CrowdStrike, Datadog, Auth0, Snowflake, Jira, Confluence, PagerDuty, Box, Dropbox, AWS, Cloudflare, Zendesk, SendGrid, Twilio, 1Password Connect, Jamf, and more.

Secret manager backends for credential reset: Delinea Secret Server, Azure Key Vault, AWS Secrets Manager, HashiCorp Vault KV2, GCP Secret Manager, 1Password Connect, local Fernet-encrypted store.

• Deployed in customer environment; customer controls host, network, backups, TLS
• Entra SSO + RBAC + page registry access control
• Integration secrets encrypted at rest (ENCRYPTION_KEY)
• API keys stored hashed, expirable, RBAC-scoped
• Audit logging; optional SIEM shipping (Splunk, syslog, webhook)
• Governance removals: dry-run → privileged role → audit event
• Not a password vault for end users; service-account secrets go to customer vaults
• MFA/device trust delegated to Microsoft Entra Conditional Access + Intune

Best fit: 500–10,000 employees (mid-market sweet spot); hybrid Active Directory + Microsoft Entra ID; regulated or audit-sensitive sectors (financial services, healthcare, retail, manufacturing, higher ed, public sector, technology); pain around spreadsheet access reviews and day-2 work in ADUC/PowerShell/tickets; optional scope for NTFS, DNS/DHCP/DC ops, Secret Server service accounts.

Less ideal today: Cloud-only Okta-first estates without AD; full HRIS-driven JML on day one without integration work; buyers expecting multi-tenant SaaS with zero install; buyers needing full SailPoint-scale SaaS connector catalog on day one.

• Hybrid AD + Entra governance and operations in one product
• Access reviews that preview and apply revocations
• Enterprise integrations hub with per-domain configuration inheritance
• Identity Analysis with security findings + executive PDF report
• AWS IAM portal with same operating model as AD/Entra
• Zero Trust identity governance overlay (signals → grant policy), not network ZTNA

• Close the loop — Access reviews that end in revoked access, not signed spreadsheets.
• Hybrid Microsoft first — Built for AD + Entra estates, not cloud-only SaaS shops.
• One console, many portals — Operators, owners, app requesters, auditors each get the right view.
• Govern + operate — Not just governance; also day-2 identity, file, license, infra, and AWS work.
• Your environment, your data — Customer-controlled deployment for regulated industries.
• Prove it fast — 8–12 week pilot with one real review cycle and audit evidence.
• Identity Zero Trust — Signal-driven grant policies on top of Entra CA/MFA/Intune.
• Platform + people — Software plus advisory and custom tooling when the standard product is not enough.

Channels to consider: LinkedIn (founder-led), Microsoft partner ecosystem, IAM/audit communities, SOC 2 / ITGC buyers, regional MSPs serving regulated mid-market.

• Stack: Python 3.13, FastAPI, Uvicorn, SQLAlchemy, PostgreSQL, Jinja2 templates, vanilla JS/CSS
• Directories: ldap3 (LDAPS), multi-domain, per-domain config inheritance
• Cloud: msal + Microsoft Graph (multi-tenant Azure integrations)
• Vaults: REST/SDK integrations to major secret managers
• Background work: PostgreSQL-backed scheduler + optional python -m worker process
• Testing: pytest unit tests + GitHub Actions CI (growing coverage)
• Install: Unattended installer + Windows service option
• API: REST throughout; API keys for integrations