For IT departments and service providers that operate heterogeneous infrastructures spread across multiple sites and want to bring operations, documentation, and compliance together in one place.

The COD combines its own solutions with integrations. Capabilities such as NAC, backup, OTP, GRC, or virtual switch management are delivered as standalone, vendor-independent solutions. Existing third-party systems — such as directory services, monitoring, your CMDB/asset management, Baramundi, or firewalls — remain in place and are connected. You keep the mechanisms you know and gain central transparency and automation.

All modules are active by default and already installed out of the box — the only exception is our optional VAS module (Vulnerability Assessment).

We include the following as standalone, vendor-independent solutions: Network Access Control (NAC), backup/disaster recovery, OTP authentication, GRC (including NIS2 support), hypervisor management (for virtual switches), as well as network documentation and visualization (L2/L3 topology) including firewall and report management.

Through integrations, we also connect existing third-party systems: directory services, monitoring, your CMDB/asset management, and Baramundi.

The COD is delivered as containers and can run on-premises or in your own environment (including Docker and Kubernetes/Helm). Your data therefore stays within your infrastructure.

Because the COD runs in your own environment, your data stays under your control. Access is governed by roles and is logged. Data is held in dedicated databases, and site-specific data is stored separately per tenant/site.

Through role-based access control (RBAC). Permissions are assigned in fine-grained detail per module, role, and site. For sign-in, existing directory services can be connected via LDAP/Active Directory, and local accounts are supported as well.

Yes. The COD is multi-tenant and multi-site capable. Data and permissions are separated per site, and users can switch between the sites they are authorized for.

The GRC module digitizes the risk matrix, asset-based risk management, and policy and threat catalogs. Combined with the central asset and dependency context, the COD supports the evidence and documentation obligations under NIS2.

The COD is multi-vendor capable. In network management, it supports Cisco, HPE, Allied Telesis, Ruijie, and MikroTik, among others. Firewalls can be managed via OPNsense, pfSense, and AIMdefense. For NAC, PacketFence can be connected as an alternative. In addition, we connect directory services (LDAP/Active Directory), monitoring, your CMDB/asset management, and Baramundi. The goal is to operate with your existing, heterogeneous infrastructure.

Security is built in from the ground up: role-based access, optional two-factor authentication (OTP), encrypted storage of sensitive data, and end-to-end audit logs. Tenants are already separated at the database level. On-premises operation keeps data and access within your environment.

All modules are included in the base price — there is no separate licensing for individual modules. Only our VAS module (Vulnerability Assessment) is optional and comes at an additional cost. For a custom quote, contact us at info@extoco.de or +49 (861) 88 00 32 00.

COD is modular: you license the modules you need. Which features belong to which module is shown above in the respective group, and the terms are listed on the Pricing page.

Yes. COD runs in your environment, and you retain full data sovereignty — a good fit for KRITIS and NIS2 requirements.

Through the REST-based bConnect interface: communication via JSON, secured over HTTPS with authentication and SSL. Inventory data is imported automatically and synchronized into your CMDB.

codPass can be run standalone today. Native integration into COD is in preparation. Browser plugins are not part of the product.

No. COD can run fully on-premises and is KRITIS-ready. Compliance data resides in a dedicated PostgreSQL database under your full control.

The GRC module works on the same assets that COD-Network detects and maintains automatically. Your risk assessment refers to the actual asset including its live status — not to an outdated list.

Entry starts at a minimum of 2 seats at €47.50 each plus a tenant fee starting at €8 (self-hosted). VAS and service packages are added as needed.

Yes — with a 36-month contract term, seats come with a 10% term discount. For very large environments (from 25,000 assets), we calculate individually.

Yes. The live demo is free and without any obligation — no sales pressure.

Any that interest you: from Network & Assets to NAC, firewall & VPN, GRC, and monitoring, all the way to vulnerability management and backup. You set the focus.

No. Per-firewall throttling prevents repeated alerts about the same issue, and you schedule planned maintenance centrally in the calendar, so monitoring does not trigger without reason.

Monitoring is built directly into COD as a module and uses the same data as your network inventory. Existing systems such as Zabbix can be connected through Connect integrations.

A COD-native, vendor-independent solution for Network Access Control based on RADIUS. It controls and logs network access centrally in the COD.

Usually not. COD-NAC is multi-vendor capable and works with existing 802.1X- or MAC-capable infrastructure.

802.1X (EAP, with certificates) as well as MAC authentication.

Dynamically via RADIUS attributes. Client groups with priorities let you bundle rules, and non-compliant devices can be placed in a quarantine VLAN.

Yes. The CSV bulk import handles MAC addresses, VLAN assignments, and groups, including validation and conflict detection.

From the integrated PKI: creation of CA and leaf certificates, CRL management, and PKCS#12 export for distribution to clients.

Yes. As an alternative to the integrated PKI, an existing Windows CA environment can be connected. COD reads out the existing certificates in read-only mode and manages them centrally.

Yes. PacketFence can be connected as an alternative, and existing policies are preserved.

Through authentication and accounting logs (real time and history) as well as per-client connection statistics.

It is automatically disabled and removed. Forgotten legacy accounts and permanently valid passwords are a thing of the past.

They are generated server-side according to current standards, with WPA2/3 and complexity requirements, optionally as one-time passwords. No one copies a password off a whiteboard anymore.

Any TACACS+ client per RFC 8907 — such as switches, routers, and firewalls. The solution is not vendor-specific.

Yes. Through roles (user group × device group × rule), permissions can be assigned granularly per device group.

Yes. Command authorization works on a pattern basis.

As an Argon2id hash — not reversible.

For managing users, clients, groups, and rules — separate from the actual server daemon.

Levels 1 to 15, configurable per user.

Via an enabled flag. Disabled entries are skipped during evaluation.

Allied Telesis, Cisco IOS, and Ruijie (via CLI fallback). Additional vendors can be added.

No. After the initial rollout, credentials are stored encrypted in the vault and reused.

A backup of the current configuration is created automatically. A restore to an earlier state is possible.

Yes, via profiles (PORT, AUTH, VLAN) directly from the COD.

Yes. Legacy algorithms (host key, key exchange, cipher) are supported, and paramiko is used when needed.

No. Only the individual interface is reset (shutdown/no shutdown), and the device stays in operation.

There is no lock. Requests are processed sequentially, and parallel manual CLI changes should be avoided in the meantime.

Findings are broken down by severity and presented so you immediately see where urgent action is needed — you work on the risk, not on the length of the list.

Yes. The vulnerability module is part of the modular COD platform, multi-tenant capable and fully operable on-premises — KRITIS-ready, with full data control.

It manages time-based one-time passwords (TOTP) centrally — for multi-factor authentication, without credentials having to be shared among users.

Yes. It generates standard otpauth:// codes and works with any RFC 6238-compatible app.

Yes. Tokens can be shared across a team via groups, while private tokens remain bound to individual users.

Six one-time backup codes per user are available for sign-in.

Private tokens only the respective owner. Public or group tokens are visible to the members of the group as well as administrators.

Yes. All tokens and groups are isolated per site.

Through the COD's role-based access control and site isolation. Storage is in the secured database.

For multi-factor sign-in and securing the password reset.

No. codPass currently does not offer browser plugins. Managing passwords, secrets, and OTP happens directly in the application.

Because openness builds trust: the source code and the security mechanisms are transparent and verifiable. For a secrets manager, that is a security and quality feature, not an afterthought.

• Type: Zero-knowledge vault for passwords and secrets (end-to-end encrypted)
• Principle: The server stores only ciphertext. Plaintext, the master password, and private keys never reside on the server.
• Vaults: one personal vault per user, plus shared team vaults (roles: OWNER/MEMBER)
• Sharing: individual entries across users, with READ/WRITE permission and expiration date
• Recovery: one-time recovery code at setup
• Crypto: Argon2id (key derivation), X25519 sealed box (key wrapping), AES-GCM (entries), HKDF
• Sign-in: JWT (ES384) via the COD login, verified through JWKS
• Operation: PostgreSQL; reachable only through the COD proxy; rate limiting; tamper-proof audit log (HMAC chain)

No. The server holds only encrypted data. Without your master password — which exists only on the client side — that data is worthless even in a full database dump.

At setup you receive a one-time recovery code. It lets you restore access to your key and set a new master password.

Yes — either through a shared vault or by sharing individual entries (with permission and expiration date). Both are public-key encrypted.

The vault key is reissued for the remaining members, and the removed member loses access to future content.

No. The vault name is encrypted, and only the icon is stored in plaintext.

The recovery code restores access to your key (e.g., after a forgotten master password). The COD's regular backup protects against server-side data loss.

Through the COD login (JWT, ES384; verified via JWKS). The vault is reachable exclusively through the COD proxy.

Configurations of all devices reachable via SSH as well as MariaDB/MySQL databases. The solution is vendor-independent and extensible via OS templates.

Freely configurable via cron — per host or per template, e.g., hourly, daily, or weekly.

Optionally. AES-256-CBC can be enabled per host or template.

Configurable by count or age in days. Once the limit is reached, the oldest states are deleted automatically.

Yes. A diff view shows the changes between two versions line by line.

You receive an email alert with error details, and the host is flagged with ERROR status.

Yes. Optionally, backups are mirrored to an SCP server, including retention rules.

Yes, through a jump-host tunnel.

Backups can be downloaded through the interface. Restoring to the device is done manually with the usual tools.

Virtual switches and port groups on VMware. It deliberately does not control the lifecycle of VMs or hosts.

VMware vCenter and ESXi (via the VMware API pyVmomi). Other platforms such as Hyper-V or KVM are not supported.

Yes. Each port group is assigned a VLAN ID (0–4094).

Yes. All modifying calls support a dry-run mode that simulates changes without making them.

Yes. Active/standby/unused NICs as well as load balancing can be read and configured.

With vCenter credentials (host, user, password) in each call.

Yes. Operations accept a host list, and the result reports success or failure per host.

It provides the complete vCenter object tree as read access — for example, for dashboard views or documentation.