Syteca Architecture

​

A few moving parts, deliberately

Most PAM/UAM platforms expose a sprawl of components: separate vault servers, password managers, web access proxies, recording engines, search indexers, reporting databases. Each component runs on its own host, with its own version, its own backup, its own failure mode. The operational surface grows fast — by mid-deployment, a typical cybersecurity installation has six to ten distinct services to maintain. Syteca takes a different approach: three main components (Application Server, Management Tool, Clients) and two optional standalone components (Master Panel for large-scale aggregation, SDK for integrations). Everything else — session recording, alert evaluation, password management, account discovery, USB monitoring, reporting, dashboards — lives inside those three main components, not as separate services. Less to install, less to update, less to back up, fewer cross-service version-compatibility issues during upgrades.

​

Main system components

​

Syteca Application Server

The Application Server is the central service every Client connects to and every Management Tool reads from. It:

• Receives monitored data (screen captures, metadata) from Syteca Clients.
• Analyzes the data in real time and generates alerts for potential security incidents.
• Stores everything in a central database (MS SQL Server or PostgreSQL — see Comparison of database types).
• Stores configuration data for the deployment.
• Sends update packages to Clients when newer versions are released.
• Performs database cleanup and creates reports with statistics.

The Application Server runs as a Windows service (EkranServer). Its operation is controlled via the Syteca Server tray icon in the Windows Notification area, which also exposes the Database Parameters (DbSetupToolUI) application for reissuing the Master Certificate, editing database parameters, and similar operations.

​

Syteca Management Tool

The Management Tool is the web-based administrative console — accessed remotely from any browser in the network without needing local installation. Through it, administrators:

• View and analyze monitored security data from Clients.
• Manage Clients, users, USB monitoring rules, alerts, and the database.
• Activate and manage serial keys and licenses.
• Access the Session Viewer to play back recorded sessions, with synchronized screen captures and metadata side by side.

​

Syteca Clients

Clients are lightweight agents installed on monitored endpoints. Three OS families are supported, each with its own configuration page: All Client configuration is performed centrally through the Management Tool — there’s no per-endpoint configuration to maintain.

​

Other system components

​

Syteca Master Panel

The Master Panel is an additional standalone component used in large-scale deployments with High Availability mode across multiple Application Server instances. It combines data from every Application Server in the deployment so administrators can view all Client sessions through a single user interface — without switching between separate Application Server consoles. For deployment details, see Master Panel changelog and the High Availability page.

​

Syteca SDK

The Syteca Software Development Kit is for developers integrating Syteca with custom information systems — Business Intelligence platforms, custom dashboards, security automation tools. The SDK consists of APIs and tools to facilitate data transfer between Syteca and external systems. For commercial integrations using documented APIs, see also the Syteca API Data Connector and the Application Credentials Broker (ACB).

​

The basic deployment scheme

Maximum visibility and control comes from installing the right Client type on every endpoint to be monitored — Windows Clients on Windows desktops and servers, macOS Clients on Macs, Linux Clients on Linux workstations and servers. All Clients connect to the same Application Server, which stores their data in the same database and serves the same Management Tool.

​

Where Clients can be deployed

A Syteca Client can run on any standard Windows, macOS, or Linux machine — but the deployment context determines what you’ll see in the Session Viewer: Across all of these, the Client captures users’ screens with mouse movements according to the recording settings, and logs metadata (application names, window titles, keystrokes, etc.) alongside the visual capture. If network connectivity to the Application Server is lost, the Client temporarily caches data in protected local storage until the connection is restored — no data is lost during transient outages. The Client can be tuned anywhere from heavy recording (screen capture every second, or per mouse click / key press) down to lightweight recording (event-based only). Protected mode can also be enabled to harden Client operation against tampering.

​

Large-scale deployment patterns

For organizations with data centers in multiple geographies, large concurrent-session counts, or strict data isolation requirements, three deployment patterns combine to scale Syteca beyond a single-Application-Server topology: For the supported VDI platforms and the floating-licensing model that makes VDI cost-effective, see VDI monitoring.

​

Related