Everything below is on the free tier. Skip modules you don’t need — each is independent, but they share the same workspace, RBAC, and audit trail.

​
1. Sign in and open a workspace

1

Create an account

Visit app.tigertrust.io. Sign up with email, Google, or SSO. Your organisation lands in a fresh workspace.
2

Invite your team

Settings → Workspace → Members. Assign each member an RBAC role: workspace-tier (admin / user / accountant) plus per-module (clm_admin, pam_admin, sm_admin, nhig_admin).
3

(Optional) turn on SSO

Settings → SSO for SAML or OIDC. See SSO setup.

​
2. Certificate Lifecycle (CLM)

1

Connect a CA

CLM → Authorities → New CA. Fastest path: pick “Internal (PKI Core)” and hit Create.
2

Issue a certificate

CLM → Certificates → Issue. CN, SANs, template default.
3

Install the agent

curl -fsSL https://releases.tigertrust.io/tigertrust-agent/scripts/install.sh | sudo bash -s -- \
  --collector-url https://collector.tigertrust.io \
  --api-key ak_prod_...
Full options: Install the CLM Agent.
4

Turn on auto-renewal

CLM → Automation → Workflows → Enable “Auto-renew before expiry”.

​
3. Privileged Access Management (PAM)

1

Deploy tigeraccess-server

curl -sSf https://releases.tigertrust.io/tigertrust-pam/server | \
  TT_API_URL=https://api.tigertrust.io \
  TT_WORKSPACE_ID=wsp_xxx \
  TT_JOIN_TOKEN=jt_xxx sh
Full options: Install PAM.
2

Enroll an SSH host as a resource

Mint a join token with tash-admin tokens add --type=node, then run the returned one-liner on the host.
3

Install tash and log in

brew install tigertrust/tap/tash
tash login --proxy=pam.tigertrust.example
tash ssh alice@web-01

​
4. Secrets Manager (SM)

1

Install the `tt` CLI

brew install tigertrust/tap/tt
tt login
Full options (Vault-compat, agent, CI): Install Secrets Manager.
2

Enable KV and write a secret

tt secrets engines enable kv secret
tt secrets write secret/prod/db/password value=hunter2
tt secrets read secret/prod/db/password
3

Enable dynamic DB creds

tt secrets engines enable database database
tt secrets write database/config/prod-postgres \
  plugin_name=postgresql-database-plugin \
  connection_url='postgres://root:...@db:5432/postgres' \
  allowed_roles=prod-postgres
tt secrets write database/roles/prod-postgres \
  db_name=prod-postgres default_ttl=1h max_ttl=24h

​
5. NHI Governance (NHIG)

1

Grant read-only cloud access

NHIG → Cloud Providers → Connect AWS/Azure/GCP. Deploy the read-only role via the CloudFormation / az cli / gcloud snippet the UI shows.
2

(Optional) install the on-host agent

curl -sSf https://releases.tigertrust.io/tigertrust-nhig/agent | \
  TT_API_URL=https://api.tigertrust.io TT_API_KEY=ak_prod_... sh
Full options: Install NHI Governance.
3

Assign owners

NHIG → Inventory → Bulk Actions → Assign Owner. Every unowned identity blocks compliance.
4

Kick off a review campaign

NHIG → Reviews → New Campaign. Scope, reviewers, due date. Evidence collected automatically.

​
Where next

Platform concepts

Workspaces, RBAC, policies, and the agent model shared by every module.

Integrations

AWS, Azure, GCP, DNS providers, SSO, webhooks, notification channels.

API reference

Every HTTP endpoint across all four modules.

Operations

Troubleshooting, playground, release pipeline.