- Tokens signed with hybrid ML-DSA-65 and ECDSA by default
- Windows and Linux sign-in with passkeys, security keys and TOTP
- Provisions users to Mail and the other apps over SCIM
In developmentView Prismara Identity
The sovereign software suite from SovSec
Run your organisation on software you control.
Identity, mail, office apps, security operations, device management and business apps, built by SovSec, hosted in the EU and interoperable with Microsoft 365 when you need it.
- Transport
- Hybrid post-quantum TLS 1.3
- Hosting
- EU, operated from Austria
- Audit
- Hash-chained, tamper-evident
- Supply chain
- Licence-checked on every build
The platform
One platform for identity, security and the business behind it
Every Prismara product signs in through Prismara Identity, writes to the same tamper-evident audit trail and reports security events to Prismara SOC. Use the whole suite or start with one product.
Identity & communication
3 products
- Every stored item sealed to a key made in the user's browser
- Full spam, phishing and malware filtering before sealing
- Web app plus IMAP, SMTP, CalDAV and CardDAV
In developmentView Prismara Mail
PrismaraTalk
- Messages encrypted and signed on each device
- New devices approved from one you already trust
- Sign in with Prismara Identity, Entra ID as backup
In developmentView Prismara Talk
Productivity
6 productsPrismaraWork
- Geode files and Folio documents available now in preview
- Encrypted in the browser with hybrid post-quantum keys
- OpenDocument native, with .docx import and export
In developmentView Prismara Work
PrismaraGeode
- Personal storage with folders and version history
- Sharing links whose keys never reach the server
- Password-protected links that lock after 10 wrong attempts
In developmentView Prismara Geode
PrismaraFolio
- Real-time co-editing, comments and suggestions
- Tables, images, footnotes and table of contents
- Round-trips through .odt and .docx
In developmentView Prismara Folio
PrismaraLattice
- Encrypted, co-edited spreadsheets
- OpenDocument spreadsheets with Excel import and export
- Planned for phase 2
PlannedView Prismara Lattice
PrismaraLumen
- Encrypted, co-edited slide decks
- OpenDocument presentations with PowerPoint import and export
- Planned for phase 3
PlannedView Prismara Lumen
PrismaraSpaces
- Shared storage for teams, departments and projects
- Documents open in Prismara Work and sync to desktops
- Same post-quantum protection as the rest of the suite
In developmentView Prismara Spaces
Security
7 products
- Continuous ingest from Microsoft security sources
- Correlation rules for spray, impossible travel, BEC and more
- Pseudonymised telemetry with read-only client views
In developmentView Prismara SOC
- Kernel-level sensor with execution blocking and tamper protection
- XDR hub for alerts and incidents, synced to Prismara SOC
- Response actions need an operator's passkey approval
In developmentView Prismara Endpoint Security
- Default deny per flow, on the device and at the gateway
- Post-quantum tunnels at around 2 Gbit/s per stream
- Access revoked within seconds when a user is disabled
In developmentView Prismara ZTNA
- Classification and DLP enforced at the edge, not in the hub
- Retention, records, legal holds and eDiscovery
- Every destructive step needs two of three custodians
In developmentView Prismara Gov
PrismaraCrucible
- Signed rules of engagement enforced on every action
- Findings ranked by known exploitation, then EPSS and CVSS
- Purple-team reports matched against Prismara SOC detections
In developmentView Prismara Crucible
PrismaraBrowser
- Chromium 155 with Google services removed
- 49 security policies on by default, JIT off
- Central policy that tenants can tighten but never weaken
In developmentView Prismara Browser
PrismaraPrism
- Zero-knowledge vaults: SovSec holds nothing that can decrypt them
- Hybrid ML-KEM-768 and ML-DSA-65 on every key share
- Autofill only on your click and an exact site match
In developmentView Prismara Prism
Management & operations
4 productsPrismaraAdmin
- Tenants, subscriptions and per-user licences
- Provider, partner and customer levels with delegated admin
- Service health and usage from every Prismara app
In developmentView Prismara Admin
- Windows, macOS, Linux, iOS and Android from one console
- Own Android controller, no Google Play Services needed
- Device compliance feeds ZTNA access and Service Desk tickets
In developmentView Prismara Core
PrismaraReach
- Agents run only actions signed by an operator's security key
- Remote sessions end-to-end encrypted with post-quantum keys
- Two-person approval for destructive and bulk actions
In developmentView Prismara Reach
- Incidents, problems, changes, requests and knowledge
- Multi-client with database-enforced separation
- Monthly SLA reports with service credits flagged
In developmentView Prismara Service Desk
Business
3 products
- Accounts, contacts, pipeline and activity on EU infrastructure
- Commercial records kept apart from technical asset data
- No US-hosted analytics or enrichment calls
In developmentView Prismara CRM
- Personnel records, contracts and absence under client-held keys
- GDPR retention, subject-access export and deletion workflows
- Joiner, mover and leaver events drive access and IT tasks
In developmentView Prismara HR
PrismaraERP
- Projects, time, resourcing, quoting and invoicing
- Expenses and procurement for resale
- Issues Prismara Cloud invoices with gapless numbering
In developmentView Prismara ERP
Infrastructure
3 productsPrismaraCloud
- Virtual machines, Kubernetes, networking, storage and databases
- Policy guardrails checked before anything is deployed
- Reservations save up to 45 %, with invoices issued through ERP
In developmentView Prismara Cloud
PrismaraOS
- Personal, Business and Enterprise modes from one image
- Disk sealed to the TPM before first sign-in
- Updates signed by two of three custodians, with rollback
In developmentView Prismara OS
- Brokers secure connections between your sites and Prismara
- Data minimisation before anything leaves your network
- Research programme, not yet scheduled for release
ResearchView Prismara EdgeRelay
How it's built
Security decisions made once, applied to every product
The same engineering rules run through the whole suite, so a security review of one product tells you how the others behave.
Transport
Post-quantum ready from day one
Control-plane connections use TLS 1.3 with the hybrid X25519MLKEM768 key exchange. Agents and gateways refuse classical-only connections.
Authority
Servers can't forge your intent
Access grants, admin actions and policy bundles are signed by keys you hold, and the most sensitive steps need two of three custodians. A compromised server can relay them but cannot widen, re-target or replay them.
Policy
Default deny, fail closed
Nothing is reachable until a policy allows it. When a grant expires or a check fails, access stops rather than falling back to open.
Audit
Tamper-evident by construction
Every product writes an append-only, SHA-256 hash-chained audit log. Any edited or deleted entry breaks the chain and shows up in review.
Isolation
Tenants separated in the database
PostgreSQL row-level security is enforced on every tenant table, so a query bug cannot return another customer's records.
Supply chain
Audited libraries, checked licences
Cryptography comes from audited open-source libraries. SovSec's own code is permissively licensed, and every build checks each dependency's licence. The few copyleft parts, such as Chromium's engine and the Linux base of Prismara OS, are documented exceptions with full source published.
Deployment
Move at your own pace away from Microsoft
Prismara works with the Microsoft estate you already have. Choose how much to move, and change mode later without re-platforming.
Microsoft
For teams that want Prismara apps and keep Entra ID.
- Sign-in
- Entra ID
- Exchange Online
- Apps
- Prismara SOC, Service Desk, CRM, HR and more
Hybrid
For organisations moving in stages.
- Sign-in
- Prismara Identity with Entra ID as a declared fallback
- Either platform, migrated mailbox by mailbox
- Apps
- The full suite, Microsoft integrations kept
Sovereign
For full independence from US-controlled services.
- Sign-in
- Prismara Identity
- Prismara Mail
- Apps
- The full suite on EU infrastructure under your keys
Roadmap
From prototype to general availability
SovSec runs every Prismara product internally before it is offered to clients.
- Q4 2026
Previews
Identity, Mail, Admin, Core, ZTNA, Reach, Work, Gov and Cloud run as previews. Next: first runs on real Windows, macOS, iPhone and Android hardware, and the first Prismara OS image.
- H1 2027
Independent testing
External penetration tests and code-signed installers for every agent.
- Oct 2027
SovSec go-live
SovSec moves its own operations onto the Prismara suite.
- After go-live
Client and MSP availability
Prismara offered to SovSec clients and partner MSPs, with a demo tenant available beforehand.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.