Manage every device. Nothing changes without approval.
Prismara Core manages Windows, macOS, Linux, iOS, iPadOS and Android from one console. Every policy, script, package and remote action is signed and approved before a device will act on it, so even someone with access to Core's database cannot push a change. Android runs on SovSec's own device policy controller, with no dependency on Google services.
Demo with sample data at core-demo.prismara.eu, separate from production.
See it working
Shown with sample data.
What Prismara Core does
Every platform
Native Windows MDM plus an agent, Apple MDM for iPhone, iPad and Mac, a Linux agent, and an Android controller that needs no Google Play Services and targets GrapheneOS.
Policy that stays applied
Policies take effect only after approval, drift on the device is reverted automatically, and a root-signed policy floor sets the minimum no one can go below.
Scripts and software you can trust
Scripts run only once approved with a passkey and return signed results. Software packages go only to targeted devices after approval, and each device checks the hash before installing.
BitLocker recovery without the risk
Recovery keys are escrowed sealed and revealed only after a second administrator approves with a passkey, for a limited time, with every reveal audited.
Protected wipes
Wipes of more than ten devices are held for 15 minutes so a second administrator can cancel them.
Compliance that acts
A non-compliant device produces a signed assertion for Prismara ZTNA and a ticket in Prismara Desk. A high risk score from Prismara SOC marks a device non-compliant.
How it's secured
Prismara Core follows the engineering rules shared across the suite, plus these product-specific measures.
Database can't command devices
Devices refuse a swapped payload, an added target or a forged approval, even when it comes straight from Core's own database.
Enrolment pinned to your tenant
Enrolment files are pinned to your tenant's root key, so a device cannot be enrolled into someone else's management.
No replays
Expired, rolled-back or re-delivered actions are refused.
Post-quantum by default
Agent sessions use TLS 1.3 with hybrid X25519MLKEM768, and signatures combine ML-DSA-65 with a classical algorithm.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.