Passwords and secrets that even SovSec can't open.
Prismara Prism is a zero-knowledge, post-quantum password and secrets manager. Your vault is encrypted on your device with two secrets, your master password and a Secret Key sealed in the device's TPM, so neither a breach of SovSec's servers nor a copied laptop disk exposes anything. It is built into Prismara OS and Prismara Browser, with extensions for other browsers.
What Prismara Prism does
Everything in one vault
Logins, passkeys, one-time codes, secure notes, cards, identities, SSH keys, API keys and files.
Quick, safe unlock
Unlock with a short PIN whose attempts are counted by the TPM. Five wrong tries and Prism asks for your master password.
New devices approved by security key
A FIDO2 security key approves each new device, and cloned keys are detected.
Safe autofill
No fill on page load, ever. Prism fills only after you click, only on an exact site match over HTTPS, and only into fields you can see. Look-alike sites get a blocking warning.
Built into Prismara Browser
The browser engine fills credentials as the form is sent, so page scripts and other extensions never see them.
Secrets for the whole desktop
Prism is the secrets provider for Prismara OS and the Linux Secret Service, and includes an SSH agent and a Git credential helper.
Works offline
Each device keeps an encrypted copy of your vault and syncs only ciphertext when it reconnects.
How it's secured
Prismara Prism follows the engineering rules shared across the suite, plus these product-specific measures.
Server can't guess your password
Sign-in uses OPAQUE, so the server never sees your password or anything it could guess offline.
Keys stay in one place
Only the Prism agent on your device holds keys, sessions are bound to the device, and connections use post-quantum TLS only.
Tamper-evident vaults
Vault manifests are signed and public keys are published to an append-only log that clients check, so SovSec can't swap in its own key or roll back your vault.
Recovery stays yours
SovSec can never recover a vault. Recovery uses your Emergency Kit, another device or, if your organisation opts in, two of three named administrators.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.