Remote management where the server can't act alone.
Prismara Reach is remote monitoring and management for Windows, Linux and macOS. Agents only run actions signed by an authorised operator's security key, and remote sessions are end-to-end encrypted, so a compromised server can neither command your devices nor watch a session. Patching, scheduled scripts and software deployment are signed once and carried out by the agents themselves.
Demo with sample data at reach-demo.prismara.eu, separate from production.
See it working
Shown with sample data.
What Prismara Reach does
Signed actions
Every action carries a WebAuthn signature from an operator key authorised in a policy signed by your offline root key, which needs two of three key holders.
Standing orders
Scheduled scripts, patch policies and desired software states are signed once and run by each agent on its own clock, with a bounded lifetime and a revocation list.
Software deployment you can trust
Install through winget, apt, dnf, zypper or Homebrew as signed actions. The agent refuses unless the package manager would act on exactly the package that was signed.
Allow-list and protected software
A root-signed allow-list controls what may be installed, a protected list guards what must stay, and every uninstall needs two signatures.
End-to-end encrypted sessions
Remote sessions are encrypted between your browser and the device with a hybrid ML-KEM-768 and X25519 key, and the device signs the user's consent.
Recordings only auditors can open
Session recordings are encrypted to a key held offline by your auditors.
Two-person rule
Destructive and bulk actions need a second approver.
Reports and alerts
CSV reports on your fleet, and alerts to Prismara SOC or your own tools.
How it's secured
Prismara Reach follows the engineering rules shared across the suite, plus these product-specific measures.
Server is only a broker
The controller cannot forge, widen, re-target, extend or replay an action, or read or drive a live session.
Device trust from your root
Every device's identity is rooted in your tenant's offline root key, not in the server.
Separate console origin
The console is served from its own origin, so a compromised controller cannot serve a fake one.
Post-quantum transport
TLS 1.3 with hybrid X25519MLKEM768 and per-device mutual TLS.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.