One sign-in for your people, devices and apps.
Prismara Identity is SovSec's identity provider, built from the ground up in Rust. It signs people in to Windows and Linux devices, provides single sign-on for every Prismara product and your own applications, and issues post-quantum signed tokens by default. It is the source of truth for users across the suite and can run alongside Microsoft Entra ID or replace it.
What Prismara Identity does
Single sign-on
Authorization code with PKCE, refresh-token rotation with theft detection, client credentials, introspection, logout and back-channel logout for every connected app.
Post-quantum tokens
ID and access tokens are signed with a composite ML-DSA-65 and ECDSA P-256 signature by default. Classical ES256 is available only as an opt-in for third-party software.
Windows and Linux sign-in
A Windows credential provider for logon, unlock and UAC prompts, and Linux sign-in through PAM and NSS with offline sign-in for up to 14 days.
Passwordless onboarding
New people receive a single-use access pass that can only enrol a passkey. Passkeys and FIDO2 security keys are the primary factor, with TOTP as a fallback.
User provisioning
Users and groups flow to Prismara Mail and the other apps over SCIM 2.0. Leavers are deactivated everywhere, never silently deleted.
Managed from Prismara Admin
Tenants and verified domains are created by signed events from Prismara Admin. Entra ID can stay as a declared fallback in Hybrid mode.
How it's secured
Prismara Identity follows the engineering rules shared across the suite, plus these product-specific measures.
Hybrid-only device protocol
Device keys, enrolment, assertions and directory tokens use hybrid post-quantum signatures. Classical-only devices are refused.
Post-quantum TLS
Agents connect over TLS 1.3 with X25519MLKEM768 and fail closed against a classical server.
Privileged accounts protected
Provisioning tokens cannot touch administrators, roles or privileged groups, and access passes cannot be issued for administrators.
Tenant isolation and audit
Every tenant is separated with PostgreSQL row-level security, and every change lands in a hash-chained audit log.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.