A desktop operating system that seals itself before you sign in.
Prismara OS is SovSec's hardened Linux desktop, built on openSUSE Leap 16 with KDE Plasma 6. It ships as one image with three modes: Personal, with no account and no telemetry, and Business and Enterprise, which add the Prismara apps and central management. The disk is encrypted and sealed to the device on first start.
What Prismara OS does
Immutable system
A read-only system image with btrfs snapshots, so a bad update rolls back automatically.
Sealed on first start
The first-run assistant encrypts the disk, seals it to the TPM with Secure Boot (with a PIN where policy requires it) and shows a recovery key you must confirm.
Three modes, one image
Personal needs no account and sends no telemetry. Business and Enterprise are switched on by a signed activation bundle.
Hardened by default
SELinux, a default-deny firewall, kernel lockdown, signed modules and no core dumps.
Prismara built in
Business and Enterprise devices come ready for the Prismara apps and central management.
Familiar desktop
KDE Plasma 6 with a taskbar at the bottom, in Prismara's own look.
How it's secured
Prismara OS follows the engineering rules shared across the suite, plus these product-specific measures.
Quorum-signed updates
Updates are signed with hybrid Ed25519 and ML-DSA-65, need two of three custodians, and cannot roll back to older versions.
Secure Boot
Microsoft-signed boot for Personal and Business, SovSec's own platform keys for Enterprise.
Independently reviewed
Three review rounds; every critical, high and medium finding is fixed with a regression test.
Connects to the rest of the suite
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.