Remote management where the server can't act alone.
Prismara Reach is remote monitoring and management for Windows, Linux and macOS. Agents only run actions signed by an authorised operator's security key, and remote sessions are end-to-end encrypted, so a compromised server can neither command your devices nor watch a session.
What Prismara Reach does
Signed actions
Every action carries a WebAuthn signature from an operator key authorised in a policy signed by your offline root key.
End-to-end encrypted sessions
Terminal, remote desktop and file transfer are encrypted between your browser and the device with a hybrid ML-KEM-768 and X25519 key.
Two-person rule
Destructive scripts, uninstalls and actions on more than ten devices need a second approver.
Recordings only auditors can open
Session recordings are encrypted to a recording key held offline by your auditors.
Scripts and inventory
Run approved scripts, refresh inventory and view processes across the fleet.
Alerts to your SOC
Alerts go to Prismara SOC or your own tools by webhook or email.
How it's secured
Prismara Reach follows the engineering rules shared across the suite, plus these product-specific measures.
Server is only a broker
The controller cannot forge, widen, re-target, extend or replay an action, or read or drive a live session.
Separate console origin
The console is served from its own origin, so a compromised controller cannot serve a fake one.
Post-quantum transport
TLS 1.3 with hybrid X25519MLKEM768, pinned keys and per-device mutual TLS.
Signed audit anchors
A hash-chained audit trail with signed daily anchors.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.