What's built, what's verified, and what isn't yet.
Every Prismara product is in preview. This page shows, for each one, the current build, whether it uses post-quantum cryptography and whether that build has had an independent security review. We list only what has been built and tested.
| Product | Current build | Post-quantum | Independent review | Stage |
|---|---|---|---|---|
| Prismara Identity | v0.4 | Yes | Done | In development |
| Prismara Mail | v0.1 | Yes | Done | In development |
| Prismara Talk | v0.2 | Planned | Not yet | In development |
| Prismara Work | v0.2 | Yes | Done | In development |
| Prismara Geode | v0.2 | Yes | Done | In development |
| Prismara Folio | v0.2 | Yes | Done | In development |
| Prismara Lattice | No build yet | – | – | Planned |
| Prismara Lumen | No build yet | – | – | Planned |
| Prismara Spaces | Prototype | – | Not yet | In development |
| Prismara SOC | Phase E | Planned | Not yet | In development |
| Prismara Endpoint Security | pre-0.1 | Yes | Not yet | In development |
| Prismara ZTNA | v0.3 | Yes | Done | In development |
| Prismara Gov | v0.2 | Yes | Done | In development |
| Prismara Crucible | M4 | – | Not yet | In development |
| Prismara Browser | Chromium 155 | – | Not yet | In development |
| Prismara Prism | Details to follow | – | – | In development |
| Prismara Admin | v0.1 | Yes | Done | In development |
| Prismara Core | v0.1.1 | Yes | Done | In development |
| Prismara Reach | v0.2 | Yes | Done | In development |
| Prismara Service Desk | v1.2 | Planned | Not yet | In development |
| Prismara CRM | Details to follow | – | – | In development |
| Prismara HR | Details to follow | – | – | In development |
| Prismara ERP | Phase A | – | Not yet | In development |
| Prismara Cloud | v0.3 | Planned | Not yet | In development |
| Prismara OS | v0.1 | Yes | Done | In development |
| Prismara EdgeRelay | No build yet | – | – | Research |
Post-quantum means hybrid ML-KEM-768 key exchange and ML-DSA-65 signatures alongside classical algorithms, so a break in either one alone does not expose your data.
Not done yet
- No external penetration test yet. One is planned for the first half of 2027, before any client roll-out.
- Most agents have not yet run on real Windows, macOS, iPhone or Android hardware. Linux has been tested end to end.
- TLS certificates are still classical. The messages inside them carry hybrid post-quantum signatures.
- Passkeys and security keys use classical signatures until authenticators support post-quantum algorithms.
- Prismara Talk's prototype uses classical cryptography until its MLS core is finished.
- SovSec is aligned with ISO/IEC 27001. It is not certified.
Licence exceptions
SovSec's own code is permissively licensed. These copyleft components are approved exceptions, and their full source is published with each release.
- Prismara Browser
- Chromium's Blink engine and FFmpeg (LGPL)
- Prismara OS
- openSUSE Leap 16 base packages (GPL and LGPL)
- Prismara Endpoint Security
- In-kernel eBPF programs (dual BSD and GPL)
The rules every product follows
Post-quantum ready from day one
Control-plane connections use TLS 1.3 with the hybrid X25519MLKEM768 key exchange. Agents and gateways refuse classical-only connections.
Servers can't forge your intent
Access grants, admin actions and policy bundles are signed by keys you hold, and the most sensitive steps need two of three custodians. A compromised server can relay them but cannot widen, re-target or replay them.
Default deny, fail closed
Nothing is reachable until a policy allows it. When a grant expires or a check fails, access stops rather than falling back to open.
Tamper-evident by construction
Every product writes an append-only, SHA-256 hash-chained audit log. Any edited or deleted entry breaks the chain and shows up in review.
Tenants separated in the database
PostgreSQL row-level security is enforced on every tenant table, so a query bug cannot return another customer's records.
Audited libraries, checked licences
Cryptography comes from audited open-source libraries. SovSec's own code is permissively licensed, and every build checks each dependency's licence. The few copyleft parts, such as Chromium's engine and the Linux base of Prismara OS, are documented exceptions with full source published.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.