Private access to your apps, without a flat VPN.
Prismara ZTNA connects people to exactly the applications they are allowed to use, checked on every flow. It is post-quantum end to end: tunnels are keyed with ML-KEM-768 and every signing key pairs Ed25519 with ML-DSA-65. When someone leaves, access is revoked within seconds.
What Prismara ZTNA does
Default deny per flow
The agent and the gateway both check every flow against policy. The local network cannot initiate connections to devices.
Post-quantum tunnels
WireGuard tunnels use a pre-shared key from an ML-KEM-768 exchange, rotated on a schedule.
Fast data path
Offloaded segmentation and batched I/O reach around 2 Gbit/s each way on a single stream.
Instant deprovisioning
Disable or delete a user in Prismara Identity or Entra ID and SCIM revokes their access within seconds.
Device posture
Disk encryption, firewall, Secure Boot, OS version and agent version are checked before access is granted.
Admin console
A local, loopback-only web console for devices, users, gateways, flows and the audit chain.
How it's secured
Prismara ZTNA follows the engineering rules shared across the suite, plus these product-specific measures.
Post-quantum control plane
TLS 1.3 with hybrid X25519MLKEM768, and every message signed with both Ed25519 and ML-DSA-65.
Fail closed
Routes, firewall rules and access all fail closed, with an nftables backstop on Linux.
Safe key rotation
Controller keys rotate only once every active gateway and device trusts the new key.
Independently reviewed
All high and medium findings from the v0.3 review are fixed and re-verified.
Want SovSec to run it for you?
SovSec provides managed security, SOC and Microsoft 365 services for organisations in the UK and DACH region, and can run Prismara as part of that service.