Pramaan and a cloud identity-plus-SSE stack.

Choosing between a vendor's cloud and servers you run? Here, a cloud identity-plus-SSE stack means an identity provider and a security service edge that a vendor runs in its own cloud. You buy sign-in, private-app access and the web gateway as services. Pramaan is one system you run on your own servers, covering an identity provider, a private-app access gateway and a secure web gateway. The table puts the same questions to both. This page names no vendor, and where the answer depends on the vendor, it says so.

Question by question

Question	Pramaan	A cloud stack
Where do identity data and audit events live?	On servers you run: the broker keeps its state, audit events included, in its PostgreSQL database.	In the vendor's cloud, in the regions the vendor offers.
What reports back to the vendor?	Not the broker: the broker has no licence-check server, no telemetry beacon and no phone-home. It has six optional outbound connections, each behind its own switch.	The service runs in the vendor's cloud, so each sign-in reaches the vendor.
Can it run with no internet connection?	Partly: identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today.	Not as a cloud service: it runs in the vendor's cloud.
Can a copied access token be used from another machine?	A copy is refused where the broker checks its key, once binding is switched on. The limits are below the table.	Depends on the vendor: ask which tokens are bound to a device key, and where that is checked.
Can you check that the audit log was not altered?	Yes, without asking us: each audit event is added to a transparency log, and its signed summary is public.	Depends on the vendor: ask how you can check its logs yourself.
How are private applications reached?	A connector beside the application dials out to the broker and opens no inbound port, and for a web application the broker you run checks the person's sign-in, their groups and your access rules, then relays the request over that app's connector.	Through the vendor's cloud, which relays the traffic.
Where do the web gateway and DLP run?	On your servers: a forward proxy and a DNS filter, and inline DLP that labels card numbers, Aadhaar and PAN numbers, and keywords you list.	In the vendor's cloud: web traffic goes through the vendor's points of presence.
Where does AI help with policy run?	On a model you host: its URL must be a loopback or private-network address, written as an IP address or localhost. In Pramaan, the model only proposes, deterministic broker code verifies, and a commit is recorded in the audit and transparency logs.	Depends on the vendor: ask where its model runs and what it sends there.
Do AI agents get an identity of their own?	Yes, with a named human owner, a ceiling on what it may do and a kill switch. Disabling an agent stops new tokens; tokens already issued stay valid until they expire.	Depends on the vendor.
Where does the second factor come from?	Pramaan is its own MFA provider: passkeys, number-matched push and authenticator codes.	Built into the identity service.

The limits. Binding covers access tokens only: the browser session cookie is not device-bound. A token is bound only when the client proves its key as the token is issued, so these get unbound tokens: a sign-in with no enrolled device, and an application that sends no proof. The key is a software key. The broker's API calls that list applications, private apps, devices and sessions, and the session handoff check it only when the second token-binding switch is also on, and the direct-connection entry point refuses a device-bound token outright, because the connection cannot carry a proof. The outbound list is the broker's: the mobile app is not covered. Inline DLP scans only traffic that an access rule marks for inspection. Inside HTTPS, DLP sees content only when TLS inspection has decrypted the connection. The transparency log proves that recorded events were not altered; it is not a record of every access decision.

Where they win

Managed operations. The vendor runs the service for you. You run Pramaan yourself: the broker, and the database it keeps its state in, are yours to install, upgrade and back up.
Points of presence. A cloud stack serves people from the vendor's own points of presence. Pramaan answers from the servers you install it on, so its reach is your network's.
Analyst coverage. Large vendors appear in analyst reports. This site cites no analyst report about Pramaan.
Certifications. Ask any vendor for its current certificates. The certifications we do not hold include every security certification: Pramaan's only security assurance to date is an internal white-box audit, 13 June 2026, and no third-party audit or penetration test report exists.
Breadth. Pramaan has no RADIUS server, and its mobile app is Android only: there is no iOS app. Check that what you need is on our side of the table before you choose.

Questions

Why does this page name no vendor?

Vendors differ, and their products change. The cloud-stack column describes what a vendor-run service is by design, and says where the answer depends on the vendor; ask the vendor for those answers.

Does Pramaan hold a security certification?

No. Pramaan's only security assurance to date is an internal white-box audit, 13 June 2026, and no third-party audit or penetration test report exists.

Is a self-hosted broker more work to run?

Yes. A cloud service is run by its vendor; Pramaan is run by you, on your servers. Run it with its database: without a database, the broker keeps all its state in memory and loses it on restart.

Does the broker report back to us?

No: the broker has no licence-check server, no telemetry beacon and no phone-home. That holds for the broker only: the mobile app is not covered, and as published the Android app points at our hosted broker, so a deployment on your own servers needs a rebuilt and re-signed app.

Talk to us, or try it first

Book a walkthrough
Against your own apps, not slides.
Run the lab
It uses a demonstration account; none of your data is involved.
See pricing
Published floors, named-user bands and what every tier includes.