Pramaan and a VPN, question by question.

Here, a VPN means a remote-access VPN: it joins a person's device to your network. Pramaan decides access for each application instead: a private application is denied unless an access rule allows it, and being in the application's group is not enough on its own. This page names no VPN product, and where the answer depends on the product, it says so.

Question by question

Question	Pramaan	A VPN
What does a person get access to?	One application at a time: each is denied unless an access rule allows it.	A network: the device reaches whatever your network rules allow.
Does the application need an inbound port?	No. A connector beside it dials out to the broker and opens no inbound port.	The application sits on the joined network; the VPN gateway accepts connections from the internet.
What is checked when a person opens a private web application?	The request itself: the broker checks the person's sign-in, their groups and your access rules, then relays the request over that app's connector.	The person (and, depending on the product, the device) when the tunnel is set up; after that, traffic is forwarded under your network rules.
Is the state of the device taken into account?	When your rules ask for it: an access rule can name posture labels, such as unmanaged, and step up or deny a request from a device that carries such a label, or require a minimum score. A laptop's readings arrive as agent posture reports.	Depends on the product.
What happens when someone leaves?	Deactivating them revokes their sessions, their renewal tokens and every access token issued to them, and their live sessions on the browser SSH terminal and connections that desktop tools forward are cancelled, not merely refused next time.	You disable the account; whether a live tunnel ends at once depends on the product.
Can people reach SSH, RDP and Postgres servers?	Yes, over a direct connection, from the desktop app, with the limits below. Each connection is checked on its own: the access token, the person's groups and your access rules.	Yes, like any other traffic on the joined network.
Does it carry traffic that is not TCP?	Partly. A direct connection carries TCP only. UDP (voice, video) comes from the always-on desktop client alone, unicast only, off by default.	Yes: it carries IP traffic, UDP included.
Does it work from a phone?	Web applications open in the phone's browser. Forwarding runs in the Pramaan desktop app only: the Android app lists direct-connection apps and does not forward them.	Depends on the product's clients.
Can it join one site's network to another?	No. Its connector relays only to targets on its own approved list: Pramaan connects a person to an application.	Yes: a site-to-site VPN joins networks.
Can you try it before switching?	Yes, on web applications behind a sign-in check: behind the proxy that signs people in today, Pramaan evaluates your rules on live traffic, enforces nothing, and reports where it would have disagreed with your current gate. The sign-in check must be on: it is on once an administrator sets a cookie domain for it and the identity store is on.	It keeps running while you test.
What evidence does it produce?	When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event, and the broker writes an audit event when its access checks refuse a direct connection after the person's token has been read. Each audit event is added to a transparency log.	The product's own connection logs, whose contents depend on the product.
Where does the second factor come from?	Pramaan is its own MFA provider: passkeys, number-matched push and authenticator codes.	Built in, or a separate MFA service, depending on the product.

The limit. The application has no inbound port; the broker's own entry points do. In our reference deployment the connector's entry point and the direct-connection entry point accept connections from the internet, each behind source-address connection limits that our host applies. The desktop client's UDP tunnel is also published, behind a token and an address check instead. On your own host, those limits are yours to set up. A laptop's readings are self-reported: the report's signature proves which enrolled device sent it, not that its readings are true. On a direct connection device posture is unknown: the broker refuses a device-bound token outright, because the connection cannot carry a proof, so a token that works there is unbound, and a copy of it is not refused for coming from another machine; it works until it expires. The transparency log proves that recorded events were not altered; it is not a record of every access decision. Run the broker with its database: without a database, the broker keeps all its state in memory and loses it on restart.

Where a VPN is still the right tool

Joining networks, site to site. Pramaan connects a person to an application, and its connector relays only to targets on its own approved list. It does not join one network to another.
Traffic that is not TCP. A direct connection carries TCP only. UDP (voice, video) comes from the always-on desktop client alone, unicast only, off by default.
Direct connections from a phone. Forwarding runs in the Pramaan desktop app only: the Android app lists direct-connection apps and does not forward them.

For the rest, move application by application: test Pramaan beside the gate you have.

Questions

Do we have to switch off the VPN to start?

No. Shadow mode runs beside the proxy that signs people in today, which keeps deciding. An application reached only over the VPN, with no such proxy, cannot be shadow-tested.

Why does this page name no VPN product?

Products differ, and they change. Where an answer depends on the product, ask your vendor.

Can a phone reach SSH or a database through Pramaan?

No. Forwarding runs in the Pramaan desktop app only: the Android app lists direct-connection apps and does not forward them.

What happens to live connections when someone leaves?

When you deactivate them, their live sessions on the browser SSH terminal and connections that desktop tools forward are cancelled, not merely refused next time.

Talk to us, or try it first

Book a walkthrough
Against your own apps, not slides.
Run the lab
It uses a demonstration account; none of your data is involved.
See pricing
Published floors, named-user bands and what every tier includes.