Vendor access and audit evidence for banks and insurers.
Banks and insurers give vendors, outsourced teams and administrators access to systems that hold customers' money and data. Pramaan publishes those systems one application at a time and decides each request with your access rules. It writes refusals by its access checks to an audit log, as set out below. Sector rules are yours to map; here is the evidence the product produces.
The statutes this page names
The Digital Personal Data Protection Rules were published in the Gazette of India on 13 November 2025, and their phased compliance period ends on 13 May 2027. The Act's highest penalty, up to ₹250 crore, is for a Data Fiduciary's failure to maintain reasonable security safeguards. CERT-In's Directions No. 20(3)/2022 require all service providers, intermediaries, data centres, body corporate and Government organisations to keep the logs of all their ICT systems. The period is a rolling 180 days, within Indian jurisdiction. The sources, and which Pramaan evidence fits each safeguard.
Access problems, and what Pramaan offers
| Access problem | What Pramaan offers | From tier |
|---|---|---|
| A vendor or outsourced team needs one application for a fixed piece of work, not your network. | Publish the application through a connector: it dials out to the broker and opens no inbound port. A private application is denied unless an access rule allows it, so admit the vendor's group on this application and no other. | Pramaan Zero Trust |
| Administrators need SSH to servers without long-lived keys on their laptops. | Pramaan's own browser SSH terminal signs in with just-in-time SSH certificates, each valid for 60 seconds and made with a fresh key, generated in the broker's memory and never stored. | Pramaan Sovereign |
| Operations staff need a remote desktop without being given the machine's credentials. | Remote desktop in the browser: the browser talks to the broker, which relays to a remote-desktop gateway; the gateway holds the connection to the machine, and the connection's secrets never reach the browser. | Pramaan Sovereign |
| Branch staff and outsourced teams sign in from laptops the bank does not manage. | With agent posture reports switched on, a laptop running the Pramaan desktop agent reports its posture checks, and an access rule can name posture labels, such as unmanaged, and step up or deny a request from a device that carries such a label, or require a minimum score. | Pramaan Zero Trust |
| Evidence of access control has to hold up when it is questioned. | Audit events, each entered in a transparency log, set out below. | Every tier |
What the product produces as evidence
- Audit log. When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event. The broker keeps its audit events in its PostgreSQL database, on servers you run.
- Receipts. When an AI agent acts through the broker, the broker can hand back a signed action receipt, which an auditor can verify offline against the public key.
- Transparency log. Each audit event is added to a transparency log, whose signed summary you can check without asking us.
Not claimed
- Compliance with a sector regulator's rules. Mapping them to your controls stays with you.
- Customers or references. This page names none.
- A certification or a third-party audit. Pramaan was internally audited on 13 June 2026; no third-party penetration test yet.
- Recording of privileged sessions. Pramaan itself does not record what is shown or typed in a privileged session.
- Fraud or transaction monitoring. Pramaan decides access; it does not watch payments.
For your engineers
Technical detail: the evidence chain
On direct connections, the raw-TCP listener writes an audit event when its access checks refuse a connection after the person's token has been read. The transparency log follows RFC 6962; each audit event is a leaf. The browser remote-desktop gateway is guacd. Run the broker with PostgreSQL: without DATABASE_URL, the broker keeps all its state in memory and loses it on restart.
Questions
Does Pramaan make a bank or insurer compliant with its regulator's rules?
No. This page names only the statutes we have checked, and Pramaan does not make your organisation compliant with those either. It produces evidence; mapping your sector's rules to that evidence stays with you.
Can a vendor reach only the application they support?
Publish that application through a connector and admit the vendor's group on it alone: a private application is denied unless an access rule allows it, and being in the application's group is not enough on its own.
Are privileged sessions recorded?
Pramaan itself does not record them today: it keeps no copy of what is shown or typed in a privileged session.
What happens to a vendor's access when the contract ends?
Deactivate the vendor and Pramaan revokes their sessions, their renewal tokens and every access token issued to them. Their live direct connections are cancelled, not merely refused next time.
Where are the audit events kept?
On your servers: the broker keeps its audit events in its PostgreSQL database. Keeping the logs of all your ICT systems for a rolling 180 days stays with your organisation.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.