Contractor and BPO access, judged per device.
IT services and BPO firms put contractors and agents on their clients' applications, from delivery floors and from home. Pramaan admits each person to the applications their groups and your access rules allow, and, for a browser sign-in, reads posture from the device that approved it. Sector rules are yours to map; here is the evidence the product produces.
The statutes this page names
The Digital Personal Data Protection Rules were published in the Gazette of India on 13 November 2025, and their phased compliance period ends on 13 May 2027. The Act's highest penalty, up to ₹250 crore, is for a Data Fiduciary's failure to maintain reasonable security safeguards. CERT-In's Directions No. 20(3)/2022 require all service providers, intermediaries, data centres, body corporate and Government organisations to keep the logs of all their ICT systems. The period is a rolling 180 days, within Indian jurisdiction. The sources, and which Pramaan evidence fits each safeguard.
Access problems, and what Pramaan offers
| Access problem | What Pramaan offers | From tier |
|---|---|---|
| Agents need one client's applications, not that client's network. | Publish each application through a connector. When a browser asks for it, the web edge checks the person's sign-in, their groups and your access rules, then relays the request over that app's connector. | Pramaan Zero Trust |
| Agents work from delivery floors, from home and on personal devices. | A laptop running the Pramaan desktop agent reports its posture checks, and an access rule can name posture labels, such as unmanaged, and step up or deny a request from a device that carries such a label, or require a minimum score. Which device counts is set out below. | Pramaan Zero Trust |
| Client data should not leave in a web upload. | On traffic through Pramaan's secure web gateway, inline DLP labels card numbers, Aadhaar and PAN numbers, and keywords you list, and your access rules decide what a label blocks. | Pramaan Zero Trust |
| Developers need SSH to client servers without long-lived keys on their laptops. | Pramaan's own browser SSH terminal signs in with just-in-time SSH certificates, each valid for 60 seconds. | Pramaan Sovereign |
| Clients ask for evidence of the access controls. | Audit events, each entered in a transparency log, set out below. | Every tier |
Which device is judged
A browser reports nothing on its own. By default, a browser session carries the posture captured when it was signed in: that of the device that approved it. A laptop's own agent report counts in a browser decision when that laptop approved the sign-in in the Pramaan desktop app; when a phone approved it, the phone's posture counts. A sign-in that no device approved carries no posture, and its tier is unknown.
So an agent at a shared desk who approves on a phone is judged by the phone; a laptop is judged only when it approves the sign-in itself, with agent posture reports switched on.
What the product produces as evidence
- Audit log. When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event. The broker keeps its audit events in its PostgreSQL database, on servers you run.
- Receipts. When an AI agent acts through the broker, the broker can hand back a signed action receipt, which an auditor can verify offline against the public key.
- Transparency log. Each audit event is added to a transparency log, whose signed summary you can check without asking us.
Not claimed
- Compliance with a client's or a sector's security rules. Mapping them to your controls stays with you.
- Recording of agents' screens or keystrokes. Pramaan itself does not record a session's screen or keystrokes.
- Customers or references. This page names none.
- A certification or a third-party audit. Pramaan was internally audited on 13 June 2026; no third-party penetration test yet.
For your engineers
Technical detail: the evidence chain
On direct connections, the raw-TCP listener writes an audit event when its access checks refuse a connection after the person's token has been read. The transparency log follows RFC 6962; each audit event is a leaf. Run the broker with PostgreSQL: without DATABASE_URL, the broker keeps all its state in memory and loses it on restart.
Questions
Which device's posture counts for a browser sign-in?
By default, a browser session carries the posture captured when it was signed in: that of the device that approved it. A sign-in that no device approved carries no posture, and its tier is unknown.
Can a contractor's access end with their project?
Deactivate the contractor and Pramaan revokes their sessions, their renewal tokens and every access token issued to them. Their live direct connections are cancelled, not merely refused next time.
Can an access rule admit a contractor only during working hours?
An access rule can be limited to the days of the week it applies on and a time-of-day window, both in UTC. The window repeats every week, and a rule has no end date. Also, a connection that stays open, such as a direct connection or a live browser connection through the web edge, is decided when it opens and is not cut when the window closes.
Does inline DLP read uploads sent over HTTPS?
Inside HTTPS, DLP sees content only when TLS inspection has decrypted the connection. It scans only traffic that an access rule marks for inspection.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.