Legacy plant systems reached one app at a time.
Plants run applications that speak their own protocols, on networks that were not built for remote access. Pramaan reaches each of these applications over a direct connection, through a connector beside it, and each forward names the one application it opens. Sector rules are yours to map; here is the evidence the product produces.
The statutes this page names
The Digital Personal Data Protection Rules were published in the Gazette of India on 13 November 2025, and their phased compliance period ends on 13 May 2027. The Act's highest penalty, up to ₹250 crore, is for a Data Fiduciary's failure to maintain reasonable security safeguards. CERT-In's Directions No. 20(3)/2022 require all service providers, intermediaries, data centres, body corporate and Government organisations to keep the logs of all their ICT systems. The period is a rolling 180 days, within Indian jurisdiction. The sources, and which Pramaan evidence fits each safeguard.
Access problems, and what Pramaan offers
| Access problem | What Pramaan offers | From tier |
|---|---|---|
| Plant applications speak their own protocols, not a web sign-in. | A direct connection, through the application's connector. Each connection is checked on its own: the access token, the person's groups and your access rules. Forwarding runs in the Pramaan desktop app only: the Android app lists direct-connection apps and does not forward them. | Pramaan Zero Trust |
| Plants reuse the same private address ranges. | Multi-site routing: an app routed by its Site is reached only through a connector in that Site, so the same private address range in another Site never collides with it. | Pramaan Sovereign |
| A plant network should accept no connection from outside. | The connector dials out to the broker and opens no inbound port, and it relays only to targets on its own approved list. | Pramaan Zero Trust |
| Remote engineers need a desktop on a plant workstation. | Remote desktop in the browser: the browser talks to the broker, which relays to a remote-desktop gateway; the gateway holds the connection to the machine, and the connection's secrets never reach the browser. | Pramaan Sovereign |
| Shift workers share logins to plant applications. | Each person signs in to Pramaan as themselves; the application keeps its own login. Pramaan is its own MFA provider. | Every tier |
What the product produces as evidence
- Audit log. When the web edge refuses a request, because of the person's groups or your access rules, the refusal is written as an audit event. The broker keeps its audit events in its PostgreSQL database, on servers you run.
- Receipts. When an AI agent acts through the broker, the broker can hand back a signed action receipt, which an auditor can verify offline against the public key.
- Transparency log. Each audit event is added to a transparency log, whose signed summary you can check without asking us.
Not claimed
- Compliance with a plant control-system standard. Mapping it to your controls stays with you.
- Control of plant equipment. Pramaan decides who may open a connection; the equipment and its own login stay as they are.
- Protocols the direct-connection path does not carry. They need another path; the limit above names them.
- Customers or references. This page names none.
- A certification or a third-party audit. Pramaan was internally audited on 13 June 2026; no third-party penetration test yet.
For your engineers
Technical detail: the evidence chain
On direct connections, the raw-TCP listener writes an audit event when its access checks refuse a connection after the person's token has been read. The transparency log follows RFC 6962; each audit event is a leaf. The browser remote-desktop gateway is guacd. Run the broker with PostgreSQL: without DATABASE_URL, the broker keeps all its state in memory and loses it on restart.
Questions
Can Pramaan reach an application that speaks its own protocol?
Yes, over a direct connection, which carries TCP only. UDP (voice, video) comes from the always-on desktop client alone, unicast only, off by default. Each connection is checked on its own: the access token, the person's groups and your access rules.
Our plants use the same private addresses. Does that matter?
Not for an app routed by its Site: an app routed by its Site is reached only through a connector in that Site, so the same private address range in another Site never collides with it.
Do we open a port into the plant network?
No. The connector dials out to the broker and opens no inbound port, and it relays only to targets on its own approved list.
Can engineers forward plant applications from their phones?
No. Forwarding runs in the Pramaan desktop app only: the Android app lists direct-connection apps and does not forward them.
Is device posture checked on direct connections?
No. On them device posture is unknown, so a rule that requires a trusted or limited device tier never matches there; if no other rule allows the connection, the default deny refuses it.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.