Controls on outbound web traffic and browser sessions.
Decide which websites your people reach, look inside only the traffic you choose, and let people open your servers from a browser. Each control is switched on separately and stays off until you do.
Secure web gateway
With its switch on, the gateway runs a forward proxy and a DNS filter; each also needs its own address. Each client presents a Pramaan access token to the proxy, and your access rules decide each destination.
Selective TLS inspection
With selective TLS inspection on, the proxy decrypts an HTTPS connection only when an access rule asks for inspection and the destination's category is on your list. So only categories you list are decrypted, and an empty list decrypts nothing. Before it forwards anything, the broker checks the real site's certificate against its built-in list of root authorities.
Inline DLP
With inline DLP on, the gateway labels the content it inspects for card numbers, Aadhaar and PAN numbers, and keywords you list, and your access rules decide what a label blocks. It scans only traffic that an access rule marks for inspection.
Browser-delivered sessions
People open remote desktop (RDP or VNC) and SSH sessions, through a browser remote-desktop gateway, once you give the broker that gateway's address.
Pramaan also has its own browser SSH terminal, separate from that gateway. It signs in to the server with just-in-time SSH certificates that the broker issues itself, and each certificate lives 60 seconds. Until you configure the broker's signing key for them, the terminal does not open.
Roadmap: not built yet
Roadmap: a managed enterprise browser with clipboard, watermark and USB controls. Roadmap
It is not built: Pramaan adds no clipboard, watermark or USB controls of its own to browser-delivered sessions.
For your engineers
Technical detail: the settings and the parts
- Web proxy
- DNS filter
- Remote desktop
The proxy and the DNS filter: each also needs its own address to be set.
The browser remote-desktop gateway is guacd: the browser talks to the broker, which relays to guacd; guacd holds the RDP, SSH or VNC connection to the machine, and the connection's secrets never reach the browser. The browser SSH terminal is separate from guacd; its certificates come from the broker's own SSH certificate authority, and TLS inspection needs the separate inspection certificate authority that your managed devices trust.
Questions
Does the gateway decrypt all HTTPS traffic?
No. It decrypts only with selective TLS inspection switched on, and then only categories you list are decrypted, and an empty list decrypts nothing.
What does inline DLP look for?
It labels card numbers, Aadhaar and PAN numbers, and keywords you list. It does not block on its own: your access rules decide what a label blocks.
Is there an enterprise browser with clipboard and watermark controls?
Not today. Pramaan adds no clipboard, watermark or USB controls of its own; the section headed Roadmap says what is planned.
Does the gateway work without decrypting HTTPS?
Yes. Your access rules still decide each destination. Without TLS inspection the proxy cannot read inside an HTTPS connection.
How long does a certificate for the browser SSH terminal last?
In Pramaan's own browser SSH terminal, 60 seconds. The broker issues just-in-time SSH certificates itself, from a signing key you configure.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.