Single sign-on
OIDC, with a safeguard against reused sign-in codes for public clients, and SAML 2.0 as identity provider and as service provider.
Four tiers, one platform — priced to consolidate.
Indicative list prices are published: Identity from ₹3,500 and Zero Trust from ₹7,500 per named user per year, ex-GST. Sovereign and Sovereign+ are quoted. Single sign-on, MFA, passkeys and the tamper-evident audit log are in every tier.
The tiers
- Identity
- Zero Trust
- Sovereign
- Sovereign+
How to read the tiers: every line is in the tier, though some features stay off until an administrator turns them on. The broker is Pramaan's server, ZTNA is access to private applications one at a time, and device posture is what a device reports about its own state. The glossary explains the other terms in the tiers, such as secure web gateway, DLP, just-in-time access, attestation and post-quantum signatures.
Tier 1
Pramaan Identity
Replace a legacy IdP with a sovereign, on-prem one.
from ₹3,500 / user / yr · US$80 · ex-GST
- OIDC / PKCE & SAML 2.0 identity provider
- A SAML service provider
- Passkeys, push-to-approve, MFA
- Built-in LDAP
- SCIM 2.0 out
- Inbound SCIM
- Tamper-evident audit log
- Admin & self-service consoles
AI-agent identities included: 25
Tier 2
Pramaan Zero Trust
Add Zero-Trust access to your private apps.
from ₹7,500 / user / yr · US$160 · ex-GST
Everything in Identity, plus:
- ZTNA gateway: private apps; the connector dials out to the broker and opens no inbound port
- Device-bound (DPoP) access tokens
- Continuous device posture
- Secure Web Gateway + DNS
- Inline DLP
- Per-request access, denied unless an access rule allows it
AI-agent identities included: 250
Tier 3
Pramaan Sovereign
Consolidate IdP + ZTNA + SWG under one plane.
Contact sales
Everything in Zero Trust, plus:
- Privileged access: just-in-time SSH certificates (60-second lifetime, no standing SSH keys)
- Browser RDP
- Android hardware key attestation of the app's device key: it needs Google's attestation roots and only upgrades posture
- First-class AI-agent identity
- Post-quantum audit anchoring
- SIEM export over RFC 5424 syslog (UDP, TCP or TLS), set up as an alert channel in the admin console
- Multi-site routing
AI-agent identities included: Unlimited
Tier 4 · Enterprise
Pramaan Sovereign+
Government, defence & critical infrastructure.
Contact sales
Everything in Sovereign, plus:
- Air-gapped install: identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today
- Source-code escrow, by agreement
- Sovereign SLA and on-site support, by agreement
AI-agent identities included: Unlimited
Indicative list, per named user / year, ex-GST. Each tier includes one production deployment. Pramaan Sovereign is priced to replace an identity provider, a private-app access gateway and a secure web gateway.
Named-user bands
Named users
A band
Prices are per named user per year, and the band is set by how many named users you have.
| Band | Named users |
|---|---|
| A | ≤500 |
| B | ≤2,000 |
| C | ≤10,000 |
| D | unlimited |
Larger bands reduce the per-user price; ask for a quote.
Subscription or perpetual
Subscription
Perpetual
Licences are sold as an annual subscription, which is the default, or perpetual with annual maintenance. With a perpetual licence the maintenance is part of the licence, not an option. Either way, non-production use is free.
In every tier
- Sign-in
- Passkeys
- Audit log
MFA
Pramaan is its own MFA provider: push approvals, where the person confirms by matching a number on the screen, and codes from an authenticator app, checked inside the broker that issues the sign-in.
Passkeys
People sign in with a passkey instead of a password. Registration takes a fixed signature type only, so a key that cannot sign with that type will not enrol.
Tamper-evident audit log
Every audit event is added to a transparency log, whose signed summary you can check.
Frontier Labs is a Class-I local supplier (asserted per tender) under the PPP-MII Order. That is a supplier status, not a feature, so it holds for every tier.
AI-agent pools
Agents
A pool
| Tier | AI-agent identities |
|---|---|
| Pramaan Identity | 25 |
| Pramaan Zero Trust | 250 |
| Pramaan Sovereign and Sovereign+ | Unlimited |
Pools are contractual and self-declared; the broker does not meter agents. AI-agent identity is switched on separately:
Questions
Who counts as a user?
Every named person who holds an account. Prices are per named user per year, in bands of ≤500 / ≤2,000 / ≤10,000 / unlimited named users, never per monthly sign-in. AI agents are not counted as users: each tier includes a pool of agent identities.
Is non-production charged?
No: non-production use is free. Each tier includes one production deployment, and test or staging environments are not charged on top of it.
Is there a licence server?
No. Pramaan has no licence-check server and no phone-home, so named-user bands and agent pools are self-declared under the contract. The broker has six optional outbound connections, each off by default or unconfigured and each with a named switch; none of them reports usage to Frontier Labs.
Are prices ex-GST?
Yes. Every price on this page is an indicative list price per named user per year, before GST.
Is the US-dollar list for every country?
The US-dollar prices, from US$80 for Identity and US$160 for Zero Trust, are the global list. Rupee prices are set separately for India rather than converted at the exchange rate.
Can we buy a perpetual licence?
Yes: perpetual with annual maintenance. With a perpetual licence the maintenance is part of the licence, not an option. Annual subscription is the default; ask for a quote for either.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.