Security and trust, with the evidence.
A security review asks who checked a product, which standards it implements and how to report a flaw. Here are Pramaan's answers. Where a claim has a limit, the limit sits next to it.
What the audit covered, and what it did not
Pramaan was internally audited on 13 June 2026; no third-party penetration test yet. That white-box audit covered the broker (Pramaan's server), the mobile application and a non-destructive probe of the live service. No third-party audit or penetration test report exists.
Standards we implement
- Device binding. Access tokens can be bound to a key held on the device. The key is a software key, and binding is enforced only once it is switched on.
- Transparency log. Every audit event is added to a tamper-evident log, written unconditionally. Its signed summary, and the proofs that check it, are public, with no credentials; reading the events themselves needs an access token.
- SAML 2.0. Pramaan is a native SAML identity provider for your applications, once it has a signing key and certificate.
- SCIM 2.0. Users are provisioned outbound to your applications, and, once inbound SCIM is switched on, inbound from a directory that pushes to Pramaan. Inbound SCIM has no request that deletes a user or group.
- Passkeys. Registration takes a fixed signature type only: a key that offers only other types will not enrol, and Pramaan does not verify which authenticator model holds the key.
Try the documented access rules
Illustrative model of the documented rules, with example rules: deny a device labelled unmanaged, and allow one group on set days. It runs in this page and sends nothing.
AllowStep-upDeny
| When | Verdict |
|---|---|
| The device carries a posture label that a Deny rule names, such as unmanaged | Deny |
| No rule allows the person's group on this day: a rule lists the days it applies on by weekday, from Sunday to Saturday | Deny, by the default deny |
| A rule allows it and adaptive step-up is off | Allow |
| Adaptive step-up is on: impossible travel adds 100, three or more recent failed attempts by the person or from the address add 50, and a country outside the home list adds 40, which scores only once an administrator lists home countries; travel and country need the optional city location database. The total is 60 or more | Step-up: a sign-in no older than 300 seconds |
| The total is below 60 | Allow |
| The verdict is already Deny | Deny: adaptive step-up only raises a request that would otherwise be allowed |
Report a vulnerability
Write to contact@pramaanid.cloud with what you found, the component or host it affects, and the steps to reproduce it. Send only what is needed to show the problem, and no personal data you came across.
There is no bug bounty, and no response time is promised.
Evidence pages
Limits
Each claim we make printed beside its limit.
Sovereignty
Each optional outbound connection and its switch, and what the list does not cover.
Transparency log
Check the audit log yourself with curl, and what its signed tree head proves and does not prove.
Device binding
What a device-bound token is bound to, where the broker checks it, and what binding does not cover.
For your engineers
Technical detail: the standards by name and number
- DPoP, RFC 9449. Device binding. The key is a software P-256 key.
- Transparency log, RFC 6962. Every audit event becomes a leaf of a Merkle log. The signed tree head and the inclusion and consistency proofs are public, with no credentials.
- SCIM 2.0. Inbound SCIM has no DELETE route.
- WebAuthn passkeys. Registration takes ES256 only, none attestation.
Questions
Has anyone outside Frontier Labs assessed Pramaan?
No. Pramaan was internally audited on 13 June 2026; no third-party penetration test yet. No third-party audit or penetration test report exists, so nothing on this site should be read as outside assurance.
Which standards does Pramaan implement?
SAML 2.0 single sign-on, SCIM 2.0 provisioning, passkeys (registration takes a fixed signature type only), device binding for access tokens and a transparency log for audit events, each to its published standard, which this page names. Device binding is enforced only once it is switched on. Implementing a standard is not a certification against it.
How do I verify a claim myself?
Start with the transparency log. A Pramaan broker serves the log's signed summary to anyone, with no credentials, and serves the proofs that check it the same way, because they expose only hashes. That lets you check a recorded audit event against the published log without asking us.
Is there a bug bounty?
No. There is no bug bounty and no paid reward. Report what you find as described under Report a vulnerability on this page.
Does Pramaan hold security certifications?
No. Pramaan's only security assurance to date is the internal white-box audit, 13 June 2026, and no third-party audit or penetration test report exists.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.