What can leave your network, and the switch for each.
Running identity and access on your own servers means knowing what can still reach the internet. Here is each outbound connection a Pramaan deployment can make, the switch for each, and what that list does not cover. The list is kept in step with the product.
The broker does not phone home
Pramaan runs on your own infrastructure, and the broker has no licence-check server, no telemetry beacon and no phone-home. It needs no outbound connection to start or to sign anyone in. It can make six optional outbound connections, each off by default or unconfigured and each with its own switch. Calls you set up yourself, such as provisioning users from your own directory, go to the services you name and are unconfigured until you add one. The technical detail below lists them all.
What the list does not cover
Air-gapped installation
For an air-gapped install the scope is: identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today. A test rig starts the broker, its store and the edge on a network with no route out and serves OIDC discovery over TLS. That test does not sign anyone in or issue a token, and it does not exercise the app or the copilot model.
For your engineers
Technical detail: each outbound connection and its switch
Pramaan runs on the customer's own infrastructure. There is no licence-check server, no telemetry beacon and no phone-home in the broker: nothing reports usage, health or identity to Frontier Labs, and the broker needs no outbound connectivity to start or to authenticate anyone. The outbound calls that exist are optional and off by default or unconfigured, and each has a named switch:
| Outbound connection | Switch or condition |
|---|---|
| the CVE/CISA KEV feed sync to storage.googleapis.com and cisa.gov | the vulnerability-feed switch, default off |
| Firebase push to fcm.googleapis.com | absent unless a service account is configured; the broker falls back to WebSocket and polling |
| Google Play Integrity attestation | the Play Integrity switch, default off |
| the Android key-attestation revocation list at android.googleapis.com, refreshed daily | the key-attestation switch, default off |
| the Telegram Bot API | only if configured |
| the secure web gateway's upstream DNS resolver | the gateway's upstream-resolver setting, operator-overridable |
Outbound SCIM/Graph/Google Workspace provisioning and outbound OIDC/SAML/LDAP calls go to endpoints the operator names -- in the normal case the customer's own tenant at their own IdP -- and are unconfigured until the operator adds a source or target.
There are six optional outbound connections, and the table above lists every one.
Questions
Does the Pramaan broker phone home?
No. The broker has no licence-check server, no telemetry beacon and no phone-home, and it needs no outbound connection to start or to sign anyone in. It can make six optional outbound connections, each listed on this page with its switch. The published mobile app is a separate matter: it connects to our hosted broker and to Google's push service, as the limits on this page say.
Which of those connections are on by default?
Each one is optional and either off by default or unconfigured; the switch beside it says which. Push, for example, is absent unless a service account is configured, and the broker then falls back to a connection the app holds open, and to polling.
Does the list cover the mobile app?
No: the mobile app is not covered. The published Android app starts its push configuration when it opens, and its broker address is fixed when it is built, so a deployment on your own infrastructure needs a rebuilt and re-signed app.
Can Pramaan run air-gapped?
Partly. The air-gapped scope is: identity plane only, rig-proven; offline app enrolment and the copilot model are not proven, and no update procedure exists today. A test rig proves that the broker, its store and the edge start with no route out and serve OIDC discovery; it does not sign anyone in or issue a token.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.