Security and encryption in Prismara Spaces

Prismara Spaces is built to keep your organisation’s files private and recoverable. This page explains what protects your content and what each option means for the way you work.

Every file in every space is encrypted. Connections between your browser or computer and Prismara Spaces use post-quantum security, so traffic recorded today can’t be read later by a quantum computer.

Spaces Sync only connects over post-quantum-protected connections. Because of this, it won’t connect through a proxy or firewall that decrypts HTTPS traffic (sometimes called TLS inspection or SSL inspection). If your network does this, ask your network team to exclude the Prismara addresses listed in Prismara app addresses.

Each space uses one of three encryption modes. The mode decides who holds the keys that unlock the space’s files, and which features are available.

Mode	Who holds the keys	What you can do	Best for
Standard	SovSec holds the keys for your organisation in dedicated key-protection hardware.	Search, previews, editing in the browser and malware scanning all work.	Most spaces. This is the default.
Customer Key	Your organisation holds the key in its own key store, and can withdraw access at any time.	The same as Standard, for as long as your organisation grants access to the key.	Regulated organisations that need to control their own keys.
Vault	End-to-end encrypted. The keys exist only on members’ devices.	No search, previews or browser editing, because the service can’t read the files. Files open on the desktop.	Your most sensitive content.

When you use Prismara Gov, sensitivity labels will be able to set a space’s encryption mode automatically. For example, a label for strictly confidential content can require the Vault mode, so nobody has to remember to choose it.

• Phishing-resistant sign-in. Signing in to Prismara Spaces requires phishing-resistant multi-factor authentication, such as a passkey or a security key.
• Single sign-on. You sign in with your Prismara Identity account, or with your Microsoft work account if your organisation still uses Microsoft Entra ID. See Sign in to Prismara Spaces.
• Paired computers. You never type your password into Spaces Sync. To add a computer, you approve a short pairing code in your browser, where you’re already signed in. Codes expire after 10 minutes and work only once. Each paired computer then has its own access to your account.
• Remove a lost device. If a computer is lost, stolen or replaced, you or your administrator can remove it, and its access to your spaces ends. See Sync files to your computer.

Sharing links are signed, so they can’t be altered or guessed, and they can be set to expire. Links for guests outside your organisation will be able to require a one-time code before the file opens (coming). See Share files and folders.

Every view, change, share and permission change in a space is recorded in a tamper-evident activity log, so you can see who did what and when.

If your organisation uses Prismara SOC, SovSec analysts are alerted to unusual activity, such as mass downloads, mass deletions or unusual sharing.

Protection	What it does	Status
Mass-delete guard	Spaces Sync asks you to confirm before a large number of files is deleted everywhere.	Available
Ransomware detection	Spaces Sync watches for signs of ransomware on your computer, so damaged files don’t spread to everyone else’s copies.	Coming
Point-in-time restore	Restore a whole library to how it was at an earlier point in time.	Coming

Until point-in-time restore is available, you can restore individual files and folders from version history and the recycle bin. See Restore versions and deleted files.

• Prismara Spaces overview
• Post-quantum security in Prismara
• Prismara app addresses
• Share files and folders
• Manage access to a space
• Troubleshoot Prismara Spaces