OpenZTA
RU Client portal Request a pilot
Menu
Русская версия ENCLAVE PromtWall OpenDSPM OpenASOC AI-SOC Zero Trust
Pilot About Contacts Client portal Request a pilot
NEW ENCLAVE — corporate AI over your company’s documents

Data, code, AI and access — protected on your own servers.

Six platforms for security teams in banking, telecom, industry and government. Find personal data and excess access. Stop a risky release. Get a ready-made attack investigation. Protect your AI applications — and give employees a corporate AI of their own. Everything runs on your servers, the licence ships as a file, and the buying decision rests on the pilot report.

Request a 30-day pilot Explore the platforms ↓
● self-hosted ● air-gapped: PromtWall · ENCLAVE · AI-SOC ● Russian compliance built in: BDU FSTEC, 152-FZ, 187-FZ

Why now

The cost of a mistake has gone up. Keep your security under your own roof.

Fines now scale with turnover. Data leaks into public AI tools. AI agents get access to databases. Attacks arrive through contractors and VPNs, while the SOC drowns in alerts. For each of these risks, OpenZTA has a platform that runs inside your perimeter.

up to 3%
of revenue — Russia’s turnover-based fine for a repeat personal data leak
420-FZ, from 30 May 2025OpenDSPM →
×30
growth in the corporate data employees upload to public AI tools
Solar, 2025ENCLAVE →
48%
of breaches involve a third party — dependencies, contractors and the supply chain
Verizon DBIR 2026OpenASOC →
42%
of SOC alerts are never investigated — and another 46% turn out to be false positives
Microsoft / Omdia, 2026AI-SOC →
97%
of organisations with AI incidents had no control over access to AI
IBM Cost of a Data Breach 2025PromtWall →
24%
of 2025 investigations began with an intrusion through a contractor — up from 6% in 2024
Solar 4RAYS, 12 March 2026Zero Trust →

Platforms

Six platforms. One perimeter. Your data stays with you.

Start with one platform for a specific task, or deploy the full stack. Every platform ships through a single portal and runs on your servers.

AI layer

Corporate AI that keeps your data inside

Corporate AI
0unauthorized views per 100,000 access checks

ENCLAVEnew

Answers in a second — citing the exact policy clause and strictly within each employee’s permissions.

workspaceanswer
How many days does it take to approve a contractor agreement?
Up to 5 business days. If the amount exceeds the limit, the CFO must also sign off[1][2]
[1] Procurement policy · cl. 4.2[2] Confluence · Legal
✓ source permissions applied0.6 s
  • 10 sources out of the box: Confluence, Jira, SharePoint, GitHub, GitLab, S3, network shares, websites, SDK + a desktop app for Mac and Windows
  • Source permissions are enforced before the answer: a document with unclear permissions is visible to no one
  • 16 model slots — local or cloud, your call
  • No grounding, no answer — just “insufficient data”; answers export to Word, Excel and PowerPoint
Learn more about ENCLAVE →
AI security
48controls in 7 categories

PromtWall

A gateway between your apps and the models: injections, personal data leaks and agent actions — under control.

decision logruntime
support-bot · injection in RAGDENY
sales-copilot · SNILS in responseMASK
finance-agent · DELETE FROMASK
hr-chat · policy compliantALLOW
  • Change only the URL and the key — an OpenAI-compatible API; your application code stays untouched
  • PII Vault: passports, cards, SNILS and INN (Russian insurance and tax IDs) reach the model as tokens and are restored in the response
  • Agents and MCP: tool pinning, human approval, hash-chained session recording
  • OWASP LLM Top 10 and MITRE ATLAS; garak-based red teaming with a CI/CD gate
Learn more about PromtWall →

Foundation

Data, code, monitoring and access

Data
69sensitive data types

OpenDSPM

Where personal data lives, who can access it — and how to close excess access before the audit.

data cataloguescanning
crm.public.customersRussian passport · SNILS
billing.paymentsPAN · Luhn ✓
analytics_ro → paymentsexcess privilege → REVOKE
s3://reports/clients.xlsxINN · full name
  • 8 storage types: PostgreSQL, MySQL, ClickHouse, MongoDB, Kafka, Redis, Elasticsearch, S3
  • Russian passport, SNILS, INN, cards, IBAN — with checksum validation; international passports via MRZ
  • Revoke excess privileges right at the source — PostgreSQL, MySQL, ClickHouse (preview)
  • 31 standards and ~250 requirements: 152-FZ (Russian personal data law), Government Decree 1119, FSTEC Order No. 21, 187-FZ (critical information infrastructure law), GOST R 57580.1 (financial-sector security standard)
Learn more about OpenDSPM →
Code and applications
9vulnerability databases, including Russia’s BDU FSTEC

OpenASOC

Every code check in one stream. First in line: what’s reachable in your code and already being exploited.

from noise to action · examplegate
analyser findings15,768
after deduplication6,120
reachable412
to fix today53
  • 20 SAST and secrets analysers for 11 languages, plus 6 SCA, IaC, DAST and mobile
  • Vulnerability databases as signed offline packages — for closed networks
  • Reachability analysis for 6 languages, with priority by CVSS, EPSS, KEV and context
  • Release gate in GitHub, GitLab, Azure — the release verdict is signed with Ed25519
Learn more about OpenASOC →
Monitoring and SOC
19verified log sources

AI-SOC

The model spots the attack in your logs and assembles the investigation right away — no hand-written correlation rules.

attack chain · MITRE ATT&CKinvestigation
TA0001initial access
TA0002execution
TA0003persistence
TA0008lateral movement
TA0010exfiltration
✓ every conclusion is backed by events37 events
  • Sources out of the box: Windows, Sysmon, auditd, Kubernetes, Cisco, FortiGate, PAN-OS, Suricata, Zeek
  • Any conclusion not tied to specific events is discarded — every alert can be checked against the log
  • 316 ready-made threat-hunting questions, export to Sigma
  • Local model on CPU — no GPU required, runs air-gapped
Learn more about AI-SOC →
Access
55device checks across 3 operating systems

Zero Trustpilot deployments

Only verified people on healthy devices reach your resources — instead of a VPN that opens everything to everyone.

93%of rules
✓ disk encrypted
✓ key in Secure Enclave
✓ firewall on
! OS update overdue
ALLOW · admin.internal
  • Checks on Windows, macOS and Linux: disk encryption, firewall, secure boot, antivirus
  • Device key in TPM 2.0 or Secure Enclave — the certificate can’t be stolen by copying
  • 30 ready-made CEL rules, 5 severity levels with thresholds
  • Pilot deployments — together with our team
Learn more about Zero Trust →

Interfaces

See the platforms at work.

Six consoles with clear navigation: what needs attention, where the risk is and what to do next.

Employees ask in their own words — ENCLAVE answers with footnotes to source fragments, shows what was hidden by access rights and honestly says “insufficient data” when there is no basis.More about ENCLAVE →

Demo data.

How we deploy

Judge us by the pilot report — not by a demo.

We agree on success criteria before kick-off. You provide a server inside your perimeter, access to the systems and a small pilot group.

STEP 01

Scope

We pick the task and the platform together with your security and IT teams.

STEP 02

Install

We deploy inside your perimeter with a single installer command — in the first days of the pilot.

STEP 03 · 30 DAYS

Pilot

We work on your data. Observation first — no blocking.

STEP 04

Decision

A report with findings and measured impact — and your call on production rollout.

One perimeter

From licence to a running platform — with no standing vendor access to your environment.

Everything you need for delivery and operations is already in place: a portal, a private registry, an installer and log export to your SIEM.

Delivery portal

Licences, releases and feeds — only what has been issued to your organisation

openzta.ru/portal

Private registry

Images are downloaded under your licence — pull-only, and only the release you need

registry.openzta.ru

Installer

Installation, diagnostics, backups, upgrades and rollback

install · doctor · upgrade

Your SIEM

Logs and findings from ENCLAVE, PromtWall, OpenDSPM and OpenASOC flow to where your SOC already reads them

CEF · syslog · webhook

Trust

Verify it — don’t take our word for it.

Signatures and SBOM

OpenASOC images are verified with cosign, and the release verdict is signed with Ed25519 — openasoc gate verify. SBOMs in CycloneDX and SPDX, plus an AI-BOM for AI applications.

Honest about limits

We don’t hold FSTEC certificates yet. Each platform’s page states what it can’t do, and we measure accuracy and speed in a pilot on your data rather than promising them.

Offline updates

OpenASOC vulnerability databases ship as signed packages, PromtWall rules as packages, the licence as a file. PromtWall, ENCLAVE and AI-SOC run fully air-gapped.

Zero mandatory outbound connections

Every ENCLAVE build verifies that there are no outbound connections. An external model is used only if you choose to.

Logs that can’t be rewritten

Append-only logs and hash chains for operator actions and AI agent sessions.

Russian requirements built in

BDU FSTEC in OpenASOC; 152-FZ, Government Decree 1119, FSTEC Order No. 21, 187-FZ and GOST R 57580.1 in the OpenDSPM requirements catalogue.

Pilot

Test it on your own data — in 30 days.

Tell us what you need to protect — we’ll suggest a platform, agree on success criteria and deploy it inside your perimeter.

By submitting this request, you agree to our privacy policy.

Request sent

We’ll contact you at the email you provided to agree on the task and the pilot criteria.