We continuously expand the unified On-Premise security perimeter. Beyond currently shipped components (Core, Windows Logon, RADIUS 802.1X, SSO OIDC/SAML, and Branch Relay), our team is actively architecting new products for remote administration and physical access control.
Corporate Remote Presence Gateway: Console, SOS & Unattended under Zero-Trust Control
A proprietary on-premise remote presence platform with zero third-party cloud dependencies. A unified native agent for server fleets (Unattended), owner console access (Console), and on-demand user helpdesk (SOS) featuring strict Number Matching, perimeter-aware evaluation, and Step-Up 2FA enforcement.
A single high-performance LocalSystem Go daemon replaces fragmented tools. Supports all remote presence scenarios: owner desktop console, server fleet management, and emergency SOS support within a unified client application.
Dynamic CIDR evaluation classifies connections as internal or external. Operators connecting from trusted office networks proceed instantly, while external sessions strictly require fresh 2FA re-verification (Passkey biometrics or TOTP).
Eliminates push fatigue and social engineering during SOS sessions: the remote user must manually type a 2-digit verification code provided by the operator. Blind "Allow" buttons are completely excluded.
Full support for locked workstations, RunAs dialogs, and Windows logon credentials. Seamless DXGI Desktop Duplication recovery during desktop transitions (Default ↔ Winlogon) prevents frozen video streams.
Scales WebRTC signaling across distributed Ligament 2FA cluster nodes using PostgreSQL Claim-Check routing: lightweight notifications bypass payload limits while handling large SDP offers reliably.
Temporary drops, Wi-Fi roaming, or mobile handovers do not sever the session: a 60-second resilience window triggers automatic background ICE Restart and seamless fallback to WSS 443 relay without re-prompting users.
For Security & Zero-Trust Teams: perimeter-adaptive access control, mandatory external Step-Up MFA, and user phishing protection via Number Matching.
For IT Helpdesks: instant attended support via 2-digit SOS codes, interaction with Windows logon screens, and seamless UAC elevation.
For Remote Employees: secure access to office workstations (Console) from home without the overhead of maintaining a separate full-tunnel VPN.
Link / Bastion: Bastion provides RDP/SSH port forwarding via Core or Branch Relays. Ligament Link is an interactive real-time visual streaming gateway with WebRTC, UAC handling, perimeter Step-Up 2FA, and a unified agent.
Remote Session Archive, Auditing & AI-Powered Incident Investigation
A dedicated on-premise archiving and forensics service for Link, Console, and SOS sessions with its own independent web console. Captures activity directly on the managed host without operator dependency (across both P2P and Relay sessions). High-definition adaptive screenshots around key actions, interactive timeline player, Legal Hold, password keystroke exclusion, and local evidence extraction for budget-controlled AI analysis.
Recording originates directly on the managed host machine and continues uninterrupted regardless of the operator's browser window, across both encrypted Relay and direct WebRTC P2P streams.
Smart screen capture: baseline interval snapshots augmented with high-definition bursts around clicks, keystrokes, system dialogs, errors, and window changes without storage bloat.
Centralized policies (inherit, record+AI, record_only, exclude). Under mandatory recording, desktop control is withheld until the first stored frame is ACKed and suspends immediately if archiving fails.
Dedicated web console featuring session calendar grid, visual timeline with frame scrubbers, remote input traces, operator handover markers, and session coverage integrity indicators.
Attach notes, review tags, and helpdesk ticket references to session records. Legal Hold flag prevents scheduled retention purge. Cryptographic manifest export for compliance and courtroom evidence.
Local OCR and frame deduplication extract minimal evidence packages. Structured analysis via OpenRouter with Zero Data Retention (ZDR), token caps, and exact second-by-second evidence citation.
For Security & SOC Teams: 100% verified chronological timeline of remote admin activity, tamper-resistant evidence trail, and accelerated incident root-cause analysis.
For IT Helpdesks & Team Leads: dispute resolution, vendor/contractor audit, and automatic summarized action recaps for ticket resolution.
For Compliance & Privacy: granular access segregation, password masking at source, customizable retention schedules, and partition-level automated pruning.
Recorder / Standard Audit Logs: Standard audit logs only register connection timestamps. Link Recorder captures visual state, remote inputs, and user interactions with frame-accurate scrubbing and AI verification.
Physical access control & turnstiles under 2FA perimeter
We are developing native integration between Ligament 2FA and Physical Access Control Systems (PACS): turnstiles, doors, and server room access validated via mobile Passkey/Push. Eliminates badge borrowing (Anti-Passback) and automatically locks the Windows desktop when leaving the premises.
Tapping an RFID/HID badge sends an instant Push or Passkey prompt to the employee's phone. Turnstile opens only upon personal biometric confirmation.
Turnstile exit events automatically trigger an immediate Lock Screen for active Windows Logon and RDP sessions on the employee's workstation.
Prevents badge lending: access to server rooms or high-security zones requires FaceID/TouchID confirmation on the registered mobile device.
Compatibility with Bolid Orion Pro, Sigur, RusGuard, HikCentral, Perco, and Wiegand/OSDP hardware controllers via native APIs and Webhooks.
Instant SIEM alert when an Active Directory, RDP, or VPN session originates for an employee who has not badged into the physical facility.
Unified timeline correlating turnstile badges with Windows logins and 802.1X Wi-Fi connections, exported directly to corporate SIEM via Syslog/CEF.
For Physical Security: eliminate badge borrowing and instantly revoke both physical turnstile and domain access with one click.
For SOC & InfoSec: detect impossible logins by correlating physical location data with corporate credentials.
For IT Administration: automatic lock for abandoned workstations without requiring employee action or short idle timers.
PACS / RADIUS: RADIUS secures Wi-Fi and VPN network connections, while Ligament PACS secures doors, gates, and synchronizes real-world presence with workstation session locks.
Bolid fire alarm zone mapping with targeted evacuation broadcast
Full-fledged fire incident management mapping Bolid fire detectors and loops to physical zones and occupants. Automated real-time evacuation monitoring using PACS presence data, emergency priority broadcasts to users trapped in the hazard zone, and live evacuation accounting.
Precise mapping of Bolid detectors, loops, and partitions to: Building → Floor → Room → PACS Zone. If unmapped at room level, system reports "room unspecified" rather than guessing.
Upon fire alarm trigger, creates an immutable baseline snapshot (fire_person_snapshots) of all employees whose current_zone matches the incident zone or its child spaces.
Instantaneous alert dispatch specifically to occupants located in the active hazard zone: critical push notification with audible siren, Windows Logon full-screen dialog, SMS, and corporate bots.
Classifies occupants by evidence reliability: inside (confirmed present), outside (badged through exit), unknown (stale or ambiguous). An employee is never assumed safe without verified egress.
Turnstile and emergency door egress events are tagged specifically as evacuation_exit, preserving dedicated forensics separated from routine daily access logs.
Automated command dispatch to open designated emergency exit paths and integration with Bolid fire safety scenarios without risking unmonitored perimeter collapse.
For Incident Command & Responders: named list of personnel confirmed inside the burning area, time of last verified badge, and data reliability metrics.
For Building Occupants: personalized emergency alerts indicating the nearest clear egress route directly on smartphone and workstation screens.
For Physical Security: unified live dashboard with one-click manual room sweep confirmation and zone clearance verification.
Bolid Fire / Standard PACS: Standard PACS only logs badge taps for time-tracking. Ligament Fire & Evacuation transforms scattered Bolid alarms and turnstiles into a life-safety coordination hub with strict individual accounting.
