Give access to the app, not a way out for the data.
Contractors, acquired teams, offshore staff, and your own people log into SaaS that holds your crown jewels. Bromure gives them a real, logged-in browser — with copy, download, screenshot, and upload governed per session, and every byte of state destroyed when the window closes.
The problem
Once it renders, it has already left
A ZTNA gateway verifies who someone is, then hands the session to a browser that will happily copy a customer list to the clipboard, sync a download to a personal cloud, and cache an OAuth token to disk where a rogue extension can read it. The identity check was zero-trust; the place the data actually lands is implicit-trust.
The exposure widens every time a contractor logs in from a personal laptop, every time an acquired team gets day-one access on whatever device they already carry, every time someone installs one more extension. Each is a spot where your DLP can't see and your access verdict has quietly evaporated into “they're inside now.”
Bromure's answer
Containment at the tab, re-evaluated every session
Bromure runs each SaaS session in a disposable VM with no persistent state, no ambient credentials, and no path back to the host. Copy, paste, download, upload, and screenshot are governed per profile — off by default for the sensitive ones — so the data stays on the inside of the glass while the work still gets done.
Because every session is a fresh VM, policy is re-evaluated per session, not per install. Pair it with your ZTNA broker: the gateway says who, Bromure enforces what the session may do with what it sees. Close the window and the cookies, cache, tokens, and anything written to disk are destroyed with the VM.
How it works
Per-profile egress controls
Downloads, clipboard, uploads, and screen capture are each governed independently. The crown-jewel SaaS profile can render everything and exfiltrate nothing.
Ephemeral by default
No session state survives a window close. Tokens, cookies, and cache die with the VM — nothing for a stolen laptop or a rogue extension to harvest later.
Cross-org access, no laptop project
Acquired teams, contractors, and partners get correctly-scoped access on the device they already carry. Integration becomes an identity problem, not an eighteen-month reimaging program.
Continuous verification
SSO and device mTLS are re-checked on every launch. Revoke in your IdP and the next window simply doesn't open.
In practice
Contained access, from login to window-close
A finance contractor needs the billing console for six weeks. IT points them at a `contained-billing` profile: allowed domains limited to the billing SaaS and its IdP, downloads and clipboard off, uploads off, full session recording on. The contractor installs Bromure on their own laptop; the installer issues a per-device mTLS cert against your PKI.
On launch, the contractor authenticates through your IdP, the profile is pulled and signature-verified, and a fresh VM renders the console. They read invoices and reconcile accounts — but can't copy a customer list to the clipboard, can't download the export, and can't paste anything back out to the host. Every request is logged from outside the VM.
Six weeks later the engagement ends. You revoke the IdP grant and the next launch fails. Nothing was ever cached to the contractor's disk, because there was no disk state to begin with — every session was destroyed at window-close. There's no offboarding scramble, because there's nothing left behind to collect.
Architecture & integration
How it's actually built
The marketing stops here. What follows is the technical substrate every Bromure deployment sits on — the same whether you're protecting a BYOD workforce or segregating classification levels inside a regulated agency.
Hypervisor-enforced isolation
Each profile runs in its own lightweight Linux VM on top of Apple's Virtualization.framework — a separate kernel, filesystem, and network stack from the host. The base image is a signed, reproducible Alpine build cloned via APFS copy-on-write at session launch (near-zero disk cost). The host cannot read VM memory; the VM cannot read the host's clipboard, filesystem, or network adapters unless profile policy explicitly allows it.
Identity: SSO for users, mTLS for devices
Enrollment and session launch are gated by two factors your organization already operates. OIDC / SAML against Google Workspace, Okta, Microsoft Entra, or Authentik identifies the user. A per-device mTLS client certificate, issued from your PKI and bound to the installation, identifies the machine. Revoke either and the next session fails to launch — no agent to tamper with, no local policy to edit around.
Profile-as-code
The work profile — allowed SaaS list, download / clipboard / screenshot posture, VPN configuration, keyboard layout, root CAs, network egress rules — is a signed declarative artifact. Version it in Git. Push it through your MDM or the Bromure config endpoint. Tampered profiles fail signature verification and the session refuses to start. What runs on the user's machine is bit-for-bit what you authored.
Per-profile network plane
Each profile carries its own virtual NIC. Choose NAT through the host, bridge to a physical interface, or tunnel via WireGuard, IKEv2 / IPsec, or Cloudflare WARP — all terminated inside the VM, invisible to the host. Layer on DNS overrides, outbound port whitelists, LAN isolation, and an HTTP proxy. Segmentation is enforced by the hypervisor, not by a sticker on the firewall.
Audit pipeline
Every request — timestamp, verb, URL, status, user, profile, device — is captured outside the VM in a tamper-resistant JSON Lines stream and delivered to the log sink you already feed (SIEM, data lake, retention archive). Optional headers-only or full-body session recording for suspicious traffic. Stable schema, documented fields, no vendor lock-in on the format.
Ephemeral by default, persistent by opt-in
Close the window, the VM is destroyed. Tokens, cookies, cache, downloads, and any malware that landed during the session go with it. Profiles that need state — a bookmarks set, a saved session, a logged-in SaaS — opt into a LUKS-encrypted persistent disk keyed to the macOS Keychain. The key never leaves the user's device.
Common questions
Does this replace our DLP or CASB?
+
It complements them. DLP and CASB inspect traffic and flag exfiltration after the fact; Bromure removes the exfiltration paths — clipboard, download, upload, screenshot — at the browser itself, per session, so there's far less left for them to catch.
Does Bromure replace our ZTNA?
+
No. ZTNA verifies identity and brokers access at the edge; Bromure enforces the session contract on the device — no credential caching, no extension carryover, no lateral reach into the host. They're complementary.
Can a profile allow downloads when a workflow genuinely needs them?
+
Yes. Every control is per-profile. One profile can permit downloads with VirusTotal gating and an audit entry, while the crown-jewel profiles keep them off entirely.
What about acquired teams during an M&A integration?
+
Bromure supports multiple IdPs at enrollment, so an acquired population gets scoped access to both estates under their existing directory while federation and back-office consolidation land on their own timeline — no day-one reimaging.
Give them the app. Keep the data.
Render every SaaS session in a VM that can't leak — and pair it with the ZTNA stack you already run.