Security model

Reemo’s security rests on a few constant principles: encrypt all communications, grant trust only to components that hold a valid cryptographic identity, and deliver secrets only in a temporary, compartmentalized way.

The layers of Reemo's security model: TLS exposure on the browser side, internal mTLS trust, dedicated per-domain PKIs, and secret management by Vault.

The layers of the security model: TLS exposure, internal mTLS trust, dedicated PKIs, and secrets.

Encryption and internal trust (mTLS)

Reemo encrypts all its communications with TLS, in two distinct roles:

  • Public exposure: the Traefik front end terminates TLS on the browser side, with a certificate usually issued by a public authority, independent of the internal PKI.

  • Internal communications (mTLS): each micro-service presents a certificate signed by an internal CA (the Reemo CA) and verifies the other party’s certificate. A service without a valid certificate is rejected, even on a compromised network.

Dedicated per-domain PKIs

Beyond the common internal PKI, the secure gateways connect each functional domain (workstations, appliance, secrets, identity) to the platform core over a dedicated PKI. Each gateway holds its own cryptographic identity: a compromised domain does not open access to the others, and authentication is verified both ways on every connection.

Secret management (Vault)

Secrets — passwords, keys, certificates — are stored in a Vault (based on OpenBao) and delivered only to authorized services. Two key properties:

  • Sealing (seal/unseal): Vault never keeps in clear the key that encrypts its data; it must be unsealed after every restart. The master key is protected by Shamir’s Secret Sharing (by default 3 keys required out of 5).

  • Temporary, compartmentalized secrets: through the Portal Credential, a container retrieves its secrets using three combined mechanisms — mTLS, an ephemeral key pair generated in memory, and a temporary Vault token (5 minutes by default). Each container is limited to its own permissions.

The secure-access building blocks

On the usage side, Reemo brings together several secure-access functions in a single product: ZTNA (per-application access), bastion (protocol break, for example RDP or SSH in the browser), PAM (privileges and secrets), and RBI (browser isolation).