The hardened workstation, watched by your own team.
Postern OS is a hardened Linux system for the desktop, phone-sized screens and the console. Paired with Postern Cyber, every device reports to a detection and response server your organization runs, and tells its user exactly what is collected.
Every screen on this page is a real capture of the 0.4.0-dev images running offline in a virtual machine.
Quiet on the network. Hardened underneath. Honest about both.
Three things are true of every Postern OS image, and a built-in report lets you check them on the machine in front of you.
Quiet
Nothing listens, and the device says little about itself to a network.
- No SSH, discovery, remote desktop or location service
- Inbound firewall on; a random hardware address per connection
- Host name withheld from DHCP; no telemetry in Firefox
- Session, journal and temporary files live in memory
Hardened
A bug in one program should be harder to turn into control of the machine.
- Memory wiped when allocated and when freed
- Hardened allocator and kernel stack; CPU mitigations kept on
- kexec, SysRq and unused network protocols disabled
- AppArmor enabled; core dumps discarded
Capable
A full working system, not a locked-down kiosk.
- Firefox, Tor Browser, KeePassXC, Metadata Cleaner
- Encrypted vault files that travel on a USB stick
- Parallel file-integrity manifests for large data sets
- Compressed memory swap and tuned networking
Detection and response, on a server you own.
Postern OS and Postern Cyber are one product in two parts. Postern OS is the hardened workstation. Postern Cyber watches every one of them for an intruder and gives your security team the means to throw one out. Postern, the vendor, is deliberately kept at arm's length.
See
A sensor built into each managed device reports every program started, every network connection, every login and every change to a critical file.
Recognise
Your server compares that activity against 48 known attack behaviours and your own list of bad files and addresses, and raises an alert on a match.
Understand
Related alerts are joined into one incident, in order. An AI analyst, on a key Postern installs for your organization, can explain what happened and what to do.
Act
From the console you stop a process, quarantine a file or cut a device off the network, and restore files after ransomware.
Everything Postern Cyber does, and what it does not do yet, is at posterncyber.com →
Everything its devices report
- Every program started, with its command line and the account that ran it, pushed by the kernel
- Network connections and listening ports
- sshd and sudo authentication
- Changes to system configuration files
- The Postern OS status report of each device, as posture
- Alerts from behavioural rules mapped to MITRE ATT&CK, grouped into incidents
Stored on your server. Response actions (stop a process, quarantine a file, isolate a host) run only on devices where you granted them.
A summary without identities, and only if you switch it on
- How many devices, how many online, which sensor versions
- The status of each posture check, per device pseudonym
- Which rules fired and how severe, per device pseudonym
- Counts of successful and failed authentications
Never host names, user names, command lines, file paths or IP addresses. Your console shows the exact payload before anything leaves.
Monitoring that the person at the keyboard can read.
A managed device cannot be set up silently. It will not build without the organization's name, a privacy contact and the legal basis it relies on, and it shows them at login, in a notice file and in the Postern Status window, next to the list of what is collected.
- Minimization. Passwords and tokens typed on a command line are masked before upload. No file contents, keystrokes, screens, browsing history or DNS queries.
- Access and erasure. Export or erase one person's records from the console; remove a retired device with everything it reported.
- Retention. Ordinary records expire after a period you set; evidence of closed incidents after a longer one.
- Accountability. Every export, erasure and vendor report is written to an audit log.
The software supplies the means. The legal basis, the impact assessment and your policy for staff remain yours; none of this is legal advice.
Calm, fast, and already set up.
GNOME on Wayland with a dock that stays put, a blurred top bar, one icon family and window controls where your hand expects them.
The tools you need for private work are in the dock.
Firefox opens on a quiet page with telemetry, studies and saved logins switched off by locked policy. Tor Browser is included and starts only when you open it. Metadata Cleaner strips author, location and device data from files before you share them.
Keep files across restarts without leaving them readable.
A vault is one encrypted file (LUKS2, AES-256-XTS, Argon2id). Put it on a USB stick, open it when you need it, close it when you are done.
Do not take our word for it. Ask the system.
One window, or one command, reports what can be observed right now: firewall, listeners, remote-login services, AppArmor, CPU mitigations, kernel hardening, network identity, swap, logs and account passwords. A check that cannot read its source says “not determined”. It never says “ok” by default.
The same system, shaped for a phone screen.
The Phosh phone shell on the same privacy and hardening baseline: favourites, an app grid with search, apps as cards, and the same Postern Status report in a phone layout.
Today this is the phone interface running on x86-64, for a virtual machine or an x86 tablet. It is not yet a handset image: no phone hardware port, modem or telephony is configured or tested.
Recorded from the real images.
Each video is one scripted session of the ISO booted with no network in a virtual machine, driven by keyboard events. Playback is faster than real time and idle waits are shortened; the opening card of each video says so.
Desktop walkthrough
4 min 30 s · 19 of 19 checks recorded inside the running system passed
Mobile walkthrough
2 min 55 s · 12 of 12 recorded checks passed
Console (compute) walkthrough
4 min · 6 of 6 recorded checks passed
Checked on a booted system, not on paper.
The build runs a real boot test: it sends traffic at a listening service to prove the firewall filters it, crashes a program to prove no core file is kept, and opens, closes and reopens an encrypted vault.
For organizations, per device, per year.
Postern OS is offered to organizations together with Postern Cyber, under an annual licence per managed device. It is in private preview and not yet on general sale.
What the licence covers
- Managed Postern OS images built for your organization
- The Postern Cyber sensor on each device and the server and console you host
- Updates to the system and to the detection rules
What stays yours
- The server, its database and every record in it
- The decision to send Postern the reduced summary
- Whether the AI analyst is on: Postern installs its API key only if you ask for it
Before general sale
- Validation on physical hardware
- An installer with full-disk encryption
- Signed images and an independent audit
One baseline, three shapes.
| Image | Interface | Made for | Status |
|---|---|---|---|
| Desktop | GNOME on Wayland | Private everyday work: browsing, documents, passwords, encrypted files | Builds, boots and records in a virtual machine |
| Mobile | Phosh phone shell | Portrait screens: a virtual machine or an x86 tablet | Builds and boots in a virtual machine; not a handset image |
| Compute | Local console | Offline data processing, integrity manifests, diagnostics | Builds, boots and records in a virtual machine |
x86-64 only. Each shape can be built unmanaged, as shown in the walkthroughs, or managed with the Postern Cyber sensor. There are no public downloads: images are development builds from the private source repository.
What Postern OS does not do.
A privacy tool that overstates itself is a risk to the people who rely on it. So, plainly:
A managed device is monitored
- That is its purpose: the organization sees what runs on it. It is not a tool for private personal use.
- The device says so to its user, in full. An organization that hides that is misusing it.
- Masking of secrets on command lines is heuristic; an unusual spelling can pass.
It is not anonymity
- It does not route the whole system through Tor. Only Tor Browser's own traffic uses Tor.
- Ordinary DHCP, DNS, time and application traffic still happen on the network you join.
- An access point still sees that a device connected, and when.
It is a development preview
- Validated in virtual machines under software emulation; not on physical hardware.
- No installer and no full-disk encryption; the live session has no password, so physical access is control.
- Hardening raises the cost of an attack. It is not a sandbox and it has not been audited.
- The Postern Cyber integration was tested with server and sensor in one virtual machine; a managed image on real hardware and response actions on Postern OS are not yet validated.