Vault · both
SST-Citadel
Organizational credentials. Viewer / Editor / Admin on a Vendors collection. Versions and an activity log. First-host SKU.
Citadel →Applications
Named so a buyer can point.
A short description of each application. First host is still Citadel. The rest attach after that box is standing, or stay with SST. No public price list.
What we install
White-glove on a box you hold, or SST-hosted where the placement allows it. Merlon is on-prem only.
Sign · both
Sigma Signet
Mark, PAdES-B sign, and validate PDFs. Saves into the mailbox you already have — OneDrive or Drive. Not a Signet content cloud.
Infra · both
Sigma Alembic
Distill living infrastructure into a capture pack and a replay pack. Coverage is a score, not a guarantee.
Cutover · both
Sigma Janus
On-prem to Azure / GCP / AWS crossing. Preflight, operator-gated migrate, post-validate. Does not flip DNS.
Edge · on-prem
Sigma Merlon
Perimeter appliance. nftables. Guard / Watch / Seal. Not DPI. Not TLS intercept. Dedicated box.
AI · both
Sigma Helios
Isolated AI access. Entra + MFA. Separate engines for Excel, boards, financials, general help, and IT fix. Zero data sharing across them.
Assist · both
Sigma Argus
Remote assist. Host plus agents. Shared database is the remaining SPOF — we write that in the quote.
Office bubble · both
Sigma Halo
Staff attach to your nodes — HO, plant, staging VPC. Not a consumer privacy VPN. Signaling stays with SST.
What stays with SST
Not customer installs. How we issue grants and refuse to become a public file drop.
Installer
Sigma Hermes
Short-notice deployer. Rehearsal first. Customers do not install Hermes.
Assessment
Sigma Aegis
Authorized black / grey / white-box work. Control plane stays with SST.
License office
Sigma Charter
Mints, validates, revokes grants. Not sold. Customers never install it.