For agencies & ESN
You ship client projects. You answer for their code.
One persistent session per client project, hosted in the EU by a French provider, with a signable DPA. No third-party model is a sub-processor in your DPA via us.
- Enforceable DPA downstream
- One environment per client
- EU-hosted
- A human in Paris
$ ssh nadia@project-acme $ permia attach acme > session live · 3d 14h · attach #4 > agent: claude code > region: eu-fr
The reinforcement dev starts today, not after setup week.
$ ssh nadia@project-acme $ permia attach acme > session live · 3d 14h · attach #4 > agent: claude code > region: eu-fr
Your devs already manage their own local setup, and for one dev that works. The failure mode is the sixth laptop: dotfiles that drift, a setup doc nobody updated, a week of unbillable ramp-up. Here the new dev gets credentials and attaches to the project environment that was already running.
attach, don't rebuild · same panes, same state
One environment per client. The same one for every dev.
client A
own vm · own filesystem
client B
own vm · own filesystem
internal
own vm · own filesystem
one DPA · under French law
Each client project runs in its own isolated environment with its own filesystem and its own access list. Every dev on the project attaches to that one environment: same filesystem, same versions, same running state. Switching clients is switching sessions, not juggling client repos on one laptop.
The client questionnaire
Answer your client's security questionnaire with documents, not promises.
When the tender carries an EU-residency clause or your client's DPO sends the questionnaire, the answer is structural: their code sits in an environment hosted in the EU by a French provider, under a DPA that names Permia as your sub-processor. Their DPO can verify that on your sub-processor list instead of taking your word for it.
The DPA names us as your sub-processor under Art. 28. You attach it to the RFP security annex instead of writing one.
A dev leaves. The project doesn't.
The environment, its history, the running agent session and the project state live in the project environment, not on the departing laptop. You revoke one access; the replacement attaches to the same session. One thing doesn't transfer: the leaver's own agent keys go with them. Keys belong to people, not to us.
~/client-app $ claude --resume> refactoring api/auth.ts ...account: yours · EU
$ permia attach #4
> refactoring api/auth.ts ...
● live · 3d 14h · EU Priced for adding devs, not for punishing it.
Team · 1,490 EUR/yr 3 seats included +300 EUR/yr per extra seat One annual SEPA invoice. No per-seat surprises, no SSO tax.
The full price is on the pricing page, the same number for everyone. Setup is one itemized line, 390 EUR for the onboarding work, charged once, printed there next to everything else.
Some client work needs a contract: SLA, single-tenant, audit log.
Single-tenant environments, an SLA, an audit log of who attached to what, SSO/SCIM without an enterprise paywall, accompanied onboarding. That track has its own page.
HDS / SecNumCloud: roadmap, not certified
One environment per client. Any dev attaches on day one.
A human in Paris, not a support ticket. Bring your lead dev to the same call; we can send the DPA ahead of it.