SECURE ENTERPRISE BROWSING
Management console
Policies, people and protection in one workspace.
Administrator access
Sign in with your enterprise identity, or use the bootstrap token configured on the server.
POLICY POSTURE
Current enforcement
Based on the published policy. Configuration is not a device health attestation.
OPERATOR WORKFLOW
Configure, review, publish
- Choose a template or adjust your controls.
- Test data protection with representative examples.
- Review changes and publish a signed policy.
- Check device versions and security events.
ENTERPRISE SETUP
Start with a reviewed policy template
Templates tighten selected controls while keeping your existing rules and infrastructure. Preview changes, add them to your draft, then publish when ready.
Integration configuration
These checks describe policy configuration. They do not certify that an enrolled device can reach the service.
Your existing network and security services
Keep Windows-managed proxy and DNS for existing enterprise deployments, or mandate corporate resolvers and VPN interfaces. ICAP connects compatible antivirus and sandbox services before content is released.
TLS certificate validation stays enabled. Customer CA certificates and mutual TLS credentials belong in protected deployment configuration. Plaintext ICAP exposes submitted content; approve it only for a separately protected trusted transport. VPN adapter checks do not prove tunnel routing. Deferred verdicts and modified payloads are rejected. Publish the signed policy to apply changes.
CENTRAL CONFIGURATION
One policy. Every managed browser.
Devices refresh every 15 seconds. Changes and actor identity are recorded in the audit log.
IDENTITY AND FEATURE ACCESS
User classes and website access
Create profiles for any user class with your own names and controls. Employee, developer and high-protection templates are optional starting points. Assign profiles to verified enterprise subjects or explicit managed devices. Asset-owner labels are not authenticated identities. Website denials and category restrictions accumulate across matching profiles; an allowlist does not bypass a denial.
| Profile | Assignments | Developer tools | Action |
|---|
Create profile
Developer grants require central delegation; any applicable deny wins. No profile can override mandatory scanning or unlock centrally hidden settings.
Preview effective device policy
Central categories and developer delegation
Categories contain your approved domain lists. This is not an automatic external website reputation feed. Enabling delegation permits reviewed developer-profile grants; denying profiles still win.
Assignment visibility
| Device | Verified subject | Effective profiles |
|---|
CONTROLLED DEPLOYMENT
Groups and pilot rollouts
Apply additional restrictions to explicit device groups. Start with selected pilot devices, inspect their reported policy versions, then explicitly expand the cohort. Group rules can tighten the baseline; they cannot weaken it. No automatic promotion occurs.
| Group | Members | Stage | Actions |
|---|
Create a device group
Membership, restrictions and cohort changes are signed policy changes. Mandatory independent approval applies to these changes too.
Additional company bookmarks
These managed bookmarks are added for the selected rollout cohort. They do not replace baseline company bookmarks.
| Title | URL | Folder | Action |
|---|
Effective policy preview
Reported rollout state
| Device | Effective groups | Reported / target version | Version acknowledgment | Last contact |
|---|
Acknowledgment compares the device-reported version with its target. It is not security attestation or proof that every control is functioning. Last contact is shown separately.
INDEPENDENT CHANGE CONTROL
Policy approval queue
Loading approval requirements.
Prepared changes remain inactive until approved. A different administrator must review the exact payload and base version. Stale changes must be prepared again against the latest policy.
| Prepared | Author | Change | Base version | Status | Review |
|---|
CHANGE CONTROL
Policy history and recovery
Review persisted signed versions and compare changes. Restoring reapplies the selected security rules, permissions, bookmarks and network settings, group memberships and rollout cohorts. The original version stays preserved; restoration publishes a new version with a fresh expiry. Devices never receive a lower policy version.
| Version | Published | Actor | Review |
|---|
Managed browser settings
Hide settings or deny changes centrally. These permissions are enforced in the native browser process as well as the interface. Hiding a section denies its user actions; publishing a new signed policy applies changes to connected devices at refresh.
| Section | Hide and deny access | Lock user actions |
|---|---|---|
| Appearance | ||
| Bookmarks and tab groups | ||
| AI workspace | ||
| Password manager | ||
| Manual document scan | ||
| Local agent controls |
Appearance values become mandatory when appearance is hidden, locked, or settings access is disabled. Otherwise users may choose local preferences. Vault locking remains available to keep credentials safe. Mandatory security inspection continues independently of settings visibility. Publish signed policy above to apply.
COMPANY LIBRARY
Managed bookmarks
Publish intranet and approved service links to every browser. Company bookmarks are read-only for employees. Personal bookmarks remain separate; configure whether employees may add, edit or delete them.
| Title | HTTPS / HTTP URL (no query or fragment) | Folder | Actions |
|---|
Company changes are drafts until you publish the signed policy. Personal permissions also respect the centrally locked or hidden Library section.
Device personal bookmarks
Authorized administrators can review and remotely edit a device's synchronized personal bookmarks. Changes are applied when the browser next refreshes management state. Titles and URLs are never included in security audit events.
| Title | HTTPS / HTTP URL (no query or fragment) | Folder | Actions |
|---|
Saving compares the loaded revision so another user's or administrator's updates cannot be overwritten silently.
TEACH YOUR BROWSER
Define what must stay inside
Add phrases that must never leave, or register an exact file fingerprint. Reference files stay on your computer; only their SHA-256 fingerprint enters policy.
Local semantic reference protection
Describe a confidential category. Your approved local EmbeddingGemma 2 runtime creates pinned text reference vectors. Document extraction and local OCR text can be compared against these references. This workflow does not train a model or provide native video inspection.
Only normalized reference vectors and coverage features enter the policy draft. No document, extracted text or model fine tuning is retained. Complete extraction and chunk coverage are required; publish explicitly to approve.
Requires locally provisioned model weights, an exact model revision, matching dimensions and the document-v1 profile. Similarity is a detector score, not a confidence guarantee. Incomplete extraction or chunk coverage always blocks.
Enterprise security and local agents
Configure centrally signed DNS blocklists, YARA source rules, content phrases, restricted Sigma metadata detections and agent permissions. Unsupported Sigma syntax is rejected.
Advanced source configuration: YARA, Sigma and visual references
Structured controls above are authoritative for DNS, content and agent permissions. Preserve advanced rule sources when making other changes.
Publish signed policy above to apply. Downloads require configured local YARA or external ICAP. Every enabled scanner is mandatory; unavailable inspection blocks downloads. Scan limit is 20 MB. Sigma supports exact metadata selection only.
Governed document teaching
Submit a reference document to the private local inspector, then explicitly approve its fingerprint for publication. For incomplete extraction, explicitly approve available fingerprints with partial coverage; unextracted media is not fingerprinted. Only hashes, coverage counts and the reference label are retained. Full documents, extracted text and base64 are discarded after local processing and are never persisted by management.
Local password vault
Credentials stay on the browser device. Management stores permissions and lifecycle audit events only; passwords, usernames and credential identifiers are not uploaded.
Publish signed policy to apply these controls.
Visual impersonation protection
For example, register a trusted Google login screenshot and allow only https://accounts.google.com. A matching login on another origin can then be blocked even when its domain is absent from every blocklist.
Upload your own trusted PNG of a brand login page or cropped login form. Only a derived perceptual hash, dimensions and allowed origins enter the policy draft. Reference pixels are discarded; no automatic Google or other brand profile is supplied.
Add trusted references, enable the control above and publish the signed policy. Use multiple references for different themes, languages and login steps. False positives, viewport changes and visual evasion require validation. The browser checks rendered pixels; this is not pre-render response inspection.
Managed clipboard and ClickFix protection
Control supported browser copy, cut and paste actions centrally. High-risk shell command patterns are blocked without sending clipboard text to an AI provider. Clipboard text and credentials never enter security logs.
Publish signed policy to apply. Mandatory DLP remains active when supplemental clipboard controls are disabled. Unsupported formats and unavailable required inspection fail closed. Pattern detection covers selected execution chains; it does not prove text or commands safe.
DEVICE FLEET
Enrollment and access
Enable or disable supplemental manual document analysis per browser. Mandatory upload DLP and download YARA continue regardless of this setting.
| Device | Platform | Identity | Policy | Last seen | Access |
|---|
ADMINISTRATOR ACCESS
Active management sessions
Administrators can review current SSO sessions and immediately revoke a session. Identity-provider group membership controls whether that person can sign in again. Bootstrap access has no stored browser session.
Session inventory requires the administrator role.
| Identity | Role | Expires | Action |
|---|
SECURITY OPERATIONS
Incident triage
Review security event metadata, assign an investigation and record its outcome. Documents and prompts are not retained here. Keep investigation notes free of secrets and personal data.
| Created | Security event | Status | Severity | Assignee | Review |
|---|
Incident
Investigation history
AUDIT LIFECYCLE
Database event retention
Loading deployment configuration.
Retention applies only to exported database events that are not referenced by incidents. Investigation history is retained. External SIEM, file exports and backups have separate retention policies. Deployment configuration controls this setting.
SECURITY MONITORING
Recent audit events
| Time | Event | Device | Metadata |
|---|
This view shows the latest 100 events. Prompts and document contents are excluded. Exports contain up to 1,000 events; cursor-based APIs and durable HTTPS delivery support continuous SIEM ingestion.
OBSERVABILITY
Browser OpenTelemetry
Publish centrally signed operational or detailed debug collection. Spans report code stages, timing and outcomes. Confidential security evidence needs its separate protected storage; passwords and authentication tokens are excluded.
HTTPS is required except for a numeric loopback collector. Queue and export limits remain enforced. Endpoint credentials do not belong in policy URLs. Disable and publish to stop new collection.