Secure Workplace
Netzilo secures two workforces: the people in your organization and the AI agents that work alongside them. AI agents are governed by AI Detection & Response (AIDR). Secure Workplace is the human side. It lets people reach and work with company resources from any device, managed or not, employee or contractor, without a fleet of virtual desktops and without a network that trusts whatever connects to it.
You configure Secure Workplace in the dashboard under Endpoint > Profiles, Network and Settings. People use it through the Netzilo client, a browser, and the Workplace, their own page in the dashboard.
Profiles, which deliver the Enterprise Workspace, the Enterprise Browser, the Disposable Browser and the browser extension's data controls, need the Enterprise plan on Netzilo Cloud. Self-hosted Netzilo Servers include them.
How it works
Secure Workplace is a set of components. You choose the ones that fit each group of people and each kind of device:
| Component | What it does | Where it runs |
|---|---|---|
| Zero Trust Networking | identity-based, encrypted access to private resources; replaces the VPN | every device with the Netzilo client |
| Enterprise Workspace | runs native Windows applications in an isolated, optionally encrypted workspace with data controls | Windows x64 with the full (administrator) install |
| Enterprise Browser | Netzilo's own managed browser with per-domain controls | Windows, macOS, Android, iOS |
| Disposable Browser | throw-away browser sessions, destroyed on close | Windows x64 with the full install |
| Browser extension | per-domain data controls inside the user's own Chrome, Edge, Firefox or Safari | any device with a supported browser |
| Clientless Access | a browser with only the extension reaches internal web resources through the Netzilo gateway | Chromium-based browsers and Firefox, no client |
| Published applications | a private web application at an address of its own, in any browser, nothing installed | any browser |
- Profiles bind the Workspace, Enterprise Browser, Disposable Browser and extension settings to groups and operating systems. A device gets a profile when it is in one of the profile's groups and runs one of its operating systems.
- Policies, routes and posture checks decide which resources each person and device reaches. They apply the same way to devices with the client, to browser sessions through the gateway, and to published applications.
- The Workplace is where people start. It shows their applications and bookmarks, their devices and, under Agentic Access, the AI gateways and MCP servers granted to them.
Choose an access path
| Situation | Use |
|---|---|
| Company laptops and servers | the Netzilo client, with profiles for the Workspace or the Enterprise Browser as needed |
| Native desktop apps on a Windows device you do not fully control | the Enterprise Workspace |
| Web and SaaS apps with data controls, on any device | the Enterprise Browser, or the browser extension in the user's own browser |
| Contractors and personal devices that must not get the client | clientless access, or published applications |
| Phones and tablets | the Netzilo app, the Enterprise Browser app, or published applications |
What users see
People sign in to the Workplace with their work account. Its tabs are Applications (published applications and profile bookmarks), Devices (their devices and connection state) and Agentic Access (AI gateways and MCP servers). Regular users land there after sign-in; administrators open it from the dashboard header. See Workplace.
Related Documentation
- Workplace - the user's own page: applications, devices, Agentic Access
- Profiles - deliver the Workspace, browsers and extension settings
- Clientless Access - browser access without the client
- Applications - publish internal web applications
- Posture Checks - require device conditions
- How Netzilo works - the network underneath