Overview

Blocked categories

Categories enforced on every endpoint. Applied at the next agent poll.

Allowlist — never blocked, one domain per line

Blocked sites

One per line — domain, IP or CIDR range. Learn more

Blocked entries

Temporary site access

Grant a user access to a specific site that is normally blocked by category filtering (adult, gambling, messaging apps like WhatsApp/Telegram, etc.) for a limited time — on demand, without changing the category rule for everyone else.

Data Loss Prevention

Rules that block or log sensitive content leaving the company. Learn more

Block message Policies Add policy

Advanced: detectors & classifications (JSON)

detectors classifications

Threat intelligence

Indicators the agent blocks on: malicious destinations and known-malware file hashes. EICAR + Windows Defender (AMSI) are always on.

Malicious domains (one per line) Malicious IPs / CIDRs Malware SHA-256 hashes

USB device control

Default for removable drives. Exceptions apply to a person or a machine, never to an individual USB device. Learn more

Block message Exceptions (first match wins)

Leave Expires blank for a permanent exception, or pick a date to grant access on demand and have it lapse automatically.

Add exception

Upload policies

Controls where files may be uploaded from a browser. Learn more

Allowed destination domains

Allows the domain and its subdomains; unlisted destinations are blocked. Paste a full URL and it's trimmed down to the domain automatically. Learn more

Add domain

Devices

Endpoints running the agent. Compliance is from each device’s last check-in. Click a row for detail.

Assets

Who has which endpoint — assigned manually, one asset tag per device. Not auto-populated from a heartbeat; add a record here when a device is issued. Learn more

Logs

Audit and enforcement events for your scope, newest first.

Console users

Who can sign in, and what they may do. New users set their own password by email code. Learn more

Directory groups — Microsoft Entra ID / Active Directory

Group membership grants the role automatically. Learn more

Local admin account lockdown — endpoint security

gsecure provisions two admin accounts on every laptop (one you name, plus the built-in Administrator as a recovery account), verifies both actually work, then removes local-admin rights from every other account after a grace period — closing the gap on endpoints with no Active Directory to manage this. Off by default. Learn more

Password history — last 5 per account, for a device that missed a rotation

Role reference

Your role is —. You can assign roles at or below your own.

API tokens

Programmatic access, scoped to your organization. Delete a token to revoke it. Learn more

Quick reference — reporting & bulk changes (curl)

Send as Authorization: Bearer gsk_…. Learn more

KEY="gsk_your_token"; BASE="http://127.0.0.1:8889"; H="X-API-Key: $KEY" # --- reporting (read) --- curl -s -H "$H" "$BASE/v1/devices?full=1" # fleet + posture + compliance curl -s -H "$H" "$BASE/v1/dlp" # effective DLP ruleset curl -s -H "$H" "$BASE/v1/usbpolicy" # USB device control curl -s -H "$H" "$BASE/api/auth/me" # your role + scope # --- bulk change (read_write) — PUT replaces the whole doc --- curl -s -X PUT -H "$H" -H "Content-Type: application/json" "$BASE/v1/dlp" -d '{ "enabled": true, "rules": [{"name":"block-pci","channels":["WEB_BROWSER_UPLOAD","USB_FILE_WRITE"], "classifications":["PCI"],"action":"BLOCK"}] }'

Agent logout code

A shared code your users must enter to sign out of the gsecure agent. Rotating it invalidates the old code immediately, for everyone. Leave it unconfigured to keep today's one-click logout.

Organizations

Only approved organizations can sign in. Self-service registrations arrive pending. Learn more

Agent builds

Upload an agent.msi built on another machine (this server has no build toolchain), then publish it as the live update - a separate step on purpose, so you can check the size/hash before every already-installed agent silently updates to it.

Access request link

Where the block page’s request button sends users. Learn more

Ticketing URL — https:// only. {host_enc} inserts the blocked site. Button label — optional

Leave empty to hide the button.

Email delivery

Loading…

Verification codes and password-reset emails for your users are sent from here. Leave this empty to use the gsecure platform mail server.

SMTP host Username — leave empty for a relay that does not authenticate Password — stored encrypted; never shown again

The test sends a real message to your own address using the settings above — including unsaved changes. Nothing is stored until you press Save.