Decide what your connected devices can access.
One workspace for VPN profiles, domain controls and optional DNS activity.
A profile for each device
Enroll an authorized device, generate its private key in your browser and import the configuration into a supported WireGuard client. Revoke a lost profile independently. A router profile represents a gateway, not all devices behind it.
Rules with a clear scope
Apply explicit domain block and allow rules to a workspace, policy group or enrolled device. See whether a change is pending, applied or failed. Scheduled controls use a named timezone. DNS caching and existing connections can delay changes.
DNS activity, by choice
Detailed DNS logging starts off. An authorized owner can enable it after accepting the disclosure, choose retention and clear the tenant’s activity and statistics. DNS requests are not a complete page history.
Understand the limits
Controls apply to traffic using the configured service. An unmanaged device may bypass them by disabling the VPN or changing networking settings. DNS filtering cannot remove every advertisement.