Clipboard controls —
the copy that never leaves
Block copy/paste and clipboard access for designated applications; block screen-capture and screen-recording actions initiated through the governed session context.
Endpoint Controls
Access granted is not the end of the story.
What happens inside the session — copying, downloading, wandering — is policy too.
the six controls_
enforced per app, per user group — every event is one of 202 logged types.
A live remote session to SAP ERP, showing the Q3 vendor payment schedule. It runs from a managed laptop, and the tunnel out of it reaches that one application and nothing else on the network — the file server, the internal range and the database are all off the map. A copy of two invoice rows has been attempted and refused, so the local clipboard is stamped BLOCKED; a watermark carrying the user, the session ID and the time is rendered over the screen; downloads and printing are switched off; a personal file-sharing domain is denied while a support domain is allowed; and the session closes on its own after fifteen minutes idle. Each of those decisions is written to the audit log.
Finance / AP / Q3-2026ExportPrint
Q3 vendor payment schedule
6 of 214| Vendor | Invoice | Amount | Due | Status |
|---|---|---|---|---|
| Meridian Components | INV-4471 | ₹18,40,000 | 12 Sep | Scheduled |
| Kestrel Logistics | INV-4468 | ₹6,72,500 | 15 Sep | Approved |
| Novapack Industries | INV-4459 | ₹11,05,000 | 19 Sep | Scheduled |
| Arcus IT Services | INV-4454 | ₹3,90,000 | 22 Sep | On hold |
| Trident Freight | INV-4449 | ₹8,26,000 | 26 Sep | Approved |
| Halcyon Chemicals | INV-4442 | ₹5,18,750 | 29 Sep | Scheduled |
net_filter · 24 rules armed
local_clipboard_
the session edge
BLOCKED
nothing crossedthe session edge
audit_log_10:42:14
- 10:42:07 TUNNEL app=sap-erp scope=1 net=unreachable
- 10:42:11 CLIP direction=out action=blocked
- 10:42:14 MARK overlay=on bound=sophia.s
What are endpoint controls?
Endpoint Controls
Not who gets in — what happens once they are.
Traditional security ends at the login: once in, the user's actions are their own. Endpoint controls extend policy into the live session — because most data loss isn't a hack, it's an allowed user doing an unallowed thing.
- The risk is a permitted personPasting a customer table into personal email, downloading the price list before resigning, screensharing a console with credentials visible. None of those trip an intrusion alarm, because none of them are an intrusion.
- Enforced on the device, not requested of the userInstaSafe's endpoint controls are enforced by the agent and portal on the device itself, which is why they hold on a laptop nobody in IT has ever touched.
- Set per application and per user groupSo the sales tool can allow exporting while the HR system forbids even copy — same person, same session, different answer.
- And every refusal is written downClipboard, watermark, network filter, app filter, chrome control, inactivity timeout. Each enforcement is one of 202 logged event types, so a block is evidence rather than a dead end.
6session controls
per-appand per-group
202logged event types
The six controls
Six things a session will not do for you.
Each control is a policy on an application and a user group, not a switch on a laptop. Hover any card to watch it enforce. Nothing here needs an agent rebuild, a proxy in front of the app, or a ticket queue.
Clipboard controls —
Q3-vendors.txt
10:42Watermark protection —
the screen names its viewer
A logo and text overlay is rendered over on-screen content, carrying the user, the session ID and the time — so a photograph of the screen identifies who took it.
Network filter —
where the session may reach
Specified domains and IP ranges are blocked per user group for the life of the session. The support domain still resolves; the personal drive does not.
App filter —
the tool that will not start
Named local applications are blocked from launching while a sensitive session is open, and released the moment it closes.
anydesk.exeChrome control —
the browser, minus the exits
Downloads, developer tools and printing are switched off in governed browsing. The application itself stays entirely usable.
Inactivity timeout —
the unattended desk, closed
Idle or low-transfer sessions disconnect on their own, and the disconnect is logged like every other decision.
The controls, live
Try them yourself.
This is a real desktop, not a video. Turn a control on in the admin console and then attempt the thing it governs — the session answers the way it would on a laptop nobody in IT has ever touched.
The session ends. The evidence stays.
Endpoint outcomes
Nothing usableleavesthe session.
The controls are not a fence around the person — they are a boundary around the data. The work carries on; the copy of it does not.
Insider risk gets guardrails
The allowed user's unallowed action is blocked at the moment of attempt, and logged.
Third parties leave empty-handed
Vendors work in your systems; nothing usable leaves the session.
Compliance evidence by default
Every enforcement event is one of the 202 logged types — the audit trail writes itself.
FAQ
Endpoint controls, answered.
Tap a question — or open them all and read straight through.
Talk to us//Ready when you are//
Ditch the VPN. Keep your apps invisible.
Runs alongside the VPN you have, app by app, until there is nothing left to switch off. Nothing to rack, no network to re-architect.
Regulated, air-gapped, or on-premise? See deployment options