Technical security overview for Citrix SecurSpaces™ Flex
This article describes the security architecture, shared responsibility model, data handling practices, and compliance posture of Citrix SecurSpaces™ Flex. It is intended for security teams, procurement reviewers, and CISOs evaluating the service.
Architecture overview
Citrix SecurSpaces Flex is built on three layers:
| Layer | Description | Operated by |
|---|---|---|
| Control plane | Manages workspace provisioning, access, policies, and lifecycle. Built on Azure Kubernetes Service (AKS) and Azure Cosmos DB. | Citrix |
| Execution plane | Runs isolated, sandboxed Linux workspaces. Each workspace is a containerized environment with defined vCPU, RAM, and persistent storage. | Citrix |
| Integration layer | Connects workspaces to customer-owned systems: identity providers, Git repositories, CI/CD pipelines, secrets managers, and data sources. | Customer + Citrix (connectivity infrastructure) |
All components run inside Citrix-managed Azure subscriptions in the Azure regions agreed for your deployment. The customer’s application data, container images, secrets, and identity configuration remain under customer ownership and control.
Shared responsibility model
Citrix SecurSpaces Flex uses a clear division of responsibilities between Citrix and the customer across configuration and management, infrastructure, and ongoing support.
Configuration and management
| Customer | Citrix |
|---|---|
| Workspace image hosting and management | Citrix SecurSpaces platform configuration and updates |
| Workspace and template management | Citrix SecurSpaces region management (upon request) |
| User accounts, access, and permissions | Platform-wide Citrix SecurSpaces configurations |
| Organizations, projects, and secrets | Workspace specifications |
| Network policies and security monitoring | Backups, DR planning, and availability monitoring |
Infrastructure
| Customer | Citrix |
|---|---|
| Authentication (IdP) | Azure AKS, Cosmos DB, and Azure tenant |
| Source code repositories | Landing zone VM |
| Artifactories | Citrix SecurSpaces control plane scaling (up/down) |
| Azure vNET peering / VPN gateway (shared) | Azure vNET peering / VPN gateway (shared) |
Ongoing support
| Customer | Citrix |
|---|---|
| End-user support | Citrix SecurSpaces and Azure infrastructure support |
| Citrix SecurSpaces product support |
Note: Azure vNET peering and the VPN gateway are a shared responsibility. Citrix provisions and operates the Citrix-managed side of the connection; the customer configures and maintains their side. See Network connections for details.
Workspace isolation
Each workspace is an isolated, sandboxed Linux container. Isolation is enforced at the Kubernetes runtime level.
- No shared file systems between workspaces. Each workspace has its own Persistent Volume Claim (PVC) for persistent state.
- No lateral movement. A compromised workspace cannot access other workspaces or the control plane.
- Controlled ingress and egress. Workspace network traffic is subject to policy-defined rules. Egress to the internet and to customer networks is controlled; unrestricted outbound access is not the default.
- AI agent containment. AI coding agents run inside the same workspace sandbox as human sessions. Agent processes are subject to the same egress controls, DLP rules, and audit logging as any other workspace activity.
Data loss prevention (DLP)
Citrix SecurSpaces Flex includes built-in DLP controls.
- Clipboard DLP — Clipboard operations between the workspace and the user’s local device are policy-controlled. Administrators can restrict or monitor copy/paste behavior.
- Session monitoring — Workspace activity can be subject to session recording and behavioral monitoring for compliance and forensic purposes.
- Audit logging — All administrative and developer actions generate audit log entries. Logs are retained and exportable for SIEM integration.
Data residency and encryption
Data residency
Workspace execution runs in the Azure region designated as your primary region, and in any secondary regions provisioned for your deployment. Citrix does not transfer workspace data across regions outside of the regions agreed for your deployment.
Customer-owned assets — container images, secrets, source code, identity configurations — remain in customer-owned infrastructure and are not replicated into Citrix-managed systems except as required for workspace execution (for example, pulling a container image at workspace launch).
Encryption
- In transit — All communication between workspace clients and the platform uses TLS 1.2 or higher. Communication between internal platform components is encrypted.
- At rest — Persistent workspace storage (PVCs) is encrypted at rest using Azure-managed encryption keys. Control plane configuration data stored in Cosmos DB is encrypted at rest.
Role-based access control (RBAC)
Citrix SecurSpaces Flex enforces role-based access at the platform level.
- Administrators manage deployments, workspace templates, user access, and policy configuration.
- Developers access workspaces assigned to them. They cannot access other developers’ workspaces or administrative functions.
- Roles and permissions are managed in the Citrix SecurSpaces console and integrated with the customer’s IdP.